studiograph 1.3.48-next.2 → 1.3.48-next.201

package/dist/server/body-write-coordinator.js

@@ -0,0 +1,161 @@
+/**
+ * Body-write coordinator — single critical section for entity markdown body writes.
+ *
+ * Owns the safe path that every server-side surface (autosave PUT, MCP
+ * update_entity, agent tools, event processor) shares. The contract:
+ *
+ *   1. assertWritable gate (server-write only — autosave is the client's
+ *      own write and must not be refused). Folded into lock acquisition so
+ *      a throwing gate releases the lock cleanly.
+ *   2. Per-doc lock — serializes server-side body writes for the same doc.
+ *      Inbound client MSG_SYNC frames queue while held (see
+ *      yjsManager.withDocLock + msgSyncQueue).
+ *   3. Base-hash precondition (autosave 412 path). Read inside the lock so
+ *      we see prior locked writes before deciding.
+ *   4. Atomic disk write via MarkdownService (tmp-write + fsync + rename).
+ *   5. mdRevisionHash bookkeeping (yjsManager.recordDiskBody) so the next
+ *      persistence flush captures the post-write state.
+ *   6. Git commit. On failure, register the dirty file with SessionManager
+ *      (if wired) and surface `CommitFailedDirtyError` to the caller.
+ *   7. Server-write only: post-commit `applyAgentContent` broadcast to the
+ *      live Y.Doc. Autosave skips this — its content originated in the
+ *      live Y.Doc; re-applying would race in-flight keystrokes.
+ *
+ * Scope boundary: body writes only. Structural ops (rename, delete,
+ * changeType, move, folder ops) keep their own paths on graph.ts using
+ * the existing transaction — they have a different concurrency profile
+ * (no per-doc lock, no base-hash precondition) and routing them through
+ * here would create a god-class.
+ *
+ * Also exposes `reconcileFromDisk` — the explicit external-disk-change
+ * primitive callable from startup boot, git-pull event handlers, and
+ * dev-tools "reload from disk". Not called from the normal write path.
+ */
+import { createHash } from 'node:crypto';
+import { MarkdownService } from '../services/markdown.js';
+import { CommitFailedDirtyError, StaleBaseRevisionError } from '../core/graph.js';
+function sha256OfBody(body) {
+    return createHash('sha256').update(body, 'utf-8').digest('hex');
+}
+export class BodyWriteCoordinator {
+    commitHook;
+    yjs;
+    sessionManager;
+    markdownService = new MarkdownService();
+    constructor(commitHook, yjs, sessionManager) {
+        this.commitHook = commitHook;
+        this.yjs = yjs;
+        this.sessionManager = sessionManager;
+    }
+    /**
+     * Atomically write a body+frontmatter to disk, commit, and (for
+     * server-write) broadcast to live editors. The single body-write
+     * critical section shared by autosave + MCP + agent + event processor.
+     */
+    async writeBody(coords, body, opts) {
+        const docName = `${coords.repo}/${coords.entityType}/${coords.entityId}`;
+        return this.yjs.withDocLock(docName, async () => {
+            // assertWritable for server-write (autosave is the client's own write
+            // and never refused). Inside the lock so a throwing gate releases via
+            // withDocLock's try/finally — without that, a future change could
+            // deadlock the write path.
+            if (opts.source === 'server-write') {
+                this.yjs.assertWritable(docName);
+            }
+            // Single parse inside the lock: yields the current body (for the
+            // base-hash precondition) AND the current frontmatter (to merge
+            // against). Both must reflect any prior locked write before we decide.
+            const current = this.markdownService.parseFile(coords.entityPath);
+            // Optimistic-concurrency check.
+            if (opts.baseHash !== undefined) {
+                const currentHash = sha256OfBody(current.content);
+                if (currentHash !== opts.baseHash) {
+                    throw new StaleBaseRevisionError(coords.entityType, coords.entityId, opts.baseHash, currentHash);
+                }
+            }
+            // Merge frontmatter against fresh on-disk state, inside the lock.
+            const frontmatter = opts.prepareFrontmatter(current.frontmatter);
+            this.markdownService.writeFile(coords.entityPath, {
+                frontmatter,
+                content: body,
+                wikilinks: this.markdownService.extractWikilinks(body, frontmatter),
+            });
+            // Pin the live entry.mdRevisionHash to disk state. No-op when no
+            // Y.Doc is loaded for this entity.
+            try {
+                this.yjs.recordDiskBody(docName, body);
+            }
+            catch (err) {
+                console.warn(`[coordinator] recordDiskBody failed for ${coords.entityType}/${coords.entityId}:`, err);
+            }
+            if (!opts.skipCommit) {
+                const message = opts.commitMessage ?? `Update ${coords.entityType}: ${coords.entityId}`;
+                try {
+                    await this.commitHook.commit(coords, opts.actor, message);
+                }
+                catch (err) {
+                    // Disk write already landed; commit failed. Register the
+                    // dirty file with sessionManager (if wired) so the existing
+                    // dirty-flush retry has a chance to recover. Then surface a
+                    // typed error so the caller knows the repo is dirty.
+                    try {
+                        this.sessionManager?.markDirty(coords.repo, opts.actor, coords.entityType, coords.entityId, coords.entityPath);
+                    }
+                    catch (registerErr) {
+                        console.warn(`[coordinator] markDirty failed for ${coords.entityType}/${coords.entityId}:`, registerErr);
+                    }
+                    throw new CommitFailedDirtyError(coords.entityType, coords.entityId, coords.entityPath, err);
+                }
+            }
+            // Server-write body updates apply to the live Y.Doc AFTER commit.
+            // Returns 'no-doc' / 'unseeded' when there's no live editor — the
+            // disk write is the only side effect, which is correct.
+            // Autosave does NOT re-apply: its content originated in the live
+            // Y.Doc and re-applying would race in-flight keystrokes typed
+            // during the PUT round-trip.
+            if (opts.source === 'server-write') {
+                try {
+                    const { applied } = this.yjs.applyAgentContent(docName, body);
+                    return { broadcast: applied };
+                }
+                catch (err) {
+                    // applyAgentContent already sent a doc_conflict frame to live
+                    // clients. Log but do not rethrow — disk + git are
+                    // authoritative; surfacing the error to the caller would
+                    // suggest the write failed when in fact only the Y.Doc broadcast
+                    // did.
+                    console.warn(`[coordinator] applyAgentContent failed post-commit for ${coords.entityType}/${coords.entityId} — clients notified via doc_conflict`, err);
+                    return { broadcast: 'broadcast-failed' };
+                }
+            }
+            return { broadcast: 'skipped' };
+        });
+    }
+    /**
+     * Reconcile a live Y.Doc against the latest .md file on disk. EXPLICIT
+     * external-disk-change primitive — call this from startup boot, git-pull
+     * event handlers, and dev-tools "reload from disk" only. NOT called from
+     * the normal write path; server-side body writes route through
+     * {@link writeBody}, which broadcasts via `applyAgentContent` under the
+     * per-doc lock.
+     *
+     * Acquires the per-doc lock so a reconcile mid-write composes with the
+     * Phase 2 MSG_SYNC queue + write serialization.
+     */
+    async reconcileFromDisk(coords) {
+        const docName = `${coords.repo}/${coords.entityType}/${coords.entityId}`;
+        await this.yjs.withDocLock(docName, async () => {
+            this.yjs.reconcileFromDisk(docName);
+        });
+    }
+    /**
+     * Live body for an entity if a seeded editor doc is open, else null.
+     * Synchronous and lock-free — a point-in-time peek used by lossless reads
+     * (get_entity) and the asset-drop guard so they see the body the user is
+     * actually editing, not just the last-persisted disk state.
+     */
+    peekLiveBody(coords) {
+        return this.yjs.peekLiveBody?.(`${coords.repo}/${coords.entityType}/${coords.entityId}`) ?? null;
+    }
+}
+//# sourceMappingURL=body-write-coordinator.js.map

