@cat-factory/server 0.295.0 → 0.296.1

package/dist/persistence/rpc-allowlist-libraries.js

@@ -0,0 +1,209 @@
+// The repo-sourced CONTENT LIBRARY half of the mothership-mode persistence allow-list: prompt
+// fragments, Claude Skills and foundational services, with their generated briefs, contract
+// manifests and the three source tables their repo sync writes.
+//
+// Split out of `rpc-allowlist.ts` when that file reached its size budget. These belong together for
+// a reason beyond size: all three are tenant-owned catalogs a RUN resolves, all three sync from a
+// git repo through a source row, and all three bind through the owner-pair rules (`owner` /
+// `ownerField` / `ownerFieldUpsert` / `librarySource`, and the account-keyed `skillSource` twin)
+// rather than through a workspace argument. Spread into `REMOTE_PERSISTENCE_METHODS`; the merged
+// table is what the dispatcher and the drift guard read.
+/** The content libraries' remote surface. See `rpc-allowlist.ts` for the table's contract. */
+export const LIBRARY_PERSISTENCE_METHODS = {
+    // --- Prompt-fragment library management surface ---------------------------------
+    // The tenant-scoped prompt-fragment library (ADR 0006) a mothership-mode SPA curates
+    // (`FragmentLibraryController` → `FragmentLibraryService`): list / create / update / delete
+    // hand-authored fragments at either tier. The library module assembles from
+    // `promptFragmentRepository` ALONE (no connection/secret repo — unlike the document/task
+    // integrations, whose modules require a decrypt-inside connection repo and so stay off), and its
+    // rows carry NO secrets, so the whole management surface is remote. Every method is keyed by an
+    // `(ownerKind, ownerId)` PAIR (`ownerKind` ∈ `workspace` | `account`), bound by the `owner` scope
+    // rule (positional pair) / `ownerField` rule (the record's fields on `upsert`): a `workspace`
+    // owner resolves its account like the `workspace` rule, an `account` owner IS the accountId — so a
+    // machine token scoped to one account can never read/write another tenant's fragments. Both tiers'
+    // endpoints are member-level (account-tier routes guard on `requireMember`, NOT `requireAdmin`), so
+    // this follows the same member-level policy as the other settings/library panels above.
+    //
+    // `listBySource` (the repo-sync reconcile read) joins them: see the `librarySource` note on
+    // `fragmentSourceRepository` below for why the sync surface is no longer deferred.
+    promptFragmentRepository: {
+        listByOwner: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
+        get: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
+        upsert: { scope: { kind: 'ownerField', arg: 0 } },
+        softDelete: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
+        // The source-keyed reconcile pair, mirroring the skill and foundational-service libraries':
+        // list a source's live fragments to diff against the repo listing, and tombstone all of them
+        // in one write on unlink. Each method carries a source id and nothing else, so the
+        // `librarySource` rule resolves that source's owning tier pair server-side (`fragmentSource`
+        // names the table it lives in).
+        listBySource: { scope: { kind: 'librarySource', arg: 0, entity: 'fragmentSource' } },
+        softDeleteBySource: { scope: { kind: 'librarySource', arg: 0, entity: 'fragmentSource' } },
+    },
+    // Model-GENERATED condensed briefs for long standards (`FragmentBriefService`), read and
+    // written on the RUN path: a mothership-mode implementer dispatch resolves them alongside the
+    // fragment bodies above, so leaving them off would silently fold full standards on every turn
+    // of every local loop — the exact cost this feature exists to remove. `remote`, not
+    // `local-first`: they are org-durable derived state (a condensation an account paid a model
+    // for, reused by every board in it), not per-user runner telemetry. The rows hold model output
+    // condensing a standard the same token already reads in full through `promptFragmentRepository`,
+    // so they widen no exposure, and every method is keyed by the same `(ownerKind, ownerId)` pair —
+    // bound by the `owner` rule (positional) / `ownerField` rule (the record's fields on `upsert`),
+    // so a token scoped to one account can neither read nor overwrite another tenant's briefs.
+    fragmentBriefRepository: {
+        listByOwner: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
+        upsert: { scope: { kind: 'ownerField', arg: 0 } },
+        delete: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
+    },
+    // The fragment-source (repo-linkage) library the SPA lists, links and SYNCS
+    // (`FragmentSourceService`), owner scoped exactly like the fragments above. `listByOwner` is bound
+    // by the `owner` rule; the sourceId-keyed sync methods by `librarySource`, which resolves a
+    // source's owning `(ownerKind, ownerId)` pair server-side.
