studiograph 1.3.47 → 1.3.48-beta.1

package/dist/server/routes/mcp.d.ts

@@ -4,10 +4,14 @@
  * Exposes Studiograph's MCP tools over HTTP at /mcp so external clients
  * (Claude Code, Cursor, etc.) can connect to a remote Studiograph server.
  *
- * Uses stateless mode — each request creates a fresh MCP server instance.
- * Auth is handled by the existing Fastify auth hook (Bearer token or JWT cookie).
+ * Uses stateless mode — each request creates a fresh MCP server instance
+ * bound to the caller's identity. The Bearer header MUST resolve to a
+ * real user (JWT or per-user API token). There is no workspace-wide
+ * shared key anywhere in the system — every MCP call carries a user.
  */
 import type { FastifyInstance } from 'fastify';
 import { WorkspaceManager } from '../../core/workspace-manager.js';
 import type { AuthService } from '../../services/auth-service.js';
-export declare function registerMcpRoutes(fastify: FastifyInstance, workspaceManager: WorkspaceManager, authService?: AuthService | null): Promise<void>;
+import type { WsHub } from '../ws-hub.js';
+import type { CommentService } from '../../services/comment-service.js';
+export declare function registerMcpRoutes(fastify: FastifyInstance, workspaceManager: WorkspaceManager, authService: AuthService, wsHub?: WsHub, commentService?: CommentService): Promise<void>;

package/dist/server/routes/mcp.js

@@ -4,17 +4,33 @@
  * Exposes Studiograph's MCP tools over HTTP at /mcp so external clients
  * (Claude Code, Cursor, etc.) can connect to a remote Studiograph server.
  *
- * Uses stateless mode — each request creates a fresh MCP server instance.
- * Auth is handled by the existing Fastify auth hook (Bearer token or JWT cookie).
+ * Uses stateless mode — each request creates a fresh MCP server instance
+ * bound to the caller's identity. The Bearer header MUST resolve to a
+ * real user (JWT or per-user API token). There is no workspace-wide
+ * shared key anywhere in the system — every MCP call carries a user.
  */
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { registerTools } from '../../mcp/tools.js';
-export async function registerMcpRoutes(fastify, workspaceManager, authService) {
+export async function registerMcpRoutes(fastify, workspaceManager, authService, wsHub, commentService) {
     // POST /mcp — handle MCP JSON-RPC requests (tool calls, initialization, etc.)
     fastify.post('/mcp', async (req, reply) => {
+        const user = req.user;
+        if (!user) {
+            return reply.status(401).send({
+                error: 'MCP requires a user-scoped Bearer token. Generate one at POST /api/auth/tokens.',
+            });
+        }
+        // The auth hook stashes the api_tokens.name on req when the request was
+        // bearer-authenticated against a named token (the typical MCP path).
+        // We thread it through so mutation broadcasts are labeled with the
+        // integration name (e.g. "Christian's Cursor" rather than just the user).
+        const apiTokenName = req.apiTokenName;
         const server = new McpServer({ name: 'studiograph', version: '1.0.0' });
-        registerTools(server, workspaceManager, authService);
+        // Passing wsHub in the context lets create_entity / update_entity
+        // broadcast entity_change events so connected web clients refresh
+        // their views live when an MCP agent mutates a folder.
+        registerTools(server, workspaceManager, authService, { user, wsHub, apiTokenName, commentService });
         const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
         await server.connect(transport);
         // Hijack the response so Fastify doesn't interfere with the MCP transport's writes
@@ -25,11 +41,11 @@ export async function registerMcpRoutes(fastify, workspaceManager, authService)
     });
     // GET /mcp — SSE endpoint for server-initiated notifications (stateless: returns 405)
     fastify.get('/mcp', async (_req, reply) => {
-        reply.status(405).send({ error: 'SSE not available in stateless mode. Use POST.' });
+        return reply.status(405).send({ error: 'SSE not available in stateless mode. Use POST.' });
     });
     // DELETE /mcp — session cleanup (stateless: returns 405)
     fastify.delete('/mcp', async (_req, reply) => {
-        reply.status(405).send({ error: 'No sessions in stateless mode.' });
+        return reply.status(405).send({ error: 'No sessions in stateless mode.' });
     });
 }
 //# sourceMappingURL=mcp.js.map

package/dist/server/routes/mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../src/server/routes/mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAGnG,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAwB,EACxB,gBAAkC,EAClC,WAAgC;IAGhC,8EAA8E;IAC9E,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACxE,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;QAErD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;QACvF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhC,mFAAmF;QACnF,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAE5D,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,sFAAsF;IACtF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACxC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,yDAAyD;IACzD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QAC3C,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../src/server/routes/mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAKnG,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAwB,EACxB,gBAAkC,EAClC,WAAwB,EACxB,KAAa,EACb,cAA+B;IAG/B,8EAA8E;IAC9E,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,iFAAiF;aACzF,CAAC,CAAC;QACL,CAAC;QACD,wEAAwE;QACxE,qEAAqE;QACrE,mEAAmE;QACnE,0EAA0E;QAC1E,MAAM,YAAY,GAAI,GAAW,CAAC,YAAkC,CAAC;QAErE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACxE,kEAAkE;QAClE,kEAAkE;QAClE,uDAAuD;QACvD,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC;QAEpG,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;QACvF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhC,mFAAmF;QACnF,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAE5D,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,sFAAsF;IACtF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACxC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IAEH,yDAAyD;IACzD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QAC3C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/routes/permissions-api.d.ts

@@ -1,8 +1,15 @@
 /**
  * Permissions API routes
  *
- * Self-hosted per-collection access management backed by AuthService.
