@cat-factory/server 0.226.0 → 0.227.0

package/dist/http/workspaceAccess.js

@@ -93,80 +93,120 @@ export function blockEditActor(c) {
     return { role: access.role, managesPolicy: access.permissions.has('settings.manage') };
 }
 /**
- * Controller-level admin-tier gate (workspace-rbac, slice 6). Mount ONCE at the top of an
- * admin route group — `app.use('*', requireWorkspacePermission('integrations.manage'))` —
- * and every WRITE the controller serves (now and in the future) requires that permission,
- * with ZERO per-handler code. Reads (GET/HEAD) pass straight through, so the whole controller
- * stays viewer-readable (`workspace.read`, satisfied by the gate resolution) while its mutations
- * are admin-only.
+ * The controller-level admin-tier gate (workspace-rbac, slice 6): every WRITE served under one of
+ * `prefixes` requires `permission`, with ZERO per-handler code. Reads (GET/HEAD) pass straight
+ * through, so the controller stays viewer-readable (`workspace.read`, satisfied by the gate
+ * resolution) while its mutations are admin-only. Use
+ * {@link mountWorkspacePermissionIncludingReads} for the rare controller whose READ is the
+ * sensitive half.
  *
- * This is the method-shaped counterpart to the gate's viewer floor: the floor rejects viewer
- * writes wholesale (non-GET ⇒ ≥ member) in ONE place; this rejects member writes on the admin
- * groups in ONE place per group. Because it is co-located with the controller's mount (not a
- * central path→permission table), a new route inherits the correct gate automatically — the
- * drift a shadow route-map would suffer can't happen. It runs BEFORE the handler, so an
+ * This is the method-shaped counterpart to the gate's viewer floor: the floor rejects viewer writes
+ * wholesale (non-GET ⇒ ≥ member) in ONE place; this rejects member writes on the admin groups in
+ * ONE place per group. Because it is co-located with the controller's own mount (not a central
+ * path→permission table), a new route under a gated prefix inherits the correct gate automatically:
+ * the drift a shadow route-map would suffer can't happen. It runs BEFORE the handler, so an
  * unauthorized caller is refused even when the underlying integration is unwired (a member never
- * learns whether Slack/GitHub/etc. is configured).
+ * learns whether Slack/GitHub/etc. is configured), and before body validation, so a malformed
+ * payload cannot turn a refusal into a 422 that answers the same question.
  *
  * `OPTIONS` (CORS preflight) is never gated. Where a controller mixes gated and ungated writes
- * under one mount (e.g. workspace create vs rename), call {@link requirePermission} per-handler
+ * under one prefix (e.g. workspace create vs rename), call {@link requirePermission} per-handler
  * instead of mounting this.
  *
- * ⚠️ **A `'*'` mount is NOT scoped to the controller.** `app.route('/workspaces/:workspaceId', sub)`
- * re-registers each of `sub`'s entries under that prefix, and a `sub.use('*', …)` becomes
- * `ALL /workspaces/:workspaceId/*` on the shared app — so it also matches routes OTHER controllers
- * mounted on the same prefix. Hono then runs whichever matching entry was registered first, which
- * makes the blast radius depend on the order in `app.ts`: today the run controllers are registered
- * before the config ones, so their routes win and the existing `'*'` mounts reach only the config
- * controllers listed after them (all admin-tier, which is why nothing has surfaced). Prefer mounting
- * on the controller's OWN path patterns (`/thing` and `/thing/*`), which cannot reach a sibling
- * whatever the order — as {@link requireWorkspacePermissionIncludingReads}'s two call sites do,
- * because for them the ordering accident stopped being harmless.
+ * **`prefixes` are the controller's OWN top-level paths, and taking them is the whole point of this
+ * helper.** `app.route('/workspaces/:workspaceId', sub)` re-registers each of `sub`'s entries under
+ * that prefix, so a `sub.use('*', …)` becomes `ALL /workspaces/:workspaceId/*` on the shared app and
+ * matches routes OTHER controllers mounted on the same prefix. Hono runs a matching middleware for
+ * every route registered after it, which made the blast radius depend on the order in `app.ts`: the
+ * admin document and task-source controllers are registered ahead of the human-gate controllers, so
+ * their `'*'` mounts refused a plain member's review decisions, requirement answers and initiative
+ * writes with `integrations.manage`. Nobody noticed because an account admin resolves as a workspace
+ * admin, and dogfooding happens as one. Passing prefixes cannot reach a sibling whatever the order,
+ * and it is why no middleware factory is exported from this module: a `'*'` mount is now
+ * unrepresentable rather than merely discouraged. `permissionMounts.test.ts` pins the invariant
+ * (a member is refused exactly the writes their own controller gates).
+ *
+ * Each prefix is mounted twice, bare and `/*`, because Hono's `*` does not match the bare prefix.
+ * A prefix may carry params (`/services/:blockId/test-secrets`), which is how a controller whose
+ * routes hang off a shared first segment gates its own without claiming the segment.
  */
-export function requireWorkspacePermission(permission) {
-    return (c, next) => {
+export function mountWorkspacePermission(app, permission, prefixes) {
+    mountGate(app, prefixes, { permission, gatesReads: false }, (c, next) => {
         const method = c.req.method;
         if (method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS') {
             requirePermission(c, permission);
         }
         return next();
-    };
+    });
 }
 /**
  * The same controller-level gate, applied to READS as well.
  *
- * {@link requireWorkspacePermission} lets GET/HEAD through by design: on almost every admin
+ * {@link mountWorkspacePermission} lets GET/HEAD through by design: on almost every admin
  * controller the permission guards MUTATION and the configuration itself is viewer-readable. A few
- * controllers invert that, because their READ is the sensitive half — the capability-credential
+ * controllers invert that, because their READ is the sensitive half. The capability-credential
  * checklist and the tool-server inventory both project the credential KEY NAMES this deployment's
  * capabilities want, which is exactly what the workspace snapshot withholds from a viewer ("no
  * business learning which environment variables the deployment sets"). Moving the value into a
  * sealed row did not change that judgement, and neither did adding a second surface over the same
- * registry.
+ * registry. `vcsConnectController` is the third and the plainest: it serves ONE read and no write,
+ * so the writes-only mount left it enforcing nothing at all.
  *
  * A separate function rather than an option, so the choice is legible at the mount and a controller
  * cannot acquire it by a default changing underneath it. `OPTIONS` still passes: a CORS preflight
  * carries no credentials to judge, and refusing it breaks the browser before the real request that
  * this gate is here to refuse.
  *
- * The failure this exists to prevent is not hypothetical. Both call sites documented the read as
- * gated (in the controller, in the SPA's tab gate, in the store's 403 handling) while the mount let
- * every member's GET through, because "gated on `secrets.manage`" reads as covering the controller
- * and covered only its writes.
- *
- * ⚠️ **Mount this on the controller's OWN path patterns, never `'*'`.** See the warning on
- * {@link requireWorkspacePermission}: a `'*'` mount lands on `/workspaces/:workspaceId/*` and can
- * refuse a SIBLING controller's routes. That is survivable while only writes are gated (the
- * siblings it can reach are admin-tier anyway); gating READS makes it fatal, because the same
- * pattern then refuses every member-readable GET registered after it — `GET /github/repos` was the
- * one that caught it. Two patterns are needed, `/thing` and `/thing/*`: Hono's `*` does not match
- * the bare prefix.
+ * The failure this exists to prevent is not hypothetical, and all three call sites hit it: each
+ * documented the read as gated (in the controller, in the SPA's tab gate, in the store's 403
+ * handling) while the mount let every member's GET through, because "gated on `secrets.manage`"
+ * reads as covering the controller and covered only its writes. `permissionMounts.test.ts` now
+ * asserts the READS of an `IncludingReads` controller are covered too, so the gap cannot reopen
+ * by a prefix going missing.
  */
-export function requireWorkspacePermissionIncludingReads(permission) {
-    return (c, next) => {
+export function mountWorkspacePermissionIncludingReads(app, permission, prefixes) {
+    mountGate(app, prefixes, { permission, gatesReads: true }, (c, next) => {
         if (c.req.method !== 'OPTIONS')
             requirePermission(c, permission);
         return next();
-    };
+    });
+}
+const MOUNTED_GATE = Symbol('workspacePermissionGate');
+/**
+ * What a mounted gate enforces, or `undefined` for any other middleware.
+ *
+ * Read off a controller's route table by `permissionMounts.test.ts`, which asserts that a member is
+ * refused exactly the writes their own controller gates AND that a gated controller leaves none of
+ * its own routes uncovered. It exists because a controller's middleware is not necessarily a
+ * permission gate: `executionController` and `notificationController` both mount their own `ALL`
+ * middleware, and treating every middleware entry as a gate made the derived expectation wrong for
+ * them. Tagging the handler is what lets the invariant be READ from what the mount actually did
+ * instead of from a second list somebody has to keep in step.
+ *
+ * Read it off a STANDALONE-built controller, not the composed app: `app.route()` passes a sub-app's
+ * handlers through untouched only while the sub-app has no error handler of its own, and wraps them
+ * (losing this tag) the moment one calls `app.onError`. No controller does today, and the invariant
+ * does not depend on none ever doing.
+ */
+export function permissionGateOf(handler) {
+    if (typeof handler !== 'function')
+        return undefined;
+    const tagged = handler[MOUNTED_GATE];
+    return typeof tagged === 'object' && tagged !== null ? tagged : undefined;
+}
+/** Mount one gate on each prefix, bare and `/*` (Hono's `*` does not match the bare prefix). */
+function mountGate(app, prefixes, mounted, gate) {
+    if (prefixes.length === 0) {
+        // A gated controller with no prefix would gate nothing while reading as gated, which is the
+        // silent hole this whole helper exists to close. A prefix that matches none of the controller's
+        // routes is the same hole one step later, so `permissionMounts.test.ts` refuses that too: this
+        // throw can only catch the spelling of it that names no path at all.
+        throw new Error('mountWorkspacePermission: at least one path prefix is required');
+    }
+    Object.defineProperty(gate, MOUNTED_GATE, { value: mounted });
+    for (const prefix of prefixes) {
+        app.use(prefix, gate);
+        app.use(`${prefix}/*`, gate);
+    }
 }
 //# sourceMappingURL=workspaceAccess.js.map