+    //
+    // The sync half was deferred on a premise that is no longer true: that a mothership-mode node has
+    // no GitHub client. Token delegation gave it one (`DelegatedAppTokenSource` mints the tier's App
+    // token over the same machine API), which is what already made the SKILLS library's sync surface
+    // remote — so these routes were reachable and broken, the state that is worse than either serving
+    // them or hiding them. `librarySource` is `skillSource` generalised to a tier PAIR, because a
+    // fragment source can be owned by a workspace as well as an account.
+    //
+    // `upsert(record)` takes `ownerFieldUpsert`, NOT the plain `ownerField` the fragments above use.
+    // This is the gap the skills slice named and could not close: the write conflicts on the `id`
+    // ALONE and never re-`SET`s the owner columns, so binding only the DECLARED owner would let an
+    // in-scope caller name a foreign source id and repoint another tenant's link at a repo it
+    // controls, whose Markdown bodies the victim's next sync folds into their prompts as standards.
+    // The rule binds the STORED row's owner too; a create (no such row) still passes on the declared
+    // half. `ownerFieldUpsert` is the owner-pair analogue of `accountFieldUpsert` above, and is what
+    // any new id-keyed library upsert must use.
+    fragmentSourceRepository: {
+        listByOwner: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
+        upsert: { scope: { kind: 'ownerFieldUpsert', arg: 0, entity: 'fragmentSource' } },
+        get: { scope: { kind: 'librarySource', arg: 0, entity: 'fragmentSource' } },
+        updateSyncState: { scope: { kind: 'librarySource', arg: 0, entity: 'fragmentSource' } },
+        softDelete: { scope: { kind: 'librarySource', arg: 0, entity: 'fragmentSource' } },
+    },
+    // --- Repo-sourced Claude Skills library (ADR 0024) ------------------------------
+    // Skills live in ONE tier — the ACCOUNT — so every method here binds on an accountId rather
+    // than the `(ownerKind, ownerId)` pair the fragment library uses: positionally via the `account`
+    // rule, on a record's `accountId` FIELD via `accountField` / `accountFieldUpsert`, or (the sync
+    // surface) via the `skillSource` rule, which resolves a source id to its owning account
+    // server-side. A machine token scoped to one account can therefore neither read nor write another
+    // tenant's skills.
+    //
+    // Remote rather than `telemetry` or `local-sqlite` for the reason the bucket test names: what
+    // READS this is a RUN. `SkillRunResolver` resolves the picked skill (and ADR 0029's declared
+    // `{ catalogSkillId }` capabilities) out of `accountSkillRepository` at every dispatch, and
+    // `skillResolver` is a HARD dependency for a `skill` step — so leaving the catalog off would
+    // not merely blank a panel, it would fail every skill-running dispatch on a mothership-mode
+    // node with `unknown_method`. The rows carry no secrets (a `SKILL.md` body plus a resource
+    // manifest of `{ path, sha, size }`); the resource BODIES are fetched from the repo at
+    // dispatch and never stored, so nothing credential-bearing crosses the machine API.
+    //
+    // This was the FIRST library whose repo-SYNC surface went remote. A sync needs a GitHub client,
+    // and a mothership-mode node HAS one (`DelegatedAppTokenSource` mints the account's App token
+    // over the same machine API), so its `SkillSourceService` assembles and its link/sync/unlink
+    // routes are live. Leaving the sourceId-keyed methods off would leave those routes reachable and
+    // broken, which is worse than either serving them or hiding them. `skillSource` is the rule that
+    // binds them (skills live in one tier, so it resolves a bare accountId); the sibling
+    // libraries have since adopted it, in its owner-pair form (`librarySource`).
+    accountSkillRepository: {
+        // Catalog reads: the account library panel, the pipeline builder's skill picker, and the RUN
+        // path (`SkillCatalogService.list`/`get`, behind the per-account `skillCatalog` cache slice).