- * All endpoints require admin role.
+ * Per-folder membership management. Only folder admins (member with
+ * role='admin') can grant/revoke access to their folder; workspace
+ * ownership alone does NOT confer folder-admin rights, so owners can't
+ * push users into private folders they aren't members of. The list of
+ * folders returned by GET /api/permissions/folders is scoped by
+ * `isFolderAdminOrOwner` so workspace owners see shared folders they
+ * can oversee, but solo/private folders of other users stay hidden
+ * (matching the AGENTS.md rule that privacy holds even against the
+ * workspace owner).
  */
 import type { FastifyInstance } from 'fastify';
 import { AuthService } from '../../services/auth-service.js';

package/dist/server/routes/permissions-api.js

@@ -1,59 +1,116 @@
 /**
  * Permissions API routes
  *
- * Self-hosted per-collection access management backed by AuthService.
- * All endpoints require admin role.
+ * Per-folder membership management. Only folder admins (member with
+ * role='admin') can grant/revoke access to their folder; workspace
+ * ownership alone does NOT confer folder-admin rights, so owners can't
+ * push users into private folders they aren't members of. The list of
+ * folders returned by GET /api/permissions/folders is scoped by
+ * `isFolderAdminOrOwner` so workspace owners see shared folders they
+ * can oversee, but solo/private folders of other users stay hidden
+ * (matching the AGENTS.md rule that privacy holds even against the
+ * workspace owner).
  */
+import { isFolderAdminOrOwner } from '../../services/access-control.js';
+/** True if the user is a member-admin on the folder. Workspace ownership
+ *  alone does NOT qualify — membership is required. */
+function canManageFolder(user, folder, authService) {
+    if (!user)
+        return true; // API key / open mode
+    return authService.isFolderAdmin(user.id, folder);
+}
 export async function registerPermissionsApiRoutes(fastify, authService, workspaceManager, wsHub) {
-    // GET /api/permissions/collections — all collections with their granted users
-    fastify.get('/api/permissions/collections', async (req, reply) => {
+    // GET /api/permissions/folders — folders the caller can manage or
+    // oversee in the Manage Folders tab, with the members and entry count
+    // of each. A folder is visible when the caller is a member-admin on it
+    // OR the caller is a workspace owner AND the folder is shared (>1
+    // member). Solo/private folders of other users stay hidden — workspace
+    // ownership alone does not reveal them. Mutation endpoints below still
+    // gate on member-admin, so visibility here does not grant edit rights.
+    fastify.get('/api/permissions/folders', async (req, reply) => {
         const user = req.user;
-        if (user && user.role !== 'admin') {
-            return reply.status(403).send({ error: 'Admin access required' });
-        }
-        const repos = workspaceManager.getAllRepoConfigs().filter(r => !r.private);
-        const result = repos.map(repo => ({
-            collection: repo.name,
-            users: authService.getCollectionUsers(repo.name),
-        }));
+        const allRepos = workspaceManager.getAllRepoConfigs();
+        const visible = allRepos.filter(repo => isFolderAdminOrOwner(user, repo.name, workspaceManager, authService));
+        const result = visible.map(repo => {
+            // `listEntityIds()` just walks the folder's subdirectories — no
+            // markdown parse, no zod validation. Previously we called
+            // `graph.search({})` here which eagerly loaded every entity in
+            // every folder on each modal open, turning workspaces with large
+            // folders (800+ entries) into a visible stall.
