studiograph 1.3.48-next.2 → 1.3.48-next.201

package/dist/cli/commands/admin/restore.js

@@ -0,0 +1,228 @@
+/**
+ * studiograph admin restore — counterpart to `admin backup`.
+ *
+ * Decrypts the .sgbackup bundle, expands the workspace contents into
+ * a target directory, and writes two sidecar files into the PARENT of
+ * the target:
+ *
+ *   1. `.env.restore` — the Railway env vars (master key, JWT secret)
+ *      the operator captured at backup time. NOT auto-applied to
+ *      Railway — restore prints instructions for pasting them into the
+ *      Railway dashboard. Sidecar lives outside the workspace so it
+ *      doesn't get accidentally git-committed when the operator later
+ *      re-deploys.
+ *   2. `RESTORE-README.md` — step-by-step instructions for finishing
+ *      the recovery: create a new Railway service, paste env vars,
+ *      update workspace.json's `railway` block with the new IDs, run
+ *      `studiograph redeploy`.
+ *
+ * Refuses to overwrite an existing `.studiograph/` in the target dir.
+ * That's the disaster-recovery contract: restore is destructive enough
+ * that we want an explicit empty target.
+ */
+import { Command } from 'commander';
+import { intro, outro, log, spinner, password, isCancel } from '@clack/prompts';
+import { execFileSync } from 'child_process';
+import { existsSync, mkdirSync, writeFileSync, readFileSync, statSync, mkdtempSync, rmSync, } from 'fs';
+import { join, resolve, dirname, basename } from 'path';
+import { tmpdir } from 'os';
+import { openBundle } from '../../crypto-bundle.js';
+export const adminRestoreCommand = new Command('restore')
+    .description('Decrypt a .sgbackup bundle and expand it into a target directory')
+    .argument('<bundle>', 'Path to the .sgbackup file produced by `admin backup`')
+    .option('--into <dir>', 'Target directory for the restored workspace (default: ./<workspace-name>)')
+    .option('--passphrase <value>', 'Bundle passphrase (DO NOT use on shared shell history — prefer --passphrase-stdin)')
+    .option('--passphrase-stdin', 'Read the bundle passphrase from stdin (single line)')
+    .option('--force', 'Overwrite an existing .studiograph/ in the target directory')
+    .action(async (bundlePath, opts) => {
+    intro('Studiograph workspace restore');
+    const absBundle = resolve(bundlePath);
+    if (!existsSync(absBundle) || !statSync(absBundle).isFile()) {
+        outro(`Not a file: ${absBundle}`);
+        process.exit(1);
+        return;
+    }
+    // Passphrase resolution. Flag → stdin → interactive. Refuse on no-TTY
+    // without an explicit source (matches feedback_cli_non_interactive.md).
+    let passphrase;
+    if (opts.passphrase) {
+        passphrase = opts.passphrase;
+    }
+    else if (opts.passphraseStdin) {
+        passphrase = await readPassphraseStdin();
+    }
+    else if (process.stdout.isTTY) {
+        const input = await password({
+            message: 'Bundle passphrase:',
+            validate: (v) => (v.length > 0 ? undefined : 'Required'),
+        });
+        if (isCancel(input)) {
+            outro('Cancelled');
+            process.exit(0);
+            return;
+        }
+        passphrase = String(input);
+    }
+    else {
+        outro('No TTY. Pass --passphrase-stdin and pipe the passphrase, or use --passphrase.');
+        process.exit(1);
+        return;
+    }
+    // Decrypt + expand into a temp dir first so we can read the manifest
+    // before we know where the workspace lands. Avoids creating the
+    // target directory until we know the bundle is legit.
+    const tmpRoot = mkdtempSync(join(tmpdir(), 'sg-restore-'));
+    try {
+        const spin = spinner();
+        spin.start('Decrypting bundle...');
+        const ciphertext = readFileSync(absBundle);
+        let plaintext;
+        try {
+            plaintext = openBundle(ciphertext, passphrase);
+        }
+        catch (err) {
+            spin.stop('Decryption failed');
+            outro(err instanceof Error ? err.message : String(err));
+            process.exit(1);
+            return;
+        }
+        spin.stop('Decrypted');
+        const tarPath = join(tmpRoot, 'bundle.tar.gz');
+        writeFileSync(tarPath, plaintext, { mode: 0o600 });
+        const stagePath = join(tmpRoot, 'stage');
+        mkdirSync(stagePath, { mode: 0o700 });
+        spin.start('Expanding tar...');
+        execFileSync('tar', ['-xzf', tarPath, '-C', stagePath], { stdio: 'pipe' });
+        spin.stop('Expanded');
+        // Read the manifest to determine target directory.
