studiograph 1.0.0

package/dist/server/routes/graph-api.js

@@ -0,0 +1,72 @@
+/**
+ * Graph API routes
+ *
+ * Read-only REST façade over WorkspaceManager.
+ * All writes go through the agent (/api/chat).
+ */
+export async function registerGraphApiRoutes(fastify, workspaceManager) {
+    // GET /api/repos — list all accessible repos
+    fastify.get('/api/repos', async (_req, reply) => {
+        const repos = workspaceManager.getAllRepoConfigs();
+        return reply.send(repos);
+    });
+    // GET /api/repos/:repo/entities/:type — list entities of a type
+    fastify.get('/api/repos/:repo/entities/:type', async (req, reply) => {
+        const { repo, type } = req.params;
+        let graph;
+        try {
+            graph = workspaceManager.getGraph(repo);
+        }
+        catch (err) {
+            return reply.status(404).send({ error: err.message });
+        }
+        const entities = graph.search({ entityType: type });
+        return reply.send(entities);
+    });
+    // GET /api/repos/:repo/entities/:type/:id — get single entity
+    fastify.get('/api/repos/:repo/entities/:type/:id', async (req, reply) => {
+        const { repo, type, id } = req.params;
+        let graph;
+        try {
+            graph = workspaceManager.getGraph(repo);
+        }
+        catch (err) {
+            return reply.status(404).send({ error: err.message });
+        }
+        const entity = graph.get(type, id);
+        if (!entity) {
+            return reply.status(404).send({ error: `Entity not found: ${type}/${id}` });
+        }
+        return reply.send(entity);
+    });
+    // GET /api/repos/:repo/search?q=&type=&tags= — search within a repo
+    fastify.get('/api/repos/:repo/search', async (req, reply) => {
+        const { repo } = req.params;
+        const { q, type, tags } = req.query;
+        let graph;
+        try {
+            graph = workspaceManager.getGraph(repo);
+        }
+        catch (err) {
+            return reply.status(404).send({ error: err.message });
+        }
+        const results = graph.search({
+            query: q,
+            entityType: type,
+            tags: tags ? tags.split(',').map(t => t.trim()) : undefined,
+        });
+        return reply.send(results);
+    });
+    // GET /api/search?q=&type=&tags=&repos= — cross-repo search
+    fastify.get('/api/search', async (req, reply) => {
+        const { q, type, tags, repos } = req.query;
+        const results = workspaceManager.search({
+            query: q,
+            entityType: type,
+            tags: tags ? tags.split(',').map(t => t.trim()) : undefined,
+            repoNames: repos ? repos.split(',').map(r => r.trim()) : undefined,
+        });
+        return reply.send(results);
+    });
+}
+//# sourceMappingURL=graph-api.js.map

package/dist/server/routes/graph-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-api.js","sourceRoot":"","sources":["../../../src/server/routes/graph-api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAwB,EACxB,gBAAkC;IAElC,6CAA6C;IAC7C,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QAC9C,MAAM,KAAK,GAAG,gBAAgB,CAAC,iBAAiB,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,gEAAgE;IAChE,OAAO,CAAC,GAAG,CACT,iCAAiC,EACjC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAElC,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAkB,EAAE,CAAC,CAAC;QAClE,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC,CACF,CAAC;IAEF,8DAA8D;IAC9D,OAAO,CAAC,GAAG,CACT,qCAAqC,EACrC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAEtC,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAkB,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC,CACF,CAAC;IAEF,oEAAoE;IACpE,OAAO,CAAC,GAAG,CAIT,yBAAyB,EACzB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC5B,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;QAEpC,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC;YAC3B,KAAK,EAAE,CAAC;YACR,UAAU,EAAE,IAA8B;YAC1C,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;SAC5D,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC,CACF,CAAC;IAEF,4DAA4D;IAC5D,OAAO,CAAC,GAAG,CAGT,aAAa,EACb,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;QAE3C,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC;YACtC,KAAK,EAAE,CAAC;YACR,UAAU,EAAE,IAA8B;YAC1C,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3D,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/server/routes/webhook.d.ts

