commandmate 0.49.2 → 0.50.0

package/dist/server/src/lib/agent-roles/resolve.js

@@ -0,0 +1,375 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AgentRoleTargetNotFoundError = void 0;
+exports.withSettledWorktreeMembership = withSettledWorktreeMembership;
+exports.withSettledRepositoryMembership = withSettledRepositoryMembership;
+exports.resolveDefaultsForTool = resolveDefaultsForTool;
+exports.resolveInstanceRole = resolveInstanceRole;
+exports.resolveWorktreeToolRole = resolveWorktreeToolRole;
+exports.resolveRepositoryToolRole = resolveRepositoryToolRole;
+exports.attributeToRepository = attributeToRepository;
+exports.toEffectiveRole = toEffectiveRole;
+/**
+ * Which role applies: instance → repository → system → none (Epic #4112).
+ *
+ * The one resolver. The CLI and the screen read its answer through the routes and
+ * do not copy it. It imports the database by type only; the handle comes from the
+ * caller, so nothing here puts `better-sqlite3` into a launcher's import graph.
+ *
+ * ## Which registered roots a worktree belongs to
+ *
+ * `worktrees.repository_path` is whichever root scanned last, so with two roots
+ * registered for one repository it flips run to run (`git/git-common-dir.ts`).
+ * Using it as the answer would change the role with the scan order. So:
+ *
+ * - A root belongs to a worktree when `repository_path` names it (the only use of
+ *   that column), or when `git rev-parse --git-common-dir` says it is the same
+ *   repository as the worktree.
+ * - If any of those roots is enabled, only the enabled ones count, as in
+ *   `duplicateOf` of `GET /api/repositories`: disabling one of a pair is how an
+ *   operator resolves it. With none enabled they all still count, so disabling a
+ *   lone root changes nothing about what its worktrees resolve to.
+ * - All roots agree for the tool: that is the answer. Otherwise it is "ambiguous",
+ *   which #4115 turns into not sending, and never a silent pick. A root without a
+ *   row holds "inherit", and that disagrees with a root holding a role.
+ *
+ * ## When git cannot answer
+ *
+ * `probeGitCommonDir` tells a path that is not a repository from a git that failed
+ * or timed out (1 second). Not a repository is an answer: such a root is the same
+ * repository as nothing, so it is no candidate unless `repository_path` names it
+ * (Issue #4134). A failure is not. Treating it as "another repository" would let a
+ * slow git change the result, so a root that exists on
+ * disk, is enabled and cannot be identified counts against the answer if its
+ * setting differs, by the same comparison as a member: a root with no row holds
+ * "inherit", which differs from a role. Reason `membership-undetermined`. So two
+ * settings give the same kind of answer whether or not git answered. A root whose
+ * directory is gone cannot be scanned and a disabled one is not scanned, so neither
+ * blocks anything.
+ *
+ * ## Asking git takes time
+ *
+ * The answers from git arrive across an `await`, and anything can change meanwhile.
+ * Everything else happens in one synchronous stretch after the last answer: check
+ * that what was asked about still holds, and build the result, with {@link
+ * withSettledWorktreeMembership} calling the builder itself. better-sqlite3 is
+ * synchronous, so that stretch is one consistent view.
+ *
+ * The builder is a callback and not something the caller does with a returned
+ * membership on purpose: returning from an `async` function yields to the event
+ * loop, so anything read after that `await` can pair an old membership with a newer
+ * setting, however close together the two lines look.
+ *
+ * ## Targets
+ *
+ * Which tool an instance is comes from `resolveSessionTarget`, the session
+ * authority. An ad-hoc id (`send --agent codex --instance codex-3`) has no row and
+ * resolves from the defaults of that tool. A contradicted request resolves by the
+ * declaration here; refusing it is the job of the route with the side effect.