+        listByAccount: { scope: { kind: 'account', arg: 0 } },
+        get: { scope: { kind: 'account', arg: 0 } },
+        // Sync writes. `upsert(record)` binds on the record's `accountId` FIELD, so a synced skill can
+        // only ever land under an in-scope account. Plain `accountField` is sufficient HERE (and NOT for
+        // `skillSourceRepository.upsert` below) because this write conflicts on `(account_id, skill_id)`
+        // on both runtimes: the bound account is part of the key, so a foreign `skillId` inserts a fresh
+        // row under the caller's own account and can never mutate another tenant's. `softDelete(accountId,
+        // skillId, at)` is positional.
+        upsert: { scope: { kind: 'accountField', arg: 0 } },
+        softDelete: { scope: { kind: 'account', arg: 0 } },
+        // The source-keyed reconcile pair: list a source's live skills to diff against the repo, and
+        // tombstone all of them in one write on unlink. Both bind through `skillSource`.
+        listBySource: { scope: { kind: 'skillSource', arg: 0 } },
+        softDeleteBySource: { scope: { kind: 'skillSource', arg: 0 } },
+    },
+    // The repo-linkage rows the library panel lists and the sync pins its head commit on.
+    // `listByAccount` is positional; the three sourceId-keyed methods bind through `skillSource`.
+    //
+    // `upsert(record)` takes `accountFieldUpsert`, NOT the plain `accountField` its sibling above uses,
+    // because this write conflicts on the `id` ALONE and does not re-`SET account_id` (D1
+    // `ON CONFLICT (id) DO UPDATE`, Drizzle `target: skillSources.id`). The row it lands on is therefore
+    // chosen by the id, not by the bound account — so binding only the DECLARED `accountId` would let a
+    // token scoped to account A name account B's source id, declare its own account to pass the check,
+    // and repoint B's link at an attacker-controlled repo; B's next sync folds that repo's `SKILL.md`
+    // bodies — agent INSTRUCTIONS — into B's catalog. `accountFieldUpsert` additionally binds the STORED
+    // row's account, so an existing foreign row is refused while a create (no such row) still passes.
+    //
+    // `listByRepo` is deliberately absent: it is the GLOBAL `(repoOwner, repoName)` → sources reverse
+    // lookup the push-webhook fan-out uses, spanning every account by construction, so no rule can
+    // bind it. It runs on the mothership (which receives the webhook), never on a laptop — the same
+    // "unscoped, mothership-internal" bucket as `slackConnectionRepository.getByTeam`.
+    skillSourceRepository: {
+        listByAccount: { scope: { kind: 'account', arg: 0 } },
+        get: { scope: { kind: 'skillSource', arg: 0 } },
+        upsert: { scope: { kind: 'accountFieldUpsert', arg: 0, entity: 'skillSource' } },
+        updateSyncState: { scope: { kind: 'skillSource', arg: 0 } },
+        softDelete: { scope: { kind: 'skillSource', arg: 0 } },
+    },
+    // --- Foundational services (backend/docs/adr/0031-foundational-services.md) -----------
+    // The tiered catalog of shared capabilities an Architect designs against, and the API contract
+    // documents its consumers lazily read. Both are `(ownerKind, ownerId)`-keyed org/durable state
+    // — the `remote` bucket by default — and every method here binds with the same `owner` /
+    // `ownerField` rules the prompt-fragment library uses, so a token scoped to one account can
+    // neither read nor overwrite another tenant's catalog.
+    //
+    // Remote rather than `telemetry` or `local-sqlite` for the reason the bucket test names: what
+    // READS this is a RUN. A mothership-mode node dispatching an architect step resolves the merged
+    // catalog over this RPC, and its coder resolves the declared services' contract documents the
+    // same way — so a catalog that lived only on the laptop would make every design on a
+    // mothership-mode deployment silently see an empty catalog and rebuild capabilities the org
+    // already runs. `listByServiceIds` is the hot one (once per consumer dispatch) and is already a
+    // single chunked `IN` query, so it stays one round trip over the wire too.
+    //
+    // The sourceId-keyed sync methods now bind through `librarySource` (see the fragment library
+    // above: the same rule, the same dead premise, and the same node-side GitHub client). What stays
+    // OFF is `foundationalServiceSourceRepository.listStale` (the autorefresh sweep's global query)
+    // and `listByRepo` (the push-webhook fan-out's), both unscoped across tiers by construction and
+    // both running where a delivery ARRIVES, which is never a laptop.
+    foundationalServiceRepository: {
+        listByOwner: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
+        get: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
+        upsert: { scope: { kind: 'ownerField', arg: 0 } },
+        softDelete: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
+        // Lifting a board's suppression of an inherited service. Same owner rule as `softDelete` and
+        // the same management surface, so it belongs on the same side of the boundary: leaving it off
+        // would let a mothership-mode board opt OUT of an account service with no way back in.
