studiograph 1.3.3-next.9 → 1.3.4

package/dist/server/routes/auth-api.js

@@ -3,6 +3,38 @@
  *
  * Login, logout, session verification, and auth status endpoints.
  */
+// ── Login rate limiting ──
+const MAX_ATTEMPTS = 5;
+const LOCKOUT_MS = 15 * 60 * 1000; // 15 minutes
+const loginAttempts = new Map();
+/** Check if an email is currently locked out. Returns seconds remaining, or 0 if not locked. */
+export function checkRateLimit(email) {
+    const key = email.toLowerCase();
+    const attempt = loginAttempts.get(key);
+    if (!attempt || attempt.count < MAX_ATTEMPTS)
+        return 0;
+    const elapsed = Date.now() - attempt.firstAttempt;
+    if (elapsed > LOCKOUT_MS) {
+        loginAttempts.delete(key);
+        return 0;
+    }
+    return Math.ceil((LOCKOUT_MS - elapsed) / 1000);
+}
+/** Record a failed login attempt. */
+export function recordFailedAttempt(email) {
+    const key = email.toLowerCase();
+    const attempt = loginAttempts.get(key);
+    if (!attempt || Date.now() - attempt.firstAttempt > LOCKOUT_MS) {
+        loginAttempts.set(key, { count: 1, firstAttempt: Date.now() });
+    }
+    else {
+        attempt.count++;
+    }
+}
+/** Clear failed attempts on successful login. */
+export function clearAttempts(email) {
+    loginAttempts.delete(email.toLowerCase());
+}
 function requireAdmin(req, authService) {
     const token = req.cookies?.['__sg_token'];
     if (!token)
@@ -81,16 +113,39 @@ export async function registerAuthApiRoutes(fastify, authService) {
             return reply.status(400).send({ error: err.message });
         }
     });
+    // POST /api/auth/api-key/regenerate — regenerate workspace API key (admin only)
+    fastify.post('/api/auth/api-key/regenerate', async (req, reply) => {
+        const admin = requireAdmin(req, authService);
+        if (!admin)
+            return reply.status(403).send({ error: 'Admin access required' });
+        const newKey = authService.regenerateApiKey();
+        return reply.send({ apiKey: newKey });
+    });
+    // GET /api/auth/seed — export auth seed data (admin only, for remote pull)
+    fastify.get('/api/auth/seed', async (req, reply) => {
+        const admin = requireAdmin(req, authService);
+        if (!admin)
+            return reply.status(403).send({ error: 'Admin access required' });
+        return reply.send(authService.getSeedData());
+    });
     // POST /api/auth/login — authenticate and set session cookie
     fastify.post('/api/auth/login', async (req, reply) => {
         const { email, password } = req.body;
         if (!email || !password) {
             return reply.status(400).send({ error: 'Email and password are required' });
         }
+        // Rate limit check
+        const retryAfter = checkRateLimit(email);
+        if (retryAfter > 0) {
+            reply.header('Retry-After', String(retryAfter));
+            return reply.status(429).send({ error: 'Too many login attempts. Try again later.', retryAfter });
+        }
         const result = authService.authenticate(email, password);
         if (!result) {
+            recordFailedAttempt(email);
             return reply.status(401).send({ error: 'Invalid credentials' });
         }
+        clearAttempts(email);
         const secure = req.headers['x-forwarded-proto'] === 'https';
         reply.setCookie('__sg_token', result.token, {
             path: '/',

package/dist/server/routes/auth-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-api.js","sourceRoot":"","sources":["../../../src/server/routes/auth-api.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,SAAS,YAAY,CAAC,GAAQ,EAAE,WAAwB;IACtD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAwB,EAAE,WAAwB;IAC5F,8BAA8B;IAE9B,oDAAoD;IACpD,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAClD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,wDAAwD;IACxD,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAE9E,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAKlD,CAAC;QAEF,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,QAAQ,CAAC,CAAC;YAC3G,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4FAA4F;IAC5F,OAAO,CAAC,MAAM,CAA6B,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACrF,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAE9E,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC/E,IAAI,KAAK,CAAC,EAAE,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAE5F,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAExE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACjF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,OAAO,CAAC,KAAK,CAA6B,8BAA8B,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7F,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAE9E,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAE/E,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAA6B,CAAC;QACvD,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAEhF,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACnD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6DAA6D;IAC7D,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAA6C,CAAC;QAE9E,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,OAAO,CAAC;QAC5D,KAAK,CAAC,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,EAAE;YAC1C,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,QAAQ;YAClB,MAAM;YACN,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS;SACpC,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,+CAA+C;IAC/C,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACrD,KAAK,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE;YAChC,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,CAAC;SACV,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,4CAA4C;IAC5C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