studiograph 1.3.46 → 1.3.48-beta.0

package/dist/services/workspace-access.js

@@ -0,0 +1,149 @@
+/**
+ * Workspace access service — the single architectural boundary through which
+ * routes resolve a graph (or read an entity) for an identified user.
+ *
+ * Why this exists as a service, not a helper:
+ *   The helpers in `access-control.ts` are correct but opt-in — a route that
+ *   forgets to call `hasRepoAccess()` before `workspaceManager.getGraph()`
+ *   silently bypasses access control. After a security audit flagged this as
+ *   an architectural risk, we moved the "give me a graph for repo X as user U"
+ *   resolution behind this service so the act of getting a graph IS the
+ *   access check. There is no method on this surface that returns a graph
+ *   without first running the check; bypassing it requires reaching past
+ *   the service to `WorkspaceManager.getGraph()` directly, which is what
+ *   review now looks for.
+ *
+ * Routes should call `graphForRead`/`graphForWrite`/`graphForAdmin` instead
+ * of `workspaceManager.getGraph(repo)`. The few internal callers that still
+ * need raw graph access (SessionManager, YjsManager, vector indexer, etc.)
+ * are not user-facing transports and operate with the workspace's own
+ * identity, not a request user — they are explicitly out of scope for this
+ * boundary.
+ */
+import { canWriteRepo, filterWikilinks, getAccessibleEntityIds, getAccessibleRepos, hasRepoAccess, isFolderAdminOrOwner, } from './access-control.js';
+/**
+ * Thrown when an identified user attempts to resolve a graph or read an
+ * entity in a folder they cannot access. The route layer maps `kind` to an
+ * HTTP status: `not_found` → 404 (don't leak existence to non-members),
+ * `forbidden` → 403 (caller can see the folder but lacks the requested role).
+ */
+export class AccessDeniedError extends Error {
+    kind;
+    repoName;
+    code = 'ACCESS_DENIED';
+    constructor(kind, repoName, message) {
+        super(message);
+        this.kind = kind;
+        this.repoName = repoName;
+        this.name = 'AccessDeniedError';
+    }
+}
+export class WorkspaceAccessService {
+    workspaceManager;
+    authService;
+    constructor(workspaceManager, authService) {
+        this.workspaceManager = workspaceManager;
+        this.authService = authService;
+    }
+    /**
+     * Resolve a graph for read. Identified users without read access get a
+     * not_found denial — we deliberately mirror the "folder doesn't exist"
+     * 404 path so non-members can't probe folder existence by status code.
+     * Unidentified callers (API key / open mode) skip the check, matching
+     * legacy web behavior.
+     */
+    graphForRead(user, repoName) {
+        // ENFORCEMENT POINT: every read of repo content goes through here.
+        // Removing this check would let any authenticated user fetch entries
+        // from any folder, including personal/private folders.
+        if (!hasRepoAccess(user, repoName, this.workspaceManager, this.authService)) {
+            throw new AccessDeniedError('not_found', repoName, `Folder "${repoName}" not found`);
+        }
+        return this.workspaceManager.getGraph(repoName);
+    }
+    /**
+     * Resolve a graph for write (create / update / delete entities, move
+     * folders, etc.). A caller who can read but not write gets a forbidden
+     * denial so the UI can render an actionable role-required message.
+     */
+    graphForWrite(user, repoName) {
+        // ENFORCEMENT POINT: write must be checked separately from read because
+        // editor and admin both read but only members with editor/admin role
+        // can write. A future refactor that collapses this into graphForRead
+        // would silently grant write to read-only collaborators.
+        if (!hasRepoAccess(user, repoName, this.workspaceManager, this.authService)) {
+            throw new AccessDeniedError('not_found', repoName, `Folder "${repoName}" not found`);
+        }
+        if (!canWriteRepo(user, repoName, this.workspaceManager, this.authService)) {
+            throw new AccessDeniedError('forbidden', repoName, `You need editor or admin role to modify entries in "${repoName}".`);
+        }
+        return this.workspaceManager.getGraph(repoName);
+    }
+    /**
+     * Resolve a graph for folder-admin operations (delete folder, rename
+     * folder, manage members). Workspace owners are admins on shared folders
+     * but NOT on private/solo folders — see `isFolderAdminOrOwner` for the
+     * full rule. This is enforced separately because some operations (renaming
+     * a folder) are catastrophic if a regular editor can perform them.
+     */
+    graphForAdmin(user, repoName) {
+        // ENFORCEMENT POINT: admin-only operations must clear the folder-admin
+        // bar in addition to read access. Editors must NOT be able to rename or
+        // delete the folder out from under their fellow members.
+        if (!hasRepoAccess(user, repoName, this.workspaceManager, this.authService)) {
+            throw new AccessDeniedError('not_found', repoName, `Folder "${repoName}" not found`);
+        }
+        if (!isFolderAdminOrOwner(user, repoName, this.workspaceManager, this.authService)) {
+            throw new AccessDeniedError('forbidden', repoName, `Folder admin access required for "${repoName}".`);
+        }
+        return this.workspaceManager.getGraph(repoName);
+    }
+    /**
+     * Read a single entity through the access boundary. Provided as a
+     * convenience so routes that just need an entity body don't have to
+     * resolve the graph and call `.get()` themselves — every such call site
+     * was a place a future refactor could accidentally bypass enforcement.
+     */
+    readEntity(user, repoName, entityType, entityId) {
+        // ENFORCEMENT POINT: even single-entity reads must go through the read
+        // gate. Without this, a caller that has the (repo, type, id) tuple from
+        // any source (search results, agent output, log line) could fetch its
+        // body bypassing folder access.
+        const graph = this.graphForRead(user, repoName);
+        return graph.get(entityType, entityId);
+    }
+    /** List repos the user may read. Wraps the helper for symmetry. */
+    listReadableRepos(user) {
+        return getAccessibleRepos(user, this.workspaceManager, this.authService);
+    }
+    /** Set of entity IDs visible to the user across their accessible folders. */
+    listAccessibleEntityIds(user) {
+        return getAccessibleEntityIds(user, this.workspaceManager, this.authService);
+    }
+    /** Filter a wikilink list to only entities the caller can access. */
+    filterWikilinks(wikilinks, accessibleIds) {
+        return filterWikilinks(wikilinks, accessibleIds);
+    }
+    /** Boolean check — for routes that need a 404/200 branch without a graph. */
+    canRead(user, repoName) {
+        return hasRepoAccess(user, repoName, this.workspaceManager, this.authService);
+    }
+    /** Boolean check — for routes that need a 403/200 branch without a graph. */
+    canWrite(user, repoName) {
+        return canWriteRepo(user, repoName, this.workspaceManager, this.authService);
+    }
+    /** Boolean check — for routes that need a 403/200 branch without a graph. */
+    canAdmin(user, repoName) {
+        return isFolderAdminOrOwner(user, repoName, this.workspaceManager, this.authService);
+    }
+}
+/**
+ * Map an AccessDeniedError to an HTTP reply. Routes catch the error at the
+ * top of each handler and call this — keeps the per-route boilerplate to
+ * a single try/catch instead of two checks per access kind.
+ */
+export function sendAccessDenied(reply, err) {
+    const status = err.kind === 'not_found' ? 404 : 403;
+    return reply.status(status).send({ error: err.message });
+}
+//# sourceMappingURL=workspace-access.js.map