+        hardDelete: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
+        // The source-keyed reconcile pair, mirroring `accountSkillRepository`'s: list a source's live
+        // services to diff against the repo, and tombstone all of them in one write on unlink.
+        listBySource: {
+            scope: { kind: 'librarySource', arg: 0, entity: 'foundationalServiceSource' },
+        },
+        softDeleteBySource: {
+            scope: { kind: 'librarySource', arg: 0, entity: 'foundationalServiceSource' },
+        },
+    },
+    apiContractRepository: {
+        listManifestByOwner: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
+        listByServiceIds: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
+        replaceForService: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
+        deleteForService: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
+    },
+    // `upsert` takes `ownerFieldUpsert` for exactly the reason `fragmentSourceRepository.upsert` does:
+    // it conflicts on the `id` alone, so the declared owner does not decide which row is written.
+    foundationalServiceSourceRepository: {
+        listByOwner: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
+        upsert: {
+            scope: { kind: 'ownerFieldUpsert', arg: 0, entity: 'foundationalServiceSource' },
+        },
+        get: { scope: { kind: 'librarySource', arg: 0, entity: 'foundationalServiceSource' } },
+        updateSyncState: {
+            scope: { kind: 'librarySource', arg: 0, entity: 'foundationalServiceSource' },
+        },
+        softDelete: {
+            scope: { kind: 'librarySource', arg: 0, entity: 'foundationalServiceSource' },
+        },
+    },
+};
+//# sourceMappingURL=rpc-allowlist-libraries.js.map

package/dist/persistence/rpc-allowlist-libraries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc-allowlist-libraries.js","sourceRoot":"","sources":["../../src/persistence/rpc-allowlist-libraries.ts"],"names":[],"mappings":"AAEA,8FAA8F;AAC9F,4FAA4F;AAC5F,gEAAgE;AAChE,EAAE;AACF,oGAAoG;AACpG,kGAAkG;AAClG,4FAA4F;AAC5F,iGAAiG;AACjG,iGAAiG;AACjG,yDAAyD;AAEzD,8FAA8F;AAC9F,MAAM,CAAC,MAAM,2BAA2B,GAA2B;IACjE,mFAAmF;IACnF,qFAAqF;IACrF,4FAA4F;IAC5F,4EAA4E;IAC5E,yFAAyF;IACzF,iGAAiG;IACjG,gGAAgG;IAChG,kGAAkG;IAClG,8FAA8F;IAC9F,mGAAmG;IACnG,mGAAmG;IACnG,oGAAoG;IACpG,wFAAwF;IACxF,EAAE;IACF,4FAA4F;IAC5F,mFAAmF;IACnF,wBAAwB,EAAE;QACxB,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/D,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QACjD,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,4FAA4F;QAC5F,6FAA6F;QAC7F,mFAAmF;QACnF,6FAA6F;QAC7F,gCAAgC;QAChC,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE;QACpF,kBAAkB,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE;KAC3F;IACD,yFAAyF;IACzF,8FAA8F;IAC9F,8FAA8F;IAC9F,oFAAoF;IACpF,4FAA4F;IAC5F,+FAA+F;IAC/F,iGAAiG;IACjG,iGAAiG;IACjG,gGAAgG;IAChG,2FAA2F;IAC3F,uBAAuB,EAAE;QACvB,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/D,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QACjD,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;KAC3D;IACD,4EAA4E;IAC5E,mGAAmG;IACnG,4FAA4F;IAC5F,2DAA2D;IAC3D,EAAE;IACF,kGAAkG;IAClG,iGAAiG;IACjG,iGAAiG;IACjG,kGAAkG;IAClG,8FAA8F;IAC9F,qEAAqE;IACrE,EAAE;IACF,iGAAiG;IACjG,8FAA8F;IAC9F,+FAA+F;IAC/F,0FAA0F;IAC1F,gGAAgG;IAChG,iGAAiG;IACjG,iGAAiG;IACjG,4CAA4C;IAC5C,wBAAwB,EAAE;QACxB,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/D,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE;QACjF,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE;QAC3E,eAAe,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE;QACvF,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE;KACnF;IACD,mFAAmF;IACnF,4FAA4F;IAC5F,iGAAiG;IACjG,gGAAgG;IAChG,wFAAwF;IACxF,kGAAkG;IAClG,mBAAmB;IACnB,EAAE;IACF,8FAA8F;IAC9F,6FAA6F;IAC7F,4FAA4F;IAC5F,6FAA6F;IAC7F,4FAA4F;IAC5F,2FAA2F;IAC3F,uFAAuF;IACvF,oFAAoF;IACpF,EAAE;IACF,gGAAgG;IAChG,8FAA8F;IAC9F,6FAA6F;IAC7F,iGAAiG;IACjG,iGAAiG;IACjG,qFAAqF;IACrF,6EAA6E;IAC7E,sBAAsB,EAAE;QACtB,6FAA6F;QAC7F,8FAA8F;QAC9F,aAAa,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QACrD,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QAC3C,+FAA+F;QAC/F,iGAAiG;QACjG,iGAAiG;QACjG,iGAAiG;QACjG,mGAAmG;QACnG,+BAA+B;QAC/B,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QACnD,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QAClD,6FAA6F;QAC7F,iFAAiF;QACjF,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QACxD,kBAAkB,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;KAC/D;IACD,sFAAsF;IACtF,8FAA8F;IAC9F,EAAE;IACF,oGAAoG;IACpG,sFAAsF;IACtF,qGAAqG;IACrG,oGAAoG;IACpG,mGAAmG;IACnG,kGAAkG;IAClG,qGAAqG;IACrG,kGAAkG;IAClG,EAAE;IACF,kGAAkG;IAClG,+FAA+F;IAC/F,gGAAgG;IAChG,mFAAmF;IACnF,qBAAqB,EAAE;QACrB,aAAa,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QACrD,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QAC/C,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;QAChF,eAAe,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QAC3D,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;KACvD;IACD,yFAAyF;IACzF,+FAA+F;IAC/F,+FAA+F;IAC/F,yFAAyF;IACzF,4FAA4F;IAC5F,uDAAuD;IACvD,EAAE;IACF,8FAA8F;IAC9F,gGAAgG;IAChG,8FAA8F;IAC9F,qFAAqF;IACrF,4FAA4F;IAC5F,gGAAgG;IAChG,2EAA2E;IAC3E,EAAE;IACF,6FAA6F;IAC7F,iGAAiG;IACjG,gGAAgG;IAChG,gGAAgG;IAChG,kEAAkE;IAClE,6BAA6B,EAAE;QAC7B,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/D,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QACjD,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,6FAA6F;QAC7F,8FAA8F;QAC9F,uFAAuF;QACvF,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,8FAA8F;QAC9F,uFAAuF;QACvF,YAAY,EAAE;YACZ,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE;SAC9E;QACD,kBAAkB,EAAE;YAClB,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE;SAC9E;KACF;IACD,qBAAqB,EAAE;QACrB,mBAAmB,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvE,gBAAgB,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpE,iBAAiB,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrE,gBAAgB,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;KACrE;IACD,mGAAmG;IACnG,8FAA8F;IAC9F,mCAAmC,EAAE;QACnC,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/D,MAAM,EAAE;YACN,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE;SACjF;QACD,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE,EAAE;QACtF,eAAe,EAAE;YACf,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE;SAC9E;QACD,UAAU,EAAE;YACV,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE;SAC9E;KACF;CACF,CAAA"}

package/dist/persistence/rpc-allowlist-vcs.d.ts

@@ -0,0 +1,24 @@
+import type { PersistenceMethodTable } from './rpc.js';
+/**
+ * The VCS installation + projection surface a mothership-mode node may reach.
+ *
+ * **Why the WRITE half is open now.** The projection writes were parked on "the mothership owns
+ * GitHub sync, since the App and the webhooks live there", and the specific fear was that opening
+ * `repoProjectionRepository.get` alone would let a repo-write endpoint perform the real GitHub
+ * write and then fail on the un-remoted `upsertMany` refresh. That is an argument for opening the
+ * two TOGETHER, which is what happens here: token delegation (`/internal/github/installation-token`)
+ * gave a node a real GitHub client, so create-branch / open-PR / merge / comment already run there,
+ * and their projection refresh is the only half still failing.
+ *
+ * A node still does not RECEIVE webhooks (a delivery reaches the deployment holding the public URL)
+ * and does not run the reconcile cron, so `listStale` and the fan-out reads stay mothership-internal.