package/dist/http/workspaceAccess.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspaceAccess.js","sourceRoot":"","sources":["../../src/http/workspaceAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAuB,MAAM,wBAAwB,CAAA;AACvF,OAAO,EACL,cAAc,EACd,sBAAsB,GAGvB,MAAM,qBAAqB,CAAA;AAI5B,8EAA8E;AAC9E,wFAAwF;AACxF,yFAAyF;AACzF,mFAAmF;AACnF,EAAE;AACF,yFAAyF;AACzF,sFAAsF;AACtF,wFAAwF;AACxF,2FAA2F;AAC3F,8FAA8F;AAC9F,4FAA4F;AAC5F,8FAA8F;AAC9F,uFAAuF;AACvF,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAA0B,EAC1B,WAAmB,EACnB,MAAc;IAEd,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC9F,MAAM,EAAE,MAAM,8BAA8B,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC;KAC7E,CAAC,CAAC,CAAA;IACH,OAAO,MAAM,CAAA;AACf,CAAC;AAED,qGAAqG;AACrG,KAAK,UAAU,8BAA8B,CAC3C,SAA0B,EAC1B,WAAmB,EACnB,MAAc;IAEd,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;IAC3E,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA,CAAC,4DAA4D;IAExF,uFAAuF;IACvF,uDAAuD;IACvD,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO,sBAAsB,CAAC;YAC5B,MAAM;YACN,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,IAAI;SACjB,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC;QAC9D,SAAS,CAAC,gBAAgB,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC;KAC7D,CAAC,CAAA;IACF,OAAO,sBAAsB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAA;AAC3F,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,CAAa,EACb,UAA+B;IAE/B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAM,CAAC,kDAAkD;QAC7E,MAAM,IAAI,cAAc,CAAC,4BAA4B,UAAU,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/F,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,cAAc,CAAC,4BAA4B,UAAU,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/F,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAmB,CAAa;IAC5D,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,yBAAyB,CAAA;IAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAA;AACxF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAA+B;IAE/B,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;QACjB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAA;QAC3B,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAClE,iBAAiB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;QAClC,CAAC;QACD,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,wCAAwC,CACtD,UAA+B;IAE/B,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;QACjB,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,iBAAiB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;QAChE,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"workspaceAccess.js","sourceRoot":"","sources":["../../src/http/workspaceAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAuB,MAAM,wBAAwB,CAAA;AACvF,OAAO,EACL,cAAc,EACd,sBAAsB,GAGvB,MAAM,qBAAqB,CAAA;AAI5B,8EAA8E;AAC9E,wFAAwF;AACxF,yFAAyF;AACzF,mFAAmF;AACnF,EAAE;AACF,yFAAyF;AACzF,sFAAsF;AACtF,wFAAwF;AACxF,2FAA2F;AAC3F,8FAA8F;AAC9F,4FAA4F;AAC5F,8FAA8F;AAC9F,uFAAuF;AACvF,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAA0B,EAC1B,WAAmB,EACnB,MAAc;IAEd,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC9F,MAAM,EAAE,MAAM,8BAA8B,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC;KAC7E,CAAC,CAAC,CAAA;IACH,OAAO,MAAM,CAAA;AACf,CAAC;AAED,qGAAqG;AACrG,KAAK,UAAU,8BAA8B,CAC3C,SAA0B,EAC1B,WAAmB,EACnB,MAAc;IAEd,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;IAC3E,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA,CAAC,4DAA4D;IAExF,uFAAuF;IACvF,uDAAuD;IACvD,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO,sBAAsB,CAAC;YAC5B,MAAM;YACN,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,IAAI;SACjB,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC;QAC9D,SAAS,CAAC,gBAAgB,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC;KAC7D,CAAC,CAAA;IACF,OAAO,sBAAsB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAA;AAC3F,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,CAAa,EACb,UAA+B;IAE/B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAM,CAAC,kDAAkD;QAC7E,MAAM,IAAI,cAAc,CAAC,4BAA4B,UAAU,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/F,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,cAAc,CAAC,4BAA4B,UAAU,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/F,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAmB,CAAa;IAC5D,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,yBAAyB,CAAA;IAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAA;AACxF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAY,EACZ,UAA+B,EAC/B,QAA2B;IAE3B,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;QACtE,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAA;QAC3B,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAClE,iBAAiB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;QAClC,CAAC;QACD,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,sCAAsC,CACpD,GAAY,EACZ,UAA+B,EAC/B,QAA2B;IAE3B,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;QACrE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,iBAAiB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;QAChE,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAA;AAStD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,IAAI,OAAO,OAAO,KAAK,UAAU;QAAE,OAAO,SAAS,CAAA;IACnD,MAAM,MAAM,GAAI,OAA8C,CAAC,YAAY,CAAC,CAAA;IAC5E,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAsB,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5F,CAAC;AAED,gGAAgG;AAChG,SAAS,SAAS,CAChB,GAAY,EACZ,QAA2B,EAC3B,OAAoB,EACpB,IAA0B;IAE1B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,4FAA4F;QAC5F,gGAAgG;QAChG,+FAA+F;QAC/F,qEAAqE;QACrE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;IACnF,CAAC;IACD,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IAC7D,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QACrB,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,EAAE,IAAI,CAAC,CAAA;IAC9B,CAAC;AACH,CAAC"}