+            let entryCount = 0;
+            try {
+                entryCount = workspaceManager.getGraph(repo.name).listEntityIds().length;
+            }
+            catch { /* skip */ }
+            return {
+                folder: repo.name,
+                members: authService.getFolderMembers(repo.name),
+                entry_count: entryCount,
+            };
+        });
         return reply.send(result);
     });
-    // POST /api/permissions/grant — grant user access to a collection
+    // POST /api/permissions/grant — add a user to a folder with a role.
     fastify.post('/api/permissions/grant', async (req, reply) => {
         const user = req.user;
-        if (user && user.role !== 'admin') {
-            return reply.status(403).send({ error: 'Admin access required' });
+        const { userId, folder, role } = req.body ?? {};
+        if (!userId || !folder) {
+            return reply.status(400).send({ error: 'userId and folder are required' });
         }
-        const { userId, collection } = req.body ?? {};
-        if (!userId || !collection) {
-            return reply.status(400).send({ error: 'userId and collection are required' });
+        if (!canManageFolder(user, folder, authService)) {
+            return reply.status(403).send({ error: 'Folder admin access required' });
         }
-        authService.grantCollectionAccess(userId, collection);
+        if (role && role !== 'admin' && role !== 'editor') {
+            return reply.status(400).send({ error: `Invalid role "${role}" — must be "admin" or "editor"` });
+        }
+        // Preserve the "≥1 admin" invariant when demoting an existing admin.
+        const desired = role ?? 'editor';
+        const currentRole = authService.getFolderRole(userId, folder);
+        if (currentRole === 'admin' && desired === 'editor') {
+            const admins = authService.getFolderAdmins(folder);
+            if (admins.length <= 1) {
+                return reply.status(400).send({ error: 'Cannot demote the last folder admin. Promote another member first.' });
+            }
+        }
+        authService.grantFolderAccess(userId, folder, desired);
+        // Patch the recipient's WS folder cache before the event fires —
+        // otherwise canReceive() keeps dropping `entity_change` broadcasts
+        // for entities in this folder until they reconnect.
+        wsHub.addUserFolder(String(userId), folder);
         wsHub.broadcastToUser(String(userId), {
             type: 'access_granted',
-            repo: collection,
+            repo: folder,
             userId: String(userId),
-            actor: req.user?.displayName ?? 'admin',
+            actor: user?.displayName ?? 'admin',
             timestamp: new Date().toISOString(),
         });
         return reply.send({ ok: true });
     });
-    // POST /api/permissions/revoke — revoke user access to a collection
+    // POST /api/permissions/revoke — remove a user from a folder.
     fastify.post('/api/permissions/revoke', async (req, reply) => {
         const user = req.user;
-        if (user && user.role !== 'admin') {
-            return reply.status(403).send({ error: 'Admin access required' });
+        const { userId, folder } = req.body ?? {};
+        if (!userId || !folder) {
+            return reply.status(400).send({ error: 'userId and folder are required' });
+        }
+        if (!canManageFolder(user, folder, authService)) {
+            return reply.status(403).send({ error: 'Folder admin access required' });
         }
-        const { userId, collection } = req.body ?? {};
-        if (!userId || !collection) {
-            return reply.status(400).send({ error: 'userId and collection are required' });
+        // Preserve the "≥1 admin" invariant on shared folders.
+        const targetRole = authService.getFolderRole(userId, folder);
+        if (targetRole === 'admin') {
+            const admins = authService.getFolderAdmins(folder);
+            if (admins.length <= 1) {
+                return reply.status(400).send({ error: 'Cannot remove the last folder admin. Promote another member first.' });
+            }
         }
-        authService.revokeCollectionAccess(userId, collection);
+        authService.revokeFolderAccess(userId, folder);
+        wsHub.removeUserFolder(String(userId), folder);
         wsHub.broadcastToUser(String(userId), {
             type: 'access_revoked',
-            repo: collection,
+            repo: folder,
             userId: String(userId),
-            actor: req.user?.displayName ?? 'admin',
+            actor: user?.displayName ?? 'admin',
             timestamp: new Date().toISOString(),
         });
         return reply.send({ ok: true });

package/dist/server/routes/permissions-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions-api.js","sourceRoot":"","sources":["../../../src/server/routes/permissions-api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAwB,EACxB,WAAwB,EACxB,gBAAkC,EAClC,KAAY;IAGZ,8EAA8E;IAC9E,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC/D,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,iBAAiB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChC,UAAU,EAAE,IAAI,CAAC,IAAI;YACrB,KAAK,EAAE,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;SACjD,CAAC,CAAC,CAAC;QAEJ,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,OAAO,CAAC,IAAI,CACV,wBAAwB,EACxB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,WAAW,CAAC,qBAAqB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACtD,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;YACpC,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,KAAK,EAAG,GAAW,CAAC,IAAI,EAAE,WAAW,IAAI,OAAO;YAChD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;IAEF,oEAAoE;IACpE,OAAO,CAAC,IAAI,CACV,yBAAyB,EACzB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,WAAW,CAAC,sBAAsB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACvD,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;YACpC,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,KAAK,EAAG,GAAW,CAAC,IAAI,EAAE,WAAW,IAAI,OAAO;YAChD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"permissions-api.js","sourceRoot":"","sources":["../../../src/server/routes/permissions-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAGxE;uDACuD;AACvD,SAAS,eAAe,CAAC,IAA0B,EAAE,MAAc,EAAE,WAAwB;IAC3F,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,sBAAsB;IAC9C,OAAO,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAwB,EACxB,WAAwB,EACxB,gBAAkC,EAClC,KAAY;IAGZ,kEAAkE;IAClE,sEAAsE;IACtE,uEAAuE;IACvE,kEAAkE;IAClE,uEAAuE;IACvE,uEAAuE;IACvE,uEAAuE;IACvE,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC3D,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,iBAAiB,EAAE,CAAC;QAEtD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC;QAC9G,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YAChC,gEAAgE;YAChE,0DAA0D;YAC1D,+DAA+D;YAC/D,iEAAiE;YACjE,+CAA+C;YAC/C,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,CAAC;gBAAC,UAAU,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;YACtG,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,IAAI;gBACjB,OAAO,EAAE,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAChD,WAAW,EAAE,UAAU;aACxB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,OAAO,CAAC,IAAI,CACV,wBAAwB,EACxB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;YAChD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,IAAI,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,IAAI,iCAAiC,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,qEAAqE;QACrE,MAAM,OAAO,GAAG,IAAI,IAAI,QAAQ,CAAC;QACjC,MAAM,WAAW,GAAG,WAAW,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,WAAW,KAAK,OAAO,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACvB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oEAAoE,EAAE,CAAC,CAAC;YACjH,CAAC;QACH,CAAC;QAED,WAAW,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACvD,iEAAiE;QACjE,mEAAmE;QACnE,oDAAoD;QACpD,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5C,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;YACpC,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,KAAK,EAAE,IAAI,EAAE,WAAW,IAAI,OAAO;YACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;IAEF,8DAA8D;IAC9D,OAAO,CAAC,IAAI,CACV,yBAAyB,EACzB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;YAChD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,uDAAuD;QACvD,MAAM,UAAU,GAAG,WAAW,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7D,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACvB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oEAAoE,EAAE,CAAC,CAAC;YACjH,CAAC;QACH,CAAC;QAED,WAAW,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/C,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/C,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;YACpC,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,KAAK,EAAE,IAAI,EAAE,WAAW,IAAI,OAAO;YACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/server/routes/r2-api.d.ts

@@ -0,0 +1,25 @@
+/**
+ * R2 management API routes — owner-only operations that live alongside
+ * the existing `/api/settings` + `/api/secrets` flow.
+ *
+ *   GET  /api/r2/status                — local-asset count + current mode
+ *   POST /api/r2/create-bucket         — create the configured bucket (idempotent)
+ *   POST /api/r2/sync                  — start a local-asset upload job
+ *   GET  /api/r2/sync/:jobId           — poll progress
+ *   POST /api/r2/sync/:jobId/cancel    — request cooperative cancel
+ *
+ * Credentials are read from the encrypted store (`r2.account_id` setting +
+ * `r2.access_key_id`/`r2.secret_access_key` secrets) — the body never
+ * carries them on the wire. The user is expected to have saved each
+ * field via the existing settings UI before invoking these endpoints.
+ *
+ * Sync runs in-process. Jobs are tracked in a `Map<jobId, SyncJob>` and
+ * survive only as long as the process. After completion (or cancel) the
+ * job stays around for SYNC_JOB_TTL_MS so the UI can fetch the final
+ * state, then auto-evicts.
+ */
+import type { FastifyInstance } from 'fastify';
+import { type AuthService } from '../../services/auth-service.js';
+import type { WorkspaceManager } from '../../core/workspace-manager.js';
+import { type GitUser } from '../../services/git.js';
+export declare function registerR2ApiRoutes(fastify: FastifyInstance, workspaceManager: WorkspaceManager, authService: AuthService, gitUser: GitUser): Promise<void>;

package/dist/server/routes/r2-api.js

@@ -0,0 +1,276 @@
+/**
+ * R2 management API routes — owner-only operations that live alongside
+ * the existing `/api/settings` + `/api/secrets` flow.
+ *
+ *   GET  /api/r2/status                — local-asset count + current mode
+ *   POST /api/r2/create-bucket         — create the configured bucket (idempotent)
+ *   POST /api/r2/sync                  — start a local-asset upload job
+ *   GET  /api/r2/sync/:jobId           — poll progress
+ *   POST /api/r2/sync/:jobId/cancel    — request cooperative cancel
+ *
+ * Credentials are read from the encrypted store (`r2.account_id` setting +
+ * `r2.access_key_id`/`r2.secret_access_key` secrets) — the body never
+ * carries them on the wire. The user is expected to have saved each
+ * field via the existing settings UI before invoking these endpoints.
+ *
+ * Sync runs in-process. Jobs are tracked in a `Map<jobId, SyncJob>` and
+ * survive only as long as the process. After completion (or cancel) the
+ * job stays around for SYNC_JOB_TTL_MS so the UI can fetch the final
+ * state, then auto-evicts.