,wDAAwD;IACxD,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACpD,OAAO,KAAK,CAAC,IAAI,CAAC;YAChB,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE;YACnC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE;SACtC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,yFAAyF;IACzF,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnD,IAAI,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAI5C,CAAC;QAEF,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAClG,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACjF,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,OAAO,CAAC;YAC5D,KAAK,CAAC,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,EAAE;gBAC1C,IAAI,EAAE,GAAG;gBACT,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,QAAQ;gBAClB,MAAM;gBACN,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;aACzB,CAAC,CAAC;YAEH,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"auth-api.js","sourceRoot":"","sources":["../../../src/server/routes/auth-api.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,4BAA4B;AAC5B,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,aAAa;AAOhD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAwB,CAAC;AAEtD,gGAAgG;AAChG,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,GAAG,YAAY;QAAE,OAAO,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAClD,IAAI,OAAO,GAAG,UAAU,EAAE,CAAC;QACzB,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,YAAY,GAAG,UAAU,EAAE,CAAC;QAC/D,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACjE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,YAAY,CAAC,GAAQ,EAAE,WAAwB;IACtD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAwB,EAAE,WAAwB;IAC5F,8BAA8B;IAE9B,oDAAoD;IACpD,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAClD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,wDAAwD;IACxD,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAE9E,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAKlD,CAAC;QAEF,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,QAAQ,CAAC,CAAC;YAC3G,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4FAA4F;IAC5F,OAAO,CAAC,MAAM,CAA6B,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACrF,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAE9E,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC/E,IAAI,KAAK,CAAC,EAAE,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAE5F,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAExE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACjF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,OAAO,CAAC,KAAK,CAA6B,8BAA8B,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7F,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAE9E,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAE/E,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAA6B,CAAC;QACvD,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAEhF,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACnD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,OAAO,CAAC,IAAI,CAAC,8BAA8B,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAChE,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,WAAW,CAAC,gBAAgB,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACjD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,6DAA6D;IAC7D,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAA6C,CAAC;QAE9E,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,mBAAmB;QACnB,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAChD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,UAAU,EAAE,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC3B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,aAAa,CAAC,KAAK,CAAC,CAAC;QAErB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,OAAO,CAAC;QAC5D,KAAK,CAAC,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,EAAE;YAC1C,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,QAAQ;YAClB,MAAM;YACN,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS;SACpC,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,+CAA+C;IAC/C,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACrD,KAAK,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE;YAChC,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,CAAC;SACV,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,4CAA4C;IAC5C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,wDAAwD;IACxD,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACpD,OAAO,KAAK,CAAC,IAAI,CAAC;YAChB,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE;YACnC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE;SACtC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,yFAAyF;IACzF,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnD,IAAI,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAI5C,CAAC;QAEF,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAClG,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACjF,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,OAAO,CAAC;YAC5D,KAAK,CAAC,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,EAAE;gBAC1C,IAAI,EAAE,GAAG;gBACT,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,QAAQ;gBAClB,MAAM;gBACN,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;aACzB,CAAC,CAAC;YAEH,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/routes/collab.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Collaborative editing WebSocket endpoint — delegates to Hocuspocus via CollabServer.
+ */
+import type { FastifyInstance } from 'fastify';
+import type { CollabServer } from '../collab.js';
+export declare function registerCollabRoute(fastify: FastifyInstance, collabServer: CollabServer): Promise<void>;

package/dist/server/routes/collab.js

@@ -0,0 +1,10 @@
+/**
+ * Collaborative editing WebSocket endpoint — delegates to Hocuspocus via CollabServer.