+        const manifestPath = join(stagePath, 'manifest.json');
+        if (!existsSync(manifestPath)) {
+            outro('Bundle is missing manifest.json — was this produced by `admin backup`?');
+            process.exit(1);
+            return;
+        }
+        const manifest = JSON.parse(readFileSync(manifestPath, 'utf-8'));
+        if (manifest.format_version !== 1) {
+            outro(`Bundle format version ${manifest.format_version} is not supported by this CLI.`);
+            process.exit(1);
+            return;
+        }
+        const defaultDir = manifest.workspace_name
+            .toLowerCase()
+            .replace(/[^a-z0-9]+/g, '-')
+            .replace(/^-+|-+$/g, '') || 'workspace';
+        const targetDir = resolve(opts.into ?? defaultDir);
+        const targetStudio = join(targetDir, '.studiograph');
+        if (existsSync(targetStudio) && !opts.force) {
+            outro(`Refusing to overwrite ${targetStudio}. Pass --force to clobber, or pick a different --into.`);
+            process.exit(1);
+            return;
+        }
+        if (existsSync(targetStudio) && opts.force) {
+            log.warn(`--force: removing existing ${targetStudio}`);
+            rmSync(targetStudio, { recursive: true, force: true });
+        }
+        mkdirSync(targetDir, { recursive: true, mode: 0o700 });
+        spin.start('Moving workspace contents into place...');
+        // The staged tar contains: manifest.json + everything that was at
+        // the workspace root. Copy everything except manifest.json into
+        // targetDir. We use `cp -R` rather than rename to handle the
+        // already-exists case cleanly.
+        execFileSync('sh', ['-c', `cp -R "${stagePath}/." "${targetDir}/" && rm -f "${targetDir}/manifest.json"`], { stdio: 'pipe' });
+        spin.stop('Workspace files restored');
+        // Sidecars in the PARENT of targetDir so they don't get committed
+        // into the workspace by accident.
+        const parentDir = dirname(targetDir);
+        const envPath = join(parentDir, '.env.restore');
+        writeFileSync(envPath, renderEnvFile(manifest, basename(targetDir)), { encoding: 'utf-8', mode: 0o600 });
+        const readmePath = join(parentDir, 'RESTORE-README.md');
+        writeFileSync(readmePath, renderReadme(manifest, basename(targetDir)), { encoding: 'utf-8', mode: 0o600 });
+        log.success(`Restored workspace into ${targetDir}`);
+        log.message(`Sidecars written:\n` +
+            `  ${envPath}        (paste these into Railway → Variables)\n` +
+            `  ${readmePath}    (step-by-step recovery instructions)`);
+        outro('Restore complete — open RESTORE-README.md for the next steps.');
+    }
+    finally {
+        rmSync(tmpRoot, { recursive: true, force: true });
+    }
+});
+async function readPassphraseStdin() {
+    return new Promise((resolveFn, rejectFn) => {
+        let buf = '';
+        process.stdin.setEncoding('utf-8');
+        process.stdin.on('data', (chunk) => (buf += chunk));
+        process.stdin.on('end', () => resolveFn(buf.replace(/\r?\n$/, '')));
+        process.stdin.on('error', rejectFn);
+    });
+}
+function renderEnvFile(manifest, workspaceDir) {
+    return (`# Studiograph restore sidecar — created ${new Date().toISOString()}\n` +
+        `# Source workspace: ${manifest.workspace_name} (backed up ${manifest.created_at})\n` +
+        `# Restored into:    ./${workspaceDir}\n` +
+        `#\n` +
+        `# Paste these into Railway → your new service → Variables. Then\n` +
+        `# update ${workspaceDir}/.studiograph/workspace.json's "railway" block\n` +
+        `# with the new project/service/environment IDs from the dashboard URL\n` +
+        `# (old IDs below are not portable across Railway accounts).\n` +
+        `#\n` +
+        `# Old Railway IDs (for reference only):\n` +
+        `#   project_id:     ${manifest.railway?.project_id ?? '<not set>'}\n` +
+        `#   service_id:     ${manifest.railway?.service_id ?? '<not set>'}\n` +
+        `#   environment_id: ${manifest.railway?.environment_id ?? '<not set>'}\n` +
+        `\n` +
+        `STUDIOGRAPH_MASTER_KEY=${manifest.env.STUDIOGRAPH_MASTER_KEY}\n` +
+        `STUDIOGRAPH_JWT_SECRET=${manifest.env.STUDIOGRAPH_JWT_SECRET}\n`);
+}
+function renderReadme(manifest, workspaceDir) {
+    return `# Restoring \`${manifest.workspace_name}\`
+
+This workspace was decrypted from a \`.sgbackup\` bundle on ${new Date().toISOString().slice(0, 10)}.