package/dist/modules/agentPrompts/AgentPromptController.js

@@ -2,7 +2,7 @@ import { getAgentPromptContract, listAgentPromptsContract, promoteAgentPromptCon
 import { promptIdForKind, promptVersionLabel } from '@cat-factory/agents';
 import { buildHonoRoute } from '@toad-contracts/hono';
 import { Hono } from 'hono';
-import { requireWorkspacePermission } from '../../http/workspaceAccess.js';
+import { mountWorkspacePermission } from '../../http/workspaceAccess.js';
 import { param } from '../../http/params.js';
 import { requireCapability } from '../../http/guards.js';
 import { NotFoundError, ValidationError } from '@cat-factory/kernel';
@@ -56,7 +56,7 @@ function detailFor(c, agentKind, revisions) {
  */
 export function agentPromptController() {
     const app = new Hono();
-    app.use('*', requireWorkspacePermission('settings.manage'));
+    mountWorkspacePermission(app, 'settings.manage', ['/agent-prompts']);
     buildHonoRoute(app, listAgentPromptsContract, async (c) => {
         const prompts = requireAgentPrompts(c);
         return c.json(await prompts.service.listSummaries(param(c, 'workspaceId')), 200);

package/dist/modules/agentPrompts/AgentPromptController.js.map

@@ -1 +1 @@
-{"version":3,"file":"AgentPromptController.js","sourceRoot":"","sources":["../../../src/modules/agentPrompts/AgentPromptController.ts"],"names":[],"mappings":"AACA,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAA;AAEtE,qFAAqF;AACrF,SAAS,mBAAmB,CAAmB,CAAa;IAC1D,OAAO,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,YAAY,EAAE,kCAAkC,CAAC,CAAA;AAC/F,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAmB,CAAa;IACrD,OAAO,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,+BAA+B,CAAC,CAAA;AACvF,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAChB,CAAa,EACb,SAAiB,EACjB,SAAgC;IAEhC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,iBAAiB,CAAA;IACrD,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAC7D,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAA;IACzB,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;IAC3C,OAAO;QACL,SAAS;QACT,WAAW;QACX,2FAA2F;QAC3F,4FAA4F;QAC5F,6EAA6E;QAC7E,YAAY,EAAE,oBAAoB,CAAC,SAAS,EAAE,QAAQ,CAAC;QACvD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,aAAa,EAAE,IAAI,EAAE,IAAI,IAAI,WAAW;QACxC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI;QAC9B,SAAS;KACV,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,0BAA0B,CAAC,iBAAiB,CAAC,CAAC,CAAA;IAE3D,cAAc,CAAC,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxD,MAAM,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAA;QACtC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAClF,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtD,MAAM,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAA;QACtC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC1C,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,SAAS,CAAC,CAAA;QACzF,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAA;QACtC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC1C,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAC1C,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,SAAS,EACT,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EACnB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAClB,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1D,MAAM,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAA;QACtC,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC1C,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAA;QAC3C,MAAM,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAEtD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAA;QACpF,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,wBAAwB,EAAE,sBAAsB,CAAC,CAAA;QACvF,4FAA4F;QAC5F,0FAA0F;QAC1F,sFAAsF;QACtF,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,eAAe,CAAC,mDAAmD,EAAE;gBAC7E,MAAM,EAAE,qBAAqB;gBAC7B,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,OAAO,CAAC,SAAS;aAC1B,CAAC,CAAA;QACJ,CAAC;QACD,6FAA6F;QAC7F,mFAAmF;QACnF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAC1C,WAAW,EACX,SAAS,EACT,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE,EAC5B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAClB,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"AgentPromptController.js","sourceRoot":"","sources":["../../../src/modules/agentPrompts/AgentPromptController.ts"],"names":[],"mappings":"AACA,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AACxE,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAA;AAEtE,qFAAqF;AACrF,SAAS,mBAAmB,CAAmB,CAAa;IAC1D,OAAO,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,YAAY,EAAE,kCAAkC,CAAC,CAAA;AAC/F,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAmB,CAAa;IACrD,OAAO,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,+BAA+B,CAAC,CAAA;AACvF,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAChB,CAAa,EACb,SAAiB,EACjB,SAAgC;IAEhC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,iBAAiB,CAAA;IACrD,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAC7D,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAA;IACzB,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;IAC3C,OAAO;QACL,SAAS;QACT,WAAW;QACX,2FAA2F;QAC3F,4FAA4F;QAC5F,6EAA6E;QAC7E,YAAY,EAAE,oBAAoB,CAAC,SAAS,EAAE,QAAQ,CAAC;QACvD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,aAAa,EAAE,IAAI,EAAE,IAAI,IAAI,WAAW;QACxC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI;QAC9B,SAAS;KACV,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAC9B,wBAAwB,CAAC,GAAG,EAAE,iBAAiB,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAA;IAEpE,cAAc,CAAC,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxD,MAAM,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAA;QACtC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAClF,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtD,MAAM,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAA;QACtC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC1C,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,SAAS,CAAC,CAAA;QACzF,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAA;QACtC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC1C,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAC1C,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,SAAS,EACT,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EACnB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAClB,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1D,MAAM,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAA;QACtC,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC1C,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAA;QAC3C,MAAM,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAEtD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAA;QACpF,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,wBAAwB,EAAE,sBAAsB,CAAC,CAAA;QACvF,4FAA4F;QAC5F,0FAA0F;QAC1F,sFAAsF;QACtF,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,eAAe,CAAC,mDAAmD,EAAE;gBAC7E,MAAM,EAAE,qBAAqB;gBAC7B,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,OAAO,CAAC,SAAS;aAC1B,CAAC,CAAA;QACJ,CAAC;QACD,6FAA6F;QAC7F,mFAAmF;QACnF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAC1C,WAAW,EACX,SAAS,EACT,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE,EAC5B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAClB,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/agentSettings/WorkspaceAgentSettingsController.js