package/dist/services/workspace-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-access.js","sourceRoot":"","sources":["../../src/services/workspace-access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAMH,OAAO,EACL,YAAY,EACZ,eAAe,EACf,sBAAsB,EACtB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAI7B;;;;;GAKG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAGxB;IACA;IAHT,IAAI,GAAG,eAAwB,CAAC;IACzC,YACkB,IAA+B,EAC/B,QAAgB,EAChC,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAA2B;QAC/B,aAAQ,GAAR,QAAQ,CAAQ;QAIhC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,sBAAsB;IAEd;IACA;IAFnB,YACmB,gBAAkC,EAClC,WAAwB;QADxB,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEJ;;;;;;OAMG;IACH,YAAY,CAAC,IAA0B,EAAE,QAAgB;QACvD,mEAAmE;QACnE,qEAAqE;QACrE,uDAAuD;QACvD,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,iBAAiB,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,QAAQ,aAAa,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,IAA0B,EAAE,QAAgB;QACxD,wEAAwE;QACxE,qEAAqE;QACrE,qEAAqE;QACrE,yDAAyD;QACzD,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,iBAAiB,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,QAAQ,aAAa,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,iBAAiB,CACzB,WAAW,EACX,QAAQ,EACR,uDAAuD,QAAQ,IAAI,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;OAMG;IACH,aAAa,CAAC,IAA0B,EAAE,QAAgB;QACxD,uEAAuE;QACvE,wEAAwE;QACxE,yDAAyD;QACzD,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,iBAAiB,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,QAAQ,aAAa,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,iBAAiB,CACzB,WAAW,EACX,QAAQ,EACR,qCAAqC,QAAQ,IAAI,CAClD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACH,UAAU,CACR,IAA0B,EAC1B,QAAgB,EAChB,UAAsB,EACtB,QAAgB;QAEhB,uEAAuE;QACvE,wEAAwE;QACxE,sEAAsE;QACtE,gCAAgC;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,mEAAmE;IACnE,iBAAiB,CAAC,IAA0B;QAC1C,OAAO,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3E,CAAC;IAED,6EAA6E;IAC7E,uBAAuB,CAAC,IAA0B;QAChD,OAAO,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/E,CAAC;IAED,qEAAqE;IACrE,eAAe,CAAC,SAAmB,EAAE,aAAiC;QACpE,OAAO,eAAe,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACnD,CAAC;IAED,6EAA6E;IAC7E,OAAO,CAAC,IAA0B,EAAE,QAAgB;QAClD,OAAO,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAChF,CAAC;IAED,6EAA6E;IAC7E,QAAQ,CAAC,IAA0B,EAAE,QAAgB;QACnD,OAAO,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/E,CAAC;IAED,6EAA6E;IAC7E,QAAQ,CAAC,IAA0B,EAAE,QAAgB;QACnD,OAAO,oBAAoB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACvF,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAqC,EAAE,GAAsB;IAC5F,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACpD,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;AAC3D,CAAC"}