+Source backup timestamp: \`${manifest.created_at}\`.
+
+The workspace files are now in \`./${workspaceDir}/\`. Two sidecars sit beside
+this README:
+
+- \`.env.restore\` — the Railway env vars you'll need (master key + JWT secret).
+- This file.
+
+## What to do next
+
+1. **Spin up a fresh Railway service.** Either via \`studiograph deploy railway\`
+   from \`./${workspaceDir}/\`, or manually in the Railway dashboard. You want a
+   brand-new project so the IDs are fresh.
+
+2. **Paste the env vars.** Copy \`STUDIOGRAPH_MASTER_KEY\` and
+   \`STUDIOGRAPH_JWT_SECRET\` from \`.env.restore\` into the new service's
+   Variables. **These MUST match exactly** — without them, the restored
+   \`secrets.db\` cannot decrypt and the restored auth state cannot validate
+   tokens.
+
+3. **Update \`workspace.json\`.** The old Railway IDs in the manifest do NOT
+   transfer to your new service. Open
+   \`${workspaceDir}/.studiograph/workspace.json\` and replace the \`railway\`
+   block with the IDs from your new service's dashboard URL:
+
+   \`\`\`
+   railway.com/project/<PROJECT_ID>/service/<SERVICE_ID>?environmentId=<ENV_ID>
+   \`\`\`
+
+4. **Redeploy.**
+   \`\`\`
+   cd ${workspaceDir}
+   npx -y studiograph@<latest> redeploy
+   \`\`\`
+
+5. **Verify.** \`pull --remote\` from the new server. Confirm your users,
+   secrets, and folder access all came across.
+
+## After restore is complete
+
+- Delete \`.env.restore\` from this directory once Railway has the values.
+- Delete the original \`.sgbackup\` bundle from any shared/transferred location
+  (it contains bcrypt password hashes, even though they're inside an
+  encrypted envelope).
+- Rotate the backup passphrase if it was typed on a machine you don't trust.
+`;
+}
+//# sourceMappingURL=restore.js.map

package/dist/cli/commands/admin/restore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restore.js","sourceRoot":"","sources":["../../../../src/cli/commands/admin/restore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EACL,UAAU,EACV,SAAS,EACT,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,MAAM,GACP,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAUpD,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC;KACtD,WAAW,CAAC,kEAAkE,CAAC;KAC/E,QAAQ,CAAC,UAAU,EAAE,uDAAuD,CAAC;KAC7E,MAAM,CAAC,cAAc,EAAE,2EAA2E,CAAC;KACnG,MAAM,CAAC,sBAAsB,EAAE,oFAAoF,CAAC;KACpH,MAAM,CAAC,oBAAoB,EAAE,qDAAqD,CAAC;KACnF,MAAM,CAAC,SAAS,EAAE,6DAA6D,CAAC;KAChF,MAAM,CAAC,KAAK,EAAE,UAAkB,EAAE,IAAiB,EAAE,EAAE;IACtD,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAEvC,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5D,KAAK,CAAC,eAAe,SAAS,EAAE,CAAC,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,IAAI,UAAkB,CAAC;IACvB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IAC/B,CAAC;SAAM,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,UAAU,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC3C,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC;YAC3B,OAAO,EAAE,oBAAoB;YAC7B,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;SACzD,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACrE,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,+EAA+E,CAAC,CAAC;QACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,qEAAqE;IACrE,gEAAgE;IAChE,sDAAsD;IACtD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAC/B,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAEvB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/C,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAEnD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACzC,SAAS,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAEtC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC/B,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEtB,mDAAmD;QACnD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,KAAK,CAAC,wEAAwE,CAAC,CAAC;YAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAmB,CAAC;QAEnF,IAAI,QAAQ,CAAC,cAAc,KAAK,CAAC,EAAE,CAAC;YAClC,KAAK,CAAC,yBAAyB,QAAQ,CAAC,cAAc,gCAAgC,CAAC,CAAC;YACxF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,cAAc;aACvC,WAAW,EAAE;aACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;aAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,CAAC;QACnD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QAErD,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5C,KAAK,CACH,yBAAyB,YAAY,wDAAwD,CAC9F,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QACD,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3C,GAAG,CAAC,IAAI,CAAC,8BAA8B,YAAY,EAAE,CAAC,CAAC;YACvD,MAAM,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAEvD,IAAI,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACtD,kEAAkE;QAClE,gEAAgE;QAChE,6DAA6D;QAC7D,+BAA+B;QAC/B,YAAY,CACV,IAAI,EACJ,CAAC,IAAI,EAAE,UAAU,SAAS,QAAQ,SAAS,gBAAgB,SAAS,iBAAiB,CAAC,EACtF,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAEtC,kEAAkE;QAClE,kCAAkC;QAClC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QAChD,aAAa,CACX,OAAO,EACP,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,EAC5C,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CACnC,CAAC;QACF,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QACxD,aAAa,CACX,UAAU,EACV,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,EAC3C,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CACnC,CAAC;QAEF,GAAG,CAAC,OAAO,CAAC,2BAA2B,SAAS,EAAE,CAAC,CAAC;QACpD,GAAG,CAAC,OAAO,CACT,qBAAqB;YACnB,KAAK,OAAO,kDAAkD;YAC9D,KAAK,UAAU,0CAA0C,CAC5D,CAAC;QACF,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACzE,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,KAAK,UAAU,mBAAmB;IAChC,OAAO,IAAI,OAAO,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE;QACzC,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,QAAwB,EAAE,YAAoB;IACnE,OAAO,CACL,2CAA2C,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI;QACvE,uBAAuB,QAAQ,CAAC,cAAc,eAAe,QAAQ,CAAC,UAAU,KAAK;QACrF,yBAAyB,YAAY,IAAI;QACzC,KAAK;QACL,mEAAmE;QACnE,YAAY,YAAY,kDAAkD;QAC1E,yEAAyE;QACzE,+DAA+D;QAC/D,KAAK;QACL,2CAA2C;QAC3C,uBAAuB,QAAQ,CAAC,OAAO,EAAE,UAAU,IAAI,WAAW,IAAI;QACtE,uBAAuB,QAAQ,CAAC,OAAO,EAAE,UAAU,IAAI,WAAW,IAAI;QACtE,uBAAuB,QAAQ,CAAC,OAAO,EAAE,cAAc,IAAI,WAAW,IAAI;QAC1E,IAAI;QACJ,0BAA0B,QAAQ,CAAC,GAAG,CAAC,sBAAsB,IAAI;QACjE,0BAA0B,QAAQ,CAAC,GAAG,CAAC,sBAAsB,IAAI,CAClE,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,QAAwB,EAAE,YAAoB;IAClE,OAAO,iBAAiB,QAAQ,CAAC,cAAc;;8DAEa,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;6BACtE,QAAQ,CAAC,UAAU;;qCAEX,YAAY;;;;;;;;;cASnC,YAAY;;;;;;;;;;;OAWnB,YAAY;;;;;;;;;QASX,YAAY;;;;;;;;;;;;;;CAcnB,CAAC;AACF,CAAC"}

package/dist/cli/commands/admin/secrets.d.ts

@@ -0,0 +1,23 @@
+/**
+ * studiograph secrets — operator-facing CLI for the encrypted secrets store.
+ *
+ *   studiograph secrets list                    Inventory of stored secrets
+ *   studiograph secrets get <key>               Metadata for one key (no value)
+ *   studiograph secrets set <key> [--value v]   Write or replace a secret
+ *   studiograph secrets delete <key>            Remove a secret
+ *   studiograph secrets test <key>              Dispatch the registry probe
+ *
+ * Values are never echoed by `list` / `get` — secrets are write-only-from-
+ * the-outside. The UI used to surface this as a Secrets tab in Settings;
+ * removed because (a) Providers panel handles the common cases, (b) the
+ * remaining surface is operator-only forensics, which is what this CLI is
+ * for.