package/dist/server/body-write-coordinator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-write-coordinator.js","sourceRoot":"","sources":["../../src/server/body-write-coordinator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAuFlF,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,OAAO,oBAAoB;IAIrB;IACA;IACA;IALF,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;IAEhD,YACU,UAA+B,EAC/B,GAAsB,EACtB,cAAqC;QAFrC,eAAU,GAAV,UAAU,CAAqB;QAC/B,QAAG,GAAH,GAAG,CAAmB;QACtB,mBAAc,GAAd,cAAc,CAAuB;IAC5C,CAAC;IAEJ;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,MAAoB,EAAE,IAAY,EAAE,IAAsB;QACxE,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAEzE,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,IAA8B,EAAE;YACxE,sEAAsE;YACtE,sEAAsE;YACtE,kEAAkE;YAClE,2BAA2B;YAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;gBACnC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YACnC,CAAC;YAED,iEAAiE;YACjE,gEAAgE;YAChE,uEAAuE;YACvE,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAElE,gCAAgC;YAChC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAClD,IAAI,WAAW,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAClC,MAAM,IAAI,sBAAsB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;gBACnG,CAAC;YACH,CAAC;YAED,kEAAkE;YAClE,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,WAAyB,CAAC,CAAC;YAE/E,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE;gBAChD,WAAW;gBACX,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,IAAI,EAAE,WAAW,CAAC;aACpE,CAAC,CAAC;YAEH,iEAAiE;YACjE,mCAAmC;YACnC,IAAI,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,2CAA2C,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,GAAG,EAAE,GAAG,CAAC,CAAC;YACxG,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBACrB,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,IAAI,UAAU,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACxF,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC5D,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,yDAAyD;oBACzD,4DAA4D;oBAC5D,4DAA4D;oBAC5D,qDAAqD;oBACrD,IAAI,CAAC;wBACH,IAAI,CAAC,cAAc,EAAE,SAAS,CAC5B,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAC/E,CAAC;oBACJ,CAAC;oBAAC,OAAO,WAAW,EAAE,CAAC;wBACrB,OAAO,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,GAAG,EAAE,WAAW,CAAC,CAAC;oBAC3G,CAAC;oBACD,MAAM,IAAI,sBAAsB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;gBAC/F,CAAC;YACH,CAAC;YAED,kEAAkE;YAClE,kEAAkE;YAClE,wDAAwD;YACxD,iEAAiE;YACjE,8DAA8D;YAC9D,6BAA6B;YAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBAC9D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,8DAA8D;oBAC9D,mDAAmD;oBACnD,yDAAyD;oBACzD,iEAAiE;oBACjE,OAAO;oBACP,OAAO,CAAC,IAAI,CACV,0DAA0D,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,sCAAsC,EACpI,GAAG,CACJ,CAAC;oBACF,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;gBAC3C,CAAC;YACH,CAAC;YAED,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAAoB;QAC1C,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACzE,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YAC7C,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,YAAY,CAAC,MAA8D;QACzE,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,IAAI,CAAC;IACnG,CAAC;CACF"}