package/dist/utils/git.d.ts

@@ -3,13 +3,17 @@
  * Extracted so tests can mock them without mocking the built-in child_process.
  */
 export type PullResult = 'updated' | 'up-to-date' | 'diverged';
-export type PushResult = 'pushed' | 'nothing-to-push' | 'rejected';
+export type PushResult = 'pushed' | 'nothing-to-push' | 'rejected' | 'not-found';
 export interface GitPullOptions {
     /** Basic Auth credentials for the embedded git server (injected via GIT_ASKPASS). */
     credentials?: {
         username: string;
         password: string;
     };
+    /** Extra HTTP headers (e.g. `X-Studiograph-Include-Private: 1`). Each
+     *  is passed via `git -c http.extraHeader=...`. Used for owner-gated
+     *  admin escalation when pulling private folders. */
+    extraHeaders?: string[];
 }
 /**
  * Pull the latest changes in a local git repo using fetch + fast-forward merge.
@@ -43,6 +47,13 @@ export declare function gitHasRemote(repoPath: string): boolean;
  * Set or update the 'origin' remote URL on a local git repo.
  */
 export declare function gitSetRemote(repoPath: string, url: string): void;
+export interface GitPushOptions {
+    /** Extra HTTP headers to send with the git request, e.g.
+     *  `['X-Studiograph-Include-Private: 1']`. Each is passed via
+     *  `git -c http.extraHeader=...`. Used for owner-gated admin
+     *  escalation when pushing to private folders. */
+    extraHeaders?: string[];
+}
 /**
  * Push local commits to origin with Basic Auth credentials via GIT_ASKPASS.
  * Used for pushing to the embedded git server.
@@ -50,7 +61,7 @@ export declare function gitSetRemote(repoPath: string, url: string): void;
 export declare function gitPushWithCredentials(repoPath: string, credentials: {
     username: string;
     password: string;
-}): PushResult;
+}, opts?: GitPushOptions): PushResult;
 export interface GitCloneOptions {
     /** When true, suppress all output and disable interactive prompts (for server use). */
     silent?: boolean;
@@ -59,6 +70,10 @@ export interface GitCloneOptions {
         username: string;
         password: string;
     };
+    /** Extra HTTP headers (e.g. `X-Studiograph-Include-Private: 1`). Each
+     *  is passed via `git -c http.extraHeader=...`. Used for owner-gated
+     *  admin escalation when cloning private folders. */
+    extraHeaders?: string[];
 }
 /**
  * Clone a remote repository to a local path.