+ * What is open is the refresh a node's OWN write earns, plus the incremental-sync cursors that keep
+ * it from re-fetching what the mothership already fetched.
+ *
+ * Scope rules: everything workspace-keyed takes the plain `workspace` rule on arg0, which is what
+ * the projections are indexed by. The installation-keyed methods take the `installation` rule
+ * (installation id → the binding's account, resolved server-side) and `linkedWorkspaces` binds its
+ * CANDIDATE list (`workspaceList`).
+ */
+export declare const VCS_PERSISTENCE_METHODS: PersistenceMethodTable;
+//# sourceMappingURL=rpc-allowlist-vcs.d.ts.map

package/dist/persistence/rpc-allowlist-vcs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc-allowlist-vcs.d.ts","sourceRoot":"","sources":["../../src/persistence/rpc-allowlist-vcs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAYtD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,uBAAuB,EAAE,sBAuFrC,CAAA"}

package/dist/persistence/rpc-allowlist-vcs.js

@@ -0,0 +1,119 @@
+// The VCS half of the mothership-mode persistence allow-list: the installation bindings and the
+// six GitHub/GitLab read-model projections. Split out of `rpc-allowlist.ts` when the sync +
+// repo-write surface landed, because that file had reached its size budget and this is the one
+// cohesive block inside it: every entry here is about a repository host rather than about the
+// board, and they share one argument shape (a workspaceId, or an installation id) and one
+// question ("may this node write what its GitHub client just read?").
+//
+// Spread into `REMOTE_PERSISTENCE_METHODS`; the drift guard reads the merged table, so an entry
+// here is indistinguishable from one there to everything downstream.
+/**
+ * The VCS installation + projection surface a mothership-mode node may reach.
+ *
+ * **Why the WRITE half is open now.** The projection writes were parked on "the mothership owns
+ * GitHub sync, since the App and the webhooks live there", and the specific fear was that opening
+ * `repoProjectionRepository.get` alone would let a repo-write endpoint perform the real GitHub
+ * write and then fail on the un-remoted `upsertMany` refresh. That is an argument for opening the
+ * two TOGETHER, which is what happens here: token delegation (`/internal/github/installation-token`)
+ * gave a node a real GitHub client, so create-branch / open-PR / merge / comment already run there,
+ * and their projection refresh is the only half still failing.
+ *
+ * A node still does not RECEIVE webhooks (a delivery reaches the deployment holding the public URL)
+ * and does not run the reconcile cron, so `listStale` and the fan-out reads stay mothership-internal.
+ * What is open is the refresh a node's OWN write earns, plus the incremental-sync cursors that keep
+ * it from re-fetching what the mothership already fetched.
+ *
+ * Scope rules: everything workspace-keyed takes the plain `workspace` rule on arg0, which is what
+ * the projections are indexed by. The installation-keyed methods take the `installation` rule
+ * (installation id → the binding's account, resolved server-side) and `linkedWorkspaces` binds its
+ * CANDIDATE list (`workspaceList`).
+ */
+export const VCS_PERSISTENCE_METHODS = {
+    // --- Installation bindings -------------------------------------------------------
+    // `getByWorkspace` is the run path's first read: `resolveRepoTarget` runs it on EVERY
+    // container-agent dispatch (installation → then the `github_repos` projection). The
+    // installation-keyed reads back the binding surface around it: `listByInstallationIds` annotates
+    // a list of candidate ids, `getByInstallationId` recovers GitHub's stateless setup redirect, and
+    // `listWorkspacesForInstallation` is the sync fan-out's "which boards does this installation
+    // reach" (bound by the installation's own account, and it answers with workspace ids of that
+    // account only, so it discloses nothing the account's roster does not).
+    //
+    // Still OFF, and permanently:
+    //
+    // - `listActive`, the cron's every-tenant read. It takes no argument, so no rule can bind it,
+    //   which is exactly why `listActiveForAccount` exists beside it.
+    // - `upsert` / `softDelete`, the connect and disconnect WRITES. Both are `integrations.manage`
+    //   in the service layer (`GitHubController` / `GitLabController` mount that permission), and
+    //   the machine token scopes ACCOUNTS, not roles: a plain member of an account holds one, so
+    //   opening these would let them rebind or tear down the org's VCS connection. That is the same
+    //   reason `emailConnectionRepository.upsert`/`softDelete` and the invitation writes are
+    //   excluded, and no scope rule can substitute for the role check the RPC bypasses.
