studiograph 1.3.46 → 1.3.48-beta.0

package/dist/services/asset-upload-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-upload-service.js","sourceRoot":"","sources":["../../src/services/asset-upload-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAG1D,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAkC1B,MAAM,OAAO,GAAG,CAAC,GAAW,EAAU,EAAE,CACtC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAE7E,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAC1C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAEjE,MAAM,YAAY,GAAG,CAAC,IAAY,EAAU,EAAE,CAC5C,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;AAExC,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,KAAK,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAEpF,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAE5C,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,IAAI,QAAQ,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAEzC,uEAAuE;IACvE,iEAAiE;IACjE,mEAAmE;IACnE,uBAAuB;IACvB,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,UAAU,CAAC,OAAqB,EAAE,WAAW,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,4EAA4E;IAC9E,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,SAAS,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACvF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAE7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,UAAU,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,QAAQ,CAAC;IAExE,MAAM,QAAQ,GAAwB;QACpC,WAAW,EAAE,OAAO;QACpB,SAAS,EAAE,MAAM;QACjB,IAAI;QACJ,0EAA0E;QAC1E,8CAA8C;QAC9C,SAAS,EAAE,aAAa;QACxB,UAAU,EAAE,SAAS;QACrB,eAAe,EAAE,GAAG;QACpB,UAAU,EAAE,MAAM,CAAC,MAAM;QACzB,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,GAAG;QACf,UAAU,EAAE,GAAG;QACf,UAAU,EAAE,UAAU;QACtB,UAAU,EAAE,UAAU;KACvB,CAAC;IAEF,sEAAsE;IACtE,kEAAkE;IAClE,2BAA2B;IAC3B,IAAI,QAAQ,GAAG,MAAM,CAAC;IACtB,IAAI,WAAmB,CAAC;IACxB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,IAAI,EAAE,CAAC;QACZ,QAAQ,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;gBACjC,UAAU,EAAE,OAAqB;gBACjC,QAAQ;gBACR,IAAI,EAAE,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE;gBAC1C,OAAO,EAAE,EAAE;gBACX,UAAU;gBACV,UAAU,EAAE,IAAI;gBAChB,IAAI;aACL,CAAC,CAAC;YACH,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;YAC3B,MAAM;QACR,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,MAAM,IAAI,EAAE;gBAAE,MAAM,GAAG,CAAC;YAC/D,MAAM,EAAE,CAAC;QACX,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,wEAAwE;IACxE,qEAAqE;IACrE,uEAAuE;IACvE,wEAAwE;IACxE,kEAAkE;IAClE,gCAAgC;IAChC,IAAI,KAAyB,CAAC;IAC9B,IAAI,WAA+B,CAAC;IACpC,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,2EAA2E;QAC3E,MAAM,cAAc,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjE,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,WAAW,CACnC,OAAqB,EACrB,QAAQ,EACR,cAAc,EACd,MAAM,CACP,CAAC;QAEF,kEAAkE;QAClE,iEAAiE;QACjE,oEAAoE;QACpE,sEAAsE;QACtE,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACxB,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;YAC5C,IAAI,MAAM,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;gBACvC,GAAG,CAAC,IAAI,CACN,kDAAkD,QAAQ,KAAK,MAAM,CAAC,MAAM,YAAY,kBAAkB,MAAM,CACjH,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,aAAa,GAAG,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;oBAC/C,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;oBAC9C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;oBACtC,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;oBACvB,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC;wBAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;oBAC3D,aAAa,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;gBAC5C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,6DAA6D;oBAC7D,6DAA6D;oBAC7D,yDAAyD;oBACzD,GAAG,CAAC,IAAI,CACN,iDAAiD,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CACzG,CAAC;gBACJ,CAAC;gBACD,IAAI,aAAa,IAAI,aAAa,EAAE,CAAC;oBACnC,IAAI,CAAC;wBACH,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;wBAC/E,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;4BAAE,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;wBACxE,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,QAAQ,MAAM,CAAC,CAAC;wBAClD,aAAa,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;oBACrD,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,4DAA4D;wBAC5D,4DAA4D;wBAC5D,2CAA2C;wBAC3C,WAAW,GAAG,SAAS,CAAC;wBACxB,GAAG,CAAC,IAAI,CACN,+CAA+C,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CACvG,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,2EAA2E;QAC3E,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAC5B,MAAM,UAAU,GAAwB,EAAE,SAAS,EAAE,CAAC;QACtD,IAAI,KAAK,KAAK,SAAS;YAAE,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC;QAElD,MAAM,KAAK,CAAC,MAAM,CAAC;YACjB,UAAU,EAAE,OAAqB;YACjC,QAAQ;YACR,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,IAAI;YAChB,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,MAAM,CAAC,OAAqB,EAAE,QAAQ,EAAE,iCAAiC,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;QACzG,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CACN,6CAA6C,QAAQ,KAAK,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAC1H,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC;QAClC,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzF,GAAG,CAAC,SAAS,CAAC,iBAAiB,QAAQ,EAAE,EAAE,UAAU,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ;QACR,UAAU,EAAE,OAAO;QACnB,QAAQ,EAAE,WAAW;QACrB,SAAS;QACT,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,MAAM,CAAC,MAAM;QACzB,KAAK;QACL,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/dist/services/assets/asset-index-service.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Authoritative ownership index for immutable-keyed assets.