+ *
+ * @module lib/agent-roles/resolve
+ */
+const fs_1 = require("fs");
+const agent_roles_db_1 = require("../../lib/db/agent-roles-db");
+const db_repository_1 = require("../../lib/db/db-repository");
+const worktree_db_1 = require("../../lib/db/worktree-db");
+const resolve_session_target_1 = require("../../lib/session/resolve-session-target");
+const agent_roles_1 = require("../../types/agent-roles");
+/** A worktree or repository that does not exist. Not the same thing as having no role. */
+class AgentRoleTargetNotFoundError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'AgentRoleTargetNotFoundError';
+    }
+}
+exports.AgentRoleTargetNotFoundError = AgentRoleTargetNotFoundError;
+const NO_MEMBERSHIP = { members: [], undetermined: [] };
+function byPath(a, b) {
+    return a.path < b.path ? -1 : a.path > b.path ? 1 : 0;
+}
+async function loadProbe(deps) {
+    const { resolveCommonDir, probeCommonDir } = deps;
+    if (resolveCommonDir) {
+        return async (path) => {
+            const commonDir = await resolveCommonDir(path);
+            return commonDir === null ? { kind: 'failed' } : { kind: 'repository', commonDir };
+        };
+    }
+    // Loaded here, on the way to git: every driver reaches this module, and suites
+    // that mock `child_process` down to what a driver uses have no git to load.
+    return probeCommonDir ?? (await Promise.resolve().then(() => __importStar(require('../../lib/git/git-common-dir')))).probeGitCommonDir;
+}
+const commonDirOf = (probe) => probe.kind === 'repository' ? probe.commonDir : null;
+/** The only part that waits. Decides nothing. */
+async function askGit(db, question, deps) {
+    const roots = (0, db_repository_1.getAllRepositories)(db);
+    if (roots.length === 0)
+        return { roots, identity: null, commonDirs: [], notRepository: [] };
+    const probe = await loadProbe(deps);
+    let identity = null;
+    for (const path of question.identityPaths) {
+        identity = commonDirOf(await probe(path));
+        if (identity !== null)
+            break;
+    }
+    const probes = await Promise.all(roots.map((root) => probe(root.path)));
+    return {
+        roots,
+        identity,
+        commonDirs: probes.map(commonDirOf),
+        notRepository: probes.map((answer) => answer.kind === 'not-repository'),
+    };
+}
+function membershipFrom(question, { roots, identity, commonDirs, notRepository }, deps) {
+    if (roots.length === 0)
+        return NO_MEMBERSHIP;
+    const pathExists = deps.pathExists ?? fs_1.existsSync;
+    const candidates = [];
+    const undetermined = [];
+    roots.forEach((root, index) => {
+        const commonDir = commonDirs[index];
+        if (root.path === question.namedRootPath || (identity !== null && commonDir === identity)) {
+            candidates.push(root);
+        }
+        else if (!notRepository[index] &&
+            (identity === null || commonDir === null) &&
+            root.enabled &&
+            pathExists(root.path)) {
+            undetermined.push(root);
+        }
+    });
+    const enabled = candidates.filter((root) => root.enabled);
+    const members = enabled.length > 0 ? enabled : candidates;
+    return { members: [...members].sort(byPath), undetermined: undetermined.sort(byPath) };
+}
+/** How many times to ask again when the answer went stale during the wait. */
+const MAX_MEMBERSHIP_ATTEMPTS = 3;
+function rootsSignature(db) {
+    return JSON.stringify((0, db_repository_1.getAllRepositories)(db).map((root) => [root.id, root.path, root.enabled]));
+}
+/**
+ * The synchronous stretch: compare, then build. Nothing here may await, and that is
+ * the whole of what makes the result one consistent view.
+ *
+ * @returns The built result, or `stale` to ask git again
+ */
+function finishAttempt(db, spec, asked, question, answers, deps, build) {
+    const current = spec.read();
+    if (`${spec.signature(current)}|${rootsSignature(db)}` !== asked)
+        return { stale: true };
+    return { stale: false, value: build(current, membershipFrom(question, answers, deps)) };
+}
+async function withSettledMembership(db, spec, deps, build) {
+    for (let attempt = 0; attempt < MAX_MEMBERSHIP_ATTEMPTS; attempt += 1) {
+        const target = spec.read();
+        const asked = `${spec.signature(target)}|${rootsSignature(db)}`;
+        const question = spec.question(target);
+        const answers = await askGit(db, question, deps);
+        const outcome = finishAttempt(db, spec, asked, question, answers, deps, build);
+        if (!outcome.stale)
+            return outcome.value;
+    }
+    throw new Error('The repository registration kept changing while it was being read');
+}
+/**
+ * Build a result from a worktree, as it is now, and the roots it belongs to. Reads
+ * only; never registers anything.