package/dist/server/cloud-billing-flow.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Cloud-inference billing flow helpers.
+ *
+ * Wrap a single hosted-inference run in the Studiograph Cloud
+ * reserve → settle/release lifecycle. Shared by every server route that
+ * drives the agent (chat + quick capture + the import pipeline that calls
+ * capture), so hosted inference is metered consistently — not just on chat.
+ *
+ * Semantics (unchanged from the original chat.ts implementation):
+ *  - reserve: on failure, throw only when billing is REQUIRED; otherwise log
+ *    and proceed unmetered (best-effort).
+ *  - settle: report actual usage; release the reservation when there was no
+ *    billable usage.
+ *  - release: return an unsettled reservation (error/abort path).
+ *
+ * When Cloud billing isn't configured (self-hosted / non-managed), the client
+ * is not configured: reserve() returns null and settle/release no-op, so local
+ * behavior is unchanged.
+ */
+import { createCloudInferenceBillingClient, type CloudInferenceReservation, type InferenceUsageSummary } from '../services/cloud-inference-billing.js';
+type CloudBillingClient = ReturnType<typeof createCloudInferenceBillingClient>;
+/** Minimal structural view of the orchestrator — avoids a circular import. */
+interface ModelSelector {
+    getModelSelection(): {
+        provider: string;
+        modelId: string;
+    };
+}
+export declare function reserveCloudInference(cloudBilling: CloudBillingClient, agent: ModelSelector, description: string): Promise<CloudInferenceReservation | null>;
+export declare function settleCloudInference(cloudBilling: CloudBillingClient, reservation: CloudInferenceReservation | null, usage: InferenceUsageSummary | undefined): Promise<void>;
+export declare function releaseCloudInference(cloudBilling: CloudBillingClient, reservation: CloudInferenceReservation | null, reason: string): Promise<void>;
+export {};