+ *
+ * Assets are stored under an immutable key `{assetId}/{filename}` (assetId =
+ * UUIDv4), so the storage location no longer encodes the owning entity's
+ * mutable `(type, id)`. This table is the single source of truth for:
+ *   - per-repo authorization on the serving route (`repo`), and
+ *   - "which assets does entity E own?" for delete/transfer (`owner_type`,
+ *     `owner_id`).
+ *
+ * It is written authoritatively at upload and updated by every mutation path
+ * (rename/changeType/move/transfer/delete). It is NOT rebuilt from entity
+ * bodies: deriving ownership from user-editable `/api/assets/{id}` embeds would
+ * let a user in repo A claim an asset owned by repo B by pasting its URL —
+ * a privilege-escalation vector. Treat this db as durable critical state
+ * (it lives on the same persistent workspace volume as auth.db / secrets.db),
+ * not a regenerable cache.
+ *
+ * `migration_ledger` is a transient table used only by the one-time
+ * old→new key migration to stay idempotent; it is dropped after cutover.
+ */
+export interface AssetIndexRow {
+    assetId: string;
+    repo: string;
+    ownerType: string;
+    ownerId: string;
+    filename: string;
+    contentType: string;
+    mediaType: string;
+    name: string | null;
+    createdAt: string;
+}
+export type AssetIndexInput = Omit<AssetIndexRow, 'createdAt'> & {
+    createdAt?: string;
+};
+/** Owner-reassignment changes for a mutation. Any subset may be supplied. */
+export interface OwnerReassignment {
+    ownerType?: string;
+    ownerId?: string;
+    repo?: string;
+}
+export declare class AssetIndexService {
+    private db;
+    constructor(workspacePath: string);
+    /** Keep assets.db (+ WAL/SHM) out of the workspace config repo — it's
+     *  local, durable on the workspace volume, and not safely rebuildable from
+     *  bodies, so it's never committed. Mirrors auth.db / secrets.db. */
+    private ensureGitignore;
+    /** Insert or replace the row for an assetId (idempotent on re-run). */
+    put(input: AssetIndexInput): void;
+    get(assetId: string): AssetIndexRow | null;
+    /**
+     * Assets owned by `(repo, ownerType, ownerId)`. The `repo` scope is
+     * mandatory: entity ids are unique only within (repo, type), NOT across the
+     * workspace — `note/foo` can exist in two repos. Matching on owner alone
+     * would let a delete/rename in repo A touch repo B's identically-named
+     * entity's assets (cross-repo data loss).
+     */
+    listByOwner(repo: string, ownerType: string, ownerId: string): AssetIndexRow[];
+    listByRepo(repo: string): AssetIndexRow[];
+    /**
+     * Reassign every asset owned by `(repo, fromType, fromId)`. Used by mutations:
+     *   - rename:      reassignOwner(repo, type, oldId, { ownerId: newId })
+     *   - changeType:  reassignOwner(repo, oldType, id, { ownerType: newType })
+     *   - cross-repo move/transfer: reassignOwner(sourceRepo, type, id, { repo: target })
+     * `repo` scopes the match (see listByOwner) — without it a rename in one repo
+     * would reassign a same-named entity's assets in another. Returns rows updated.
+     * No blob movement — keys are immutable.