package/dist/utils/git.js

@@ -2,7 +2,7 @@
  * Thin wrappers around git shell operations.
  * Extracted so tests can mock them without mocking the built-in child_process.
  */
-import { execSync, spawnSync } from 'child_process';
+import { execFileSync, spawnSync } from 'child_process';
 import { writeFileSync, chmodSync, unlinkSync } from 'fs';
 import { join } from 'path';
 import { tmpdir } from 'os';
@@ -33,9 +33,10 @@ export function gitPull(repoPath, opts) {
     }
     // Fetch — clear credential.helper only when injecting our own credentials so that
     // macOS Keychain / stored tokens continue to work for GitHub remotes.
+    const headerArgs = (opts?.extraHeaders ?? []).flatMap(h => ['-c', `http.extraHeader=${h}`]);
     const fetchArgs = creds
-        ? ['-c', 'credential.helper=', 'fetch', '--prune']
-        : ['fetch', '--prune'];
+        ? ['-c', 'credential.helper=', ...headerArgs, 'fetch', '--prune']
+        : [...headerArgs, 'fetch', '--prune'];
     const fetch = spawnSync('git', fetchArgs, { cwd: repoPath, encoding: 'utf-8', stdio: 'pipe', env });
     if (askpassPath) {
         try {
@@ -72,6 +73,10 @@ export function gitPush(repoPath) {
     if (combined.includes('non-fast-forward') || combined.includes('fetch first') || combined.includes('rejected')) {
         return 'rejected';
     }
+    // See gitPushWithCredentials for the rationale on the soft `not-found` state.
+    if (combined.includes('Repository not found') || combined.includes('not found') || combined.includes('404')) {
+        return 'not-found';
+    }
     throw new Error((combined || `git push failed with exit ${result.status}`).trim());
 }
 /**
@@ -112,7 +117,7 @@ export function gitSetRemote(repoPath, url) {
  * Push local commits to origin with Basic Auth credentials via GIT_ASKPASS.
  * Used for pushing to the embedded git server.
  */
-export function gitPushWithCredentials(repoPath, credentials) {
+export function gitPushWithCredentials(repoPath, credentials, opts = {}) {
     const askpassPath = join(tmpdir(), `.studiograph-askpass-${process.pid}`);
     writeFileSync(askpassPath, [
         '#!/bin/sh',
@@ -127,8 +132,9 @@ export function gitPushWithCredentials(repoPath, credentials) {
         GIT_ASKPASS: askpassPath,
         GIT_TERMINAL_PROMPT: '0',
     };
+    const headerArgs = (opts.extraHeaders ?? []).flatMap(h => ['-c', `http.extraHeader=${h}`]);
     try {
-        const result = spawnSync('git', ['-c', 'credential.helper=', 'push', '-u', 'origin', 'main'], {
+        const result = spawnSync('git', ['-c', 'credential.helper=', ...headerArgs, 'push', '-u', 'origin', 'main'], {
             cwd: repoPath, encoding: 'utf-8', env,
         });
         if (result.status === 0) {
@@ -139,6 +145,15 @@ export function gitPushWithCredentials(repoPath, credentials) {
         if (combined.includes('non-fast-forward') || combined.includes('fetch first') || combined.includes('rejected')) {
             return 'rejected';
         }
+        // `not-found` covers the case where the local clone carries a folder
+        // that doesn't exist on the server for the current user — a stale
+        // clone that pre-dates an access tightening, or a personal folder
+        // owned by another team member that workspace.json still references.
+        // Surface it as a soft state so callers can skip + suggest cleanup
+        // instead of failing the whole push run.
+        if (combined.includes('Repository not found') || combined.includes('not found') || combined.includes('404')) {
+            return 'not-found';
+        }
         throw new Error((combined || `git push failed with exit ${result.status}`).trim());
     }
     finally {
@@ -185,8 +200,9 @@ export function gitClone(remoteUrl, localPath, opts) {
     }
     // If !silent and no credentials/token, leave stdio inherited so Git can prompt the user
     const stdio = (hasCredentials || silent) ? 'pipe' : 'inherit';
+    const headerArgs = (opts?.extraHeaders ?? []).flatMap(h => ['-c', `http.extraHeader=${h}`]);
     try {
-        execSync(`git -c credential.helper= clone "${remoteUrl}" "${localPath}"`, { stdio, env, timeout: 120_000 });
+        execFileSync('git', ['-c', 'credential.helper=', ...headerArgs, 'clone', remoteUrl, localPath], { stdio, env, timeout: 120_000 });
     }
     finally {
         // Clean up askpass script
@@ -204,7 +220,7 @@ export function gitClone(remoteUrl, localPath, opts) {
  */
 export function getGitConfig(key) {
     try {
-        return execSync(`git config ${key}`, { stdio: 'pipe' }).toString().trim() || undefined;
+        return execFileSync('git', ['config', key], { stdio: 'pipe' }).toString().trim() || undefined;
     }
     catch {
         return undefined;