+ */
+import { randomUUID } from 'crypto';
+import { join, relative } from 'path';
+import { isWorkspaceOwner } from '../../services/auth-service.js';
+import { tryResolve } from '../../core/secrets/read-flip.js';
+import { GitService } from '../../services/git.js';
+import { countLocalAssets, createR2Bucket, syncLocalAssetsToR2, } from '../../services/assets/r2-sync.js';
+const SYNC_JOB_TTL_MS = 10 * 60_000;
+const syncJobs = new Map();
+function reapStaleJobs() {
+    const now = Date.now();
+    for (const [id, job] of syncJobs) {
+        if (job.finishedAt && now - job.finishedAt > SYNC_JOB_TTL_MS) {
+            syncJobs.delete(id);
+        }
+    }
+}
+function requireOwner(req, authService) {
+    if (!authService.hasUsers())
+        return true;
+    const user = req.user;
+    if (!user)
+        return true; // API key — admin-equivalent
+    return isWorkspaceOwner(user.role);
+}
+function actorLabel(req) {
+    const user = req.user;
+    return user ? user.displayName : 'api-token';
+}
+/**
+ * Read the R2 fields from the encrypted store. Returns the resolved
+ * values plus a list of missing field names; callers can decide which
+ * subset they need (createBucket doesn't need public_url; sync needs
+ * everything).
+ */
+function resolveR2() {
+    const accountId = tryResolve('r2.account_id') ?? '';
+    const bucket = tryResolve('r2.bucket') ?? '';
+    const publicUrl = tryResolve('r2.public_url') ?? '';
+    const accessKeyId = tryResolve('r2.access_key_id') ?? '';
+    const secretAccessKey = tryResolve('r2.secret_access_key') ?? '';
+    const missing = [];
+    if (!accountId)
+        missing.push('r2.account_id');
+    if (!bucket)
+        missing.push('r2.bucket');
+    if (!accessKeyId)
+        missing.push('r2.access_key_id');
+    if (!secretAccessKey)
+        missing.push('r2.secret_access_key');
+    return {
+        resolved: { accountId, bucket, publicUrl, accessKeyId, secretAccessKey },
+        missing,
+    };
+}
+export async function registerR2ApiRoutes(fastify, workspaceManager, authService, gitUser) {
+    // ── GET /api/r2/status ──────────────────────────────────────────────────
+    //
+    // Reports whether the workspace currently runs in `r2` mode (account_id
+    // + bucket resolve) and counts files under `.studiograph/assets/`. The
+    // Settings UI uses this to gate the "you have N local assets, sync to
+    // R2 →" banner.
+    fastify.get('/api/r2/status', async (req, reply) => {
+        if (!requireOwner(req, authService)) {
+            return reply.status(403).send({ error: 'Workspace owner access required' });
+        }
+        const workspacePath = workspaceManager.getWorkspacePath();
+        const accountId = tryResolve('r2.account_id') ?? '';
+        const bucket = tryResolve('r2.bucket') ?? '';
+        const mode = accountId && bucket ? 'r2' : 'local';
+        const localAssetsCount = countLocalAssets(workspacePath);
+        return reply.send({ mode, localAssetsCount });
+    });
+    // ── POST /api/r2/create-bucket ──────────────────────────────────────────
+    //
+    // Idempotent bucket-create. Reads credentials + bucket name from the
+    // encrypted store — the body carries no secrets. The CLI shape
+    // (`r2 setup`) does the same thing inline; this endpoint surfaces it
+    // to the UI so users don't have to drop to a terminal after entering
+    // credentials in Settings.
+    fastify.post('/api/r2/create-bucket', async (req, reply) => {
+        if (!requireOwner(req, authService)) {
+            return reply.status(403).send({ error: 'Workspace owner access required' });
+        }
+        const { resolved, missing } = resolveR2();
+        // public_url is not required to create the bucket itself.
+        const requiredMissing = missing.filter(k => k !== 'r2.public_url');
+        if (requiredMissing.length > 0) {
+            return reply.status(400).send({
+                error: `Missing R2 fields: ${requiredMissing.join(', ')}. Save them under Settings → Providers → Asset Storage first.`,
+            });
+        }
+        try {
+            const result = await createR2Bucket({
+                accountId: resolved.accountId,
+                accessKeyId: resolved.accessKeyId,
+                secretAccessKey: resolved.secretAccessKey,
+            }, resolved.bucket);
+            return reply.send({ ok: true, ...result });
+        }
+        catch (err) {
+            // S3 SDK errors have `.name` (e.g. InvalidAccessKeyId) and `.message`.
+            // The UI renders message verbatim — keep it actionable, no stack.
+            const name = err?.name ?? 'Error';
+            const message = err?.message ?? 'Failed to create bucket';
+            return reply.status(400).send({ error: `${name}: ${message}` });
+        }
+    });
+    // ── POST /api/r2/sync ───────────────────────────────────────────────────
+    //
+    // Kicks off a background sync, returns `{ jobId }`. Progress is polled
+    // via GET /api/r2/sync/:jobId. Refuses if another sync is already in
+    // flight — concurrent syncs would race on file rewrites.