+     */
+    reassignOwner(repo: string, fromType: string, fromId: string, changes: OwnerReassignment): number;
+    delete(assetId: string): void;
+    ledgerGet(repo: string, oldKey: string): string | null;
+    ledgerPut(repo: string, oldKey: string, assetId: string): void;
+    ledgerEntries(): Array<{
+        repo: string;
+        oldKey: string;
+        assetId: string;
+    }>;
+    dropLedger(): void;
+    close(): void;
+    private toRow;
+}

package/dist/services/assets/asset-index-service.js

@@ -0,0 +1,167 @@
+import Database from 'better-sqlite3';
+import { join } from 'node:path';
+import { existsSync, mkdirSync, chmodSync, readFileSync, writeFileSync } from 'node:fs';
+export class AssetIndexService {
+    db;
+    constructor(workspacePath) {
+        const sgDir = join(workspacePath, '.studiograph');
+        if (!existsSync(sgDir))
+            mkdirSync(sgDir, { recursive: true });
+        this.ensureGitignore(sgDir);
+        const dbPath = join(sgDir, 'assets.db');
+        this.db = new Database(dbPath);
+        if (process.platform !== 'win32') {
+            try {
+                chmodSync(dbPath, 0o600);
+            }
+            catch { /* non-fatal */ }
+        }
+        this.db.pragma('journal_mode = WAL');
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS assets (
+        asset_id     TEXT PRIMARY KEY,
+        repo         TEXT NOT NULL,
+        owner_type   TEXT NOT NULL,
+        owner_id     TEXT NOT NULL,
+        filename     TEXT NOT NULL,
+        content_type TEXT NOT NULL,
+        media_type   TEXT NOT NULL,
+        name         TEXT,
+        created_at   TEXT NOT NULL DEFAULT (datetime('now'))
+      )
+    `);
+        this.db.exec(`CREATE INDEX IF NOT EXISTS idx_assets_owner ON assets(owner_type, owner_id)`);
+        this.db.exec(`CREATE INDEX IF NOT EXISTS idx_assets_repo ON assets(repo)`);
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS migration_ledger (
+        repo     TEXT NOT NULL,
+        old_key  TEXT NOT NULL,
+        asset_id TEXT NOT NULL,
+        PRIMARY KEY (repo, old_key)
+      )
+    `);
+    }
+    /** Keep assets.db (+ WAL/SHM) out of the workspace config repo — it's
+     *  local, durable on the workspace volume, and not safely rebuildable from
+     *  bodies, so it's never committed. Mirrors auth.db / secrets.db. */
+    ensureGitignore(sgDir) {
+        const gitignorePath = join(sgDir, '.gitignore');
+        const entries = ['assets.db', 'assets.db-wal', 'assets.db-shm'];
+        let content = '';
+        if (existsSync(gitignorePath))
+            content = readFileSync(gitignorePath, 'utf-8');
+        const missing = entries.filter(e => !content.includes(e));
+        if (missing.length > 0) {
+            const suffix = (content && !content.endsWith('\n') ? '\n' : '') +
+                '# Asset ownership index — local, durable on the workspace volume\n' +
+                missing.join('\n') + '\n';
+            writeFileSync(gitignorePath, content + suffix, 'utf-8');
+        }
+    }
+    /** Insert or replace the row for an assetId (idempotent on re-run). */
+    put(input) {
+        this.db.prepare(`
+      INSERT INTO assets (asset_id, repo, owner_type, owner_id, filename, content_type, media_type, name, created_at)
+      VALUES (@assetId, @repo, @ownerType, @ownerId, @filename, @contentType, @mediaType, @name, COALESCE(@createdAt, datetime('now')))
+      ON CONFLICT(asset_id) DO UPDATE SET
+        repo=excluded.repo, owner_type=excluded.owner_type, owner_id=excluded.owner_id,
+        filename=excluded.filename, content_type=excluded.content_type,
+        media_type=excluded.media_type, name=excluded.name
+    `).run({
+            assetId: input.assetId,
+            repo: input.repo,
+            ownerType: input.ownerType,
+            ownerId: input.ownerId,
+            filename: input.filename,
+            contentType: input.contentType,
+            mediaType: input.mediaType,
+            name: input.name ?? null,
+            createdAt: input.createdAt ?? null,
+        });
+    }
+    get(assetId) {
+        const row = this.db.prepare(`SELECT * FROM assets WHERE asset_id = ?`).get(assetId);
+        return row ? this.toRow(row) : null;
+    }
+    /**
+     * Assets owned by `(repo, ownerType, ownerId)`. The `repo` scope is
+     * mandatory: entity ids are unique only within (repo, type), NOT across the
+     * workspace — `note/foo` can exist in two repos. Matching on owner alone
+     * would let a delete/rename in repo A touch repo B's identically-named
+     * entity's assets (cross-repo data loss).