@@ -0,0 +1,14 @@
+/**
+ * GitHub webhook route
+ *
+ * For Config 2 deployments (Railway + GitHub).
+ * Validates HMAC-SHA256 signature, identifies the pushed repo,
+ * runs `git pull` on the matching local clone.
+ *
+ * Setup: add a webhook in GitHub repo settings pointing to
+ *   POST https://<your-host>/webhooks/github
+ * with secret matching WEBHOOK_SECRET env var.
+ */
+import type { FastifyInstance } from 'fastify';
+import { WorkspaceManager } from '../../core/workspace-manager.js';
+export declare function registerWebhookRoutes(fastify: FastifyInstance, workspaceManager: WorkspaceManager, webhookSecret?: string): Promise<void>;

package/dist/server/routes/webhook.js

@@ -0,0 +1,69 @@
+/**
+ * GitHub webhook route
+ *
+ * For Config 2 deployments (Railway + GitHub).
+ * Validates HMAC-SHA256 signature, identifies the pushed repo,
+ * runs `git pull` on the matching local clone.
+ *
+ * Setup: add a webhook in GitHub repo settings pointing to
+ *   POST https://<your-host>/webhooks/github
+ * with secret matching WEBHOOK_SECRET env var.
+ */
+import { createHmac, timingSafeEqual } from 'crypto';
+import { execSync } from 'child_process';
+export async function registerWebhookRoutes(fastify, workspaceManager, webhookSecret) {
+    fastify.post('/webhooks/github', { config: { rawBody: true } }, async (req, reply) => {
+        // Validate signature if secret is configured
+        if (webhookSecret) {
+            const signature = req.headers['x-hub-signature-256'];
+            if (!signature) {
+                return reply.status(401).send({ error: 'Missing X-Hub-Signature-256 header' });
+            }
+            const rawBody = req.rawBody ?? Buffer.from(JSON.stringify(req.body));
+            const expected = `sha256=${createHmac('sha256', webhookSecret).update(rawBody).digest('hex')}`;
+            let valid = false;
+            try {
+                valid = timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
+            }
+            catch {
+                valid = false;
+            }
+            if (!valid) {
+                return reply.status(401).send({ error: 'Invalid webhook signature' });
+            }
+        }
+        const event = req.headers['x-github-event'];
+        // Only process push events
+        if (event !== 'push') {
+            return reply.send({ ok: true, skipped: true, reason: `event ${event} ignored` });
+        }
+        const payload = req.body;
+        const repoName = payload?.repository?.name;
+        if (!repoName) {
+            return reply.status(400).send({ error: 'Cannot determine repository name from payload' });
+        }
+        // Find matching repo config
+        const repoConfig = workspaceManager.getRepoConfig(repoName);
+        if (!repoConfig) {
+            fastify.log.warn(`Webhook: no repo config found for "${repoName}"`);
+            return reply.send({ ok: true, skipped: true, reason: `repo ${repoName} not in workspace` });
+        }
+        try {
+            // Get the graph's underlying repo path
+            const graph = workspaceManager.getGraph(repoName);
+            const repoPath = graph.repoPath;
+            execSync('git pull --ff-only', {
+                cwd: repoPath,
+                stdio: 'pipe',
+                timeout: 30_000,
+            });
+            fastify.log.info(`Webhook: git pull completed for repo "${repoName}"`);
+            return reply.send({ ok: true, repo: repoName });
+        }
+        catch (err) {
+            fastify.log.error(err, `Webhook: git pull failed for repo "${repoName}"`);
+            return reply.status(500).send({ error: `git pull failed: ${err.message}` });
+        }
+    });
+}
+//# sourceMappingURL=webhook.js.map

