studiograph 1.3.47 → 1.3.48-beta.1

package/dist/cli/commands/admin/audit.js

@@ -0,0 +1,174 @@
+/**
+ * studiograph audit — read-only operator view of the append-only audit log.
+ *
+ *   studiograph audit list [filters]
+ *     --key <pattern>            Filter by key name (exact match)
+ *     --actor <user-id>          Filter by actor user-id
+ *     --action <action>          Filter by action type
+ *                                (set|delete|test|describe|migrate|...)
+ *     --since <iso-date>         Only events at-or-after this time
+ *     --until <iso-date>         Only events at-or-before this time
+ *     --limit <n>                Page size (default 50, max 500)
+ *     --offset <n>               Pagination offset
+ *     --format <table|json>      Output format (default table)
+ *
+ * Audit reads aren't audited themselves (append-only log; reading
+ * doesn't change state). The UI used to surface this as a Settings →
+ * Audit Log tab; removed because filtering and exporting are much
+ * better in a terminal.
+ */
+import { Command } from 'commander';
+import { log } from '@clack/prompts';
+import { homedir } from 'os';
+import { existsSync } from 'fs';
+import { join } from 'path';
+import { SqliteEncryptedStore, loadMasterKey, loadPreviousMasterKey, setSecretStore, } from '../../../core/secrets/index.js';
+function openStore() {
+    const loaded = loadMasterKey();
+    const previous = loadPreviousMasterKey();
+    const sgRoot = process.env.RAILWAY_ENVIRONMENT && existsSync('/workspace')
+        ? '/workspace'
+        : join(homedir(), '.studiograph');
+    const dbPath = join(sgRoot, 'secrets.db');
+    if (!existsSync(dbPath)) {
+        log.error(`Secrets store not found at ${dbPath}`);
+        log.info('Run `studiograph init` first, or start `studiograph serve` to initialize the store.');
+        process.exit(1);
+    }
+    const store = new SqliteEncryptedStore({
+        dbPath,
+        masterKey: loaded.key,
+        previousMasterKey: previous,
+    });
+    setSecretStore(store);
+    return store;
+}
+function parseTs(v) {
+    if (!v)
+        return undefined;
+    const n = Number(v);
+    if (Number.isFinite(n) && n > 0)
+        return n;
+    const d = Date.parse(v);
+    return Number.isFinite(d) ? d : undefined;
+}
+function fmtTs(ms) {
+    return new Date(ms).toISOString();
+}
+function fmtActor(row) {
+    return row.actor_type === 'user'
+        ? `user:${row.actor_user_id ?? '?'}`
+        : `system:${row.actor_system_id ?? '?'}`;
+}
+function fmtTable(rows) {
+    if (rows.length === 0)
+        return '';
+    const cols = Object.keys(rows[0]);
+    const widths = cols.map((c) => Math.max(c.length, ...rows.map((r) => r[c]?.length ?? 0)));
+    const header = cols.map((c, i) => c.padEnd(widths[i])).join('  ');
+    const sep = widths.map((w) => '─'.repeat(w)).join('  ');
+    const body = rows.map((r) => cols.map((c, i) => (r[c] ?? '').padEnd(widths[i])).join('  ')).join('\n');
+    return `${header}\n${sep}\n${body}`;
+}
+export const auditCommand = new Command('audit')
+    .description('Read the append-only audit log (formerly the Settings → Audit Log tab)');
+auditCommand
+    .command('list')
+    .description('List recent audit events, newest first. Filters compose with AND.')