package/dist/server/cloud-billing-flow.js

@@ -0,0 +1,75 @@
+/**
+ * Cloud-inference billing flow helpers.
+ *
+ * Wrap a single hosted-inference run in the Studiograph Cloud
+ * reserve → settle/release lifecycle. Shared by every server route that
+ * drives the agent (chat + quick capture + the import pipeline that calls
+ * capture), so hosted inference is metered consistently — not just on chat.
+ *
+ * Semantics (unchanged from the original chat.ts implementation):
+ *  - reserve: on failure, throw only when billing is REQUIRED; otherwise log
+ *    and proceed unmetered (best-effort).
+ *  - settle: report actual usage; release the reservation when there was no
+ *    billable usage.
+ *  - release: return an unsettled reservation (error/abort path).
+ *
+ * When Cloud billing isn't configured (self-hosted / non-managed), the client
+ * is not configured: reserve() returns null and settle/release no-op, so local
+ * behavior is unchanged.
+ */
+import { createInferenceUsageSummary, inferenceUsageToBillableCents, } from '../services/cloud-inference-billing.js';
+import { log } from '../utils/log.js';
+export async function reserveCloudInference(cloudBilling, agent, description) {
+    try {
+        const model = agent.getModelSelection();
+        return await cloudBilling.reserve({
+            estimatedCents: cloudBilling.estimateCents(),
+            provider: model.provider,
+            model: model.modelId,
+            requestId: cloudBilling.nextRequestId('chat'),
+            description,
+        });
+    }
+    catch (err) {
+        if (cloudBilling.isRequired())
+            throw err;
+        log.warn(`[cloud-billing] reservation skipped: ${err instanceof Error ? err.message : String(err)}`);
+        return null;
+    }
+}
+export async function settleCloudInference(cloudBilling, reservation, usage) {
+    if (!reservation)
+        return;
+    const summary = usage ?? createInferenceUsageSummary();
+    const actualCents = inferenceUsageToBillableCents(summary);
+    try {
+        if (actualCents === null) {
+            await cloudBilling.release(reservation, 'No billable model usage was reported.');
+            return;
+        }
+        await cloudBilling.settle(reservation, {
+            actualCents,
+            inputTokens: summary.inputTokens,
+            outputTokens: summary.outputTokens,
+            description: 'Settled hosted Studiograph inference.',
+        });
+    }
+    catch (err) {
+        if (cloudBilling.isRequired())
+            throw err;
+        log.warn(`[cloud-billing] settlement skipped: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+export async function releaseCloudInference(cloudBilling, reservation, reason) {
+    if (!reservation)
+        return;
+    try {
+        await cloudBilling.release(reservation, reason);
+    }
+    catch (err) {
+        if (cloudBilling.isRequired())
+            throw err;
+        log.warn(`[cloud-billing] release skipped: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+//# sourceMappingURL=cloud-billing-flow.js.map

package/dist/server/cloud-billing-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-billing-flow.js","sourceRoot":"","sources":["../../src/server/cloud-billing-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAEL,2BAA2B,EAC3B,6BAA6B,GAG9B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAStC,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAAgC,EAChC,KAAoB,EACpB,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACxC,OAAO,MAAM,YAAY,CAAC,OAAO,CAAC;YAChC,cAAc,EAAE,YAAY,CAAC,aAAa,EAAE;YAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,KAAK,CAAC,OAAO;YACpB,SAAS,EAAE,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC;YAC7C,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,YAAY,CAAC,UAAU,EAAE;YAAE,MAAM,GAAG,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,wCAAwC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrG,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAgC,EAChC,WAA6C,EAC7C,KAAwC;IAExC,IAAI,CAAC,WAAW;QAAE,OAAO;IAEzB,MAAM,OAAO,GAAG,KAAK,IAAI,2BAA2B,EAAE,CAAC;IACvD,MAAM,WAAW,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAE3D,IAAI,CAAC;QACH,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,uCAAuC,CAAC,CAAC;YACjF,OAAO;QACT,CAAC;QAED,MAAM,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE;YACrC,WAAW;YACX,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,WAAW,EAAE,uCAAuC;SACrD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,YAAY,CAAC,UAAU,EAAE;YAAE,MAAM,GAAG,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,uCAAuC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAAgC,EAChC,WAA6C,EAC7C,MAAc;IAEd,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,YAAY,CAAC,UAAU,EAAE;YAAE,MAAM,GAAG,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC;AACH,CAAC"}