+ *
+ * @param build - Runs in the same synchronous stretch as the final check. Everything
+ *   that goes with the membership (roster, tool, settings) is read here, and it must
+ *   return plain data rather than a promise.
+ * @throws {AgentRoleTargetNotFoundError} The worktree does not exist
+ * @throws Error The registration never held still; better no answer than a stale one
+ */
+function withSettledWorktreeMembership(db, worktreeId, deps, build) {
+    return withSettledMembership(db, {
+        read: () => {
+            const worktree = (0, worktree_db_1.getWorktreeById)(db, worktreeId);
+            if (!worktree)
+                throw new AgentRoleTargetNotFoundError(`Worktree not found: ${worktreeId}`);
+            return worktree;
+        },
+        signature: (worktree) => JSON.stringify([worktree.path, worktree.repositoryPath]),
+        question: (worktree) => {
+            const named = worktree.repositoryPath || null;
+            return { namedRootPath: named, identityPaths: named ? [worktree.path, named] : [worktree.path] };
+        },
+    }, deps, build);
+}
+/**
+ * Build a result from a root, as it is now, and the roots of the same repository.
+ * Same contract as {@link withSettledWorktreeMembership}.
+ *
+ * @throws {AgentRoleTargetNotFoundError} The repository does not exist
+ */
+function withSettledRepositoryMembership(db, repositoryId, deps, build) {
+    return withSettledMembership(db, {
+        read: () => {
+            const repository = (0, db_repository_1.getRepositoryById)(db, repositoryId);
+            if (!repository)
+                throw new AgentRoleTargetNotFoundError(`Repository not found: ${repositoryId}`);
+            return repository;
+        },
+        signature: (repository) => repository.path,
+        question: (repository) => ({ namedRootPath: repository.path, identityPaths: [repository.path] }),
+    }, deps, build);
+}
+function freezeRole(db, roleId) {
+    // Both reads happen before the caller gets control back, on one connection, and
+    // the foreign key refuses a delete under a reference.
+    const role = (0, agent_roles_db_1.getAgentRole)(db, roleId);
+    if (!role)
+        throw new AgentRoleTargetNotFoundError(`Role not found: ${roleId}`);
+    return Object.freeze({
+        id: role.id,
+        name: role.name,
+        bodyVersion: role.bodyVersion,
+        body: role.body,
+        bodyFingerprint: role.bodyFingerprint,
+    });
+}
+function sameState(a, b) {
+    if (a.state !== b.state)
+        return false;
+    return a.state !== 'role' || a.roleId === b.roleId;
+}
+function stateOf(db, root, cliToolId) {
+    return (0, agent_roles_db_1.getRepositoryRoleStates)(db, root.id)[cliToolId] ?? { state: 'inherit' };
+}
+function toAmbiguousRoot(db, root, cliToolId) {
+    return { repositoryId: root.id, path: root.path, state: stateOf(db, root, cliToolId) };
+}
+/**
+ * The levels below an instance. Exported so a caller holding one membership can
+ * ask about several tools without running git again for each.
