studiograph 1.3.48-next.2 → 1.3.48-next.201

package/dist/server/routes/share-api.js

@@ -0,0 +1,234 @@
+/**
+ * Public read-only share links.
+ *
+ * The app's first anonymous surface. Three routes:
+ *
+ *   POST /api/repos/:repo/entities/:type/:id/share-link   (AUTHED)  — mint/reuse
+ *   GET  /api/share/:token                                (PUBLIC)  — read body
+ *   GET  /api/share/:token/asset/:assetId/:filename       (PUBLIC)  — embedded asset
+ *
+ * Authorization model:
+ *  - Mint is write-gated (mirrors revoke). Personal folders ARE publishable by
+ *    their owner — the publish right is orthogonal to teammate visibility, and
+ *    the single mint caller is already owner-gated. Today read ⟺ write for
+ *    shared folders, so write-gating is a no-op now but keeps publish/unpublish
+ *    coherent and pre-empts a future read-only role from minting a link it
+ *    couldn't revoke.
+ *  - The two PUBLIC routes are bypassed in the global auth hook; the opaque
+ *    token (looked up in share_links, fail-closed on missing/revoked) IS the
+ *    authorization. A revoked token stops resolving for BOTH the body and its
+ *    assets immediately.
+ *  - The public read returns ONLY { title, entityType, content } — frontmatter
+ *    and metadata never cross the boundary (test-enforced). Asset URLs in the
+ *    body are rewritten to token-scoped /api/share/:token/asset/... links.
+ *  - A public asset must be EMBEDDED in the shared entry (and so belong to the
+ *    same repo), so a crafted body can't republish another entry's, another
+ *    repo's, or an un-embedded asset.
+ */
+import * as access from '../../services/access-control.js';
+import { rewriteImmutableAssetUrls, extractImmutableAssetRefs } from '../../core/embeds.js';
+import { serveIndexedAsset } from './asset-api.js';
+/**
+ * Whether a folder may be published at all. Personal folders ARE publishable:
+ * the owner's right to publish their own content externally is orthogonal to
+ * teammate visibility, and the single `mint()` caller is already owner-gated
+ * (a non-owner 404s on a personal folder before reaching here). The gate now
+ * degrades to a repo-existence check, but it stays a named gate — and keeps its
+ * four call sites — because it's where a future non-publishable repo class
+ * (e.g. a `system` / workspace-wide asset store added to RepoConfig) would be
+ * rejected. Read the flag off the repo config directly — `isRestrictedPersonalFolder`
+ * in access-control is unexported and user-scoped (a per-user access check),
+ * whereas this is a publish gate.
+ */
+function isPublishableRepo(workspaceManager, repo) {
+    const config = workspaceManager.getRepoConfig(repo);
+    if (!config)
+        return false;
+    return true;
+}
+function entityTitle(data, fallbackId) {
+    const name = data?.name ?? data?.title;
+    return typeof name === 'string' && name.trim() ? name : fallbackId;
+}
+/** The entry's stable creation timestamp, used to detect a delete+recreate at
+ *  the same coords. Returns null when absent (then identity isn't enforced). */
+function entityTimestamp(entity) {
+    const ts = entity?.data?.created_at;
+    return typeof ts === 'string' && ts ? ts : null;
+}
+/**
+ * Resolve the entry a live share link points at, applying the existence +
+ * entity-identity guards both public routes share: the repo + entry must still
+ * exist, and when both the link and the current entry carry a created_at they
+ * must match (else the original entry was deleted and a new one took its coords
+ * — fail closed so the old token can't serve unrelated content). Returns the
+ * entity, or null when any guard trips. Callers have already validated the
+ * token + publishable gate.
+ */
+function resolveSharedEntity(workspaceManager, link) {
+    let graph;
+    try {
+        graph = workspaceManager.getGraph(link.repo);
+    }
+    catch {
+        return null;
+    }
+    let entity;
+    try {
+        entity = graph.get(link.entryType, link.entryId);
+    }
+    catch {
+        return null;
+    }
+    if (!entity)
+        return null;
+    const currentTs = entityTimestamp(entity);
+    if (link.entityCreatedAt && currentTs && currentTs !== link.entityCreatedAt)
+        return null;
+    return entity;
+}
+export async function registerShareApiRoutes(fastify, workspaceManager, authService, shareLinkService) {
+    // POST /api/repos/:repo/entities/:type/:id/share-link — mint or reuse the
+    // active public link for an entry. Authed (not bypassed in the auth hook).
+    fastify.post('/api/repos/:repo/entities/:type/:id/share-link', async (req, reply) => {
+        const user = req.user;
+        if (!user)
+            return reply.status(401).send({ error: 'Authentication required' });
+        const { repo, type, id } = req.params;
+        if (!access.hasRepoAccess(user, repo, workspaceManager, authService)) {
+            return reply.status(404).send({ error: `Folder "${repo}" not found` });
+        }
+        // Write-gate publishing to match revoke (DELETE below). Today read ⟺ write
+        // for shared folders, so this is a no-op, but it keeps the two halves of
+        // the feature coherent and pre-empts a future read-only/viewer role from
+        // being able to mint a permanent public link it couldn't revoke.
+        if (!access.canWriteRepo(user, repo, workspaceManager, authService)) {
+            return reply.status(403).send({ error: 'You do not have write access to this folder' });
+        }
+        if (!isPublishableRepo(workspaceManager, repo)) {
+            return reply.status(403).send({ error: 'This folder cannot be shared publicly.' });
+        }
+        // Confirm the entity exists before minting, and capture its created_at so
+        // a later delete+recreate at the same coords can't inherit this token.