@@ -1,7 +1,7 @@
 import { listWorkspaceAgentSettingsContract, updateWorkspaceAgentSettingsContract, } from '@cat-factory/contracts';
 import { buildHonoRoute } from '@toad-contracts/hono';
 import { Hono } from 'hono';
-import { requireWorkspacePermission } from '../../http/workspaceAccess.js';
+import { mountWorkspacePermission } from '../../http/workspaceAccess.js';
 import { param } from '../../http/params.js';
 import { requireCapability } from '../../http/guards.js';
 /** Resolve the agent-settings module, or refuse with a 503 naming what isn't wired. */
@@ -20,7 +20,7 @@ function requireAgentSettings(c) {
  */
 export function workspaceAgentSettingsController() {
     const app = new Hono();
-    app.use('*', requireWorkspacePermission('settings.manage'));
+    mountWorkspacePermission(app, 'settings.manage', ['/agent-settings']);
     buildHonoRoute(app, listWorkspaceAgentSettingsContract, async (c) => {
         const settings = requireAgentSettings(c);
         return c.json(await settings.service.list(param(c, 'workspaceId')), 200);

package/dist/modules/agentSettings/WorkspaceAgentSettingsController.js.map

@@ -1 +1 @@
-{"version":3,"file":"WorkspaceAgentSettingsController.js","sourceRoot":"","sources":["../../../src/modules/agentSettings/WorkspaceAgentSettingsController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,EAClC,oCAAoC,GACrC,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAExD,uFAAuF;AACvF,SAAS,oBAAoB,CAAmB,CAAa;IAC3D,OAAO,iBAAiB,CACtB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,sBAAsB,EACzC,mCAAmC,CACpC,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gCAAgC;IAC9C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,0BAA0B,CAAC,iBAAiB,CAAC,CAAC,CAAA;IAE3D,cAAc,CAAC,GAAG,EAAE,kCAAkC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QACxC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,oCAAoC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QACxC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC1C,2FAA2F;QAC3F,0FAA0F;QAC1F,+CAA+C;QAC/C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAC3C,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,SAAS,EACT,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CACpB,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"WorkspaceAgentSettingsController.js","sourceRoot":"","sources":["../../../src/modules/agentSettings/WorkspaceAgentSettingsController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,EAClC,oCAAoC,GACrC,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AACxE,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAExD,uFAAuF;AACvF,SAAS,oBAAoB,CAAmB,CAAa;IAC3D,OAAO,iBAAiB,CACtB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,sBAAsB,EACzC,mCAAmC,CACpC,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gCAAgC;IAC9C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAC9B,wBAAwB,CAAC,GAAG,EAAE,iBAAiB,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAA;IAErE,cAAc,CAAC,GAAG,EAAE,kCAAkC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QACxC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,oCAAoC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QACxC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC1C,2FAA2F;QAC3F,0FAA0F;QAC1F,+CAA+C;QAC/C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAC3C,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,SAAS,EACT,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CACpB,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/bootstrap/BootstrapController.js

@@ -1,7 +1,7 @@
 import { createReferenceArchitectureContract, deleteReferenceArchitectureContract, getBootstrapJobContract, listBootstrapJobsContract, listReferenceArchitecturesContract, startBootstrapJobContract, updateReferenceArchitectureContract, } from '@cat-factory/contracts';
 import { buildHonoRoute } from '@toad-contracts/hono';
 import { Hono } from 'hono';
-import { requireWorkspacePermission } from '../../http/workspaceAccess.js';
+import { mountWorkspacePermission } from '../../http/workspaceAccess.js';
 import { param } from '../../http/params.js';
 import { UnavailableError } from '@cat-factory/kernel';
 import { requireCapability } from '../../http/guards.js';
@@ -17,7 +17,7 @@ function requireBootstrap(c) {
  */
 export function bootstrapController() {
     const app = new Hono();
-    app.use('*', requireWorkspacePermission('integrations.manage'));
+    mountWorkspacePermission(app, 'integrations.manage', ['/bootstrap']);
     // ---- reference architectures -------------------------------------------
     buildHonoRoute(app, listReferenceArchitecturesContract, async (c) => {
         const bootstrap = requireBootstrap(c);

package/dist/modules/bootstrap/BootstrapController.js.map

@@ -1 +1 @@
-{"version":3,"file":"BootstrapController.js","sourceRoot":"","sources":["../../../src/modules/bootstrap/BootstrapController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,EACnC,mCAAmC,EACnC,uBAAuB,EACvB,yBAAyB,EACzB,kCAAkC,EAClC,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAI3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAExD,kFAAkF;AAClF,SAAS,gBAAgB,CAAmB,CAAa;IACvD,OAAO,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,SAAS,EAAE,kCAAkC,CAAC,CAAA;AAC5F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,0BAA0B,CAAC,qBAAqB,CAAC,CAAC,CAAA;IAE/D,2EAA2E;IAE3E,cAAc,CAAC,GAAG,EAAE,kCAAkC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClE,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACjG,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,mCAAmC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnE,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,2BAA2B,CACjE,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CACpB,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,mCAAmC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnE,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,2BAA2B,CACjE,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,EACvB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CACpB,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,mCAAmC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnE,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,SAAS,CAAC,OAAO,CAAC,2BAA2B,CACjD,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CACxB,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAE5E,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,OAAO,CAAC,CAAC,IAAI,CACX,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAChF,GAAG,CACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAC5E,uEAAuE;IACvE,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,oFAAoF;QACpF,oCAAoC;QACpC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YACpC,MAAM,IAAI,gBAAgB,CACxB,2FAA2F,CAC5F,CAAA;QACH,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3F,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,8EAA8E;IAC9E,6EAA6E;IAE7E,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"BootstrapController.js","sourceRoot":"","sources":["../../../src/modules/bootstrap/BootstrapController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,EACnC,mCAAmC,EACnC,uBAAuB,EACvB,yBAAyB,EACzB,kCAAkC,EAClC,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAI3B,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AACxE,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAExD,kFAAkF;AAClF,SAAS,gBAAgB,CAAmB,CAAa;IACvD,OAAO,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,SAAS,EAAE,kCAAkC,CAAC,CAAA;AAC5F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAC9B,wBAAwB,CAAC,GAAG,EAAE,qBAAqB,EAAE,CAAC,YAAY,CAAC,CAAC,CAAA;IAEpE,2EAA2E;IAE3E,cAAc,CAAC,GAAG,EAAE,kCAAkC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClE,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACjG,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,mCAAmC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnE,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,2BAA2B,CACjE,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CACpB,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,mCAAmC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnE,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,2BAA2B,CACjE,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,EACvB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CACpB,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,mCAAmC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnE,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,SAAS,CAAC,OAAO,CAAC,2BAA2B,CACjD,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CACxB,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAE5E,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,OAAO,CAAC,CAAC,IAAI,CACX,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAChF,GAAG,CACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAC5E,uEAAuE;IACvE,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,oFAAoF;QACpF,oCAAoC;QACpC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YACpC,MAAM,IAAI,gBAAgB,CACxB,2FAA2F,CAC5F,CAAA;QACH,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3F,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,8EAA8E;IAC9E,6EAA6E;IAE7E,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/capabilityCredentials/CapabilityCredentialsController.d.ts