+    fastify.post('/api/r2/sync', async (req, reply) => {
+        if (!requireOwner(req, authService)) {
+            return reply.status(403).send({ error: 'Workspace owner access required' });
+        }
+        reapStaleJobs();
+        for (const job of syncJobs.values()) {
+            if (!job.finishedAt) {
+                return reply.status(409).send({
+                    error: 'A sync is already running',
+                    jobId: job.id,
+                });
+            }
+        }
+        const { resolved, missing } = resolveR2();
+        if (missing.length > 0 || !resolved.publicUrl) {
+            const all = missing.includes('r2.public_url') ? missing : [...missing, ...(resolved.publicUrl ? [] : ['r2.public_url'])];
+            return reply.status(400).send({
+                error: `Missing R2 fields: ${all.join(', ')}. Complete the Asset Storage form before running sync.`,
+            });
+        }
+        const repoPaths = workspaceManager.getAllRepoConfigs()
+            .map(r => join(workspaceManager.getWorkspacePath(), r.path));
+        const job = {
+            id: randomUUID(),
+            progress: {
+                totalFiles: 0,
+                uploadedFiles: 0,
+                rewrittenFiles: 0,
+                failedFiles: 0,
+                currentFile: '',
+                phase: 'scanning',
+                errors: [],
+            },
+            startedAt: Date.now(),
+            cancelRequested: false,
+            startedBy: actorLabel(req),
+        };
+        syncJobs.set(job.id, job);
+        // Author the commits as the user who clicked the button when we have
+        // an AuthUser; fall back to the workspace gitUser for API-key callers
+        // and unauthenticated/open-mode runs. Matches what /api/repos/*
+        // mutation routes do for entity edits.
+        const reqUser = req.user;
+        const commitAuthor = reqUser
+            ? { id: String(reqUser.id), name: reqUser.displayName, email: reqUser.email }
+            : gitUser;
+        // Fire-and-forget. The promise's result is captured into the job's
+        // final progress state so the polling endpoint can render the
+        // outcome without the caller having to await here.
+        (async () => {
+            try {
+                const result = await syncLocalAssetsToR2({
+                    workspacePath: workspaceManager.getWorkspacePath(),
+                    repoPaths,
+                    credentials: {
+                        accountId: resolved.accountId,
+                        accessKeyId: resolved.accessKeyId,
+                        secretAccessKey: resolved.secretAccessKey,
+                    },
+                    bucket: resolved.bucket,
+                    publicUrl: resolved.publicUrl,
+                    onProgress: (p) => { job.progress = p; },
+                    shouldCancel: () => job.cancelRequested,
+                });
+                // Commit pass-2 markdown rewrites through the git pipeline. Without
+                // this the repos stay dirty after a sync — the recovery sweep would
+                // eventually catch them, but the proper mutation surface is one
+                // commit per repo, attributed to the requesting user. Mirrors what
+                // the CLI's `r2 migrate-urls` does. Per-repo failures are surfaced
+                // through the job's error list and don't abort the rest.
+                for (const [repoPath, files] of result.rewrittenByRepo) {
+                    if (files.length === 0)
+                        continue;
+                    try {
+                        const git = new GitService(repoPath);
+                        const txn = git.createTransaction();
+                        for (const file of files) {
+                            txn.add({
+                                operation: 'update',
+                                filePath: relative(repoPath, file),
+                                entityType: '',
+                                entityId: '',
+                            });
+                        }
+                        await txn.commit(commitAuthor, 'chore(assets): rewrite asset references to R2');
+                    }
+                    catch (err) {
+                        job.progress = {
+                            ...job.progress,
+                            errors: [
+                                ...job.progress.errors,
+                                { file: repoPath, message: `Commit failed: ${err?.message ?? err}` },
+                            ],
+                        };
+                    }
+                }
+            }
+            catch (err) {
+                job.progress = {
+                    ...job.progress,
+                    phase: 'error',
+                    errors: [
+                        ...job.progress.errors,
+                        { file: '', message: err?.message ?? 'Sync failed' },
+                    ],
+                };
+            }
+            finally {
+                job.finishedAt = Date.now();
+            }
+        })();