+     */
+    listByOwner(repo, ownerType, ownerId) {
+        const rows = this.db.prepare(`SELECT * FROM assets WHERE repo = ? AND owner_type = ? AND owner_id = ? ORDER BY created_at`).all(repo, ownerType, ownerId);
+        return rows.map(r => this.toRow(r));
+    }
+    listByRepo(repo) {
+        const rows = this.db.prepare(`SELECT * FROM assets WHERE repo = ? ORDER BY created_at`).all(repo);
+        return rows.map(r => this.toRow(r));
+    }
+    /**
+     * Reassign every asset owned by `(repo, fromType, fromId)`. Used by mutations:
+     *   - rename:      reassignOwner(repo, type, oldId, { ownerId: newId })
+     *   - changeType:  reassignOwner(repo, oldType, id, { ownerType: newType })
+     *   - cross-repo move/transfer: reassignOwner(sourceRepo, type, id, { repo: target })
+     * `repo` scopes the match (see listByOwner) — without it a rename in one repo
+     * would reassign a same-named entity's assets in another. Returns rows updated.
+     * No blob movement — keys are immutable.
+     */
+    reassignOwner(repo, fromType, fromId, changes) {
+        const sets = [];
+        // Distinct param names: @matchRepo scopes the WHERE; @newRepo is the SET.
+        // Sharing one `@repo` would let a repo-change overwrite the match value.
+        const params = { matchRepo: repo, fromType, fromId };
+        if (changes.ownerType !== undefined) {
+            sets.push('owner_type = @ownerType');
+            params.ownerType = changes.ownerType;
+        }
+        if (changes.ownerId !== undefined) {
+            sets.push('owner_id = @ownerId');
+            params.ownerId = changes.ownerId;
+        }
+        if (changes.repo !== undefined) {
+            sets.push('repo = @newRepo');
+            params.newRepo = changes.repo;
+        }
+        if (sets.length === 0)
+            return 0;
+        const res = this.db.prepare(`UPDATE assets SET ${sets.join(', ')} WHERE repo = @matchRepo AND owner_type = @fromType AND owner_id = @fromId`).run(params);
+        return res.changes;
+    }
+    delete(assetId) {
+        this.db.prepare(`DELETE FROM assets WHERE asset_id = ?`).run(assetId);
+    }
+    // ── migration ledger (transient; dropped post-cutover) ───────────────────
+    ledgerGet(repo, oldKey) {
+        const row = this.db.prepare(`SELECT asset_id FROM migration_ledger WHERE repo = ? AND old_key = ?`).get(repo, oldKey);
+        return row ? row.asset_id : null;
+    }
+    ledgerPut(repo, oldKey, assetId) {
+        this.db.prepare(`INSERT OR IGNORE INTO migration_ledger (repo, old_key, asset_id) VALUES (?, ?, ?)`).run(repo, oldKey, assetId);
+    }
+    ledgerEntries() {
+        const rows = this.db.prepare(`SELECT repo, old_key, asset_id FROM migration_ledger`).all();
+        return rows.map(r => ({ repo: r.repo, oldKey: r.old_key, assetId: r.asset_id }));
+    }
+    dropLedger() {
+        this.db.exec(`DROP TABLE IF EXISTS migration_ledger`);
+    }
+    close() {
+        this.db.close();
+    }
+    toRow(r) {
+        return {
+            assetId: r.asset_id,
+            repo: r.repo,
+            ownerType: r.owner_type,
+            ownerId: r.owner_id,
+            filename: r.filename,
+            contentType: r.content_type,
+            mediaType: r.media_type,
+            name: r.name ?? null,
+            createdAt: r.created_at,
+        };
+    }
+}
+//# sourceMappingURL=asset-index-service.js.map

package/dist/services/assets/asset-index-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-index-service.js","sourceRoot":"","sources":["../../../src/services/assets/asset-index-service.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AA6CxF,MAAM,OAAO,iBAAiB;IACpB,EAAE,CAAoB;IAE9B,YAAY,aAAqB;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACxC,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC;gBAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAErC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;KAYZ,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;QAC5F,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QAC3E,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;KAOZ,CAAC,CAAC;IACL,CAAC;IAED;;yEAEqE;IAC7D,eAAe,CAAC,KAAa;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;QAChE,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,UAAU,CAAC,aAAa,CAAC;YAAE,OAAO,GAAG,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,oEAAoE;gBACpE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YAC5B,aAAa,CAAC,aAAa,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,GAAG,CAAC,KAAsB;QACxB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;;;KAOf,CAAC,CAAC,GAAG,CAAC;YACL,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;SACnC,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,OAAe;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAwC,CAAC;QAC3H,