+    .option('--key <key>', 'Filter by key name (exact match)')
+    .option('--actor <user-id>', 'Filter by actor user-id')
+    .option('--actor-type <type>', 'Filter by actor type: user or system')
+    .option('--action <action>', 'Filter by action (set, delete, test, describe, migrate, decrypt_fail, rotate_master, bundle_export, bundle_import)')
+    .option('--since <iso-date>', 'Only events at-or-after this time (ISO date or epoch ms)')
+    .option('--until <iso-date>', 'Only events at-or-before this time (ISO date or epoch ms)')
+    .option('--limit <n>', 'Page size, default 50, max 500', '50')
+    .option('--offset <n>', 'Pagination offset', '0')
+    .option('--format <format>', 'Output format: table (default) or json', 'table')
+    .action(async (opts) => {
+    const store = openStore();
+    try {
+        const where = [];
+        const params = [];
+        if (opts.key) {
+            where.push('key = ?');
+            params.push(opts.key);
+        }
+        if (opts.actor) {
+            where.push('actor_user_id = ?');
+            params.push(opts.actor);
+        }
+        if (opts.actorType) {
+            where.push('actor_type = ?');
+            params.push(opts.actorType);
+        }
+        if (opts.action) {
+            where.push('action = ?');
+            params.push(opts.action);
+        }
+        const since = parseTs(opts.since);
+        const until = parseTs(opts.until);
+        if (since !== undefined) {
+            where.push('ts >= ?');
+            params.push(since);
+        }
+        if (until !== undefined) {
+            where.push('ts <= ?');
+            params.push(until);
+        }
+        const limit = Math.min(Math.max(parseInt(opts.limit, 10) || 50, 1), 500);
+        const offset = Math.max(parseInt(opts.offset, 10) || 0, 0);
+        const sql = `SELECT id, ts, actor_type, actor_user_id, actor_system_id, action,
+                key, success, ip, user_agent, detail_json
+           FROM audit_log
+          ${where.length ? `WHERE ${where.join(' AND ')}` : ''}
+          ORDER BY ts DESC
+          LIMIT ? OFFSET ?`;
+        // `store.db` is private; the route code already reaches in via `(store as any).db`
+        // and we follow the same pattern. Refactoring the store to expose a public
+        // query helper is out of scope for this CLI.
+        const rows = (store.db
+            .prepare(sql)
+            .all(...params, limit, offset));
+        const totalRow = (store.db
+            .prepare(`SELECT COUNT(*) AS n FROM audit_log ${where.length ? `WHERE ${where.join(' AND ')}` : ''}`)
+            .get(...params));
+        if (opts.format === 'json') {
+            console.log(JSON.stringify({
+                total: totalRow.n,
+                limit,
+                offset,
+                items: rows.map((r) => ({
+                    id: r.id,
+                    ts: r.ts,
+                    actor_type: r.actor_type,
+                    actor_user_id: r.actor_user_id,
+                    actor_system_id: r.actor_system_id,
+                    action: r.action,
+                    key: r.key,
+                    success: !!r.success,
+                    ip: r.ip,
+                    user_agent: r.user_agent,
+                    detail: r.detail_json ? JSON.parse(r.detail_json) : null,
+                })),
+            }, null, 2));
+            return;
+        }
+        if (rows.length === 0) {
+            log.info(`No audit events found${where.length ? ' for the given filters' : ''}.`);
+            return;
+        }
+        const tableRows = rows.map((r) => ({
+            time: fmtTs(r.ts),
+            actor: fmtActor(r),
+            action: r.action,
+            key: r.key ?? '—',
+            result: r.success ? 'ok' : 'fail',
+        }));
+        console.log(fmtTable(tableRows));
+        console.log(`\nShowing ${rows.length} of ${totalRow.n} events (offset=${offset}, limit=${limit})`);
+    }
+    finally {
+        store.close();
+    }
+});
+//# sourceMappingURL=audit.js.map