package/dist/utils/git.js.map

@@ -1 +1 @@
-{"version":3,"file":"git.js","sourceRoot":"","sources":["../../src/utils/git.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAc,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAS5B;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CAAC,QAAgB,EAAE,IAAqB;IAC7D,MAAM,KAAK,GAAG,IAAI,EAAE,WAAW,CAAC;IAChC,IAAI,WAA+B,CAAC;IACpC,MAAM,GAAG,GAA2B,EAAE,GAAG,OAAO,CAAC,GAA6B,EAAE,CAAC;IAEjF,IAAI,KAAK,EAAE,CAAC;QACV,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACpE,aAAa,CAAC,WAAW,EAAE;YACzB,WAAW;YACX,cAAc;YACd,0BAA0B,KAAK,CAAC,QAAQ,MAAM;YAC9C,cAAc,KAAK,CAAC,QAAQ,MAAM;YAClC,MAAM;SACP,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACvB,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC9B,GAAG,CAAC,WAAW,GAAG,WAAW,CAAC;QAC9B,GAAG,CAAC,mBAAmB,GAAG,GAAG,CAAC;IAChC,CAAC;IAED,kFAAkF;IAClF,sEAAsE;IACtE,MAAM,SAAS,GAAG,KAAK;QACrB,CAAC,CAAC,CAAC,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,SAAS,CAAC;QAClD,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACpG,IAAI,WAAW,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IAAC,CAAC;IAE/E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,qEAAqE;IACrE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,CAAC,EAAE;QACnE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM;KAChD,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YAC/E,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,QAAgB;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/C,OAAO,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC;IACnF,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/C,IAAI,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/G,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,CAAC,QAAQ,IAAI,6BAA6B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACrF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACjG,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAChE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,QAAgB;IACxC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAClG,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACvG,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAChE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,GAAW;IACxD,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,SAAS,EAAE,CAAC;QACd,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/F,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,WAAmD;IAEnD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1E,aAAa,CAAC,WAAW,EAAE;QACzB,WAAW;QACX,cAAc;QACd,0BAA0B,WAAW,CAAC,QAAQ,MAAM;QACpD,cAAc,WAAW,CAAC,QAAQ,MAAM;QACxC,MAAM;KACP,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IACvB,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAE9B,MAAM,GAAG,GAA2B;QAClC,GAAG,OAAO,CAAC,GAA6B;QACxC,WAAW,EAAE,WAAW;QACxB,mBAAmB,EAAE,GAAG;KACzB,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;YAC5F,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG;SACtC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/C,OAAO,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC;QACnF,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/C,IAAI,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/G,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,CAAC,QAAQ,IAAI,6BAA6B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrF,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AASD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,QAAQ,CAAC,SAAiB,EAAE,SAAiB,EAAE,IAAsB;IACnF,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,EAAE,WAAW,CAAC;IAChC,MAAM,GAAG,GAA2B,EAAE,GAAG,OAAO,CAAC,GAA6B,EAAE,CAAC;IAEjF,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,IAAI,KAAK,EAAE,CAAC;QACV,6EAA6E;QAC7E,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1E,kFAAkF;QAClF,aAAa,CAAC,WAAW,EAAE;YACzB,WAAW;YACX,cAAc;YACd,0BAA0B,KAAK,CAAC,QAAQ,MAAM;YAC9C,cAAc,KAAK,CAAC,QAAQ,MAAM;YAClC,MAAM;SACP,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACvB,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC9B,GAAG,CAAC,WAAW,GAAG,WAAW,CAAC;QAC9B,GAAG,CAAC,mBAAmB,GAAG,GAAG,CAAC;QAC9B,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;SAAM,IAAI,MAAM,EAAE,CAAC;QAClB,GAAG,CAAC,mBAAmB,GAAG,GAAG,CAAC;IAChC,CAAC;IACD,wFAAwF;IAExF,MAAM,KAAK,GAAG,CAAC,cAAc,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,MAAe,CAAC,CAAC,CAAC,SAAkB,CAAC;IAEhF,IAAI,CAAC;QACH,QAAQ,CAAC,oCAAoC,SAAS,MAAM,SAAS,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9G,CAAC;YAAS,CAAC;QACT,0BAA0B;QAC1B,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACpB,IAAI,CAAC;gBAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,cAAc,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../../src/utils/git.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAc,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAa5B;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CAAC,QAAgB,EAAE,IAAqB;IAC7D,MAAM,KAAK,GAAG,IAAI,EAAE,WAAW,CAAC;IAChC,IAAI,WAA+B,CAAC;IACpC,MAAM,GAAG,GAA2B,EAAE,GAAG,OAAO,CAAC,GAA6B,EAAE,CAAC;IAEjF,IAAI,KAAK,EAAE,CAAC;QACV,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACpE,aAAa,CAAC,WAAW,EAAE;YACzB,WAAW;YACX,cAAc;YACd,0BAA0B,KAAK,CAAC,QAAQ,MAAM;YAC9C,cAAc,KAAK,CAAC,QAAQ,MAAM;YAClC,MAAM;SACP,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACvB,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC9B,GAAG,CAAC,WAAW,GAAG,WAAW,CAAC;QAC9B,GAAG,CAAC,mBAAmB,GAAG,GAAG,CAAC;IAChC,CAAC;IAED,kFAAkF;IAClF,sEAAsE;IACtE,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5F,MAAM,SAAS,GAAG,KAAK;QACrB,CAAC,CAAC,CAAC,IAAI,EAAE,oBAAoB,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC;QACjE,CAAC,CAAC,CAAC,GAAG,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACpG,IAAI,WAAW,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IAAC,CAAC;IAE/E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,qEAAqE;IACrE