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,IAAY,EAAE,SAAiB,EAAE,OAAe;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC1B,6FAA6F,CAC9F,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAmC,CAAC;QAClE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IAED,UAAU,CAAC,IAAY;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAC,GAAG,CAAC,IAAI,CAAmC,CAAC;QACpI,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;;OAQG;IACH,aAAa,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc,EAAE,OAA0B;QACtF,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,MAAM,GAA2B,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC7E,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YAAC,MAAM,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QAAC,CAAC;QACpH,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YAAC,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAAC,CAAC;QAC1G,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAAC,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;QAAC,CAAC;QAChG,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACzB,qBAAqB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,4EAA4E,CACjH,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACd,OAAO,GAAG,CAAC,OAAO,CAAC;IACrB,CAAC;IAED,MAAM,CAAC,OAAe;QACpB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxE,CAAC;IAED,4EAA4E;IAE5E,SAAS,CAAC,IAAY,EAAE,MAAc;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACzB,sEAAsE,CACvE,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAqC,CAAC;QACxD,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IAED,SAAS,CAAC,IAAY,EAAE,MAAc,EAAE,OAAe;QACrD,IAAI,CAAC,EAAE,CAAC,OAAO,CACb,mFAAmF,CACpF,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,aAAa;QACX,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,sDAAsD,CAAC,CAAC,GAAG,EAAmC,CAAC;QAC5H,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACnF,CAAC;IAED,UAAU;QACR,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACxD,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,CAA0B;QACtC,OAAO;YACL,OAAO,EAAE,CAAC,CAAC,QAAkB;YAC7B,IAAI,EAAE,CAAC,CAAC,IAAc;YACtB,SAAS,EAAE,CAAC,CAAC,UAAoB;YACjC,OAAO,EAAE,CAAC,CAAC,QAAkB;YAC7B,QAAQ,EAAE,CAAC,CAAC,QAAkB;YAC9B,WAAW,EAAE,CAAC,CAAC,YAAsB;YACrC,SAAS,EAAE,CAAC,CAAC,UAAoB;YACjC,IAAI,EAAG,CAAC,CAAC,IAAsB,IAAI,IAAI;YACvC,SAAS,EAAE,CAAC,CAAC,UAAoB;SAClC,CAAC;IACJ,CAAC;CACF"}

package/dist/services/assets/base.d.ts

@@ -9,6 +9,15 @@ export interface AssetInfo {
     path: string;
     mediaType: 'image' | 'video' | 'audio' | 'document' | 'other';
 }
+/**
+ * Assets enumerated across the whole backend with their (type, id) origin
+ * parsed out of the storage key. Used by the asset manager to avoid
+ * per-entity round-trips.
+ */
+export interface AssetRecord extends AssetInfo {
+    entityType: string;
+    entityId: string;
+}
 export interface AssetBackend {
     /**
      * Upload asset to storage
@@ -18,6 +27,19 @@ export interface AssetBackend {
      * List assets with a given prefix
      */
     list(prefix: string): Promise<AssetInfo[]>;
+    /**
+     * List every asset under the backend's root, parsed into
+     * `{type}/{id}/{filename}` components. Single round-trip for R2 (via
+     * paginated ListObjectsV2), single filesystem walk for local. Used by
+     * the asset manager to enumerate without per-entity queries.
+     */
+    listAll(): Promise<AssetRecord[]>;
+    /**
+     * Server-side copy from one key to another (no download round-trip).
+     * Used by the asset re-key migration and cross-repo transfer-copy.
+     * Overwrites the destination if it exists (idempotent re-runs).
+     */
+    copy(srcKey: string, destKey: string): Promise<void>;
     /**
      * Delete a single asset
      */
@@ -30,6 +52,13 @@ export interface AssetBackend {
      * Check if an asset exists
      */
     exists(key: string): Promise<boolean>;
+    /**
+     * Generate a short-lived pre-signed URL for a stored object.
+     * Implemented by remote backends (R2/S3); local backend leaves this
+     * undefined since files are streamed directly by the HTTP server.
+     * `method` selects the HTTP verb the URL is signed against.
+     */
+    getSignedUrl?(key: string, expiresIn?: number, method?: 'GET' | 'HEAD'): Promise<string>;
 }
 export interface AssetConfig {
     storage: 'local' | 'r2';
@@ -51,6 +80,21 @@ export declare const CONTENT_TYPES: Record<string, string>;
  * Detect content type from filename
  */
 export declare function detectContentType(filename: string): string;
+import type { AssetKind } from '../../core/validation.js';
+/**
+ * Map a filename to the high-level `asset_kind` written into the asset
+ * entity's frontmatter. Drives icon and viewer selection; coarser than
+ * MIME so the UI doesn't need to enumerate every format. The kind set
+ * is canonical in `ASSET_KINDS` in src/core/validation.ts.