package/dist/cli/commands/admin/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../../src/cli/commands/admin/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,qBAAqB,EACrB,cAAc,GACf,MAAM,gCAAgC,CAAC;AAExC,SAAS,SAAS;IAChB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,UAAU,CAAC,YAAY,CAAC;QACxE,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;QAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,oBAAoB,CAAC;QACrC,MAAM;QACN,SAAS,EAAE,MAAM,CAAC,GAAG;QACrB,iBAAiB,EAAE,QAAQ;KAC5B,CAAC,CAAC;IACH,cAAc,CAAC,KAAK,CAAC,CAAC;IACtB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,CAAqB;IACpC,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,QAAQ,CAAC,GAAa;IAC7B,OAAO,GAAG,CAAC,UAAU,KAAK,MAAM;QAC9B,CAAC,CAAC,QAAQ,GAAG,CAAC,aAAa,IAAI,GAAG,EAAE;QACpC,CAAC,CAAC,UAAU,GAAG,CAAC,eAAe,IAAI,GAAG,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,IAAmC;IACnD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvG,OAAO,GAAG,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE,CAAC;AACtC,CAAC;AAgBD,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;KAC7C,WAAW,CAAC,wEAAwE,CAAC,CAAC;AAEzF,YAAY;KACT,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,mEAAmE,CAAC;KAChF,MAAM,CAAC,aAAa,EAAE,kCAAkC,CAAC;KACzD,MAAM,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;KACtD,MAAM,CAAC,qBAAqB,EAAE,sCAAsC,CAAC;KACrE,MAAM,CAAC,mBAAmB,EAAE,oHAAoH,CAAC;KACjJ,MAAM,CAAC,oBAAoB,EAAE,0DAA0D,CAAC;KACxF,MAAM,CAAC,oBAAoB,EAAE,2DAA2D,CAAC;KACzF,MAAM,CAAC,aAAa,EAAE,gCAAgC,EAAE,IAAI,CAAC;KAC7D,MAAM,CAAC,cAAc,EAAE,mBAAmB,EAAE,GAAG,CAAC;KAChD,MAAM,CAAC,mBAAmB,EAAE,wCAAwC,EAAE,OAAO,CAAC;KAC9E,MAAM,CAAC,KAAK,EAAE,IAUd,EAAE,EAAE;IACH,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAC/D,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAC7E,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAClF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QACxE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QACvE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAEvE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAE3D,MAAM,GAAG,GACP;;;YAGI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;;2BAEnC,CAAC;QACtB,mFAAmF;QACnF,2EAA2E;QAC3E,6CAA6C;QAC7C,MAAM,IAAI,GAAG,CAAE,KAAyF,CAAC,EAAE;aACxG,OAAO,CAAC,GAAG,CAAC;aACZ,GAAG,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAe,CAAC;QAEhD,MAAM,QAAQ,GAAG,CAAE,KAA4F,CAAC,EAAE;aAC/G,OAAO,CAAC,uCAAuC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;aACpG,GAAG,CAAC,GAAG,MAAM,CAAC,CAAkB,CAAC;QAEpC,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;gBACzB,KAAK,EAAE,QAAQ,CAAC,CAAC;gBACjB,KAAK;gBACL,MAAM;gBACN,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACtB,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,UAAU,EAAE,CAAC,CAAC,UAAU;oBACxB,aAAa,EAAE,CAAC,CAAC,aAAa;oBAC9B,eAAe,EAAE,CAAC,CAAC,eAAe;oBAClC,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO;oBACpB,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,UAAU,EAAE,CAAC,CAAC,UAAU;oBACxB,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;iBACzD,CAAC,CAAC;aACJ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,IAAI,CAAC,wBAAwB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACjB,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;YAClB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG;YACjB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;SAClC,CAAC,CAAC,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,MAAM,OAAO,QAAQ,CAAC,CAAC,mBAAmB,MAAM,WAAW,KAAK,GAAG,CAAC,CAAC;IACrG,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/cli/commands/admin/backup.d.ts

@@ -0,0 +1,54 @@
+/**
+ * studiograph admin backup — produce a passphrase-wrapped, manifest-aware
+ * snapshot of the entire local workspace.
+ *
+ * Pairs with `admin restore`. Distinct from `clone`:
+ *   - `clone` pulls from a running server; strips machine-specific config
+ *     (r2_config, railway, master-key, JWT secret); good for setting up
+ *     a new dev machine.
+ *   - `admin backup` snapshots the local workspace; includes secrets.db,
+ *     auth.db, r2_config, railway IDs, and a manifest of the Railway env
+ *     vars (master key, JWT secret) the owner provides at backup time;
+ *     good for "server is dead, restore me."
+ *
+ * Bundle contents (encrypted as a single .sgbackup file):
+ *   - manifest.json — env-var values + Railway IDs + workspace name + ts
+ *   - workspace/ — tar of the workspace directory, minus
+ *     node_modules/, .DS_Store, and any *.log files
+ *
+ * Crypto: passphrase → scrypt → key → xchacha20poly1305(tar.gz).
+ * See [src/cli/crypto-bundle.ts] for the wire format.
+ *
+ * Refuses to write the bundle to a destination directory unless it
+ * exists with mode 0700, or is being created (we make it 0700). Bundle
+ * file is written with mode 0600. Defense against world-readable backups
+ * that contain bcrypt hashes from auth.db.