+ *
+ * Authentication: the master key gates everything. We load it from env or
+ * the on-disk key file via the same flow `serve` uses. Owner-only access
+ * isn't enforced by this CLI because the user holding the master key IS
+ * the operator; if you can read `~/.studiograph/master-key`, you can read
+ * the store regardless.
+ */
+import { Command } from 'commander';
+export declare const secretsCommand: Command;

package/dist/cli/commands/admin/secrets.js

@@ -0,0 +1,256 @@
+/**
+ * studiograph secrets — operator-facing CLI for the encrypted secrets store.
+ *
+ *   studiograph secrets list                    Inventory of stored secrets
+ *   studiograph secrets get <key>               Metadata for one key (no value)
+ *   studiograph secrets set <key> [--value v]   Write or replace a secret
+ *   studiograph secrets delete <key>            Remove a secret
+ *   studiograph secrets test <key>              Dispatch the registry probe
+ *
+ * Values are never echoed by `list` / `get` — secrets are write-only-from-
+ * the-outside. The UI used to surface this as a Secrets tab in Settings;
+ * removed because (a) Providers panel handles the common cases, (b) the
+ * remaining surface is operator-only forensics, which is what this CLI is
+ * for.
+ *
+ * Authentication: the master key gates everything. We load it from env or
+ * the on-disk key file via the same flow `serve` uses. Owner-only access
+ * isn't enforced by this CLI because the user holding the master key IS
+ * the operator; if you can read `~/.studiograph/master-key`, you can read
+ * the store regardless.
+ */
+import { Command } from 'commander';
+import { intro, log, text, password, isCancel } from '@clack/prompts';
+import { homedir } from 'os';
+import { existsSync } from 'fs';
+import { join } from 'path';
+import { SqliteEncryptedStore, loadMasterKey, loadPreviousMasterKey, setSecretStore, getKeyDef, } from '../../../core/secrets/index.js';
+function openStore() {
+    const loaded = loadMasterKey();
+    const previous = loadPreviousMasterKey();
+    const sgRoot = process.env.RAILWAY_ENVIRONMENT && existsSync('/workspace')
+        ? '/workspace'
+        : join(homedir(), '.studiograph');
+    const dbPath = join(sgRoot, 'secrets.db');
+    if (!existsSync(dbPath)) {
+        log.error(`Secrets store not found at ${dbPath}`);
+        log.info('Run `studiograph init` first, or start `studiograph serve` to initialize the store.');
+        process.exit(1);
+    }
+    const store = new SqliteEncryptedStore({
+        dbPath,
+        masterKey: loaded.key,
+        previousMasterKey: previous,
+    });
+    setSecretStore(store);
+    return store;
+}
+function actor() {
+    return { type: 'system', systemId: 'cli' };
+}
+function fmtTs(ms) {
+    if (!ms)
+        return '—';
+    return new Date(ms).toISOString();
+}
+function fmtTable(rows) {
+    if (rows.length === 0)
+        return '';
+    const cols = Object.keys(rows[0]);
+    const widths = cols.map((c) => Math.max(c.length, ...rows.map((r) => r[c]?.length ?? 0)));
+    const header = cols.map((c, i) => c.padEnd(widths[i])).join('  ');
+    const sep = widths.map((w) => '─'.repeat(w)).join('  ');
+    const body = rows.map((r) => cols.map((c, i) => (r[c] ?? '').padEnd(widths[i])).join('  ')).join('\n');
+    return `${header}\n${sep}\n${body}`;
+}
+// ── secrets list ──────────────────────────────────────────────────────────
+export const secretsCommand = new Command('secrets')
+    .description('Manage the encrypted secrets store (formerly the Settings → Secrets tab)');
+secretsCommand
+    .command('list')
+    .description('List every secret currently stored, with metadata only — values are never echoed')
+    .option('--format <format>', 'Output format: table (default) or json', 'table')
+    .action(async (opts) => {
+    const store = openStore();
+    try {
+        const items = store.listSecrets();
+        if (opts.format === 'json') {
+            console.log(JSON.stringify(items, null, 2));
+            return;