+ */
+export async function registerCollabRoute(fastify, collabServer) {
+    fastify.get('/collab', { websocket: true }, (socket, req) => {
+        // socket is a ws.WebSocket instance; req.raw is the raw IncomingMessage
+        collabServer.handleConnection(socket, req.raw);
+    });
+}
+//# sourceMappingURL=collab.js.map

package/dist/server/routes/collab.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collab.js","sourceRoot":"","sources":["../../../src/server/routes/collab.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAwB,EACxB,YAA0B;IAE1B,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;QAC1D,wEAAwE;QACxE,YAAY,CAAC,gBAAgB,CAAC,MAAa,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/routes/git-http.d.ts

@@ -14,7 +14,7 @@
  *   - No users configured (open mode) → full access
  *   - Admin → all collections
  *   - Member → only granted collections
- *   - Private repos → excluded entirely
+ *   - Private repos → owner only
  */
 import type { FastifyInstance } from 'fastify';
 import type { WsHub } from '../ws-hub.js';

package/dist/server/routes/git-http.js

@@ -14,10 +14,12 @@
  *   - No users configured (open mode) → full access
  *   - Admin → all collections
  *   - Member → only granted collections
- *   - Private repos → excluded entirely
+ *   - Private repos → owner only
  */
 import { spawn } from 'child_process';
 import { join } from 'path';
+import { existsSync } from 'fs';
+import { checkRateLimit, recordFailedAttempt, clearAttempts } from './auth-api.js';
 /**
  * Resolve Basic Auth header to an AuthUser, or null if open mode.
  * Returns { user } on success, or { error, statusCode } on failure.
@@ -37,30 +39,66 @@ function authenticateBasic(authHeader, authService) {
     }
     const email = decoded.slice(0, colonIdx);
     const password = decoded.slice(colonIdx + 1);
+    // Rate limit check
+    if (checkRateLimit(email) > 0) {
+        return { error: 'Too many login attempts', statusCode: 429 };
+    }
+    // Accept API key as password (any username) — used by MCP and CI
+    if (authService.validateApiKey(password)) {
+        return { user: { id: 0, email: '', displayName: 'API', role: 'admin' } };
+    }
+    // Accept JWT token as password (issued by studiograph join — per-user access control).
+    // JWTs always start with "eyJ" (base64url of `{"`) so we can detect them without
+    // attempting a failed password auth first.
+    if (password.startsWith('eyJ')) {
+        const jwtUser = authService.verifyToken(password);
+        if (jwtUser) {
+            clearAttempts(email);
+            return { user: jwtUser };
+        }
+        return { error: 'Invalid or expired token — run `studiograph join` again', statusCode: 401 };
+    }
     const result = authService.authenticate(email, password);
     if (!result) {
+        recordFailedAttempt(email);
         return { error: 'Invalid credentials', statusCode: 401 };
     }
+    clearAttempts(email);
     return { user: result.user };
 }
 /**
  * Check whether a user can access the named collection.
  */
-function canAccessCollection(user, repoName, authService) {
+function canAccessCollection(user, repoName, authService, workspaceManager) {
     if (!user)
         return true; // open mode / API key
     if (user.role === 'admin')
         return true;
+    // Owner of a private repo has implicit access
+    const config = workspaceManager.getRepoConfig(repoName);
+    if (config?.private && config.owner_id === user.id)
+        return true;
     return authService.getUserCollections(user.id).includes(repoName);
 }
+/** Returns true only if the path is an initialized git repo. */
+function isGitRepo(repoPath) {
+    return existsSync(join(repoPath, '.git'));
+}
 /**
  * Resolve a repo name to its absolute path on disk.
- * Returns null if the repo doesn't exist or is private.
+ * Returns null if the repo doesn't exist, or is private and the user isn't the owner.