+ */
+import { Command } from 'commander';
+interface BackupManifest {
+    workspace_name: string;
+    created_at: string;
+    format_version: 1;
+    /** Railway-side env vars the operator supplied at backup time. The
+     *  backup intentionally re-prompts for these (rather than reading from
+     *  the workspace's secrets.db) so a single passphrase-wrapped bundle
+     *  carries everything restore needs. */
+    env: {
+        STUDIOGRAPH_MASTER_KEY: string;
+        STUDIOGRAPH_JWT_SECRET: string;
+    };
+    /** Railway link, if any. Each field is optional in workspace.json
+     *  schema, so the manifest carries them as optional too — restore
+     *  reports the gap if a value is missing rather than rejecting the
+     *  whole bundle. */
+    railway?: {
+        project_id?: string;
+        service_id?: string;
+        environment_id?: string;
+    };
+    /** Cosmetic only — restore uses this to print "this bundle is from
+     *  workspace X, created Y". Does not affect the restore behavior. */
+    notes?: string;
+}
+export declare const adminBackupCommand: Command;
+export type { BackupManifest };

package/dist/cli/commands/admin/backup.js

@@ -0,0 +1,207 @@
+/**
+ * studiograph admin backup — produce a passphrase-wrapped, manifest-aware
+ * snapshot of the entire local workspace.
+ *
+ * Pairs with `admin restore`. Distinct from `clone`:
+ *   - `clone` pulls from a running server; strips machine-specific config
+ *     (r2_config, railway, master-key, JWT secret); good for setting up
+ *     a new dev machine.
+ *   - `admin backup` snapshots the local workspace; includes secrets.db,
+ *     auth.db, r2_config, railway IDs, and a manifest of the Railway env
+ *     vars (master key, JWT secret) the owner provides at backup time;
+ *     good for "server is dead, restore me."
+ *
+ * Bundle contents (encrypted as a single .sgbackup file):
+ *   - manifest.json — env-var values + Railway IDs + workspace name + ts
+ *   - workspace/ — tar of the workspace directory, minus
+ *     node_modules/, .DS_Store, and any *.log files
+ *
+ * Crypto: passphrase → scrypt → key → xchacha20poly1305(tar.gz).
+ * See [src/cli/crypto-bundle.ts] for the wire format.
+ *
+ * Refuses to write the bundle to a destination directory unless it
+ * exists with mode 0700, or is being created (we make it 0700). Bundle
+ * file is written with mode 0600. Defense against world-readable backups
+ * that contain bcrypt hashes from auth.db.
+ */
+import { Command } from 'commander';
+import { intro, outro, log, spinner, password, isCancel, confirm } from '@clack/prompts';
+import { execFileSync } from 'child_process';
+import { existsSync, mkdirSync, writeFileSync, statSync, mkdtempSync, rmSync, readFileSync } from 'fs';
+import { join, resolve } from 'path';
+import { tmpdir } from 'os';
+import { Workspace } from '../../../core/workspace.js';
+import { sealBundle } from '../../crypto-bundle.js';
+export const adminBackupCommand = new Command('backup')
+    .description('Snapshot the local workspace into a passphrase-wrapped bundle')
+    .option('--out <path>', 'Output directory for the .sgbackup file (default: cwd)')
+    .option('--master-key <value>', 'STUDIOGRAPH_MASTER_KEY env value (also reads STUDIOGRAPH_MASTER_KEY env var)')
+    .option('--jwt-secret <value>', 'STUDIOGRAPH_JWT_SECRET env value (also reads STUDIOGRAPH_JWT_SECRET env var)')
+    .option('--passphrase-stdin', 'Read the bundle passphrase from stdin (single line)')
+    .action(async (opts) => {
+    intro('Studiograph workspace backup');
+    const workspace = new Workspace();
+    if (!workspace.isWorkspace()) {
+        outro('Not a Studiograph workspace. Run from your workspace root.');
+        process.exit(1);
+        return;
+    }
+    const config = await workspace.loadConfig();
+    // Step 1: gather the env-var manifest. These are NOT in the workspace
+    // dir — they live in Railway's variables. The backup is useless
+    // without them, so we make collecting them an explicit, blocking
+    // step.