+        return reply.send({ jobId: job.id });
+    });
+    // ── GET /api/r2/sync/:jobId ─────────────────────────────────────────────
+    fastify.get('/api/r2/sync/:jobId', async (req, reply) => {
+        if (!requireOwner(req, authService)) {
+            return reply.status(403).send({ error: 'Workspace owner access required' });
+        }
+        reapStaleJobs();
+        const job = syncJobs.get(req.params.jobId);
+        if (!job)
+            return reply.status(404).send({ error: 'Job not found or expired' });
+        return reply.send({
+            jobId: job.id,
+            startedAt: job.startedAt,
+            finishedAt: job.finishedAt ?? null,
+            progress: job.progress,
+        });
+    });
+    // ── POST /api/r2/sync/:jobId/cancel ─────────────────────────────────────
+    fastify.post('/api/r2/sync/:jobId/cancel', async (req, reply) => {
+        if (!requireOwner(req, authService)) {
+            return reply.status(403).send({ error: 'Workspace owner access required' });
+        }
+        const job = syncJobs.get(req.params.jobId);
+        if (!job)
+            return reply.status(404).send({ error: 'Job not found or expired' });
+        if (job.finishedAt)
+            return reply.send({ ok: true, alreadyFinished: true });
+        job.cancelRequested = true;
+        return reply.send({ ok: true });
+    });
+}
+//# sourceMappingURL=r2-api.js.map

package/dist/server/routes/r2-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2-api.js","sourceRoot":"","sources":["../../../src/server/routes/r2-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AAEtC,OAAO,EAAE,gBAAgB,EAAmC,MAAM,gCAAgC,CAAC;AAEnG,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAgB,MAAM,uBAAuB,CAAC;AACjE,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,mBAAmB,GAEpB,MAAM,kCAAkC,CAAC;AAc1C,MAAM,eAAe,GAAG,EAAE,GAAG,MAAM,CAAC;AACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;AAE5C,SAAS,aAAa;IACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;QACjC,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,GAAG,GAAG,CAAC,UAAU,GAAG,eAAe,EAAE,CAAC;YAC7D,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAmB,EAAE,WAAwB;IACjE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;IACvD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,6BAA6B;IACrD,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,UAAU,CAAC,GAAmB;IACrC,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;IACvD,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC;AAC/C,CAAC;AAUD;;;;;GAKG;AACH,SAAS,SAAS;IAChB,MAAM,SAAS,GAAG,UAAU,CAAS,eAAe,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,MAAM,GAAG,UAAU,CAAS,WAAW,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,SAAS,GAAG,UAAU,CAAS,eAAe,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,WAAW,GAAG,UAAU,CAAS,kBAAkB,CAAC,IAAI,EAAE,CAAC;IACjE,MAAM,eAAe,GAAG,UAAU,CAAS,sBAAsB,CAAC,IAAI,EAAE,CAAC;IACzE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,CAAC,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnD,IAAI,CAAC,eAAe;QAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC3D,OAAO;QACL,QAAQ,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE;QACxE,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAwB,EACxB,gBAAkC,EAClC,WAAwB,EACxB,OAAgB;IAEhB,2EAA2E;IAC3E,EAAE;IACF,wEAAwE;IACxE,uEAAuE;IACvE,sEAAsE;IACtE,gBAAgB;IAChB,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACjD,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,aAAa,GAAG,gBAAgB,CAAC,gBAAgB,EAAE,CAAC;QAC1D,MAAM,SAAS,GAAG,UAAU,CAAS,eAAe,CAAC,IAAI,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,UAAU,CAAS,WAAW,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,IAAI,GAAmB,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;QAClE,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;QACzD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,EAAE;IACF,qEAAqE;IACrE,+DAA+D;IAC/D,qEAAqE;IACrE,qEAAqE;IACrE,2BAA2B;IAC3B,OAAO,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACzD,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;QAC1C,0DAA0D;QAC1D,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC;QACnE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,sBAAsB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,+DAA+D;aACvH,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC;gBACE,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,eAAe,EAAE,QAAQ,CAAC,eAAe;aAC1C,EACD,QAAQ,CAAC,MAAM,CAChB,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,uEAAuE;YACvE,kEAAkE;YAClE,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,IAAI,OAAO,CAAC;YAClC,MAAM,OAAO,GAAG,GAAG,EAAE,OAAO,IAAI,yBAAyB,CAAC;YAC1D,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,KAAK,OAAO,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,EAAE;IACF,uEAAuE;IACvE,qEAAqE;IACrE,yDAAyD;IACzD,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAChD,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,aAAa,EAAE,CAAC;QAChB,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;gBACpB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC5B,KAAK,EAAE,2BAA2B;oBAClC,KAAK,EAAE,GAAG,CAAC,EAAE;iBACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YACzH