  */
-function resolveRepoPath(repoName, workspaceManager, workspacePath) {
+function resolveRepoPath(repoName, workspaceManager, workspacePath, user) {
     const config = workspaceManager.getRepoConfig(repoName);
-    if (!config || config.private)
+    if (!config)
         return null;
+    if (config.private) {
+        if (!user)
+            return null;
+        // Admins (including API key user) can access all private repos
+        if (user.role !== 'admin' && (!config.owner_id || user.id !== config.owner_id))
+            return null;
+    }
     return join(workspacePath, config.path);
 }
 export async function registerGitHttpRoutes(fastify, workspaceManager, authService, workspacePath, wsHub) {
@@ -78,16 +116,16 @@ export async function registerGitHttpRoutes(fastify, workspaceManager, authServi
             return reply.status(auth.statusCode).send(auth.error);
         }
         // Resolve repo
-        const repoPath = resolveRepoPath(repo, workspaceManager, workspacePath);
-        if (!repoPath) {
+        const repoPath = resolveRepoPath(repo, workspaceManager, workspacePath, auth.user);
+        if (!repoPath || !isGitRepo(repoPath)) {
             return reply.status(404).send('Repository not found');
         }
         // Check collection access
-        if (!canAccessCollection(auth.user, repo, authService)) {
+        if (!canAccessCollection(auth.user, repo, authService, workspaceManager)) {
             return reply.status(404).send('Repository not found');
         }
         // Push requires collection access (admin → all, member → granted only)
-        if (service === 'git-receive-pack' && !canAccessCollection(auth.user, repo, authService)) {
+        if (service === 'git-receive-pack' && !canAccessCollection(auth.user, repo, authService, workspaceManager)) {
             return reply.status(403).send('Push access denied');
         }
         // Spawn git to advertise refs
@@ -129,11 +167,11 @@ export async function registerGitHttpRoutes(fastify, workspaceManager, authServi
             reply.header('WWW-Authenticate', 'Basic realm="Studiograph Git"');
             return reply.status(auth.statusCode).send(auth.error);
         }
-        const repoPath = resolveRepoPath(repo, workspaceManager, workspacePath);
-        if (!repoPath) {
+        const repoPath = resolveRepoPath(repo, workspaceManager, workspacePath, auth.user);
+        if (!repoPath || !isGitRepo(repoPath)) {
             return reply.status(404).send('Repository not found');
         }
-        if (!canAccessCollection(auth.user, repo, authService)) {
+        if (!canAccessCollection(auth.user, repo, authService, workspaceManager)) {
             return reply.status(404).send('Repository not found');
         }
         reply.raw.writeHead(200, {
@@ -169,12 +207,12 @@ export async function registerGitHttpRoutes(fastify, workspaceManager, authServi
             reply.header('WWW-Authenticate', 'Basic realm="Studiograph Git"');
             return reply.status(auth.statusCode).send(auth.error);
         }
-        const repoPath = resolveRepoPath(repo, workspaceManager, workspacePath);
-        if (!repoPath) {
+        const repoPath = resolveRepoPath(repo, workspaceManager, workspacePath, auth.user);
+        if (!repoPath || !isGitRepo(repoPath)) {
             return reply.status(404).send('Repository not found');
         }
         // Push requires collection access (admin → all, member → granted only)
-        if (!canAccessCollection(auth.user, repo, authService)) {
+        if (!canAccessCollection(auth.user, repo, authService, workspaceManager)) {
             return reply.status(403).send('Push access denied');
         }
         reply.raw.writeHead(200, {

package/dist/server/routes/git-http.js.map

@@ -1 +1 @@
-{"version":3,"file":"git-http.js","sourceRoot":"","sources":["../../../src/server/routes/git-http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAS5B;;;GAGG;AACH,SAAS,iBAAiB,CACxB,UAA8B,EAC9B,WAAwB;IAExB,oDAAoD;IACpD,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAED,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC/D,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IAE7C,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC3D,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,IAAqB,EACrB,QAAgB,EAChB,WAAwB;IAExB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,CAAyB,sBAAsB;IACtE,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,QAAgB,EAChB,gBAAkC,EAClC,aAAqB;IAErB,MAAM,MAAM,GAAG,gBAAgB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAwB,EACxB,gBAAkC,EAClC,WAAwB,EACxB,aAAqB,EACrB,KAAa;IAGb,oEAAoE;IACpE,OAAO,CAAC,GAAG,CACT,sBAAsB,EACtB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;QAElC,IAAI,OAAO,KAAK,iBAAiB,IAAI,OAAO,KAAK,kBAAkB,EAAE,CAAC;YACpE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QACpE,CAAC;QAED,eAAe;QACf,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QACvE,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,+BAA+B,CAAC,CAAC;YAClE,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC;QAED,eAAe;QACf,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACxD,CAAC;QAED,0BAA0B;QAC1B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