@@ -14,8 +14,8 @@ import type { AppEnv } from '../../http/env.js';
  * learning which environment variables the deployment sets"). Moving the value into a row does
  * not change that judgement.
  *
- * Which is why the mount is `requireWorkspacePermissionIncludingReads` and not the usual
- * `requireWorkspacePermission`: that one passes GET/HEAD straight through, so for a release this
+ * Which is why the mount is `mountWorkspacePermissionIncludingReads` and not the usual
+ * `mountWorkspacePermission`: that one passes GET/HEAD straight through, so for a release this
  * controller documented a gated read (here, in the SPA's tab gate, and in the store's 403 branch)
  * while every member's GET was answered in full.
  */

package/dist/modules/capabilityCredentials/CapabilityCredentialsController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CapabilityCredentialsController.d.ts","sourceRoot":"","sources":["../../../src/modules/capabilityCredentials/CapabilityCredentialsController.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAiD/C;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,+BAA+B,IAAI,IAAI,CAAC,MAAM,CAAC,CA2C9D"}
+{"version":3,"file":"CapabilityCredentialsController.d.ts","sourceRoot":"","sources":["../../../src/modules/capabilityCredentials/CapabilityCredentialsController.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAiD/C;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,+BAA+B,IAAI,IAAI,CAAC,MAAM,CAAC,CAoC9D"}

package/dist/modules/capabilityCredentials/CapabilityCredentialsController.js

@@ -1,7 +1,7 @@
 import { deleteCapabilityCredentialContract, getCapabilityCredentialsContract, setCapabilityCredentialContract, setCapabilityCredentialsContract, } from '@cat-factory/contracts';
 import { buildHonoRoute } from '@toad-contracts/hono';
 import { Hono } from 'hono';
-import { requireWorkspacePermissionIncludingReads } from '../../http/workspaceAccess.js';
+import { mountWorkspacePermissionIncludingReads } from '../../http/workspaceAccess.js';
 import { param } from '../../http/params.js';
 import { requireCapability } from '../../http/guards.js';
 import { buildCapabilityCredentialsView, collectDeclaredCapabilityCredentials, } from './declaredCredentials.js';
@@ -47,21 +47,14 @@ async function viewFor(container, stored) {
  * learning which environment variables the deployment sets"). Moving the value into a row does
  * not change that judgement.
  *
- * Which is why the mount is `requireWorkspacePermissionIncludingReads` and not the usual
- * `requireWorkspacePermission`: that one passes GET/HEAD straight through, so for a release this
+ * Which is why the mount is `mountWorkspacePermissionIncludingReads` and not the usual
+ * `mountWorkspacePermission`: that one passes GET/HEAD straight through, so for a release this
  * controller documented a gated read (here, in the SPA's tab gate, and in the store's 403 branch)
  * while every member's GET was answered in full.
  */
 export function capabilityCredentialsController() {
     const app = new Hono();
-    // Mounted on this controller's OWN patterns rather than `'*'`, and both are needed (Hono's `*`
-    // does not match the bare prefix). A `'*'` mount becomes `ALL /workspaces/:workspaceId/*` on the
-    // shared app, so it would refuse a SIBLING controller's routes too: harmless while the gate let
-    // GETs through, and an outage for every member-readable GET registered after this one once it
-    // stopped.
-    const gate = requireWorkspacePermissionIncludingReads('secrets.manage');
-    app.use('/capability-credentials', gate);
-    app.use('/capability-credentials/*', gate);
+    mountWorkspacePermissionIncludingReads(app, 'secrets.manage', ['/capability-credentials']);
     buildHonoRoute(app, getCapabilityCredentialsContract, async (c) => {
         const svc = requireCapabilityCredentials(c);
         const stored = await svc.listStored(param(c, 'workspaceId'));

package/dist/modules/capabilityCredentials/CapabilityCredentialsController.js.map