package/dist/server/commit-audit.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Commit audit log — append-only JSONL trail of every commit landed by
+ * the server, tagged by source so operators can answer "who committed
+ * this?" with one grep.
+ *
+ * Best-effort: a write failure logs and returns. The audit log is not
+ * load-bearing for correctness — it's diagnostic.
+ */
+import type { GitUser } from '../services/git.js';
+export type CommitSource = 'web-ui' | 'agent' | 'mcp' | 'cli' | 'recovery' | 'recovery-persisted' | 'session-flush' | 'graph-mutation';
+export interface CommitAuditRecord {
+    ts: string;
+    repo: string;
+    source: CommitSource;
+    user: string;
+    email: string;
+    message: string;
+    fileCount: number;
+}
+export declare function recordCommitAudit(workspacePath: string, entry: {
+    repo: string;
+    source: CommitSource;
+    user: GitUser;
+    message: string;
+    fileCount: number;
+}): void;

package/dist/server/commit-audit.js

@@ -0,0 +1,30 @@
+/**
+ * Commit audit log — append-only JSONL trail of every commit landed by
+ * the server, tagged by source so operators can answer "who committed
+ * this?" with one grep.
+ *
+ * Best-effort: a write failure logs and returns. The audit log is not
+ * load-bearing for correctness — it's diagnostic.
+ */
+import { appendFileSync, mkdirSync } from 'fs';
+import { join } from 'path';
+export function recordCommitAudit(workspacePath, entry) {
+    try {
+        mkdirSync(join(workspacePath, '.studiograph'), { recursive: true });
+        const auditPath = join(workspacePath, '.studiograph', 'commit-audit.jsonl');
+        const record = {
+            ts: new Date().toISOString(),
+            repo: entry.repo,
+            source: entry.source,
+            user: entry.user.name,
+            email: entry.user.email,
+            message: entry.message.slice(0, 200),
+            fileCount: entry.fileCount,
+        };
+        appendFileSync(auditPath, JSON.stringify(record) + '\n', 'utf-8');
+    }
+    catch (err) {
+        console.warn(`[commit-audit] failed to write audit record:`, err.message);
+    }
+}
+//# sourceMappingURL=commit-audit.js.map

package/dist/server/commit-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commit-audit.js","sourceRoot":"","sources":["../../src/server/commit-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAuB5B,MAAM,UAAU,iBAAiB,CAC/B,aAAqB,EACrB,KAAgG;IAEhG,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,oBAAoB,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAsB;YAChC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;YACrB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;YACvB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACpC,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;QACF,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,8CAA8C,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IACvF,CAAC;AACH,CAAC"}

package/dist/server/index.d.ts

@@ -4,20 +4,39 @@
  * Hosts:
  *   - Graph API (read-only REST over WorkspaceManager)
  *   - Agent chat via POST /api/chat and SSE GET /api/chat/stream
- *   - App plugins mounted via PluginLoader
+ *   - Static web UI (SvelteKit build) with SPA fallback
  */
 import { type FastifyInstance } from 'fastify';
 import { WorkspaceManager } from '../core/workspace-manager.js';
 import { GitUser } from '../services/git.js';
 import { WorkspaceConfig } from '../core/types.js';
+import { AuthService } from '../services/auth-service.js';
 export interface ServerConfig {
     workspaceManager: WorkspaceManager;
     workspacePath: string;
     workspaceConfig: WorkspaceConfig;
     gitUser: GitUser;
-    appsDir: string;
     port: number;
     host: string;
-    apiKeys: string[];
+    /**
+     * Phase 8: master key + version for AuthService's per-user encryption
+     * path (oauth_tokens.data_ciphertext, user_preferences.settings_ciphertext).
+     * Caller is `serve.ts`. Absent in tests that don't boot the full
+     * server (AuthService then stays on the legacy plaintext path).
+     */
+    authCryptoOptions?: {
+        masterKey: Uint8Array;
+        keyVersion?: string;
+    };
 }
+export declare function resolveStaticFilePath(webDir: string, urlPath: string): string | null;
+export declare function buildAllowedCorsOrigins(workspaceConfig: WorkspaceConfig, port: number): Set<string>;
+export declare function isCorsOriginAllowed(origin: string | undefined, allowedOrigins: Set<string>): boolean;
+/**
+ * Auth middleware — validates JWT cookie or Authorization: Bearer <key> header.
+ * When users exist in the auth database, all routes require authentication
+ * (except auth endpoints and static assets). When no users exist, everything
+ * is open (backward compatible).
+ */
+export declare function createAuthHook(authService: AuthService, workspaceConfig: Record<string, unknown>): (req: any, reply: any) => Promise<any>;
 export declare function createServer(config: ServerConfig): Promise<FastifyInstance>;