+ */
+function resolveDefaultsForTool(db, cliToolId, membership, instanceState = { state: 'inherit' }) {
+    const repositoryIds = membership.members.map((root) => root.id);
+    const base = { cliToolId, repositoryId: repositoryIds[0] ?? null, repositoryIds };
+    if (!(0, agent_roles_1.isAgentRoleCliTool)(cliToolId)) {
+        return { ...base, kind: 'none', source: 'unsupported', reason: 'unsupported-tool' };
+    }
+    if (instanceState.state === 'role') {
+        return { ...base, kind: 'role', source: 'instance', role: freezeRole(db, instanceState.roleId) };
+    }
+    if (instanceState.state === 'none') {
+        return { ...base, kind: 'none', source: 'instance', reason: 'explicit-none' };
+    }
+    const memberStates = membership.members.map((root) => stateOf(db, root, cliToolId));
+    const first = memberStates[0];
+    if (first && memberStates.some((state) => !sameState(state, first))) {
+        return {
+            ...base,
+            kind: 'ambiguous',
+            source: 'repository',
+            reason: 'root-settings-differ',
+            roots: membership.members.map((root) => toAmbiguousRoot(db, root, cliToolId)),
+        };
+    }
+    const agreed = first ?? { state: 'inherit' };
+    const contesting = membership.undetermined.filter((root) => {
+        return !sameState(stateOf(db, root, cliToolId), agreed);
+    });
+    if (contesting.length > 0) {
+        return {
+            ...base,
+            kind: 'ambiguous',
+            source: 'repository',
+            reason: 'membership-undetermined',
+            roots: [...membership.members, ...contesting].map((root) => toAmbiguousRoot(db, root, cliToolId)),
+        };
+    }
+    if (agreed.state === 'role') {
+        return { ...base, kind: 'role', source: 'repository', role: freezeRole(db, agreed.roleId) };
+    }
+    if (agreed.state === 'none') {
+        return { ...base, kind: 'none', source: 'repository', reason: 'explicit-none' };
+    }
+    const system = (0, agent_roles_db_1.getSystemRoleDefaults)(db)[cliToolId];
+    if (system)
+        return { ...base, kind: 'role', source: 'system', role: freezeRole(db, system.roleId) };
+    return { ...base, kind: 'none', source: 'fallback', reason: 'no-default' };
+}
+/**
+ * The role of one instance. Call once per launch, and pass the `ResolvedRole` on
+ * rather than asking again.
+ *
+ * @throws {AgentRoleTargetNotFoundError} The worktree does not exist
+ */
+async function resolveInstanceRole(db, input, deps = {}) {
+    return withSettledWorktreeMembership(db, input.worktreeId, deps, (_worktree, membership) => {
+        const target = (0, resolve_session_target_1.resolveSessionTarget)(db, input.worktreeId, {
+            instanceId: input.instanceId,
+            requestedCliTool: input.requestedCliTool,
+        });
+        return resolveDefaultsForTool(db, target.cliToolId, membership, (0, agent_roles_db_1.getInstanceRoleState)(db, input.worktreeId, target.instanceId));
+    });
+}
+/**
+ * The role from the defaults only, for what runs with no instance (Schedule).
+ *
+ * @throws {AgentRoleTargetNotFoundError} The worktree does not exist
+ */
+async function resolveWorktreeToolRole(db, input, deps = {}) {
+    return withSettledWorktreeMembership(db, input.worktreeId, deps, (_worktree, membership) => resolveDefaultsForTool(db, input.cliToolId, membership));
+}
+/**
+ * The role a worktree of this root would get from the defaults.
+ *
+ * @throws {AgentRoleTargetNotFoundError} The repository does not exist
+ */
+async function resolveRepositoryToolRole(db, input, deps = {}) {
+    return withSettledRepositoryMembership(db, input.repositoryId, deps, (repository, membership) => attributeToRepository(resolveDefaultsForTool(db, input.cliToolId, membership), repository.id));
+}
+/** From a root's own screen, the answer speaks for that root when it is a member. */
+function attributeToRepository(resolution, repositoryId) {
+    return resolution.repositoryIds.includes(repositoryId) ? { ...resolution, repositoryId } : resolution;
+}
+/** Leave the body out, for an API response. */
+function toEffectiveRole(resolution) {
+    if (resolution.kind !== 'role')
+        return resolution;
+    const { role, ...rest } = resolution;
+    return {
+        ...rest,
+        role: {
+            id: role.id,
+            name: role.name,
+            bodyVersion: role.bodyVersion,
+            bodyFingerprint: role.bodyFingerprint,
+        },
+    };
+}

package/dist/server/src/lib/agent-roles/toml-basic.js

@@ -0,0 +1,140 @@
+"use strict";
+/**
+ * The TOML this feature writes: `key = "basic string"` lines, and a reader for
+ * exactly that (#4114 decided against a new dependency).
+ *
+ * The reader's job is the read-back check of a generated profile (§5), so it is
+ * strict: anything outside this subset throws rather than being guessed at. It
+ * is NOT a reader for a user's `config.toml`, which may use tables, literal and
+ * multi-line strings.