+ */
+export declare function detectAssetKind(filename: string): AssetKind;
+/**
+ * Extension set the asset upload route accepts. Excludes the structured
+ * formats handled elsewhere (.md/.txt → direct write via import-service,
+ * .docx → mammoth workstream, .html → bookmark importer).
+ */
+export declare const ASSET_UPLOAD_EXTENSIONS: Set<string>;
+export declare function isAssetUploadExtension(filename: string): boolean;
 /**
  * Determine media type from content type
  */

package/dist/services/assets/base.js

@@ -51,6 +51,61 @@ export function detectContentType(filename) {
     const ext = filename.split('.').pop()?.toLowerCase() || '';
     return CONTENT_TYPES[ext] || 'application/octet-stream';
 }
+/**
+ * Map a filename to the high-level `asset_kind` written into the asset
+ * entity's frontmatter. Drives icon and viewer selection; coarser than
+ * MIME so the UI doesn't need to enumerate every format. The kind set
+ * is canonical in `ASSET_KINDS` in src/core/validation.ts.
+ */
+export function detectAssetKind(filename) {
+    const ext = filename.split('.').pop()?.toLowerCase() || '';
+    if (IMAGE_EXTS.has(ext))
+        return 'image';
+    if (VIDEO_EXTS.has(ext))
+        return 'video';
+    if (AUDIO_EXTS.has(ext))
+        return 'audio';
+    if (ext === 'pdf')
+        return 'pdf';
+    if (SPREADSHEET_EXTS.has(ext))
+        return 'spreadsheet';
+    return 'other';
+}
+// SVG is intentionally excluded — see docs/asset-architecture.md §security.
+// Stored XSS risk: SVG can contain <script> and the GET /api/assets/* route
+// serves files inline with `Content-Type: image/svg+xml`, which executes in
+// the app origin. Users who need vector assets can paste source into a note
+// or embed via the editor's per-entity attach (which also blocks SVG).
+const IMAGE_EXTS = new Set(['jpg', 'jpeg', 'png', 'gif', 'webp', 'avif', 'heic']);
+const VIDEO_EXTS = new Set(['mp4', 'mov', 'webm', 'avi', 'mkv', 'm4v']);
+const AUDIO_EXTS = new Set(['mp3', 'wav', 'm4a', 'ogg', 'flac', 'aac']);
+const SPREADSHEET_EXTS = new Set(['csv', 'xlsx', 'xls', 'numbers', 'tsv']);
+// Other formerly-categorized extensions (indd, sketch, psd, ai, fig, doc/docx,
+// pptx, key, pages, zip, tar, etc.) all fall to `other`. The product has no
+// preview / extract support for them today, so the previous fine-grained
+// kinds were noise. If preview support is added later, reintroduce a kind.
+const OTHER_UPLOAD_EXTS = new Set([
+    'indd', 'idml', 'sketch', 'psd', 'ai', 'fig',
+    'doc', 'pptx', 'ppt', 'key', 'pages',
+    'zip', 'tar', 'gz', '7z', 'rar',
+]);
+/**
+ * Extension set the asset upload route accepts. Excludes the structured
+ * formats handled elsewhere (.md/.txt → direct write via import-service,
+ * .docx → mammoth workstream, .html → bookmark importer).