+    //
+    //   The binding they would write is also not something a node can compose. App connect probes
+    //   the installation through an app-JWT call, and a node's `DelegatedAppTokenSource` refuses
+    //   every app-JWT path by design (the App key never leaves the mothership); the GitLab PAT
+    //   connect seals its token with the LOCAL `SecretCipher`, so a node-sealed row is one the
+    //   mothership cannot open. Connect stays where the App and the key are.
+    githubInstallationRepository: {
+        getByWorkspace: { scope: { kind: 'workspace', arg: 0 } },
+        listActiveForAccount: { scope: { kind: 'account', arg: 0 } },
+        getByInstallationId: { scope: { kind: 'installation', arg: 0 } },
+        listByInstallationIds: { scope: { kind: 'installationList', arg: 0 } },
+        listWorkspacesForInstallation: { scope: { kind: 'installation', arg: 0 } },
+    },
+    // --- Repo projection -------------------------------------------------------------
+    // `list` is the SPA's repos panel and the run path's projection walk. `get` is the repo-WRITE
+    // facade's resolve step, and `upsertMany`/`tombstoneMissing` the refresh that follows a write or
+    // a seed; `setMonorepo` is the board-owned flag `addServiceFromRepo` sets when a frame is linked
+    // to a subdirectory. `linkedWorkspaces` binds its candidate list rather than the repo id: the
+    // answer is a subset of what the caller passed in, so an out-of-scope candidate is refused
+    // instead of quietly filtered, which would turn the read into a probe.
+    //
+    // The cursors are keyed by installation + repo (a repo is fetched once per org and fanned out),
+    // so they take the `installation` rule. Without them a node's own sync would re-fetch every
+    // page the mothership already has, which is the rate-limit budget this table exists to protect.
+    //
+    // Still OFF: `listStale` (the reconcile cron's cross-tenant read) and `listByInstallation` (the
+    // delegation mint's own repo-scoping read, unscoped across an installation's workspaces).
+    repoProjectionRepository: {
+        list: { scope: { kind: 'workspace', arg: 0 } },
+        get: { scope: { kind: 'workspace', arg: 0 } },
+        upsertMany: { scope: { kind: 'workspace', arg: 0 } },
+        tombstoneMissing: { scope: { kind: 'workspace', arg: 0 } },
+        setMonorepo: { scope: { kind: 'workspace', arg: 0 } },
+        linkedWorkspaces: { scope: { kind: 'workspaceList', arg: 1 } },
+        getCursor: { scope: { kind: 'installation', arg: 0 } },
+        setCursor: { scope: { kind: 'installation', arg: 0 } },
+    },
+    // --- Entity projections ----------------------------------------------------------
+    // The four read models the SPA's VCS panels display and the sync ingest writes, all keyed by
+    // workspace on arg0. Reads and writes move together for the reason stated above: a node whose
+    // GitHub client just opened a PR must be able to project it, or the panel shows a repo that has
+    // no PR the run just created.
+    branchProjectionRepository: {
+        listByRepo: { scope: { kind: 'workspace', arg: 0 } },
+        upsertMany: { scope: { kind: 'workspace', arg: 0 } },
+    },
+    pullRequestProjectionRepository: {
+        listByWorkspace: { scope: { kind: 'workspace', arg: 0 } },
+        listByRepo: { scope: { kind: 'workspace', arg: 0 } },
+        upsertMany: { scope: { kind: 'workspace', arg: 0 } },
+    },
+    issueProjectionRepository: {
+        listByWorkspace: { scope: { kind: 'workspace', arg: 0 } },
+        listByRepo: { scope: { kind: 'workspace', arg: 0 } },
+        upsertMany: { scope: { kind: 'workspace', arg: 0 } },
+    },
+    commitProjectionRepository: {
+        listByRepo: { scope: { kind: 'workspace', arg: 0 } },
+        upsertMany: { scope: { kind: 'workspace', arg: 0 } },
+    },
+    // The check-run projection the `ci` gate's precheck reads by head SHA. Its absence was a run-path
+    // gap, not only a panel one: a gate that cannot read the projection falls back to the provider on
+    // every poll.