+ *
+ * @module lib/agent-roles/toml-basic
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toTomlBasicString = toTomlBasicString;
+exports.renderTomlBasicDocument = renderTomlBasicDocument;
+exports.parseTomlBasicDocument = parseTomlBasicDocument;
+const unicode_1 = require("./unicode");
+const BARE_KEY = /^[A-Za-z0-9_-]+$/;
+/** A TOML basic string. `JSON.stringify` is not one: it leaves U+007F raw. */
+function toTomlBasicString(value) {
+    if ((0, unicode_1.hasLoneSurrogate)(value))
+        throw new Error('A lone surrogate has no TOML spelling');
+    let out = '"';
+    for (const char of value) {
+        const code = char.codePointAt(0);
+        if (char === '"')
+            out += '\\"';
+        else if (char === '\\')
+            out += '\\\\';
+        else if (char === '\n')
+            out += '\\n';
+        else if (char === '\r')
+            out += '\\r';
+        else if (char === '\t')
+            out += '\\t';
+        else if (code < 0x20 || code === 0x7f)
+            out += `\\u${code.toString(16).toUpperCase().padStart(4, '0')}`;
+        else
+            out += char;
+    }
+    return `${out}"`;
+}
+/** One `key = "value"` line per entry. */
+function renderTomlBasicDocument(entries) {
+    return Object.entries(entries)
+        .map(([key, value]) => {
+        if (!BARE_KEY.test(key))
+            throw new Error('Not a bare TOML key');
+        return `${key} = ${toTomlBasicString(value)}\n`;
+    })
+        .join('');
+}
+const SIMPLE_ESCAPES = {
+    b: '\b',
+    t: '\t',
+    n: '\n',
+    f: '\f',
+    r: '\r',
+    '"': '"',
+    '\\': '\\',
+};
+/** Read the basic string opening at `start`. Answers the value and the index after the close. */
+function readBasicString(line, start) {
+    let value = '';
+    let index = start + 1;
+    while (index < line.length) {
+        const char = line[index];
+        if (char === '"')
+            return { value, end: index + 1 };
+        if (char === '\\') {
+            const escape = line[index + 1];
+            if (escape === 'u' || escape === 'U') {
+                const width = escape === 'u' ? 4 : 8;
+                const hex = line.slice(index + 2, index + 2 + width);
+                if (hex.length !== width || !/^[0-9A-Fa-f]+$/.test(hex))
+                    throw new Error('Invalid unicode escape');
+                const code = Number.parseInt(hex, 16);
+                if (code > 0x10ffff || (code >= 0xd800 && code <= 0xdfff))
+                    throw new Error('Not a Unicode scalar value');
+                value += String.fromCodePoint(code);
+                index += 2 + width;
+                continue;
+            }
+            const simple = SIMPLE_ESCAPES[escape];
+            if (simple === undefined)
+                throw new Error('Invalid escape');
+            value += simple;
+            index += 2;
+            continue;
+        }
+        const code = char.charCodeAt(0);
+        if ((code < 0x20 && char !== '\t') || code === 0x7f)
+            throw new Error('Raw control character');
+        value += char;
+        index += 1;
+    }
+    throw new Error('Unterminated string');
+}
+/**
+ * Read a document of `key = "basic string"` lines, comments and blank lines.
+ *
+ * @throws Error on anything else. The message names the line, never its content,
+ *   since a line of a generated file holds the role's body.