+ */
+export const ASSET_UPLOAD_EXTENSIONS = new Set([
+    ...IMAGE_EXTS,
+    ...VIDEO_EXTS,
+    ...AUDIO_EXTS,
+    'pdf',
+    ...SPREADSHEET_EXTS,
+    ...OTHER_UPLOAD_EXTS,
+]);
+export function isAssetUploadExtension(filename) {
+    const ext = filename.split('.').pop()?.toLowerCase() || '';
+    return ASSET_UPLOAD_EXTENSIONS.has(ext);
+}
 /**
  * Determine media type from content type
  */

package/dist/services/assets/base.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/services/assets/base.ts"],"names":[],"mappings":"AAAA;;GAEG;AAoDH;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAA2B;IACnD,SAAS;IACT,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,eAAe;IACpB,GAAG,EAAE,cAAc;IAEnB,SAAS;IACT,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,iBAAiB;IACtB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,iBAAiB;IAEtB,QAAQ;IACR,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,WAAW;IAEhB,YAAY;IACZ,GAAG,EAAE,iBAAiB;IACtB,GAAG,EAAE,oBAAoB;IACzB,IAAI,EAAE,yEAAyE;IAC/E,GAAG,EAAE,0BAA0B;IAC/B,IAAI,EAAE,mEAAmE;IACzE,GAAG,EAAE,+BAA+B;IACpC,IAAI,EAAE,2EAA2E;IAEjF,WAAW;IACX,GAAG,EAAE,iBAAiB;IACtB,GAAG,EAAE,mBAAmB;IACxB,EAAE,EAAE,kBAAkB;IAEtB,eAAe;IACf,GAAG,EAAE,0BAA0B;IAC/B,MAAM,EAAE,0BAA0B;IAElC,OAAO;IACP,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,kBAAkB;IACxB,GAAG,EAAE,iBAAiB;IACtB,GAAG,EAAE,UAAU;CAChB,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3D,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;AAC1D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,WAAmB;IAC9C,IAAI,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC3B,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;QAChC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC5B,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC7B,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC;QAClC,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACzC,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,2BAA2B;IAC3B,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QACvB,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QACtB,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IAED,yBAAyB;IACzB,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,iCAAiC;IACjC,MAAM,cAAc,GAAG,oBAAoB,CAAC;IAC5C,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,eAAe;IACf,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,UAAkB,EAClB,QAAgB,EAChB,QAAgB,EAChB,SAAkB;IAElB,OAAO,GAAG,SAAS,IAAI,UAAU,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAAkB,EAClB,QAAgB,EAChB,SAAkB;IAElB,OAAO,GAAG,SAAS,IAAI,UAAU,IAAI,QAAQ,GAAG,CAAC;AACnD,CAAC"}
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/services/assets/base.ts"],"names":[],"mappings":"AAAA;;GAEG;AAqFH;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAA2B;IACnD,SAAS;IACT,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,eAAe;IACpB,GAAG,EAAE,cAAc;IAEnB,SAAS;IACT,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,iBAAiB;IACtB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,iBAAiB;IAEtB,QAAQ;IACR,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,WAAW;IAEhB,YAAY;IACZ,GAAG,EAAE,iBAAiB;IACtB,GAAG,EAAE,oBAAoB;IACzB,IAAI,EAAE,yEAAyE;IAC/E,GAAG,EAAE,0BAA0B;IAC/B,IAAI,EAAE,mEAAmE;IACzE,GAAG,EAAE,+BAA+B;IACpC,IAAI,EAAE,2EAA2E;IAEjF,WAAW;IACX,GAAG,EAAE,iBAAiB;IACtB,GAAG,EAAE,mBAAmB;IACxB,EAAE,EAAE,kBAAkB;IAEtB,eAAe;IACf,GAAG,EAAE,0BAA0B;IAC/B,MAAM,EAAE,0BAA0B;IAElC,OAAO;IACP,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,kBAAkB;IACxB,GAAG,EAAE,iBAAiB;IACtB,GAAG,EAAE,UAAU;CAChB,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3D,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;AAC1D,CAAC;AAID;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3D,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC;IACpD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,4EAA4E;AAC5E,4EAA4E;AAC5E,4EAA4E;AAC5E,4EAA4E;AAC5E,uEAAuE;AACvE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAClF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AACxE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AACxE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AAC3E,+EAA+E;AAC/E,4EAA4E;AAC5E,yEAAyE;AACzE,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK;IAC5C,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO;IACpC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK;CAChC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAS;IACrD,GAAG,UAAU;IACb,GAAG,UAAU;IACb,GAAG,UAAU;IACb,KAAK;IACL,GAAG,gBAAgB;IACnB,GAAG,iBAAiB;CACrB,CAAC,CAAC;AAEH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3D,OAAO,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,WAAmB;IAC9C,IAAI,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC3B,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;QAChC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC5B,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC7B,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC;QAClC,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACzC,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,2BAA2B;IAC3B,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QACvB,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QACtB,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IAED,yBAAyB;IACzB,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,iCAAiC;IACjC,MAAM,cAAc,GAAG,oBAAoB,CAAC;IAC5C,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,eAAe;IACf,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,UAAkB,EAClB,QAAgB,EAChB,QAAgB,EAChB,SAAkB;IAElB,OAAO,GAAG,SAAS,IAAI,UAAU,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAAkB,EAClB,QAAgB,EAChB,SAAkB;IAElB,OAAO,GAAG,SAAS,IAAI,UAAU,IAAI,QAAQ,GAAG,CAAC;AACnD,CAAC"}

package/dist/services/assets/index.d.ts

@@ -4,11 +4,49 @@
  * Manages all media assets (images, videos, audio, documents)
  * with pluggable storage backends (local filesystem or R2)
  */
-import type { AssetInfo, AssetConfig } from './base.js';
+import type { AssetInfo, AssetRecord, AssetConfig } from './base.js';
 export * from './base.js';
+/**
+ * Result of `graph.uploadAsset`. Extends AssetInfo with the canonical public
+ * URL the caller should embed/store (`publicUrl`) and, on the immutable-key
+ * path, the generated `assetId`. Centralizing the URL here keeps callers from
+ * re-deriving `/api/assets/...` (and getting the scheme wrong).