@@ -1 +1 @@
-{"version":3,"file":"CapabilityCredentialsController.js","sourceRoot":"","sources":["../../../src/modules/capabilityCredentials/CapabilityCredentialsController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,EAClC,gCAAgC,EAChC,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAI3B,OAAO,EAAE,wCAAwC,EAAE,MAAM,+BAA+B,CAAA;AACxF,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,GACrC,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAA;AAItD,6FAA6F;AAC7F,SAAS,4BAA4B,CACnC,CAAa;IAEb,OAAO,iBAAiB,CACtB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,qBAAqB,EACxC,0EAA0E,CAC3E,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,OAAO,CACpB,SAA0B,EAC1B,MAAiC;IAEjC,MAAM,YAAY,GAAG,MAAM,oCAAoC,CAAC;QAC9D,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;QAC5C,MAAM;KACP,CAAC,CAAA;IACF,OAAO,8BAA8B,CAAC;QACpC,YAAY;QACZ,MAAM;QACN,8FAA8F;QAC9F,0FAA0F;QAC1F,qFAAqF;QACrF,8EAA8E;QAC9E,GAAG,CAAC,SAAS,CAAC,6BAA6B,KAAK,SAAS;YACvD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,SAAS,CAAC,6BAA6B,EAAE,CAAC;KACtE,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,+BAA+B;IAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAC9B,+FAA+F;IAC/F,iGAAiG;IACjG,gGAAgG;IAChG,8FAA8F;IAC9F,WAAW;IACX,MAAM,IAAI,GAAG,wCAAwC,CAAC,gBAAgB,CAAC,CAAA;IACvE,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,CAAC,CAAA;IACxC,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,CAAC,CAAA;IAE1C,cAAc,CAAC,GAAG,EAAE,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChE,MAAM,GAAG,GAAG,4BAA4B,CAAC,CAAC,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAA;QAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChE,MAAM,GAAG,GAAG,4BAA4B,CAAC,CAAC,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;QAC1E,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,wFAAwF;IACxF,4FAA4F;IAC5F,+DAA+D;IAC/D,cAAc,CAAC,GAAG,EAAE,+BAA+B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/D,MAAM,GAAG,GAAG,4BAA4B,CAAC,CAAC,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,CAC1B,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EACxB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAC1B,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,kCAAkC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClE,MAAM,GAAG,GAAG,4BAA4B,CAAC,CAAC,CAAC,CAAA;QAC3C,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAA;QACnE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"CapabilityCredentialsController.js","sourceRoot":"","sources":["../../../src/modules/capabilityCredentials/CapabilityCredentialsController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,EAClC,gCAAgC,EAChC,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAI3B,OAAO,EAAE,sCAAsC,EAAE,MAAM,+BAA+B,CAAA;AACtF,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,GACrC,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAA;AAItD,6FAA6F;AAC7F,SAAS,4BAA4B,CACnC,CAAa;IAEb,OAAO,iBAAiB,CACtB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,qBAAqB,EACxC,0EAA0E,CAC3E,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,OAAO,CACpB,SAA0B,EAC1B,MAAiC;IAEjC,MAAM,YAAY,GAAG,MAAM,oCAAoC,CAAC;QAC9D,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;QAC5C,MAAM;KACP,CAAC,CAAA;IACF,OAAO,8BAA8B,CAAC;QACpC,YAAY;QACZ,MAAM;QACN,8FAA8F;QAC9F,0FAA0F;QAC1F,qFAAqF;QACrF,8EAA8E;QAC9E,GAAG,CAAC,SAAS,CAAC,6BAA6B,KAAK,SAAS;YACvD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,SAAS,CAAC,6BAA6B,EAAE,CAAC;KACtE,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,+BAA+B;IAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAC9B,sCAAsC,CAAC,GAAG,EAAE,gBAAgB,EAAE,CAAC,yBAAyB,CAAC,CAAC,CAAA;IAE1F,cAAc,CAAC,GAAG,EAAE,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChE,MAAM,GAAG,GAAG,4BAA4B,CAAC,CAAC,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAA;QAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChE,MAAM,GAAG,GAAG,4BAA4B,CAAC,CAAC,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;QAC1E,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,wFAAwF;IACxF,4FAA4F;IAC5F,+DAA+D;IAC/D,cAAc,CAAC,GAAG,EAAE,+BAA+B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/D,MAAM,GAAG,GAAG,4BAA4B,CAAC,CAAC,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,CAC1B,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EACxB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAC1B,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,kCAAkC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClE,MAAM,GAAG,GAAG,4BAA4B,CAAC,CAAC,CAAC,CAAA;QAC3C,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAA;QACnE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/consensus/ConsensusGroupController.js

@@ -1,7 +1,7 @@
 import { createConsensusGroupContract, deleteConsensusGroupContract, listConsensusGroupsContract, updateConsensusGroupContract, } from '@cat-factory/contracts';
 import { buildHonoRoute } from '@toad-contracts/hono';
 import { Hono } from 'hono';
-import { requireWorkspacePermission } from '../../http/workspaceAccess.js';
+import { mountWorkspacePermission } from '../../http/workspaceAccess.js';
 import { param } from '../../http/params.js';
 import { requireCapability } from '../../http/guards.js';
 /** Resolve the consensus-group module, or refuse with a 503 naming what isn't wired. */
@@ -18,7 +18,7 @@ function requireConsensusGroups(c) {
  */
 export function consensusGroupController() {
     const app = new Hono();
-    app.use('*', requireWorkspacePermission('settings.manage'));
+    mountWorkspacePermission(app, 'settings.manage', ['/consensus-groups']);
     buildHonoRoute(app, listConsensusGroupsContract, async (c) => {
         const groups = requireConsensusGroups(c);
         return c.json(await groups.service.list(param(c, 'workspaceId')), 200);

package/dist/modules/consensus/ConsensusGroupController.js.map

@@ -1 +1 @@
-{"version":3,"file":"ConsensusGroupController.js","sourceRoot":"","sources":["../../../src/modules/consensus/ConsensusGroupController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,EAC5B,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAExD,wFAAwF;AACxF,SAAS,sBAAsB,CAAmB,CAAa;IAC7D,OAAO,iBAAiB,CACtB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,eAAe,EAClC,+CAA+C,CAChD,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,0BAA0B,CAAC,iBAAiB,CAAC,CAAC,CAAA;IAE3D,cAAc,CAAC,GAAG,EAAE,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3D,MAAM,MAAM,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAA;QACxC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACxE,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5D,MAAM,MAAM,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAA;QACxC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;QACvF,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5D,MAAM,MAAM,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAA;QACxC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CACvC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,EAC5B,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CACpB,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5D,MAAM,MAAM,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAA;QACxC,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAA;QAClF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"ConsensusGroupController.js","sourceRoot":"","sources":["../../../src/modules/consensus/ConsensusGroupController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,EAC5B,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AACxE,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAExD,wFAAwF;AACxF,SAAS,sBAAsB,CAAmB,CAAa;IAC7D,OAAO,iBAAiB,CACtB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,eAAe,EAClC,+CAA+C,CAChD,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAC9B,wBAAwB,CAAC,GAAG,EAAE,iBAAiB,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAA;IAEvE,cAAc,CAAC,GAAG,EAAE,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3D,MAAM,MAAM,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAA;QACxC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACxE,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5D,MAAM,MAAM,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAA;QACxC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;QACvF,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5D,MAAM,MAAM,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAA;QACxC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CACvC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,EAC5B,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CACpB,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5D,MAAM,MAAM,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAA;QACxC,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAA;QAClF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/documents/DocumentSourceController.d.ts