+    const masterKey = opts.masterKey?.trim() || process.env.STUDIOGRAPH_MASTER_KEY?.trim();
+    const jwtSecret = opts.jwtSecret?.trim() || process.env.STUDIOGRAPH_JWT_SECRET?.trim();
+    let mk;
+    let jwt;
+    if (masterKey && jwtSecret) {
+        mk = masterKey;
+        jwt = jwtSecret;
+        log.info('Using STUDIOGRAPH_MASTER_KEY + STUDIOGRAPH_JWT_SECRET from flags/env');
+    }
+    else {
+        if (!process.stdout.isTTY) {
+            outro('No TTY. Pass --master-key and --jwt-secret, or set the matching env vars.');
+            process.exit(1);
+            return;
+        }
+        log.message('These two values live in Railway, not in the workspace. Copy them from\n' +
+            '  Railway → your service → Variables → STUDIOGRAPH_MASTER_KEY / STUDIOGRAPH_JWT_SECRET\n' +
+            'Without them the restored workspace cannot decrypt secrets.db or verify any\n' +
+            'existing JWT cookies.');
+        const mkInput = await password({ message: 'STUDIOGRAPH_MASTER_KEY:', validate: (v) => v.trim() ? undefined : 'Required' });
+        if (isCancel(mkInput)) {
+            outro('Cancelled');
+            process.exit(0);
+            return;
+        }
+        const jwtInput = await password({ message: 'STUDIOGRAPH_JWT_SECRET:', validate: (v) => v.trim() ? undefined : 'Required' });
+        if (isCancel(jwtInput)) {
+            outro('Cancelled');
+            process.exit(0);
+            return;
+        }
+        mk = String(mkInput).trim();
+        jwt = String(jwtInput).trim();
+    }
+    // Step 2: passphrase for the bundle.
+    let passphrase;
+    if (opts.passphraseStdin) {
+        passphrase = await readPassphraseStdin();
+    }
+    else if (process.stdout.isTTY) {
+        const pp1 = await password({
+            message: 'Bundle passphrase (min 12 chars):',
+            validate: (v) => (v.length >= 12 ? undefined : 'At least 12 characters'),
+        });
+        if (isCancel(pp1)) {
+            outro('Cancelled');
+            process.exit(0);
+            return;
+        }
+        const pp2 = await password({ message: 'Confirm passphrase:' });
+        if (isCancel(pp2)) {
+            outro('Cancelled');
+            process.exit(0);
+            return;
+        }
+        if (String(pp1) !== String(pp2)) {
+            outro('Passphrases did not match.');
+            process.exit(1);
+            return;
+        }
+        passphrase = String(pp1);
+    }
+    else {
+        outro('No TTY. Pass --passphrase-stdin and pipe the passphrase to stdin.');
+        process.exit(1);
+        return;
+    }
+    // Step 3: validate output directory + file.
+    const outDir = resolve(opts.out ?? process.cwd());
+    if (!existsSync(outDir)) {
+        mkdirSync(outDir, { recursive: true, mode: 0o700 });
+    }
+    else {
+        const dirMode = statSync(outDir).mode & 0o777;
+        if ((dirMode & 0o077) !== 0) {
+            const proceed = await confirm({
+                message: `Output directory ${outDir} is mode 0${dirMode.toString(8)} — group/world readable. Continue anyway?`,
+                initialValue: false,
+            });
+            if (!proceed || isCancel(proceed)) {
+                outro('Cancelled — chmod 700 the directory and retry.');
+                process.exit(0);
+                return;
+            }
+        }
+    }
+    const fileName = `studiograph-backup-${(config.team_name || 'workspace').toLowerCase().replace(/[^a-z0-9]+/g, '-')}-${new Date().toISOString().slice(0, 10)}.sgbackup`;
+    const filePath = join(outDir, fileName);
+    if (existsSync(filePath)) {
+        outro(`Refusing to overwrite ${filePath}. Move or delete the existing bundle and retry.`);
+        process.exit(1);
+        return;
+    }
+    // Step 4: build the bundle. tar the workspace + manifest into a temp
+    // file, encrypt, write. Temp lives in os.tmpdir(); we clean up in
+    // finally even on errors.
+    const tmpRoot = mkdtempSync(join(tmpdir(), 'sg-backup-'));
+    const manifestPath = join(tmpRoot, 'manifest.json');
+    const tarPath = join(tmpRoot, 'bundle.tar.gz');
+    try {
+        const manifest = {
+            workspace_name: config.team_name || 'unknown',
+            created_at: new Date().toISOString(),
+            format_version: 1,
+            env: {
+                STUDIOGRAPH_MASTER_KEY: mk,
+                STUDIOGRAPH_JWT_SECRET: jwt,
+            },
+            railway: config.railway,
+        };
+        writeFileSync(manifestPath, JSON.stringify(manifest, null, 2), { encoding: 'utf-8', mode: 0o600 });
+        const spin = spinner();
+        spin.start('Tarring workspace...');
+        // -C tmpRoot for manifest.json + -C cwd for workspace contents.