package/dist/server/routes/webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.js","sourceRoot":"","sources":["../../../src/server/routes/webhook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGzC,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAwB,EACxB,gBAAkC,EAClC,aAAsB;IAEtB,OAAO,CAAC,IAAI,CACV,kBAAkB,EAClB,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAC7B,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,6CAA6C;QAC7C,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAuB,CAAC;YAE3E,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACjF,CAAC;YAED,MAAM,OAAO,GAAY,GAAW,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACtF,MAAM,QAAQ,GAAG,UAAU,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAE/F,IAAI,KAAK,GAAG,KAAK,CAAC;YAClB,IAAI,CAAC;gBACH,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YACzE,CAAC;YAAC,MAAM,CAAC;gBACP,KAAK,GAAG,KAAK,CAAC;YAChB,CAAC;YAED,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;QAElE,2BAA2B;QAC3B,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,KAAK,UAAU,EAAE,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,CAAC,IAA0C,CAAC;QAC/D,MAAM,QAAQ,GAAG,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC;QAE3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,4BAA4B;QAC5B,MAAM,UAAU,GAAG,gBAAgB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAE5D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,sCAAsC,QAAQ,GAAG,CAAC,CAAC;YACpE,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,QAAQ,mBAAmB,EAAE,CAAC,CAAC;QAC9F,CAAC;QAED,IAAI,CAAC;YACH,uCAAuC;YACvC,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAI,KAAa,CAAC,QAAkB,CAAC;YAEnD,QAAQ,CAAC,oBAAoB,EAAE;gBAC7B,GAAG,EAAE,QAAQ;gBACb,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YAEH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,yCAAyC,QAAQ,GAAG,CAAC,CAAC;YACvE,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,sCAAsC,QAAQ,GAAG,CAAC,CAAC;YAC1E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/services/assets/base.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Base types and interfaces for asset management
+ */
+export interface AssetInfo {
+    filename: string;
+    size: number;
+    contentType: string;
+    url: string;
+    path: string;
+    mediaType: 'image' | 'video' | 'audio' | 'document' | 'other';
+}
+export interface AssetBackend {
+    /**
+     * Upload asset to storage
+     */
+    upload(key: string, buffer: Buffer, contentType: string): Promise<AssetInfo>;
+    /**
+     * List assets with a given prefix
+     */
+    list(prefix: string): Promise<AssetInfo[]>;
+    /**
+     * Delete a single asset
+     */
+    delete(key: string): Promise<void>;
+    /**
+     * Delete all assets with a given prefix
+     */
+    deleteAll(prefix: string): Promise<number>;
+    /**
+     * Check if an asset exists
+     */
+    exists(key: string): Promise<boolean>;
+}
+export interface AssetConfig {
+    storage: 'local' | 'r2';
+    localPath?: string;
+    r2Config?: R2Config;
+}
+export interface R2Config {
+    accountId: string;
+    bucket: string;
+    publicUrl: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+}
+/**
+ * Content type mappings
+ */
+export declare const CONTENT_TYPES: Record<string, string>;
+/**
+ * Detect content type from filename
+ */
+export declare function detectContentType(filename: string): string;
+/**
+ * Determine media type from content type
+ */
+export declare function getMediaType(contentType: string): AssetInfo['mediaType'];
+/**
+ * Validate filename for security
+ */
+export declare function validateFilename(filename: string): void;
+/**
+ * Build asset key from components
+ */
+export declare function buildAssetKey(repo: string, entityType: string, entityId: string, filename: string): string;
+/**
+ * Build asset prefix for listing
+ */
+export declare function buildAssetPrefix(repo: string, entityType: string, entityId: string): string;