+        }
+        if (items.length === 0) {
+            log.info('No secrets stored.');
+            return;
+        }
+        const rows = items.map((s) => ({
+            key: s.key,
+            label: s.label ?? '—',
+            last_tested: s.lastTestResult ? `${s.lastTestResult} (${fmtTs(s.lastTestedAt)})` : '—',
+            updated: fmtTs(s.updatedAt),
+            updated_by: s.updatedBy,
+        }));
+        console.log(fmtTable(rows));
+    }
+    finally {
+        store.close();
+    }
+});
+// ── secrets get <key> ─────────────────────────────────────────────────────
+secretsCommand
+    .command('get <key>')
+    .description('Show metadata for a single secret (value is never echoed)')
+    .option('--format <format>', 'Output format: table (default) or json', 'table')
+    .action(async (key, opts) => {
+    const store = openStore();
+    try {
+        const meta = store.describe(key);
+        if (!meta) {
+            log.error(`No secret stored for "${key}"`);
+            process.exit(1);
+        }
+        if (opts.format === 'json') {
+            console.log(JSON.stringify(meta, null, 2));
+            return;
+        }
+        console.log(`key:           ${meta.key}`);
+        console.log(`label:         ${meta.label ?? '—'}`);
+        console.log(`provider:      ${meta.provider ?? '—'}`);
+        console.log(`last tested:   ${meta.lastTestResult ? `${meta.lastTestResult} at ${fmtTs(meta.lastTestedAt)}` : '—'}`);
+        console.log(`updated:       ${fmtTs(meta.updatedAt)} by ${meta.updatedBy}`);
+        console.log(`key version:   ${meta.keyVersion}`);
+    }
+    finally {
+        store.close();
+    }
+});
+// ── secrets set <key> ─────────────────────────────────────────────────────
+secretsCommand
+    .command('set <key>')
+    .description('Write or replace a secret. If --value is omitted, prompts for the value with input masked.')
+    .option('--value <value>', 'Value to write. If omitted, prompts interactively (recommended for terminals).')
+    .option('--label <label>', 'Optional human label stored alongside the value.')
+    .option('--provider <provider>', 'Optional provider hint stored alongside the value.')
+    .action(async (key, opts) => {
+    const def = getKeyDef(key);
+    if (!def) {
+        log.error(`Unknown key "${key}". Add it to the registry first.`);
+        process.exit(1);
+    }
+    if (def.classification !== 'workspace-secret') {
+        log.error(`Key "${key}" is classification "${def.classification}", not workspace-secret. Settings go through \`studiograph config\`.`);
+        process.exit(1);
+    }
+    let value = opts.value;
+    if (!value) {
+        intro(`Set ${key}`);
+        const input = await password({
+            message: 'New value (input masked)',
+            validate: (v) => {
+                if (!v || v.length === 0)
+                    return 'Value cannot be empty';
+                const parsed = def.validate.safeParse(v);
+                if (!parsed.success)
+                    return parsed.error.issues.map((i) => i.message).join('; ');
+                return undefined;
+            },
+        });
+        if (isCancel(input)) {
+            log.warn('Cancelled.');
+            process.exit(0);
+        }
+        value = input;
+    }
+    else {
+        const parsed = def.validate.safeParse(value);
+        if (!parsed.success) {
+            log.error(`Validation failed: ${parsed.error.issues.map((i) => i.message).join('; ')}`);
+            process.exit(1);
+        }
+    }
+    const store = openStore();
+    try {
+        const meta = await store.set({ key, value, label: opts.label, provider: opts.provider }, actor());
+        log.success(`Stored ${key}. updated_at=${fmtTs(meta.updatedAt)}`);
+    }
+    finally {
+        store.close();
+    }
+});
+// ── secrets delete <key> ──────────────────────────────────────────────────
+secretsCommand
+    .command('delete <key>')
+    .description('Remove a stored secret. Audited.')