+        // Two `-C` flags = tar resets the chdir per following path. The
+        // workspace contents land at top-level of the tar so restore is
+        // a single expand. The manifest sits beside them.
+        // Exclusions: node_modules, .DS_Store, *.log keep the bundle lean
+        // without dropping anything load-bearing.
+        execFileSync('tar', [
+            '-czf', tarPath,
+            '--exclude', 'node_modules',
+            '--exclude', '.DS_Store',
+            '--exclude', '*.log',
+            '-C', tmpRoot, 'manifest.json',
+            '-C', process.cwd(), '.',
+        ], { stdio: 'pipe' });
+        spin.stop('Tarred');
+        spin.start('Encrypting (scrypt is intentionally slow)...');
+        const plaintext = readFileSync(tarPath);
+        const ciphertext = sealBundle(plaintext, passphrase);
+        spin.stop('Encrypted');
+        writeFileSync(filePath, ciphertext, { mode: 0o600 });
+        log.success(`Wrote ${filePath} (${(ciphertext.length / 1024).toFixed(1)} KB)`);
+        log.message('Keep this file AND its passphrase separately. The bundle contains\n' +
+            'bcrypt password hashes, encrypted secrets.db, and your Railway env\n' +
+            'vars in plaintext (within the encrypted envelope) — treat it like\n' +
+            'a credential.');
+        outro('Backup complete.');
+    }
+    finally {
+        rmSync(tmpRoot, { recursive: true, force: true });
+    }
+});
+async function readPassphraseStdin() {
+    return new Promise((resolveFn, rejectFn) => {
+        let buf = '';
+        process.stdin.setEncoding('utf-8');
+        process.stdin.on('data', (chunk) => (buf += chunk));
+        process.stdin.on('end', () => resolveFn(buf.replace(/\r?\n$/, '')));
+        process.stdin.on('error', rejectFn);
+    });
+}
+//# sourceMappingURL=backup.js.map

package/dist/cli/commands/admin/backup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.js","sourceRoot":"","sources":["../../../../src/cli/commands/admin/backup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzF,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AACvG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAmCpD,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC;KACpD,WAAW,CAAC,+DAA+D,CAAC;KAC5E,MAAM,CAAC,cAAc,EAAE,wDAAwD,CAAC;KAChF,MAAM,CAAC,sBAAsB,EAAE,8EAA8E,CAAC;KAC9G,MAAM,CAAC,sBAAsB,EAAE,8EAA8E,CAAC;KAC9G,MAAM,CAAC,oBAAoB,EAAE,qDAAqD,CAAC;KACnF,MAAM,CAAC,KAAK,EAAE,IAAgB,EAAE,EAAE;IACjC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAEtC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;IAClC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7B,KAAK,CAAC,4DAA4D,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,CAAC;IAE5C,sEAAsE;IACtE,gEAAgE;IAChE,iEAAiE;IACjE,QAAQ;IACR,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC;IACvF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC;IACvF,IAAI,EAAU,CAAC;IACf,IAAI,GAAW,CAAC;IAEhB,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;QAC3B,EAAE,GAAG,SAAS,CAAC;QACf,GAAG,GAAG,SAAS,CAAC;QAChB,GAAG,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;IACnF,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAC1B,KAAK,CAAC,2EAA2E,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,OAAO,CACT,0EAA0E;YACxE,0FAA0F;YAC1F,+EAA+E;YAC/E,uBAAuB,CAC1B,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;QAC3H,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;QAC5H,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACxE,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,qCAAqC;IACrC,IAAI,UAAkB,CAAC;IACvB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,UAAU,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC3C,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC;YACzB,OAAO,EAAE,mCAAmC;YAC5C,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC;SACzE,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACnE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAC/D,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACnE,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,KAAK,CAAC,4BAA4B,CAAC,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QACD,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,mEAAmE,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,4CAA4C;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;QAC9C,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC;gBAC5B,OAAO,EAAE,oBAAoB,MAAM,aAAa,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,2CAA2C;gBAC9G,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;QAC1H,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,SAAS,IAAI,