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,CAAC,EAAE;QACnE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM;KAChD,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YAC/E,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,QAAgB;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/C,OAAO,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC;IACnF,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/C,IAAI,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/G,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,8EAA8E;IAC9E,IAAI,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5G,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,CAAC,QAAQ,IAAI,6BAA6B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACrF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACjG,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAChE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,QAAgB;IACxC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAClG,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACvG,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAChE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,GAAW;IACxD,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,SAAS,EAAE,CAAC;QACd,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/F,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAUD;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,WAAmD,EACnD,OAAuB,EAAE;IAEzB,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1E,aAAa,CAAC,WAAW,EAAE;QACzB,WAAW;QACX,cAAc;QACd,0BAA0B,WAAW,CAAC,QAAQ,MAAM;QACpD,cAAc,WAAW,CAAC,QAAQ,MAAM;QACxC,MAAM;KACP,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IACvB,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAE9B,MAAM,GAAG,GAA2B;QAClC,GAAG,OAAO,CAAC,GAA6B;QACxC,WAAW,EAAE,WAAW;QACxB,mBAAmB,EAAE,GAAG;KACzB,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,oBAAoB,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;YAC3G,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG;SACtC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/C,OAAO,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC;QACnF,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/C,IAAI,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/G,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,qEAAqE;QACrE,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,mEAAmE;QACnE,yCAAyC;QACzC,IAAI,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5G,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,CAAC,QAAQ,IAAI,6BAA6B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrF,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAaD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,QAAQ,CAAC,SAAiB,EAAE,SAAiB,EAAE,IAAsB;IACnF,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,EAAE,WAAW,CAAC;IAChC,MAAM,GAAG,GAA2B,EAAE,GAAG,OAAO,CAAC,GAA6B,EAAE,CAAC;IAEjF,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,IAAI,KAAK,EAAE,CAAC;QACV,6EAA6E;QAC7E,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1E,kFAAkF;QAClF,aAAa,CAAC,WAAW,EAAE;YACzB,WAAW;YACX,cAAc;YACd,0BAA0B,KAAK,CAAC,QAAQ,MAAM;YAC9C,cAAc,KAAK,CAAC,QAAQ,MAAM;YAClC,MAAM;SACP,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACvB,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC9B,GAAG,CAAC,WAAW,GAAG,WAAW,CAAC;QAC9B,GAAG,CAAC,mBAAmB,GAAG,GAAG,CAAC;QAC9B,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;SAAM,IAAI,MAAM,EAAE,CAAC;QAClB,GAAG,CAAC,mBAAmB,GAAG,GAAG,CAAC;IAChC,CAAC;IACD,wFAAwF;IAExF,MAAM,KAAK,GAAG,CAAC,cAAc,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,MAAe,CAAC,CAAC,CAAC,SAAkB,CAAC;IAEhF,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5F,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,oBAAoB,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACpI,CAAC;YAAS,CAAC;QACT,0BAA0B;QAC1B,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACpB,IAAI,CAAC;gBAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IAChG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/utils/log.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Phase 11 — centralized logger.
+ *
+ * Single import surface for every log call site:
+ *
+ *   import { log } from '../../utils/log.js';
+ *   log.info('starting up');
+ *   log.warn('something looks off:', err);
+ *
+ * All output flows through `sanitize()` from the server middleware so
+ * registry-listed secrets, prefix-shaped tokens, URL credentials, and
+ * JSON-quoted secret fields are redacted before reaching stdout/stderr.
+ *
+ * Modes:
+ *   - Production (`NODE_ENV === 'production'` or `RAILWAY_ENVIRONMENT` set):
+ *     sanitize() is always applied.
+ *   - Development (anything else): raw passthrough — easier to debug
+ *     with real values visible in your own terminal.
+ *   - Escape hatch (`STUDIOGRAPH_LOG_RAW=1`): force raw mode regardless of
+ *     environment. Useful when troubleshooting redaction itself.
+ *
+ * Why expose `log.*` instead of patching console.* directly here? Two
+ * reasons. First, the console patch (in serve.ts) is only safe to apply
+ * in production — local dev needs real console for debugging. Second,
+ * the explicit `log.*` import surface is what the `no-raw-console` lint
+ * rule keys off of: any direct `console.*` call outside this file is a
+ * lint warning telling the author to migrate.
+ */
+/**
+ * The exported logger. Mirrors console's API one-to-one so migration is
+ * a search-and-replace: `console.X(...) → log.X(...)`.
+ *
+ * `log.debug` exists for symmetry; it's silenced in production unless
+ * `STUDIOGRAPH_VERBOSE=1`.
+ */
+export declare const log: {
+    info: (...args: unknown[]) => void;
+    warn: (...args: unknown[]) => void;
+    error: (...args: unknown[]) => void;
+    debug: (...args: unknown[]) => void;
+};
+export declare function installConsolePatch(): void;