+    checkRunProjectionRepository: {
+        listBySha: { scope: { kind: 'workspace', arg: 0 } },
+        upsertMany: { scope: { kind: 'workspace', arg: 0 } },
+    },
+};
+//# sourceMappingURL=rpc-allowlist-vcs.js.map

package/dist/persistence/rpc-allowlist-vcs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc-allowlist-vcs.js","sourceRoot":"","sources":["../../src/persistence/rpc-allowlist-vcs.ts"],"names":[],"mappings":"AAEA,gGAAgG;AAChG,4FAA4F;AAC5F,+FAA+F;AAC/F,8FAA8F;AAC9F,0FAA0F;AAC1F,sEAAsE;AACtE,EAAE;AACF,gGAAgG;AAChG,qEAAqE;AAErE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA2B;IAC7D,oFAAoF;IACpF,sFAAsF;IACtF,oFAAoF;IACpF,iGAAiG;IACjG,iGAAiG;IACjG,6FAA6F;IAC7F,6FAA6F;IAC7F,wEAAwE;IACxE,EAAE;IACF,8BAA8B;IAC9B,EAAE;IACF,8FAA8F;IAC9F,kEAAkE;IAClE,+FAA+F;IAC/F,8FAA8F;IAC9F,6FAA6F;IAC7F,gGAAgG;IAChG,yFAAyF;IACzF,oFAAoF;IACpF,EAAE;IACF,8FAA8F;IAC9F,6FAA6F;IAC7F,2FAA2F;IAC3F,2FAA2F;IAC3F,yEAAyE;IACzE,4BAA4B,EAAE;QAC5B,cAAc,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QACxD,oBAAoB,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QAC5D,mBAAmB,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QAChE,qBAAqB,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QACtE,6BAA6B,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;KAC3E;IACD,oFAAoF;IACpF,8FAA8F;IAC9F,iGAAiG;IACjG,iGAAiG;IACjG,8FAA8F;IAC9F,2FAA2F;IAC3F,uEAAuE;IACvE,EAAE;IACF,gGAAgG;IAChG,4FAA4F;IAC5F,gGAAgG;IAChG,EAAE;IACF,gGAAgG;IAChG,0FAA0F;IAC1F,wBAAwB,EAAE;QACxB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QAC9C,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QAC7C,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QACpD,gBAAgB,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QAC1D,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QACrD,gBAAgB,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QAC9D,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QACtD,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;KACvD;IACD,oFAAoF;IACpF,6FAA6F;IAC7F,8FAA8F;IAC9F,gGAAgG;IAChG,8BAA8B;IAC9B,0BAA0B,EAAE;QAC1B,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QACpD,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;KACrD;IACD,+BAA+B,EAAE;QAC/B,eAAe,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QACzD,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QACpD,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;KACrD;IACD,yBAAyB,EAAE;QACzB,eAAe,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QACzD,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QACpD,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;KACrD;IACD,0BAA0B,EAAE;QAC1B,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QACpD,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;KACrD;IACD,kGAAkG;IAClG,kGAAkG;IAClG,cAAc;IACd,4BAA4B,EAAE;QAC5B,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QACnD,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;KACrD;CACF,CAAA"}

package/dist/persistence/rpc-allowlist.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc-allowlist.d.ts","sourceRoot":"","sources":["../../src/persistence/rpc-allowlist.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAgBtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,0BAA0B,EAAE,sBAw3CxC,CAAA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,oCAAoC,YAC/C,yBAAyB,EACzB,gCAAgC,EAChC,4BAA4B,EAC5B,yBAAyB,EACzB,2BAA2B,EAC3B,kCAAkC,CAC1B,CAAA;AAEV,yEAAyE;AACzE,MAAM,MAAM,+BAA+B,GAAG,CAAC,OAAO,oCAAoC,CAAC,CAAC,MAAM,CAAC,CAAA"}
+{"version":3,"file":"rpc-allowlist.d.ts","sourceRoot":"","sources":["../../src/persistence/rpc-allowlist.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAkBtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,0BAA0B,EAAE,sBA+rCxC,CAAA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,oCAAoC,YAC/C,yBAAyB,EACzB,gCAAgC,EAChC,4BAA4B,EAC5B,yBAAyB,EACzB,2BAA2B,EAC3B,kCAAkC,CAC1B,CAAA;AAEV,yEAAyE;AACzE,MAAM,MAAM,+BAA+B,GAAG,CAAC,OAAO,oCAAoC,CAAC,CAAC,MAAM,CAAC,CAAA"}