studiograph 1.3.47 → 1.3.48-beta.1

package/dist/server/commit-audit.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Commit audit log — append-only JSONL trail of every commit landed by
+ * the server, tagged by source so operators can answer "who committed
+ * this?" with one grep.
+ *
+ * Best-effort: a write failure logs and returns. The audit log is not
+ * load-bearing for correctness — it's diagnostic.
+ */
+import type { GitUser } from '../services/git.js';
+export type CommitSource = 'web-ui' | 'agent' | 'mcp' | 'cli' | 'recovery' | 'recovery-persisted' | 'session-flush' | 'graph-mutation';
+export interface CommitAuditRecord {
+    ts: string;
+    repo: string;
+    source: CommitSource;
+    user: string;
+    email: string;
+    message: string;
+    fileCount: number;
+}
+export declare function recordCommitAudit(workspacePath: string, entry: {
+    repo: string;
+    source: CommitSource;
+    user: GitUser;
+    message: string;
+    fileCount: number;
+}): void;

package/dist/server/commit-audit.js

@@ -0,0 +1,30 @@
+/**
+ * Commit audit log — append-only JSONL trail of every commit landed by
+ * the server, tagged by source so operators can answer "who committed
+ * this?" with one grep.
+ *
+ * Best-effort: a write failure logs and returns. The audit log is not
+ * load-bearing for correctness — it's diagnostic.
+ */
+import { appendFileSync, mkdirSync } from 'fs';
+import { join } from 'path';
+export function recordCommitAudit(workspacePath, entry) {
+    try {
+        mkdirSync(join(workspacePath, '.studiograph'), { recursive: true });
+        const auditPath = join(workspacePath, '.studiograph', 'commit-audit.jsonl');
+        const record = {
+            ts: new Date().toISOString(),
+            repo: entry.repo,
+            source: entry.source,
+            user: entry.user.name,
+            email: entry.user.email,
+            message: entry.message.slice(0, 200),
+            fileCount: entry.fileCount,
+        };
+        appendFileSync(auditPath, JSON.stringify(record) + '\n', 'utf-8');
+    }
+    catch (err) {
+        console.warn(`[commit-audit] failed to write audit record:`, err.message);
+    }
+}
+//# sourceMappingURL=commit-audit.js.map

package/dist/server/commit-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commit-audit.js","sourceRoot":"","sources":["../../src/server/commit-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAuB5B,MAAM,UAAU,iBAAiB,CAC/B,aAAqB,EACrB,KAAgG;IAEhG,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,oBAAoB,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAsB;YAChC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;YACrB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;YACvB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACpC,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;QACF,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,8CAA8C,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IACvF,CAAC;AACH,CAAC"}

package/dist/server/index.d.ts

@@ -4,7 +4,7 @@
  * Hosts:
  *   - Graph API (read-only REST over WorkspaceManager)
  *   - Agent chat via POST /api/chat and SSE GET /api/chat/stream
- *   - App plugins mounted via PluginLoader
+ *   - Static web UI (SvelteKit build) with SPA fallback
  */
 import { type FastifyInstance } from 'fastify';
 import { WorkspaceManager } from '../core/workspace-manager.js';
@@ -15,9 +15,20 @@ export interface ServerConfig {
     workspacePath: string;
     workspaceConfig: WorkspaceConfig;
     gitUser: GitUser;
-    appsDir: string;
     port: number;
     host: string;
-    apiKeys: string[];
+    /**
+     * Phase 8: master key + version for AuthService's per-user encryption
+     * path (oauth_tokens.data_ciphertext, user_preferences.settings_ciphertext).
+     * Caller is `serve.ts`. Absent in tests that don't boot the full
+     * server (AuthService then stays on the legacy plaintext path).
+     */
+    authCryptoOptions?: {
+        masterKey: Uint8Array;
+        keyVersion?: string;
+    };
 }
+export declare function resolveStaticFilePath(webDir: string, urlPath: string): string | null;
+export declare function buildAllowedCorsOrigins(workspaceConfig: WorkspaceConfig, port: number): Set<string>;
+export declare function isCorsOriginAllowed(origin: string | undefined, allowedOrigins: Set<string>): boolean;
 export declare function createServer(config: ServerConfig): Promise<FastifyInstance>;