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,sBAAsB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,wDAAwD;aACpG,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,iBAAiB,EAAE;aACnD,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/D,MAAM,GAAG,GAAY;YACnB,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ,EAAE;gBACR,UAAU,EAAE,CAAC;gBACb,aAAa,EAAE,CAAC;gBAChB,cAAc,EAAE,CAAC;gBACjB,WAAW,EAAE,CAAC;gBACd,WAAW,EAAE,EAAE;gBACf,KAAK,EAAE,UAAU;gBACjB,MAAM,EAAE,EAAE;aACX;YACD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,eAAe,EAAE,KAAK;YACtB,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC;SAC3B,CAAC;QACF,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAE1B,qEAAqE;QACrE,sEAAsE;QACtE,gEAAgE;QAChE,uCAAuC;QACvC,MAAM,OAAO,GAAI,GAAW,CAAC,IAA4B,CAAC;QAC1D,MAAM,YAAY,GAAY,OAAO;YACnC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;YAC7E,CAAC,CAAC,OAAO,CAAC;QAEZ,mEAAmE;QACnE,8DAA8D;QAC9D,mDAAmD;QACnD,CAAC,KAAK,IAAI,EAAE;YACV,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;oBACvC,aAAa,EAAE,gBAAgB,CAAC,gBAAgB,EAAE;oBAClD,SAAS;oBACT,WAAW,EAAE;wBACX,SAAS,EAAE,QAAQ,CAAC,SAAS;wBAC7B,WAAW,EAAE,QAAQ,CAAC,WAAW;wBACjC,eAAe,EAAE,QAAQ,CAAC,eAAe;qBAC1C;oBACD,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC;oBACxC,YAAY,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,eAAe;iBACxC,CAAC,CAAC;gBAEH,oEAAoE;gBACpE,oEAAoE;gBACpE,gEAAgE;gBAChE,mEAAmE;gBACnE,mEAAmE;gBACnE,yDAAyD;gBACzD,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;oBACvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;wBAAE,SAAS;oBACjC,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC;wBACrC,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAC;wBACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;4BACzB,GAAG,CAAC,GAAG,CAAC;gCACN,SAAS,EAAE,QAAQ;gCACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;gCAClC,UAAU,EAAE,EAAE;gCACd,QAAQ,EAAE,EAAE;6BACb,CAAC,CAAC;wBACL,CAAC;wBACD,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,+CAA+C,CAAC,CAAC;oBAClF,CAAC;oBAAC,OAAO,GAAQ,EAAE,CAAC;wBAClB,GAAG,CAAC,QAAQ,GAAG;4BACb,GAAG,GAAG,CAAC,QAAQ;4BACf,MAAM,EAAE;gCACN,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM;gCACtB,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,kBAAkB,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,EAAE;6BACrE;yBACF,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,GAAG,CAAC,QAAQ,GAAG;oBACb,GAAG,GAAG,CAAC,QAAQ;oBACf,KAAK,EAAE,OAAO;oBACd,MAAM,EAAE;wBACN,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM;wBACtB,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,IAAI,aAAa,EAAE;qBACrD;iBACF,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,OAAO,CAAC,GAAG,CACT,qBAAqB,EACrB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,aAAa,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC/E,OAAO,KAAK,CAAC,IAAI,CAAC;YAChB,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;YAClC,QAAQ,EAAE,GAAG,CAAC,QAAQ;SACvB,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,2EAA2E;IAC3E,OAAO,CAAC,IAAI,CACV,4BAA4B,EAC5B,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC/E,IAAI,GAAG,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,GAAG,CAAC,eAAe,GAAG,IAAI,CAAC;QAC3B,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/server/routes/secrets-api.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Secrets API routes — Phase 7 of the secrets refactor.
+ *
+ * Write-only-from-the-outside contract for secret-classified registry
+ * keys. The value never leaves the server via these endpoints: GET
+ * returns metadata only (label, provider, last_tested_at, …), and the
+ * test-connection probe runs server-side without echoing the value.
+ *
+ *   GET    /api/secrets                       — list metadata
+ *   PUT    /api/secrets/:key                  — set or overwrite (audited)
+ *   DELETE /api/secrets/:key                  — delete (audited)
+ *   POST   /api/secrets/:key/test             — dispatch registry probe
+ *
+ * Owner-only. Bootstrap-classified keys (jwt.secret, master.key, …)
+ * reject with 400 — those live in env-vars only and are not store-
+ * settable. User-secret keys also reject — those live in auth.db per
+ * Phase 8.
+ *
+ * The test endpoint dispatches `def.testConnection(value)` from the
+ * registry. The returned shape is `{ ok: bool, message?: string }` —
+ * server-derived, no upstream error body echoed. Tests are audited
+ * (success + duration), no upstream message in the audit row either.
+ *
+ * After the scope-collapse refactor, requests carry no `scope` /
+ * `scope_id` — Studiograph is single-workspace-per-process. Any legacy
+ * `scope` query param or body field is silently ignored.
+ */
+import type { FastifyInstance } from 'fastify';
+import { type AuthService } from '../../services/auth-service.js';
+/**
+ * Test-only hook: clear the process-wide cache. Vitest setups that swap
+ * the store between cases need to call this so a prior test's result
+ * doesn't leak into the next. Underscored to mark it as non-public.
+ */
+export declare function _resetSecretsTestCache(): void;
+export declare function registerSecretsApiRoutes(fastify: FastifyInstance, authService: AuthService): Promise<void>;