;YACvD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACxD,CAAC;QAED,uEAAuE;QACvE,IAAI,OAAO,KAAK,kBAAkB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;YACzF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACtD,CAAC;QAED,8BAA8B;QAC9B,MAAM,UAAU,GAAG,OAAO,KAAK,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC;QAElF,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACvB,cAAc,EAAE,iBAAiB,OAAO,gBAAgB;YACxD,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;QAEH,2CAA2C;QAC3C,MAAM,MAAM,GAAG,aAAa,OAAO,IAAI,CAAC;QACxC,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,SAAS,GAAG,MAAM,EAAE,CAAC,CAAC;QACzC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAExB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,QAAQ,CAAC,EAAE;YACvF,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAE5C,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;YACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,UAAU,YAAY,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,uBAAuB,UAAU,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBAC3B,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,yCAAyC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC,CACF,CAAC;IAEF,gDAAgD;IAChD,OAAO,CAAC,IAAI,CACV,4BAA4B,EAC5B,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAE5B,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QACvE,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,+BAA+B,CAAC,CAAC;YAClE,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;YACvD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACxD,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACvB,cAAc,EAAE,sCAAsC;YACtD,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,aAAa,EAAE,iBAAiB,EAAE,QAAQ,CAAC,EAAE;YACtE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,qCAAqC;QACrC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAE5C,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;YACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,2BAA2B,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;YAC1D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBAC3B,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC,CACF,CAAC;IAEF,0CAA0C;IAC1C,OAAO,CAAC,IAAI,CACV,6BAA6B,EAC7B,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAE5B,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QACvE,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,+BAA+B,CAAC,CAAC;YAClE,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACxD,CAAC;QAED,uEAAuE;QACvE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;YACvD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACtD,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACvB,cAAc,EAAE,uCAAuC;YACvD,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,cAAc,EAAE,iBAAiB,EAAE,QAAQ,CAAC,EAAE;YACvE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAE5C,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;YACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YAChB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,KAAK,EAAE,SAAS,CAAC;oBACf,IAAI,EAAE,WAAW,EAAE,IAAI;oBACvB,MAAM,EAAE,UAAU;oBAClB,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,IAAI,KAAK;oBACtC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,kCAAkC,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBAC3B,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"git-http.js","sourceRoot":"","sources":["../../../src/server/routes/git-http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAIhC,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAMnF;;;GAGG;AACH,SAAS,iBAAiB,CACxB,UAA8B,EAC9B,WAAwB;IAExB,oDAAoD;IACpD,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAED,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC/D,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IAE7C,mBAAmB;IACnB,IAAI,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC/D,CAAC;IAED,iEAAiE;IACjE,IAAI,WAAW,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAS,EAAE,CAAC;IAClF,CAAC;IAED,uFAAuF;IACvF,iFAAiF;IACjF,2CAA2C;IAC3C,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,OAAO,EAAE,CAAC;YACZ,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC3B,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,yDAAyD,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC/F,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC3D,CAAC;IAED,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,IAAqB,EACrB,QAAgB,EAChB,WAAwB,EACxB,gBAAkC;IAElC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,CAAyB,sBAAsB;IACtE,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACvC,8CAA8C;IAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,MAAM,EAAE,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAChE,OAAO,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACpE,CAAC;AAED,gEAAgE;AAChE,SAAS,SAAS,CAAC,QAAgB;IACjC,OAAO,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,QAAgB,EAChB,gBAAkC,EAClC,aAAqB,EACrB,IAAqB;IAErB,MAAM,MAAM,GAAG,gBAAgB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,+DAA+D;QAC/D,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IAC9F,CAAC;IACD,OAAO,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAwB,EACxB,gBAAkC,EAClC,WAAwB,EACxB,aAAqB,EACrB,KAAa;IAGb,oEAAoE;IACpE,OAAO,CAAC,GAAG,CACT