@@ -5,6 +5,16 @@ import type { AppEnv } from '../../http/env.js';
  * connection management, page import, document listing, structure
  * planning/spawning, and linking a page to a block as agent context. Mounted
  * under `/workspaces/:workspaceId`.
+ *
+ * **This controller MIXES tiers, and which half a route lands in is the whole point.**
+ * Storing a credential is integration management; reaching for a page and putting it on a task is
+ * board AUTHORING, done by whoever authors the task. Holding the whole controller at
+ * `integrations.manage` made every write admin-only, so the persona the feature exists for (someone
+ * who links the spec or the design their task is about, and is not an operator) could not attach
+ * anything at all: the Add-task picker imports-then-links, so it failed on its first write. Import,
+ * search, plan, spawn and link therefore sit at the MEMBER tier the auth gate's write floor already
+ * enforces, exactly as `boardController`'s writes do, and only the two credential routes plus the
+ * workspace-wide role tags keep the admin gate below.
  */
 export declare function documentSourceController(): Hono<AppEnv>;
 //# sourceMappingURL=DocumentSourceController.d.ts.map

package/dist/modules/documents/DocumentSourceController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DocumentSourceController.d.ts","sourceRoot":"","sources":["../../../src/modules/documents/DocumentSourceController.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAI3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAsB/C;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAAC,MAAM,CAAC,CA+IvD"}
+{"version":3,"file":"DocumentSourceController.d.ts","sourceRoot":"","sources":["../../../src/modules/documents/DocumentSourceController.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAI3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAsB/C;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAAC,MAAM,CAAC,CAsKvD"}

package/dist/modules/documents/DocumentSourceController.js

@@ -3,7 +3,7 @@ import * as v from 'valibot';
 import { buildHonoRoute } from '@toad-contracts/hono';
 import { Hono } from 'hono';
 import { ValidationError } from '@cat-factory/kernel';
-import { blockEditActor, requireWorkspacePermission } from '../../http/workspaceAccess.js';
+import { blockEditActor, mountWorkspacePermission } from '../../http/workspaceAccess.js';
 import { param } from '../../http/params.js';
 import { requireCapability } from '../../http/guards.js';
 /** Resolve the documents module, or refuse with a 503 naming what isn't wired. */
@@ -23,10 +23,37 @@ function sourceParam(c) {
  * connection management, page import, document listing, structure
  * planning/spawning, and linking a page to a block as agent context. Mounted
  * under `/workspaces/:workspaceId`.
+ *
+ * **This controller MIXES tiers, and which half a route lands in is the whole point.**
+ * Storing a credential is integration management; reaching for a page and putting it on a task is
+ * board AUTHORING, done by whoever authors the task. Holding the whole controller at
+ * `integrations.manage` made every write admin-only, so the persona the feature exists for (someone
+ * who links the spec or the design their task is about, and is not an operator) could not attach
+ * anything at all: the Add-task picker imports-then-links, so it failed on its first write. Import,
+ * search, plan, spawn and link therefore sit at the MEMBER tier the auth gate's write floor already
+ * enforces, exactly as `boardController`'s writes do, and only the two credential routes plus the
+ * workspace-wide role tags keep the admin gate below.
  */
 export function documentSourceController() {
     const app = new Hono();
-    app.use('*', requireWorkspacePermission('integrations.manage'));
+    // The admin-tier half, named path by path rather than as a whole-controller mount:
+    //
+    // - connect/disconnect write and clear the per-workspace source CREDENTIAL, which is integration
+    //   management by definition. Gating at the mount rather than per-handler keeps the refusal ahead
+    //   of body validation, so a member is refused whether or not their payload is well-formed and
+    //   never learns which sources this deployment configured;
+    // - the per-DocKind template / exemplar tags are workspace-wide authoring CONFIG, not one task's
+    //   context. One tag decides what EVERY doc run in the board writes from, the same blast radius
+    //   that keeps the fragment library and the agent-prompt overrides at the admin tier. The
+    //   writes-only gate leaves the GET open, so the management panel still renders for anyone who
+    //   can read the board.
+    //
+    // Everything else this controller serves is the member half, and mounts nothing.
+    mountWorkspacePermission(app, 'integrations.manage', [
+        '/document-sources/:source/connect',
+        '/document-sources/:source/connection',
+        '/document-role-links',
+    ]);
     // ---- source discovery ---------------------------------------------------
     // The configured sources + their connect/import metadata (drives the UI). A
     // 503 here is how the frontend learns the integration is off.
@@ -55,6 +82,9 @@ export function documentSourceController() {
         const documents = requireDocuments(c);
         return c.json(await documents.importService.listDocuments(param(c, 'workspaceId')), 200);
     });
+    // Member tier. It does spend an outbound call against the source under the workspace's stored
+    // credential, which is the reason the tool-server probe is gated: the difference is that here the
+    // call IS the feature, and the same credential is spent by every run a member may already start.
     buildHonoRoute(app, importDocumentContract, async (c) => {
         const documents = requireDocuments(c);
         const document = await documents.importService.import(param(c, 'workspaceId'), sourceParam(c), c.req.valid('json').ref);
@@ -68,7 +98,9 @@ export function documentSourceController() {
         return c.json({ results }, 200);
     });
     // ---- planning / spawning ------------------------------------------------
-    // Preview the board structure a page would expand into (no writes).
+    // Preview the board structure a page would expand into (no writes). Member tier because the
+    // spawn it previews is a board write; in `llm` planner mode it also spends one model call, a
+    // smaller spend than the run the same member may start on what it produces.
     buildHonoRoute(app, planDocumentContract, async (c) => {
         const documents = requireDocuments(c);
         const workspaceId = param(c, 'workspaceId');
@@ -88,7 +120,8 @@ export function documentSourceController() {
         return c.json({ plan, result }, 201);
     });
     // ---- context links ------------------------------------------------------
-    // Attach an imported page to a block as extra agent context.
+    // Attach an imported page to a block as extra agent context. Member tier: this is the write the
+    // designer/author flow ends on, and it edits one block's context, nothing workspace-wide.
     buildHonoRoute(app, linkDocumentContract, async (c) => {
         const documents = requireDocuments(c);
         const { source, externalId, blockId } = c.req.valid('json');