package/dist/services/assets/base.js

@@ -0,0 +1,113 @@
+/**
+ * Base types and interfaces for asset management
+ */
+/**
+ * Content type mappings
+ */
+export const CONTENT_TYPES = {
+    // Images
+    png: 'image/png',
+    jpg: 'image/jpeg',
+    jpeg: 'image/jpeg',
+    gif: 'image/gif',
+    webp: 'image/webp',
+    svg: 'image/svg+xml',
+    ico: 'image/x-icon',
+    // Videos
+    mp4: 'video/mp4',
+    mov: 'video/quicktime',
+    webm: 'video/webm',
+    avi: 'video/x-msvideo',
+    // Audio
+    mp3: 'audio/mpeg',
+    wav: 'audio/wav',
+    ogg: 'audio/ogg',
+    m4a: 'audio/mp4',
+    // Documents
+    pdf: 'application/pdf',
+    doc: 'application/msword',
+    docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+    xls: 'application/vnd.ms-excel',
+    xlsx: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+    ppt: 'application/vnd.ms-powerpoint',
+    pptx: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+    // Archives
+    zip: 'application/zip',
+    tar: 'application/x-tar',
+    gz: 'application/gzip',
+    // Design files
+    fig: 'application/octet-stream',
+    sketch: 'application/octet-stream',
+    // Text
+    txt: 'text/plain',
+    json: 'application/json',
+    xml: 'application/xml',
+    csv: 'text/csv',
+};
+/**
+ * Detect content type from filename
+ */
+export function detectContentType(filename) {
+    const ext = filename.split('.').pop()?.toLowerCase() || '';
+    return CONTENT_TYPES[ext] || 'application/octet-stream';
+}
+/**
+ * Determine media type from content type
+ */
+export function getMediaType(contentType) {
+    if (contentType.startsWith('image/'))
+        return 'image';
+    if (contentType.startsWith('video/'))
+        return 'video';
+    if (contentType.startsWith('audio/'))
+        return 'audio';
+    if (contentType.includes('pdf') ||
+        contentType.includes('document') ||
+        contentType.includes('word') ||
+        contentType.includes('excel') ||
+        contentType.includes('powerpoint') ||
+        contentType.includes('presentation')) {
+        return 'document';
+    }
+    return 'other';
+}
+/**
+ * Validate filename for security
+ */
+export function validateFilename(filename) {
+    if (!filename || filename.trim() === '') {
+        throw new Error('Filename cannot be empty');
+    }
+    // Check for path traversal
+    if (filename.includes('..') ||
+        filename.includes('/') ||
+        filename.includes('\\')) {
+        throw new Error('Filename cannot contain path separators or traversal sequences');
+    }
+    // Check for hidden files
+    if (filename.startsWith('.')) {
+        throw new Error('Filename cannot start with a dot (hidden files not allowed)');
+    }
+    // Check for forbidden characters
+    const forbiddenChars = /[<>:"|?*\x00-\x1f]/;
+    if (forbiddenChars.test(filename)) {
+        throw new Error('Filename contains forbidden characters');
+    }
+    // Check length
+    if (filename.length > 255) {
+        throw new Error('Filename too long (max 255 characters)');
+    }
+}
+/**
+ * Build asset key from components
+ */
+export function buildAssetKey(repo, entityType, entityId, filename) {
+    return `${repo}/${entityType}/${entityId}/${filename}`;
+}
+/**
+ * Build asset prefix for listing
+ */
+export function buildAssetPrefix(repo, entityType, entityId) {
+    return `${repo}/${entityType}/${entityId}/`;
+}
+//# sourceMappingURL=base.js.map

package/dist/services/assets/base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/services/assets/base.ts"],"names":[],"mappings":"AAAA;;GAEG;AAoDH;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAA2B;IACnD,SAAS;IACT,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,eAAe;IACpB,GAAG,EAAE,cAAc;IAEnB,SAAS;IACT,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,iBAAiB;IACtB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,iBAAiB;IAEtB,QAAQ;IACR,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,WAAW;IAEhB,YAAY;IACZ,GAAG,EAAE,iBAAiB;IACtB,GAAG,EAAE,oBAAoB;IACzB,IAAI,EAAE,yEAAyE;IAC/E,GAAG,EAAE,0BAA0B;IAC/B,IAAI,EAAE,mEAAmE;IACzE,GAAG,EAAE,+BAA+B;IACpC,IAAI,EAAE,2EAA2E;IAEjF,WAAW;IACX,GAAG,EAAE,iBAAiB;IACtB,GAAG,EAAE,mBAAmB;IACxB,EAAE,EAAE,kBAAkB;IAEtB,eAAe;IACf,GAAG,EAAE,0BAA0B;IAC/B,MAAM,EAAE,0BAA0B;IAElC,OAAO;IACP,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,kBAAkB;IACxB,GAAG,EAAE,iBAAiB;IACtB,GAAG,EAAE,UAAU;CAChB,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3D,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;AAC1D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,WAAmB;IAC9C,IAAI,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC3B,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;QAChC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC5B,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC7B,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC;QAClC,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACzC,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,2BAA2B;IAC3B,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QACvB,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QACtB,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IAED,yBAAyB;IACzB,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,iCAAiC;IACjC,MAAM,cAAc,GAAG,oBAAoB,CAAC;IAC5C,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,eAAe;IACf,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,UAAkB,EAClB,QAAgB,EAChB,QAAgB;IAEhB,OAAO,GAAG,IAAI,IAAI,UAAU,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,UAAkB,EAClB,QAAgB;IAEhB,OAAO,GAAG,IAAI,IAAI,UAAU,IAAI,QAAQ,GAAG,CAAC;AAC9C,CAAC"}