,sBAAsB,EACtB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;QAElC,IAAI,OAAO,KAAK,iBAAiB,IAAI,OAAO,KAAK,kBAAkB,EAAE,CAAC;YACpE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QACpE,CAAC;QAED,eAAe;QACf,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QACvE,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,+BAA+B,CAAC,CAAC;YAClE,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC;QAED,eAAe;QACf,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnF,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACxD,CAAC;QAED,0BAA0B;QAC1B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,CAAC,EAAE,CAAC;YACzE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACxD,CAAC;QAED,uEAAuE;QACvE,IAAI,OAAO,KAAK,kBAAkB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,CAAC,EAAE,CAAC;YAC3G,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACtD,CAAC;QAED,8BAA8B;QAC9B,MAAM,UAAU,GAAG,OAAO,KAAK,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC;QAElF,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACvB,cAAc,EAAE,iBAAiB,OAAO,gBAAgB;YACxD,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;QAEH,2CAA2C;QAC3C,MAAM,MAAM,GAAG,aAAa,OAAO,IAAI,CAAC;QACxC,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,SAAS,GAAG,MAAM,EAAE,CAAC,CAAC;QACzC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAExB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,QAAQ,CAAC,EAAE;YACvF,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAE5C,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;YACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,UAAU,YAAY,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,uBAAuB,UAAU,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBAC3B,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,yCAAyC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC,CACF,CAAC;IAEF,gDAAgD;IAChD,OAAO,CAAC,IAAI,CACV,4BAA4B,EAC5B,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAE5B,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QACvE,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,+BAA+B,CAAC,CAAC;YAClE,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnF,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,CAAC,EAAE,CAAC;YACzE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACxD,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACvB,cAAc,EAAE,sCAAsC;YACtD,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,aAAa,EAAE,iBAAiB,EAAE,QAAQ,CAAC,EAAE;YACtE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,qCAAqC;QACrC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAE5C,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;YACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,2BAA2B,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;YAC1D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBAC3B,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC,CACF,CAAC;IAEF,0CAA0C;IAC1C,OAAO,CAAC,IAAI,CACV,6BAA6B,EAC7B,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAE5B,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QACvE,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,+BAA+B,CAAC,CAAC;YAClE,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnF,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACxD,CAAC;QAED,uEAAuE;QACvE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,CAAC,EAAE,CAAC;YACzE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACtD,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACvB,cAAc,EAAE,uCAAuC;YACvD,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,cAAc,EAAE,iBAAiB,EAAE,QAAQ,CAAC,EAAE;YACvE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAE5C,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;YACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YAChB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,KAAK,EAAE,SAAS,CAAC;oBACf,IAAI,EAAE,WAAW,EAAE,IAAI;oBACvB,MAAM,EAAE,UAAU;oBAClB,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,IAAI,KAAK;oBACtC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,kCAAkC,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBAC3B,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/server/routes/graph-api.d.ts

@@ -9,5 +9,5 @@ import type { FastifyInstance } from 'fastify';
 import { WorkspaceManager } from '../../core/workspace-manager.js';
 import { AuthService } from '../../services/auth-service.js';
 import type { WsHub } from '../ws-hub.js';
-import type { CommitScheduler } from '../commit-scheduler.js';
-export declare function registerGraphApiRoutes(fastify: FastifyInstance, workspaceManager: WorkspaceManager, authService: AuthService, wsHub?: WsHub, commitScheduler?: CommitScheduler): Promise<void>;
+import type { SessionManager } from '../session-manager.js';
+export declare function registerGraphApiRoutes(fastify: FastifyInstance, workspaceManager: WorkspaceManager, authService: AuthService, wsHub?: WsHub, sessionManager?: SessionManager): Promise<void>;

package/dist/server/routes/graph-api.js

@@ -94,7 +94,7 @@ function filterWikilinks(wikilinks, accessibleIds) {
         return wikilinks;
     return wikilinks.filter(id => accessibleIds.has(id));
 }
-export async function registerGraphApiRoutes(fastify, workspaceManager, authService, wsHub, commitScheduler) {