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC;IACvK,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,yBAAyB,QAAQ,iDAAiD,CAAC,CAAC;QAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,qEAAqE;IACrE,kEAAkE;IAClE,0BAA0B;IAC1B,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAE/C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAmB;YAC/B,cAAc,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS;YAC7C,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,cAAc,EAAE,CAAC;YACjB,GAAG,EAAE;gBACH,sBAAsB,EAAE,EAAE;gBAC1B,sBAAsB,EAAE,GAAG;aAC5B;YACD,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;QACF,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAEnG,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACnC,gEAAgE;QAChE,gEAAgE;QAChE,gEAAgE;QAChE,kDAAkD;QAClD,kEAAkE;QAClE,0CAA0C;QAC1C,YAAY,CACV,KAAK,EACL;YACE,MAAM,EAAE,OAAO;YACf,WAAW,EAAE,cAAc;YAC3B,WAAW,EAAE,WAAW;YACxB,WAAW,EAAE,OAAO;YACpB,IAAI,EAAE,OAAO,EAAE,eAAe;YAC9B,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG;SACzB,EACD,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEpB,IAAI,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAEvB,aAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,GAAG,CAAC,OAAO,CAAC,SAAS,QAAQ,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/E,GAAG,CAAC,OAAO,CACT,qEAAqE;YACnE,sEAAsE;YACtE,qEAAqE;YACrE,eAAe,CAClB,CAAC;QACF,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,KAAK,UAAU,mBAAmB;IAChC,OAAO,IAAI,OAAO,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE;QACzC,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/commands/admin/folder.d.ts

@@ -0,0 +1,11 @@
+/**
+ * studiograph folder command
+ *
+ * Subcommands:
+ *   studiograph folder add <name>     — create a new folder
+ *   studiograph folder list           — list all folders with entity counts
+ *   studiograph folder rename <old> <new> — rename a folder
+ *   studiograph folder remove <name>  — remove a folder (with confirmation)
+ */
+import { Command } from 'commander';
+export declare const folderCommand: Command;

package/dist/cli/commands/admin/folder.js

@@ -0,0 +1,186 @@
+/**
+ * studiograph folder command
+ *
+ * Subcommands:
+ *   studiograph folder add <name>     — create a new folder
+ *   studiograph folder list           — list all folders with entity counts
+ *   studiograph folder rename <old> <new> — rename a folder
+ *   studiograph folder remove <name>  — remove a folder (with confirmation)
+ */
+import { Command } from 'commander';
+import { log, confirm } from '@clack/prompts';
+import { existsSync } from 'fs';
+import { join } from 'path';
+import { Workspace } from '../../../core/workspace.js';
+import { BaseGraphManager } from '../../../core/graph.js';
+function requireWorkspace() {
+    const workspace = new Workspace();
+    if (!workspace.isWorkspace()) {
+        console.error('Not a Studiograph workspace. Run `studiograph init` first.');
+        return null;
+    }
+    return workspace;
+}
+// ─── add ──────────────────────────────────────────────────────────────────────
+const addCommand = new Command('add')
+    .description('Create a new folder')
+    .argument('<name>', 'Folder name (kebab-case)')
+    .option('-d, --description <desc>', 'Folder description')
+    .action(async (name, opts) => {
+    const workspace = requireWorkspace();
+    if (!workspace) {
+        process.exit(1);
+        return;
+    }
+    // Validate name is kebab-case
+    if (!/^[a-z0-9][a-z0-9-]*$/.test(name)) {
+        log.error('Folder name must be kebab-case (e.g., "client-projects")');
+        process.exit(1);
+        return;
+    }
+    try {
+        const repo = await workspace.registerRepo({
+            name,
+            description: opts.description,
+        });
+        log.success(`Folder "${repo.name}" created at ${repo.path}/`);
+    }
+    catch (err) {
+        log.error(err instanceof Error ? err.message : 'Unknown error');
+        process.exit(1);
+    }
+});
+// ─── list ─────────────────────────────────────────────────────────────────────
+const listCommand = new Command('list')
+    .description('List all folders with entity counts')
+    .action(async () => {
+    const workspace = requireWorkspace();
+    if (!workspace) {
+        process.exit(1);
+        return;
+    }
+    const config = await workspace.loadConfig();
+    const repos = config.repos;
+    if (repos.length === 0) {
+        log.info('No folders. Run `studiograph folder add <name>` to create one.');
+        return;
+    }
+    console.log('\nFolders\n');
+    console.log('  Name                          Entities  Description');