package/dist/services/assets/index.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Asset service for Studiograph
+ *
+ * Manages all media assets (images, videos, audio, documents)
+ * with pluggable storage backends (local filesystem or R2)
+ */
+import type { AssetInfo, AssetConfig } from './base.js';
+export * from './base.js';
+export declare class AssetService {
+    private backend;
+    constructor(config: AssetConfig);
+    /**
+     * Upload asset for an entity
+     */
+    upload(repo: string, entityType: string, entityId: string, filename: string, buffer: Buffer): Promise<AssetInfo>;
+    /**
+     * List all assets for an entity
+     */
+    list(repo: string, entityType: string, entityId: string): Promise<AssetInfo[]>;
+    /**
+     * Delete a single asset
+     */
+    delete(repo: string, entityType: string, entityId: string, filename: string): Promise<void>;
+    /**
+     * Delete all assets for an entity (when entity is deleted)
+     */
+    deleteAll(repo: string, entityType: string, entityId: string): Promise<number>;
+    /**
+     * Check if an asset exists
+     */
+    exists(repo: string, entityType: string, entityId: string, filename: string): Promise<boolean>;
+    /**
+     * Get asset info without downloading
+     */
+    getInfo(repo: string, entityType: string, entityId: string, filename: string): Promise<AssetInfo | null>;
+}