+export async function registerGraphApiRoutes(fastify, workspaceManager, authService, wsHub, sessionManager) {
     // POST /api/repos — create a new collection (admin only, or any user for private collections)
     fastify.post('/api/repos', async (req, reply) => {
         const user = req.user;
@@ -115,6 +115,11 @@ export async function registerGraphApiRoutes(fastify, workspaceManager, authServ
                 ...(isPrivate && user ? { owner_id: user.id } : {}),
             });
             workspaceManager.reloadConfig();
+            wsHub?.broadcast({
+                type: 'collection_created', repo: name,
+                actor: req.user?.displayName ?? 'API',
+                timestamp: new Date().toISOString(),
+            });
             return reply.status(201).send(repo);
         }
         catch (err) {
@@ -139,29 +144,39 @@ export async function registerGraphApiRoutes(fastify, workspaceManager, authServ
             // Remove from config
             config.repos.splice(repoIndex, 1);
             workspace.writeConfig(config);
+            workspace.pushWorkspaceConfig(`Remove collection: ${repo}`);
             // Delete files
             const { rmSync } = await import('fs');
             if (existsSync(repoPath)) {
                 rmSync(repoPath, { recursive: true, force: true });
             }
             workspaceManager.reloadConfig();
+            wsHub?.broadcast({
+                type: 'collection_deleted', repo,
+                actor: req.user?.displayName ?? 'API',
+                timestamp: new Date().toISOString(),
+            });
             return reply.status(200).send({ success: true });
         }
         catch (err) {
             return reply.status(500).send({ error: err.message });
         }
     });
-    // PATCH /api/repos/:repo — rename a collection (admin only)
+    // PATCH /api/repos/:repo — update a collection (rename, sync rules) (admin only)
     fastify.patch('/api/repos/:repo', async (req, reply) => {
         if (!isAdmin(req)) {
             return reply.status(403).send({ error: 'Admin access required' });
         }
         const { repo } = req.params;
-        const { name: newName, ...rest } = req.body || {};
+        const body = req.body || {};
+        const { name: newName, sync: newSync, ...rest } = body;
         if ('private' in rest) {
             return reply.status(400).send({ error: 'The private flag is immutable after creation' });
         }
-        if (!newName || !/^[a-z0-9][a-z0-9-]*$/.test(newName)) {
+        if (newName === undefined && newSync === undefined) {
+            return reply.status(400).send({ error: 'Nothing to update — provide name or sync' });
+        }
+        if (newName !== undefined && (typeof newName !== 'string' || !/^[a-z0-9][a-z0-9-]*$/.test(newName))) {
             return reply.status(400).send({ error: 'New name must be kebab-case' });
         }
         try {
@@ -171,28 +186,35 @@ export async function registerGraphApiRoutes(fastify, workspaceManager, authServ
             if (!repoConfig) {
                 return reply.status(404).send({ error: `Collection "${repo}" not found` });
             }
-            if (config.repos.some(r => r.name === newName)) {
-                return reply.status(409).send({ error: `Collection "${newName}" already exists` });
+            // Handle rename
+            if (newName !== undefined) {
+                if (config.repos.some(r => r.name === newName)) {
+                    return reply.status(409).send({ error: `Collection "${newName}" already exists` });
+                }
+                const wsPath = workspaceManager['workspacePath'];
+                const oldPath = join(wsPath, repoConfig.path);
+                const newPath = join(wsPath, newName);
+                // Rename directory
+                const { renameSync, writeFileSync: writeFS } = await import('fs');
+                if (existsSync(oldPath)) {
+                    renameSync(oldPath, newPath);
+                }
+                repoConfig.name = newName;
+                repoConfig.path = newName;
+                // Update .studiograph marker
+                const markerPath = join(newPath, '.studiograph');
+                if (existsSync(markerPath)) {
+                    writeFS(markerPath, JSON.stringify({ repo_name: newName }, null, 2), 'utf-8');
+                }
+                // Update collection_access to follow the rename
+                authService.renameCollection(repo, newName);
             }
-            const wsPath = workspaceManager['workspacePath'];
-            const oldPath = join(wsPath, repoConfig.path);
-            const newPath = join(wsPath, newName);
-            // Rename directory
-            const { renameSync, writeFileSync: writeFS } = await import('fs');
-            if (existsSync(oldPath)) {
-                renameSync(oldPath, newPath);
+            // Handle sync rules update
+            if (newSync !== undefined) {
+                repoConfig.sync = newSync.length > 0 ? newSync : undefined;
             }
-            // Update config
-            repoConfig.name = newName;
-            repoConfig.path = newName;