+    console.log('  ' + '\u2500'.repeat(72));
+    for (const repo of repos) {
+        let entityCount = 0;
+        const repoPath = join(workspace.getWorkspacePath(), repo.path);
+        if (existsSync(repoPath)) {
+            try {
+                const graph = new BaseGraphManager({
+                    repoPath,
+                    repoName: repo.name,
+                    gitUser: { id: 'cli', name: 'cli', email: 'cli@studiograph.local' },
+                });
+                entityCount = graph.list().length;
+            }
+            catch { /* non-fatal */ }
+        }
+        const rname = repo.name.padEnd(30);
+        const count = String(entityCount).padStart(4);
+        const desc = repo.description || '';
+        const suffix = repo.personal ? ' (personal)' : '';
+        console.log(`  ${rname}  ${count}  ${desc}${suffix}`);
+    }
+    console.log('');
+});
+// ─── rename ───────────────────────────────────────────────────────────────────
+const renameCommand = new Command('rename')
+    .description('Rename a folder')
+    .argument('<old-name>', 'Current folder name')
+    .argument('<new-name>', 'New folder name (kebab-case)')
+    .action(async (oldName, newName) => {
+    const workspace = requireWorkspace();
+    if (!workspace) {
+        process.exit(1);
+        return;
+    }
+    if (!/^[a-z0-9][a-z0-9-]*$/.test(newName)) {
+        log.error('New name must be kebab-case (e.g., "client-projects")');
+        process.exit(1);
+        return;
+    }
+    const config = await workspace.loadConfig();
+    const repo = config.repos.find(r => r.name === oldName);
+    if (!repo) {
+        log.error(`Folder "${oldName}" not found.`);
+        process.exit(1);
+        return;
+    }
+    if (config.repos.some(r => r.name === newName)) {
+        log.error(`Folder "${newName}" already exists.`);
+        process.exit(1);
+        return;
+    }
+    const oldPath = join(workspace.getWorkspacePath(), repo.path);
+    const newPath = join(workspace.getWorkspacePath(), newName);
+    // Rename directory
+    if (existsSync(oldPath)) {
+        const { renameSync } = await import('fs');
+        renameSync(oldPath, newPath);
+    }
+    // Update config
+    repo.name = newName;
+    repo.path = newName;
+    workspace.writeConfig(config);
+    // Update .studiograph marker in the repo
+    const markerPath = join(newPath, '.studiograph');
+    if (existsSync(markerPath)) {
+        const { writeFileSync } = await import('fs');
+        writeFileSync(markerPath, JSON.stringify({ repo_name: newName }, null, 2), 'utf-8');
+    }
+    log.success(`Folder renamed: "${oldName}" → "${newName}"`);
+});
+// ─── remove ───────────────────────────────────────────────────────────────────
+const removeCommand = new Command('remove')
+    .description('Remove a folder from the workspace')
+    .argument('<name>', 'Folder name to remove')
+    .option('--delete-files', 'Also delete the folder directory from disk')
+    .action(async (name, opts) => {
+    const workspace = requireWorkspace();
+    if (!workspace) {
+        process.exit(1);
+        return;
+    }
+    const config = await workspace.loadConfig();
+    const repoIndex = config.repos.findIndex(r => r.name === name);
+    if (repoIndex === -1) {
+        log.error(`Folder "${name}" not found.`);
+        process.exit(1);
+        return;
+    }
+    const repo = config.repos[repoIndex];
+    const repoPath = join(workspace.getWorkspacePath(), repo.path);
+    const yes = await confirm({
+        message: opts.deleteFiles
+            ? `Remove folder "${name}" and delete all files at ${repo.path}/?`
+            : `Remove folder "${name}" from workspace config? (files at ${repo.path}/ will be kept)`,
+    });
+    if (!yes || typeof yes === 'symbol')
+        return;
+    // Remove from config
+    config.repos.splice(repoIndex, 1);
+    workspace.writeConfig(config);
+    if (opts.deleteFiles && existsSync(repoPath)) {
+        const { rmSync } = await import('fs');
+        rmSync(repoPath, { recursive: true, force: true });
+        log.success(`Folder "${name}" removed and files deleted.`);
+    }
+    else {
+        log.success(`Folder "${name}" removed from config. Files at ${repo.path}/ were kept.`);
+    }
+});
+// ─── parent command ───────────────────────────────────────────────────────────
+export const folderCommand = new Command('folder')
+    .description('Manage workspace folders')
+    .addCommand(addCommand)
+    .addCommand(listCommand)
+    .addCommand(renameCommand)
+    .addCommand(removeCommand);
+//# sourceMappingURL=folder.js.map