package/dist/services/assets/index.js

@@ -0,0 +1,89 @@
+/**
+ * Asset service for Studiograph
+ *
+ * Manages all media assets (images, videos, audio, documents)
+ * with pluggable storage backends (local filesystem or R2)
+ */
+import { validateFilename, detectContentType, buildAssetKey, buildAssetPrefix, } from './base.js';
+import { LocalAssetBackend } from './local.js';
+import { R2AssetBackend } from './r2.js';
+export * from './base.js';
+export class AssetService {
+    backend;
+    constructor(config) {
+        // Initialize appropriate backend
+        if (config.storage === 'local') {
+            const localPath = config.localPath || '.studiograph/assets';
+            this.backend = new LocalAssetBackend(localPath);
+        }
+        else if (config.storage === 'r2') {
+            if (!config.r2Config) {
+                throw new Error('R2 config is required when storage is set to r2');
+            }
+            this.backend = new R2AssetBackend(config.r2Config);
+        }
+        else {
+            throw new Error(`Unknown storage backend: ${config.storage}`);
+        }
+    }
+    /**
+     * Upload asset for an entity
+     */
+    async upload(repo, entityType, entityId, filename, buffer) {
+        // Validate filename
+        validateFilename(filename);
+        // Validate buffer
+        if (!buffer || buffer.length === 0) {
+            throw new Error('Buffer cannot be empty');
+        }
+        // Check file size (max 100MB)
+        const maxSize = 100 * 1024 * 1024; // 100MB
+        if (buffer.length > maxSize) {
+            throw new Error(`File too large (max ${maxSize / 1024 / 1024}MB)`);
+        }
+        // Detect content type
+        const contentType = detectContentType(filename);
+        // Build storage key
+        const key = buildAssetKey(repo, entityType, entityId, filename);
+        // Upload via backend
+        return await this.backend.upload(key, buffer, contentType);
+    }
+    /**
+     * List all assets for an entity
+     */
+    async list(repo, entityType, entityId) {
+        const prefix = buildAssetPrefix(repo, entityType, entityId);
+        return await this.backend.list(prefix);
+    }
+    /**
+     * Delete a single asset
+     */
+    async delete(repo, entityType, entityId, filename) {
+        validateFilename(filename);
+        const key = buildAssetKey(repo, entityType, entityId, filename);
+        return await this.backend.delete(key);
+    }
+    /**
+     * Delete all assets for an entity (when entity is deleted)
+     */
+    async deleteAll(repo, entityType, entityId) {
+        const prefix = buildAssetPrefix(repo, entityType, entityId);
+        return await this.backend.deleteAll(prefix);
+    }
+    /**
+     * Check if an asset exists
+     */
+    async exists(repo, entityType, entityId, filename) {
+        validateFilename(filename);
+        const key = buildAssetKey(repo, entityType, entityId, filename);
+        return await this.backend.exists(key);
+    }
+    /**
+     * Get asset info without downloading
+     */
+    async getInfo(repo, entityType, entityId, filename) {
+        const assets = await this.list(repo, entityType, entityId);
+        return assets.find(a => a.filename === filename) || null;
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/services/assets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/services/assets/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC,cAAc,WAAW,CAAC;AAE1B,MAAM,OAAO,YAAY;IACf,OAAO,CAAe;IAE9B,YAAY,MAAmB;QAC7B,iCAAiC;QACjC,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,qBAAqB,CAAC;YAC5D,IAAI,CAAC,OAAO,GAAG,IAAI,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;aAAM,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,IAAY,EACZ,UAAkB,EAClB,QAAgB,EAChB,QAAgB,EAChB,MAAc;QAEd,oBAAoB;QACpB,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAE3B,kBAAkB;QAClB,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QAED,8BAA8B;QAC9B,MAAM,OAAO,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ;QAC3C,IAAI,MAAM,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,GAAG,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC;QACrE,CAAC;QAED,sBAAsB;QACtB,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAEhD,oBAAoB;QACpB,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAEhE,qBAAqB;QACrB,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CACR,IAAY,EACZ,UAAkB,EAClB,QAAgB;QAEhB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC5D,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,IAAY,EACZ,UAAkB,EAClB,QAAgB,EAChB,QAAgB;QAEhB,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3B,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAChE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CACb,IAAY,EACZ,UAAkB,EAClB,QAAgB;QAEhB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC5D,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,IAAY,EACZ,UAAkB,EAClB,QAAgB,EAChB,QAAgB;QAEhB,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3B,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAChE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,IAAY,EACZ,UAAkB,EAClB,QAAgB,EAChB,QAAgB;QAEhB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC3D,CAAC;CACF"}

package/dist/services/assets/local.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Local filesystem asset backend
+ *
+ * Stores assets in .studiograph/assets/ directory
+ */
+import type { AssetBackend, AssetInfo } from './base.js';
+export declare class LocalAssetBackend implements AssetBackend {
+    private basePath;
+    constructor(basePath: string);
+    /**
+     * Ensure base directory exists
+     */
+    private ensureBaseDirectory;
+    /**
+     * Get full file path for a key
+     */
+    private getFilePath;
+    /**
+     * Upload asset to local filesystem
+     */
+    upload(key: string, buffer: Buffer, contentType: string): Promise<AssetInfo>;
+    /**
+     * List assets with a given prefix
+     */
+    list(prefix: string): Promise<AssetInfo[]>;
+    /**
+     * Delete a single asset
+     */
+    delete(key: string): Promise<void>;
+    /**
+     * Delete all assets with a given prefix
+     */
+    deleteAll(prefix: string): Promise<number>;
+    /**
+     * Check if an asset exists
+     */
+    exists(key: string): Promise<boolean>;
+    /**
+     * Guess content type from file extension
+     */
+    private guessContentType;
+}