             workspace.writeConfig(config);
-            // Update .studiograph marker
-            const markerPath = join(newPath, '.studiograph');
-            if (existsSync(markerPath)) {
-                writeFS(markerPath, JSON.stringify({ repo_name: newName }, null, 2), 'utf-8');
-            }
-            // Update collection_access to follow the rename
-            authService.renameCollection(repo, newName);
+            workspace.pushWorkspaceConfig(newName !== undefined ? `Rename collection: ${repo} → ${newName}` : `Update collection: ${repo}`);
             workspaceManager.reloadConfig();
             return reply.send(repoConfig);
         }
@@ -287,24 +309,6 @@ export async function registerGraphApiRoutes(fastify, workspaceManager, authServ
         }
         return reply.send(entity);
     });
-    // GET /api/repos/:repo/entities/:type/:id/contents — list sub-content in entity folder
-    fastify.get('/api/repos/:repo/entities/:type/:id/contents', async (req, reply) => {
-        const { repo } = req.params;
-        if (!hasRepoAccess(req, repo, workspaceManager, authService)) {
-            return reply.status(404).send({ error: `Collection "${repo}" not found` });
-        }
-        // Sub-content removed — entities are flat files now
-        return reply.send([]);
-    });
-    // GET /api/repos/:repo/entities/:type/:id/contents/* — read a sub-content file
-    fastify.get('/api/repos/:repo/entities/:type/:id/contents/*', async (req, reply) => {
-        const { repo } = req.params;
-        if (!hasRepoAccess(req, repo, workspaceManager, authService)) {
-            return reply.status(404).send({ error: `Collection "${repo}" not found` });
-        }
-        // Sub-content removed — entities are flat files now
-        return reply.status(404).send({ error: 'Sub-content not supported in flat file layout' });
-    });
     // GET /api/repos/:repo/search?q=&type=&tags= — search within a repo
     fastify.get('/api/repos/:repo/search', async (req, reply) => {
         const { repo } = req.params;
@@ -414,6 +418,15 @@ export async function registerGraphApiRoutes(fastify, workspaceManager, authServ
             return reply.status(404).send({ error: err.message });
         }
         try {
+            // Optimistic concurrency: reject if entity was modified after client last fetched it
+            const ifUnmodifiedSince = req.headers['if-unmodified-since'];
+            if (ifUnmodifiedSince) {
+                const current = graph.get(type, id);
+                const entityUpdatedAt = current?.data?.updated_at;
+                if (entityUpdatedAt && new Date(entityUpdatedAt) > new Date(ifUnmodifiedSince)) {
+                    return reply.status(409).send({ error: 'Conflict: entity was modified by another user', entity: current });
+                }
+            }
             const gitUser = reqGitUser(req);
             const updated = await graph.update({
                 entityType: type,
@@ -422,10 +435,10 @@ export async function registerGraphApiRoutes(fastify, workspaceManager, authServ
                 content: req.body.content,
                 commitMessage: `Update ${type}/${id} from web UI`,
                 user: gitUser,
-                skipCommit: !!commitScheduler, // defer commit if scheduler is active
+                skipCommit: !!sessionManager, // defer commit if scheduler is active
             });
-            if (commitScheduler && gitUser) {
-                commitScheduler.markDirty(repo, gitUser, type, id);
+            if (sessionManager && gitUser) {
+                sessionManager.markDirty(repo, gitUser, type, id, updated.path);
             }
             wsHub?.broadcast({
                 type: 'entity_change', action: 'updated', repo, entityType: type, entityId: id,
@@ -503,24 +516,15 @@ export async function registerGraphApiRoutes(fastify, workspaceManager, authServ
     });
     // POST /api/repos/:repo/commit — flush deferred commits (navigate-away signal)
     fastify.post('/api/repos/:repo/commit', async (req, reply) => {
-        if (!commitScheduler) {
+        if (!sessionManager) {
             return reply.send({ committed: false });
         }
         const { repo } = req.params;
         if (!hasRepoAccess(req, repo, workspaceManager, authService)) {
             return reply.status(404).send({ error: `Collection "${repo}" not found` });
         }
-        const committed = await commitScheduler.flush(repo);
+        const committed = await sessionManager.flush(repo);
         return reply.send({ committed });
     });
-    // PUT /api/repos/:repo/entities/:type/:id/contents/* — write a sub-content file
-    fastify.put('/api/repos/:repo/entities/:type/:id/contents/*', async (req, reply) => {
-        const { repo } = req.params;
-        if (!hasRepoAccess(req, repo, workspaceManager, authService)) {
-            return reply.status(404).send({ error: `Collection "${repo}" not found` });
-        }
-        // Sub-content removed — entities are flat files now
-        return reply.status(400).send({ error: 'Sub-content not supported in flat file layout' });
-    });
 }
 //# sourceMappingURL=graph-api.js.map