+ */
+export interface AssetUploadResult extends AssetInfo {
+    assetId?: string;
+    publicUrl: string;
+}
 export declare class AssetService {
     private backend;
+    private storage;
     constructor(config: AssetConfig);
+    /** Which backend this service is bound to. Routes that need different
+     *  serving strategies per backend (e.g. stream local files vs. 302 to
+     *  pre-signed URL for R2) branch on this. */
+    getStorage(): 'local' | 'r2';
+    /** Whether the backend can mint short-lived pre-signed download URLs.
+     *  True for R2; false for local (where the HTTP server streams files
+     *  directly). */
+    supportsSignedUrls(): boolean;
+    /** Generate a short-lived pre-signed download URL for an asset.
+     *  Throws if the backend doesn't support pre-signed URLs (local).
+     *  Default expiry is 4 hours (14400s) — see R2AssetBackend.getSignedUrl
+     *  for the rationale. `method` selects the HTTP verb the URL is signed
+     *  against — HEAD requests (link unfurls, OpenGraph) need a HEAD-signed
+     *  URL because pre-signed URLs are method-bound. */
+    getSignedUrl(entityType: string, entityId: string, filename: string, keyPrefix?: string, expiresIn?: number, method?: 'GET' | 'HEAD'): Promise<string>;
+    /** Reject key segments that could escape the prefix. */
+    private assertSafeSegment;
+    /** Upload bytes under an immutable assetId key. Caller records the index row. */
+    uploadByAssetId(assetId: string, filename: string, buffer: Buffer): Promise<AssetInfo>;
+    getSignedUrlByAssetId(assetId: string, filename: string, expiresIn?: number, method?: 'GET' | 'HEAD'): Promise<string>;
+    deleteByAssetId(assetId: string, filename: string): Promise<void>;
+    existsByAssetId(assetId: string, filename: string): Promise<boolean>;
+    /** Server-side copy between raw keys (migration + transfer-copy). Validates
+     *  every path segment of both keys — the migration derives srcKey from
+     *  user-editable body URLs, so a `..` in a key segment must never reach the
+     *  backend's path join (arbitrary-file read/write). */
+    copy(srcKey: string, destKey: string): Promise<void>;
     /**
      * Upload asset for an entity
      */
@@ -17,6 +55,11 @@ export declare class AssetService {
      * List all assets for an entity
      */
     list(entityType: string, entityId: string, keyPrefix?: string): Promise<AssetInfo[]>;
+    /**
+     * List every asset in the backend in one round-trip, with their
+     * (entityType, entityId) origins parsed from the storage key.
+     */
+    listAll(): Promise<AssetRecord[]>;
     /**
      * Delete a single asset
      */
@@ -34,3 +77,28 @@ export declare class AssetService {
      */
     getInfo(entityType: string, entityId: string, filename: string, keyPrefix?: string): Promise<AssetInfo | null>;
 }
+/**
+ * Convert an `AssetInfo` returned by a backend into the URL stored in
+ * an entity's `asset_url` (or used as the `src` of an inline embed).
+ *
+ * Stage 2 of the asset architecture (see docs/asset-architecture.md):
+ * always emit the proxied `/api/assets/{type}/{id}/{file}` path, regardless
+ * of backend. The route is the single chokepoint that enforces per-repo
+ * authz — local files are streamed directly, R2-backed assets get a 302
+ * to a short-lived pre-signed URL. New uploads never persist absolute
+ * R2 URLs in frontmatter; the migration CLI rewrites legacy ones.
+ *
+ * Centralised here because three different call sites used to inline this
+ * ternary, and getting it wrong silently breaks image rendering.
+ */
+export declare function publicUrlFor(_asset: {
+    url: string;
+    path: string;
+    filename: string;
+}, entityType: string, entityId: string): string;
+/**
+ * Immutable-key public URL: `/api/assets/{assetId}/{filename}`. Two path
+ * segments after `/api/assets/` (vs three for the legacy form), so the new
+ * and legacy serving routes disambiguate by arity during cutover.
+ */
+export declare function publicUrlForAssetId(assetId: string, filename: string): string;