package/dist/utils/log.js

@@ -0,0 +1,137 @@
+/**
+ * Phase 11 — centralized logger.
+ *
+ * Single import surface for every log call site:
+ *
+ *   import { log } from '../../utils/log.js';
+ *   log.info('starting up');
+ *   log.warn('something looks off:', err);
+ *
+ * All output flows through `sanitize()` from the server middleware so
+ * registry-listed secrets, prefix-shaped tokens, URL credentials, and
+ * JSON-quoted secret fields are redacted before reaching stdout/stderr.
+ *
+ * Modes:
+ *   - Production (`NODE_ENV === 'production'` or `RAILWAY_ENVIRONMENT` set):
+ *     sanitize() is always applied.
+ *   - Development (anything else): raw passthrough — easier to debug
+ *     with real values visible in your own terminal.
+ *   - Escape hatch (`STUDIOGRAPH_LOG_RAW=1`): force raw mode regardless of
+ *     environment. Useful when troubleshooting redaction itself.
+ *
+ * Why expose `log.*` instead of patching console.* directly here? Two
+ * reasons. First, the console patch (in serve.ts) is only safe to apply
+ * in production — local dev needs real console for debugging. Second,
+ * the explicit `log.*` import surface is what the `no-raw-console` lint
+ * rule keys off of: any direct `console.*` call outside this file is a
+ * lint warning telling the author to migrate.
+ */
+import { sanitize } from '../server/middleware/sanitize.js';
+/**
+ * Decide whether the current process should redact log output. Resolved
+ * dynamically on every call so tests can flip env vars between cases.
+ */
+function shouldRedact() {
+    if (process.env.STUDIOGRAPH_LOG_RAW === '1')
+        return false;
+    return (process.env.NODE_ENV === 'production' ||
+        !!process.env.RAILWAY_ENVIRONMENT);
+}
+/**
+ * Sanitize a console-style arg list. Strings flow through sanitize();
+ * objects are JSON.stringified, sanitized, and JSON.parsed back into a
+ * lightly-modified shape so downstream consumers (Fastify logger, error
+ * serializers) can still walk them. Non-serializable args fall back to
+ * String() coercion.
+ */
+function maybeSanitizeArgs(args) {
+    if (!shouldRedact())
+        return args;
+    return args.map((a) => {
+        if (typeof a === 'string')
+            return sanitize(a);
+        if (a instanceof Error) {
+            // Construct a new Error with sanitized message + stack so the
+            // shape survives downstream `instanceof Error` checks. Note: we
+            // can't mutate the original because Error.message is read-only
+            // on some V8 builds.
+            const e = new Error(sanitize(a.message));
+            if (a.stack)
+                e.stack = sanitize(a.stack);
+            // Preserve any additional properties (e.g. `code`).
+            Object.assign(e, { ...a });
+            return e;
+        }
+        if (a && typeof a === 'object') {
+            try {
+                return JSON.parse(sanitize(JSON.stringify(a)));
+            }
+            catch {
+                return sanitize(String(a));
+            }
+        }
+        return a;
+    });
+}
+/**
+ * The exported logger. Mirrors console's API one-to-one so migration is
+ * a search-and-replace: `console.X(...) → log.X(...)`.
+ *
+ * `log.debug` exists for symmetry; it's silenced in production unless
+ * `STUDIOGRAPH_VERBOSE=1`.
+ */
+export const log = {
+    info: (...args) => {
+        // eslint-disable-next-line no-console
+        console.log(...maybeSanitizeArgs(args));
+    },
+    warn: (...args) => {
+        // eslint-disable-next-line no-console
+        console.warn(...maybeSanitizeArgs(args));
+    },
+    error: (...args) => {
+        // eslint-disable-next-line no-console
+        console.error(...maybeSanitizeArgs(args));
+    },
+    debug: (...args) => {
+        if (shouldRedact() && process.env.STUDIOGRAPH_VERBOSE !== '1')
+            return;
+        // eslint-disable-next-line no-console
+        console.debug(...maybeSanitizeArgs(args));
+    },
+};
+/**
+ * Idempotent installer for the production console patch. Wraps the four
+ * console methods so any third-party (or yet-to-migrate) callsite that
+ * still hits `console.*` directly also runs through sanitize() in prod.
+ *
+ * Called once at boot from `serve.ts` after the master key is loaded
+ * (waiting until after master-key load avoids redacting the master-key
+ * info line during normal boot). Safe to call multiple times — second
+ * call no-ops because the patch records itself on a process-level
+ * Symbol.
+ */
+const CONSOLE_PATCHED = Symbol.for('studiograph.console.patched');
+export function installConsolePatch() {
+    if (!shouldRedact())
+        return;
+    const g = globalThis;
+    if (g[CONSOLE_PATCHED])
+        return;
+    g[CONSOLE_PATCHED] = true;
+    // Capture the originals so the patch can hand the sanitized args back
+    // to the underlying writer.
+    const orig = {
+        log: console.log.bind(console),
+        info: console.info.bind(console),
+        warn: console.warn.bind(console),
+        error: console.error.bind(console),
+        debug: console.debug.bind(console),
+    };
+    console.log = (...args) => orig.log(...maybeSanitizeArgs(args));
+    console.info = (...args) => orig.info(...maybeSanitizeArgs(args));
+    console.warn = (...args) => orig.warn(...maybeSanitizeArgs(args));
+    console.error = (...args) => orig.error(...maybeSanitizeArgs(args));
+    console.debug = (...args) => orig.debug(...maybeSanitizeArgs(args));
+}
+//# sourceMappingURL=log.js.map

package/dist/utils/log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../../src/utils/log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAE5D;;;GAGG;AACH,SAAS,YAAY;IACnB,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QACrC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAClC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,IAAe;IACxC,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACpB,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;YACvB,8DAA8D;YAC9D,gEAAgE;YAChE,+DAA+D;YAC/D,qBAAqB;YACrB,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,CAAC,KAAK;gBAAG,CAAgC,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACzE,oDAAoD;YACpD,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3B,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG;IACjB,IAAI,EAAE,CAAC,GAAG,IAAe,EAAQ,EAAE;QACjC,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,EAAE,CAAC,GAAG,IAAe,EAAQ,EAAE;QACjC,sCAAsC;QACtC,OAAO,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,EAAE,CAAC,GAAG,IAAe,EAAQ,EAAE;QAClC,sCAAsC;QACtC,OAAO,CAAC,KAAK,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,KAAK,EAAE,CAAC,GAAG,IAAe,EAAQ,EAAE;QAClC,IAAI,YAAY,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG;YAAE,OAAO;QACtE,sCAAsC;QACtC,OAAO,CAAC,KAAK,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,CAAC;CACF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;AAElE,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO;IAC5B,MAAM,CAAC,GAAG,UAAgD,CAAC;IAC3D,IAAI,CAAC,CAAC,eAAe,CAAC;QAAE,OAAO;IAC/B,CAAC,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC;IAE1B,sEAAsE;IACtE,4BAA4B;IAC5B,MAAM,IAAI,GAAG;QACX,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;QAC9B,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;QAChC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;QAChC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;QAClC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;KACnC,CAAC;IAEF,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,IAAe,EAAQ,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,IAAe,EAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IACnF,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,IAAe,EAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IACnF,OAAO,CAAC,KAAK,GAAG,CAAC,GAAG,IAAe,EAAQ,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IACrF,OAAO,CAAC,KAAK,GAAG,CAAC,GAAG,IAAe,EAAQ,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;AACvF,CAAC"}