+    .option('-y, --yes', 'Skip confirmation prompt', false)
+    .action(async (key, opts) => {
+    const store = openStore();
+    try {
+        if (!store.describe(key)) {
+            log.error(`No secret stored for "${key}"`);
+            process.exit(1);
+        }
+        if (!opts.yes) {
+            intro(`Delete ${key}`);
+            const confirmed = await text({
+                message: `Type the key name to confirm deletion`,
+                placeholder: key,
+                validate: (v) => (v === key ? undefined : 'Key name must match exactly'),
+            });
+            if (isCancel(confirmed) || confirmed !== key) {
+                log.warn('Cancelled.');
+                process.exit(0);
+            }
+        }
+        const removed = await store.delete(key, actor());
+        if (removed)
+            log.success(`Deleted ${key}.`);
+        else
+            log.error(`Failed to delete ${key}.`);
+    }
+    finally {
+        store.close();
+    }
+});
+// ── secrets test <key> ────────────────────────────────────────────────────
+secretsCommand
+    .command('test <key>')
+    .description('Dispatch the registry probe for a stored secret (Test Connection equivalent)')
+    .action(async (key) => {
+    const def = getKeyDef(key);
+    if (!def) {
+        log.error(`Unknown key "${key}".`);
+        process.exit(1);
+    }
+    if (!def.testConnection) {
+        log.error(`No probe registered for "${key}". Available probes: model.anthropic.api_key, r2.access_key_id, search.brave.api_key.`);
+        process.exit(1);
+    }
+    const store = openStore();
+    try {
+        const value = store.unsafeGetForResolver(key);
+        if (!value) {
+            log.error(`No value stored for "${key}". Set it first with \`studiograph secrets set ${key}\`.`);
+            process.exit(1);
+        }
+        const startedAt = Date.now();
+        let result;
+        try {
+            result = await def.testConnection(value);
+        }
+        catch (err) {
+            result = { ok: false, message: err instanceof Error ? err.message : 'probe failed' };
+        }
+        const duration = Date.now() - startedAt;
+        const ok = !!result.ok;
+        if (ok) {
+            log.success(`OK (${duration}ms)`);
+        }
+        else {
+            log.error(`Failed (${duration}ms)${result.message ? `: ${result.message}` : ''}`);
+            process.exit(1);
+        }
+    }
+    finally {
+        store.close();
+    }
+});
+//# sourceMappingURL=secrets.js.map

package/dist/cli/commands/admin/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../../src/cli/commands/admin/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,qBAAqB,EACrB,cAAc,EACd,SAAS,GAEV,MAAM,gCAAgC,CAAC;AAExC,SAAS,SAAS;IAChB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,UAAU,CAAC,YAAY,CAAC;QACxE,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;QAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,oBAAoB,CAAC;QACrC,MAAM;QACN,SAAS,EAAE,MAAM,CAAC,GAAG;QACrB,iBAAiB,EAAE,QAAQ;KAC5B,CAAC,CAAC;IACH,cAAc,CAAC,KAAK,CAAC,CAAC;IACtB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,KAAK;IACZ,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,KAAK,CAAC,EAAsB;IACnC,IAAI,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IACpB,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,QAAQ,CAAC,IAAmC;IACnD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvG,OAAO,GAAG,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,6EAA6E;AAE7E,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC;KACjD,WAAW,CAAC,0EAA0E,CAAC,CAAC;AAE3F,cAAc;KACX,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,kFAAkF,CAAC;KAC/F,MAAM,CAAC,mBAAmB,EAAE,wCAAwC,EAAE,OAAO,CAAC;KAC9E,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,EAAE;IACzC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7B,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,GAAG;YACrB,WAAW,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;YACtF,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3B,UAAU,EAAE,CAAC,CAAC,SAAS;SACxB,CAAC,CAAC,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,6EAA6E;AAE7E,cAAc;KACX,OAAO,CAAC,WAAW,CAAC;KACpB,WAAW,CAAC,2DAA2D,CAAC;KACxE,MAAM,CAAC,mBAAmB,EAAE,wCAAwC,EAAE,OAAO,CAAC;KAC9E,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,IAAwB,EAAE,EAAE;IACtD,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,KAAK,CAAC,yBAAyB,GAAG,GAAG,CAAC,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,QAAQ,IAAI,GAAG,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,cAAc,OAAO,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACrH,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IACnD,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,6EAA6E;AAE7E,cAAc;KACX,OAAO,CAAC,WAAW,CAAC;KACpB,WAAW,CAAC,4FAA4F,CAAC;KACzG,MAAM,CAAC,iBAAiB,EAAE,gFAAgF,CAAC;KAC3G,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;KAC7E,MAAM,CAAC,uBAAuB,EAAE,oDAAoD,CAAC;KACrF,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,IAA2D,EAAE,EAAE;IACzF,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,KAAK,CAAC,gBAAgB,GAAG,kCAAkC,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,CAAC,cAAc,KAAK,kBAAkB,EAAE,CAAC;QAC9C,GAAG,CAAC,KAAK,CAAC,QAAQ,GAAG,wBAAwB,GAAG,CAAC,cAAc,sEAAsE,CAAC,CAAC;QACvI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACvB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC;YAC3B,OAAO,EAAE,0BAA0B;YACnC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;gBACd,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,uBAAuB,CAAC;gBACzD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBACzC,IAAI,CAAC,MAAM,CAAC,OAAO;oBAAE,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjF,OAAO,SAAS,CAAC;YACnB,CAAC;SACF,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,KAAK,GAAG,KAAe,CAAC;IAC1B,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,KAAK,CAAC,sBAAsB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACxF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAC1B,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAC1D,KAAK,EAAE,CACR,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,UAAU,GAAG,gBAAgB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,6EAA6E;AAE7E,cAAc;KACX,OAAO,CAAC,cAAc,CAAC;KACvB,WAAW,CAAC,kCAAkC,CAAC;KAC/C,MAAM,CAAC,WAAW,EAAE,0BAA0B,EAAE,KAAK,CAAC;KACtD,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,IAAsB,EAAE,EAAE;IACpD,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,KAAK,CAAC,yBAAyB,GAAG,GAAG,CAAC,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,KAAK,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;YACvB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC;gBAC3B,OAAO,EAAE,uCAAuC;gBAChD,WAAW,EAAE,GAAG;gBAChB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,6BAA6B,CAAC;aACzE,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBAC7C,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,IAAI,OAAO;YAAE,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,GAAG,CAAC,CAAC;;YACvC,GAAG,CAAC,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,CAAC;IAC7C,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,6EAA6E;AAE7E,cAAc;KACX,OAAO,CAAC,YAAY,CAAC;KACrB,WAAW,CAAC,8EAA8E,CAAC;KAC3F,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;IAC5B,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;QACxB,GAAG,CAAC,KAAK,CAAC,4BAA4B,GAAG,uFAAuF,CAAC,CAAC;QAClI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,KAAK,CAAC,wBAAwB,GAAG,kDAAkD,GAAG,KAAK,CAAC,CAAC;YACjG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAO,GAAG,CAAC,cAA8E,CAAC,KAAK,CAAC,CAAC;QAC5G,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;QACvF,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QACxC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,IAAI,EAAE,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,OAAO,QAAQ,KAAK,CAAC,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,WAAW,QAAQ,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/cli/commands/admin/settings.d.ts

@@ -0,0 +1,28 @@
+/**
+ * studiograph settings — CLI for the non-secret half of the encrypted store.
+ *
+ *   studiograph settings list                    Inventory of stored settings + values
+ *   studiograph settings get <key>               One value
+ *   studiograph settings set <key> <value>       Write or replace a setting
+ *   studiograph settings delete <key>            Clear (reverts to registry default)
+ *   studiograph settings schema                  Show every registered key, default, and constraint
+ *
+ * Targets registry workspace-setting keys (model.provider, model.id,
+ * r2.account_id, r2.bucket, r2.public_url, search.provider,
+ * search.google.cx, …) — the same surface the Web Providers panel
+ * writes via `PUT /api/settings/:key`. Secrets go through
+ * `studiograph secrets`; this command refuses non-setting classifications.
+ *
+ * Mirrors the shape of `studiograph secrets` (list/get/set/delete) so
+ * operators already familiar with that command don't have to relearn
+ * anything. Values are JSON-serialized in the store; for enum/string
+ * settings the value is what you'd type at the prompt. Numeric and
+ * boolean values are accepted as their plain typed form (`true`,
+ * `false`, `42`) — set converts to a JSON value before storage.
+ *
+ * Authentication: same model as `studiograph secrets` — the master key
+ * is the gate. If you can read `~/.studiograph/master-key`, you can
+ * read/write the store.
+ */
+import { Command } from 'commander';
+export declare const settingsCommand: Command;