+ */
+function parseTomlBasicDocument(text) {
+    const entries = {};
+    text.split('\n').forEach((rawLine, lineIndex) => {
+        const line = rawLine.endsWith('\r') ? rawLine.slice(0, -1) : rawLine;
+        const trimmed = line.trim();
+        if (trimmed === '' || trimmed.startsWith('#'))
+            return;
+        const fail = (why) => {
+            throw new Error(`Line ${lineIndex + 1}: ${why}`);
+        };
+        const equals = line.indexOf('=');
+        if (equals === -1)
+            fail('expected key = "value"');
+        const key = line.slice(0, equals).trim();
+        if (!BARE_KEY.test(key))
+            fail('invalid key');
+        const open = equals + 1 + (line.slice(equals + 1).length - line.slice(equals + 1).trimStart().length);
+        if (line[open] !== '"' || line.startsWith('"""', open))
+            fail('expected a basic string');
+        let parsed;
+        try {
+            parsed = readBasicString(line, open);
+        }
+        catch (error) {
+            fail(error instanceof Error ? error.message : 'invalid string');
+        }
+        const { value, end } = parsed;
+        const rest = line.slice(end).trim();
+        if (rest !== '' && !rest.startsWith('#'))
+            fail('unexpected text after the value');
+        if (Object.prototype.hasOwnProperty.call(entries, key))
+            fail('duplicate key');
+        Object.defineProperty(entries, key, { value, enumerable: true, writable: true, configurable: true });
+    });
+    return entries;
+}

package/dist/server/src/lib/agent-roles/unicode.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasLoneSurrogate = hasLoneSurrogate;
+/**
+ * Whether a string holds a lone surrogate: UTF-16 no UTF-8 can spell, so it would not
+ * come back out of a file or a database byte for byte.
+ *
+ * With the `u` flag the pattern sees code points, so the two halves of a proper pair
+ * are one code point outside the range and only a lone half matches. This is
+ * `!value.isWellFormed()`, which the server build's `lib` does not have.
+ *
+ * @module lib/agent-roles/unicode
+ */
+function hasLoneSurrogate(value) {
+    return /[\uD800-\uDFFF]/u.test(value);
+}

package/dist/server/src/lib/agent-roles/validation.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.roleBodyProblem = roleBodyProblem;
+exports.normalizeRoleName = normalizeRoleName;
+exports.parseRoleAssignmentInput = parseRoleAssignmentInput;
+/**
+ * The rules for a role's name and body.
+ *
+ * @module lib/agent-roles/validation
+ */
+const unicode_1 = require("./unicode");
+const agent_roles_1 = require("../../types/agent-roles");
+/**
+ * Why a body cannot be stored, or null when it can.
+ *
+ * Blank is refused because Claude runs as if nothing were configured when handed
+ * an empty file (§6.1), which would look applied. A NUL or a lone surrogate could
+ * not come back out byte for byte. Never trims: the body reaches the model as written.
+ */
+function roleBodyProblem(body) {
+    if (typeof body !== 'string')
+        return 'body must be a string';
+    if (body.trim() === '')
+        return 'body must not be empty or only whitespace';
+    if (Buffer.byteLength(body, 'utf8') > agent_roles_1.MAX_ROLE_BODY_BYTES) {
+        return `body exceeds ${agent_roles_1.MAX_ROLE_BODY_BYTES} bytes`;
+    }
+    if (body.includes('\0'))
+        return 'body must not contain NUL';
+    if ((0, unicode_1.hasLoneSurrogate)(body))
+        return 'body must be valid Unicode';
+    return null;
+}
+/** The name as stored (trimmed), or the reason it cannot be. */
+function normalizeRoleName(name) {
+    if (typeof name !== 'string')
+        return { ok: false, problem: 'name must be a string' };
+    const trimmed = name.trim();
+    if (trimmed === '')
+        return { ok: false, problem: 'name must not be empty' };
+    if (trimmed.length > agent_roles_1.MAX_ROLE_NAME_LENGTH) {
+        return { ok: false, problem: `name exceeds ${agent_roles_1.MAX_ROLE_NAME_LENGTH} characters` };
+    }
+    // eslint-disable-next-line no-control-regex -- control characters are exactly what this refuses
+    if (/[\u0000-\u001f\u007f]/.test(trimmed))
+        return { ok: false, problem: 'name must not contain control characters' };
+    if ((0, unicode_1.hasLoneSurrogate)(trimmed))
+        return { ok: false, problem: 'name must be valid Unicode' };
+    return { ok: true, name: trimmed };
+}
+/** Parse the `role` of a request, or null when it is not one of the three states. */
+function parseRoleAssignmentInput(value) {
+    if (typeof value !== 'object' || value === null)
+        return null;
+    const { state, roleId } = value;
+    if (state === 'inherit' || state === 'none')
+        return { state };
+    if (state === 'role' && typeof roleId === 'string' && roleId !== '')
+        return { state, roleId };
+    return null;
+}