package/dist/modules/documents/DocumentSourceController.js.map

@@ -1 +1 @@
-{"version":3,"file":"DocumentSourceController.js","sourceRoot":"","sources":["../../../src/modules/documents/DocumentSourceController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,gCAAgC,EAChC,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,2BAA2B,EAC3B,+BAA+B,EAC/B,6BAA6B,EAC7B,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,GAE9B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAGrD,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAA;AAC1F,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAExD,kFAAkF;AAClF,SAAS,gBAAgB,CAAmB,CAAa;IACvD,OAAO,iBAAiB,CACtB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,SAAS,EAC5B,+CAA+C,CAChD,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,SAAS,WAAW,CAAmB,CAAa;IAClD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IACjC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,wBAAwB,EAAE,MAAM,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,eAAe,CAAC,4BAA4B,MAAM,GAAG,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,0BAA0B,CAAC,qBAAqB,CAAC,CAAC,CAAA;IAE/D,4EAA4E;IAE5E,4EAA4E;IAC5E,8DAA8D;IAC9D,cAAc,CAAC,GAAG,EAAE,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3D,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,iBAAiB,CAAC,WAAW,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAE5E,cAAc,CAAC,GAAG,EAAE,+BAA+B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/D,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAA;QAC9F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7D,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,OAAO,CAC1D,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,WAAW,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,WAAW,CAChC,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChE,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,SAAS,CAAC,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;QACrF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAE5E,cAAc,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,aAAa,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC1F,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtD,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,MAAM,CACnD,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,WAAW,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CACxB,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,gFAAgF;IAChF,6CAA6C;IAC7C,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,MAAM,CAClD,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,WAAW,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAC1B,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAA;IACjC,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAE5E,oEAAoE;IACpE,cAAc,CAAC,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpD,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,eAAe,CAC1D,WAAW,EACX,WAAW,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,UAAU,CAC/B,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,+EAA+E;IAC/E,cAAc,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAA;QAC3C,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACnD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,eAAe,CAC1D,WAAW,EACX,WAAW,CAAC,CAAC,CAAC,EACd,UAAU,CACX,CAAA;QACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACxD,4FAA4F;QAC5F,iFAAiF;QACjF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;QAC/F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAE5E,6DAA6D;IAC7D,cAAc,CAAC,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpD,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC3D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,WAAW,CACtD,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,OAAO,EACP,MAAM,EACN,UAAU,CACX,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAE5E,+FAA+F;IAC/F,cAAc,CAAC,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7D,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACxF,CAAC,CAAC,CAAA;IAEF,+FAA+F;IAC/F,cAAc,CAAC,GAAG,EAAE,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3D,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACjE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,WAAW,CACtD,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,MAAM,EACN,UAAU,EACV,IAAI,EACJ,OAAO,CACR,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,yFAAyF;IACzF,cAAc,CAAC,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7D,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAClD,MAAM,SAAS,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;QACtF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"DocumentSourceController.js","sourceRoot":"","sources":["../../../src/modules/documents/DocumentSourceController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,gCAAgC,EAChC,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,2BAA2B,EAC3B,+BAA+B,EAC/B,6BAA6B,EAC7B,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,GAE9B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAGrD,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AACxF,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAExD,kFAAkF;AAClF,SAAS,gBAAgB,CAAmB,CAAa;IACvD,OAAO,iBAAiB,CACtB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,SAAS,EAC5B,+CAA+C,CAChD,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,SAAS,WAAW,CAAmB,CAAa;IAClD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IACjC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,wBAAwB,EAAE,MAAM,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,eAAe,CAAC,4BAA4B,MAAM,GAAG,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAC9B,mFAAmF;IACnF,EAAE;IACF,iGAAiG;IACjG,kGAAkG;IAClG,+FAA+F;IAC/F,2DAA2D;IAC3D,iGAAiG;IACjG,gGAAgG;IAChG,0FAA0F;IAC1F,+FAA+F;IAC/F,wBAAwB;IACxB,EAAE;IACF,iFAAiF;IACjF,wBAAwB,CAAC,GAAG,EAAE,qBAAqB,EAAE;QACnD,mCAAmC;QACnC,sCAAsC;QACtC,sBAAsB;KACvB,CAAC,CAAA;IAEF,4EAA4E;IAE5E,4EAA4E;IAC5E,8DAA8D;IAC9D,cAAc,CAAC,GAAG,EAAE,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3D,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,iBAAiB,CAAC,WAAW,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAE5E,cAAc,CAAC,GAAG,EAAE,+BAA+B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/D,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAA;QAC9F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7D,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,OAAO,CAC1D,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,WAAW,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,WAAW,CAChC,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChE,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,SAAS,CAAC,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;QACrF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAE5E,cAAc,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,aAAa,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC1F,CAAC,CAAC,CAAA;IAEF,8FAA8F;IAC9F,kGAAkG;IAClG,iGAAiG;IACjG,cAAc,CAAC,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtD,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,MAAM,CACnD,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,WAAW,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CACxB,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,gFAAgF;IAChF,6CAA6C;IAC7C,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,MAAM,CAClD,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,WAAW,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAC1B,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAA;IACjC,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAE5E,4FAA4F;IAC5F,6FAA6F;IAC7F,4EAA4E;IAC5E,cAAc,CAAC,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpD,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,eAAe,CAC1D,WAAW,EACX,WAAW,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,UAAU,CAC/B,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,+EAA+E;IAC/E,cAAc,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAA;QAC3C,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACnD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,eAAe,CAC1D,WAAW,EACX,WAAW,CAAC,CAAC,CAAC,EACd,UAAU,CACX,CAAA;QACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACxD,4FAA4F;QAC5F,iFAAiF;QACjF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;QAC/F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAE5E,gGAAgG;IAChG,0FAA0F;IAC1F,cAAc,CAAC,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpD,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC3D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,WAAW,CACtD,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,OAAO,EACP,MAAM,EACN,UAAU,CACX,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAE5E,+FAA+F;IAC/F,cAAc,CAAC,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7D,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACxF,CAAC,CAAC,CAAA;IAEF,+FAA+F;IAC/F,cAAc,CAAC,GAAG,EAAE,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3D,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACjE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,WAAW,CACtD,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,MAAM,EACN,UAAU,EACV,IAAI,EACJ,OAAO,CACR,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,yFAAyF;IACzF,cAAc,CAAC,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7D,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAClD,MAAM,SAAS,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;QACtF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/environments/EnvironmentController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"EnvironmentController.d.ts","sourceRoot":"","sources":["../../../src/modules/environments/EnvironmentController.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AA6B/C;;;;;GAKG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAAC,MAAM,CAAC,CAsMpD"}
+{"version":3,"file":"EnvironmentController.d.ts","sourceRoot":"","sources":["../../../src/modules/environments/EnvironmentController.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AA6B/C;;;;;GAKG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAAC,MAAM,CAAC,CA0MpD"}

package/dist/modules/environments/EnvironmentController.js

@@ -2,7 +2,7 @@ import { bootstrapEnvironmentRepoContract, describeEnvironmentProviderContract,
 import { buildHonoRoute } from '@toad-contracts/hono';
 import * as v from 'valibot';
 import { Hono } from 'hono';
-import { requireWorkspacePermission } from '../../http/workspaceAccess.js';
+import { mountWorkspacePermission } from '../../http/workspaceAccess.js';
 import { param } from '../../http/params.js';
 import { requireCapability } from '../../http/guards.js';
 /** Resolve the environment module, or refuse with a 503 naming what isn't wired. */
@@ -27,7 +27,11 @@ const notFound = (c) => c.json({ error: { code: 'not_found', message: 'Environme
  */
 export function environmentController() {
     const app = new Hono();
-    app.use('*', requireWorkspacePermission('integrations.manage'));
+    mountWorkspacePermission(app, 'integrations.manage', [
+        '/environments',
+        '/environment-tests',
+        '/blocks/:blockId/environment-test',
+    ]);
     // ---- provider connection ------------------------------------------------
     buildHonoRoute(app, getEnvironmentConnectionContract, async (c) => {
         const env = requireEnvironments(c);