package/dist/utils/preflight.js

@@ -4,7 +4,7 @@
  * Run at the start of init, start, and join to surface missing dependencies
  * as clear, actionable messages before any command logic executes.
  */
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 import { log } from '@clack/prompts';
 /** Minimum supported Node.js major version */
 export const MIN_NODE_MAJOR = 20;
@@ -13,7 +13,7 @@ export const MIN_NODE_MAJOR = 20;
  */
 export function checkGit() {
     try {
-        const output = execSync('git --version', { stdio: 'pipe' }).toString().trim();
+        const output = execFileSync('git', ['--version'], { stdio: 'pipe' }).toString().trim();
         const match = output.match(/git version (\S+)/);
         const version = match ? match[1] : output;
         return { passed: true, message: `git ${version} found` };

package/dist/utils/preflight.js.map

@@ -1 +1 @@
-{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../src/utils/preflight.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AAErC,8CAA8C;AAC9C,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAQjC;;GAEG;AACH,MAAM,UAAU,QAAQ;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,OAAO,QAAQ,EAAE,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,eAAe;YACxB,IAAI,EAAE,sCAAsC;SAC7C,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS;IACvB,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,KAAK,IAAI,cAAc,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,OAAO,QAAQ,EAAE,CAAC;IAChE,CAAC;IACD,OAAO;QACL,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,YAAY,OAAO,0BAA0B,cAAc,IAAI;QACxE,IAAI,EAAE,oBAAoB,cAAc,2BAA2B;KACpE,CAAC;AACJ,CAAC;AAMD;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,WAA6B,EAAE;IAC1D,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,SAAS,EAAE,CAAC;IAE/B,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrB,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACtB,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,OAAO,SAAS,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../src/utils/preflight.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AAErC,8CAA8C;AAC9C,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAQjC;;GAEG;AACH,MAAM,UAAU,QAAQ;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QACvF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,OAAO,QAAQ,EAAE,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,eAAe;YACxB,IAAI,EAAE,sCAAsC;SAC7C,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS;IACvB,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,KAAK,IAAI,cAAc,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,OAAO,QAAQ,EAAE,CAAC;IAChE,CAAC;IACD,OAAO;QACL,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,YAAY,OAAO,0BAA0B,cAAc,IAAI;QACxE,IAAI,EAAE,oBAAoB,cAAc,2BAA2B;KACpE,CAAC;AACJ,CAAC;AAMD;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,WAA6B,EAAE;IAC1D,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,SAAS,EAAE,CAAC;IAE/B,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrB,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACtB,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,OAAO,SAAS,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC;AAC/C,CAAC"}

package/dist/utils/version-checker.d.ts

@@ -1,23 +1,16 @@
 /**
- * Version checking utility
+ * CLI version helper.
  *
- * Provides lightweight version checking that can be called by commands
- * to notify users of available updates.
- */
-/**
- * Get current CLI version from package.json
+ * Pre-C4 this module also contained `checkForUpdate` + `notifyUpdateAvailable`
+ * which printed an "update available" banner pointing at `studiograph update`.
+ * Both the banner and the `update` command were removed in cli-owner-audit
+ * Phase C4 once we standardized on `npx -y studiograph@<exact-version>` as
+ * the canonical invocation — there's no global install to upgrade.
+ *
+ * Only `getCurrentVersion` survives: `serve` reads it on boot for the
+ * WebSocket hub's version-stamp, and `redeploy` has its own copy in
+ * src/cli/railway-pin.ts. Keep this file small enough that it's obviously
+ * a leftover-by-design rather than a place to grow new logic.
  */
+/** Current CLI version, read from the bundled package.json. */
 export declare function getCurrentVersion(): string;
-/**
- * Check if an update is available (non-blocking, cached)
- * Returns update info or null if up-to-date or check failed
- */
-export declare function checkForUpdate(): Promise<{
-    current: string;
-    latest: string;
-} | null>;
-/**
- * Print update notification to console (if update available)
- * Call this in commands to notify users about updates
- */
-export declare function notifyUpdateAvailable(): Promise<void>;