+        let graph;
+        try {
+            graph = workspaceManager.getGraph(repo);
+        }
+        catch (err) {
+            return reply.status(404).send({ error: err.message });
+        }
+        let entityCreatedAt = null;
+        try {
+            const entity = graph.get(type, id);
+            if (!entity)
+                return reply.status(404).send({ error: `Entity not found: ${type}/${id}` });
+            entityCreatedAt = entityTimestamp(entity);
+        }
+        catch (err) {
+            return reply.status(404).send({ error: err.message ?? `Entity not found: ${type}/${id}` });
+        }
+        const link = shareLinkService.mint(repo, type, id, user.id, entityCreatedAt);
+        return reply.send({ path: `/share/${link.token}`, token: link.token });
+    });
+    // GET /api/repos/:repo/entities/:type/:id/share-link — share status for an
+    // entry, so the entry view can show "Unshare" only when a live link exists.
+    // Read-gated (authed). Returns the active link, or nulls when not shared.
+    fastify.get('/api/repos/:repo/entities/:type/:id/share-link', async (req, reply) => {
+        const user = req.user;
+        if (!user)
+            return reply.status(401).send({ error: 'Authentication required' });
+        const { repo, type, id } = req.params;
+        if (!access.hasRepoAccess(user, repo, workspaceManager, authService)) {
+            return reply.status(404).send({ error: `Folder "${repo}" not found` });
+        }
+        // Defense in depth against a future non-publishable repo class: report
+        // not-shared rather than handing out a token that the read path would
+        // refuse to resolve anyway.
+        if (!isPublishableRepo(workspaceManager, repo)) {
+            return reply.send({ path: null, token: null });
+        }
+        const link = shareLinkService.getActiveByEntry(repo, type, id);
+        return reply.send(link ? { path: `/share/${link.token}`, token: link.token } : { path: null, token: null });
+    });
+    // DELETE /api/repos/:repo/entities/:type/:id/share-link — revoke the entry's
+    // active public link (the per-entry "Unshare" action). Write-gated: anyone
+    // who can edit the entry can take it offline (publicness is a property of the
+    // entry, not of whoever first shared it). Idempotent — revoked:false when the
+    // entry wasn't shared.
+    fastify.delete('/api/repos/:repo/entities/:type/:id/share-link', async (req, reply) => {
+        const user = req.user;
+        if (!user)
+            return reply.status(401).send({ error: 'Authentication required' });
+        const { repo, type, id } = req.params;
+        if (!access.hasRepoAccess(user, repo, workspaceManager, authService)) {
+            return reply.status(404).send({ error: `Folder "${repo}" not found` });
+        }
+        if (!access.canWriteRepo(user, repo, workspaceManager, authService)) {
+            return reply.status(403).send({ error: 'You do not have write access to this folder' });
+        }
+        return reply.send({ revoked: shareLinkService.revokeByEntry(repo, type, id) });
+    });
+    // GET /api/share/:token — PUBLIC read. Returns title + body only.
+    fastify.get('/api/share/:token', async (req, reply) => {
+        const link = shareLinkService.resolve(req.params.token);
+        // Missing OR revoked → 404 (fail-closed, no existence oracle).
+        if (!link)
+            return reply.status(404).send({ error: 'Share link not found' });
+        // Defense in depth: even a valid token never serves a now-unpublishable
+        // folder (a future non-publishable repo class).
+        if (!isPublishableRepo(workspaceManager, link.repo)) {
+            return reply.status(404).send({ error: 'Share link not found' });
+        }
+        // Existence + entity-identity guard (a delete+recreate at the same coords
+        // fails closed). Shared with the asset route below.
+        const entity = resolveSharedEntity(workspaceManager, link);
+        if (!entity)
+            return reply.status(404).send({ error: 'Share link not found' });
+        const rawContent = entity.document?.content ?? '';
+        // Mutable + security-sensitive: never let a proxy/CDN cache it, so edits
+        // and a revoke take effect immediately (D4).
+        reply.header('Cache-Control', 'no-store');
+        // SECURITY BOUNDARY: title + body + type ONLY. Frontmatter / metadata must
+        // never cross to a guest (test-enforced in share-api.test.ts).
+        return reply.send({
+            title: entityTitle(entity.data, link.entryId),
+            entityType: entity.entityType ?? link.entryType,
+            content: rewriteImmutableAssetUrls(rawContent, (assetId, filename) => `/api/share/${link.token}/asset/${assetId}/${filename}`),
+        });
+    });
+    // GET / HEAD /api/share/:token/asset/:assetId/:filename — PUBLIC asset.
+    fastify.route({
+        method: ['GET', 'HEAD'],
+        url: '/api/share/:token/asset/:assetId/:filename',
+        handler: async (req, reply) => {
+            const { token, assetId, filename } = req.params;
+            const isHead = req.method === 'HEAD';
+            const link = shareLinkService.resolve(token);
+            if (!link)
+                return reply.status(404).send({ error: 'Asset not found' });
+            if (!isPublishableRepo(workspaceManager, link.repo)) {
+                return reply.status(404).send({ error: 'Asset not found' });
+            }
+            const row = workspaceManager.getAssetIndex().get(assetId);
+            // Unknown id, filename mismatch, or an asset owned by a DIFFERENT repo
+            // than the shared entry all fail-closed.
+            if (!row || row.filename !== filename || row.repo !== link.repo) {
+                return reply.status(404).send({ error: 'Asset not found' });
+            }
+            // The asset must be EMBEDDED in the shared entry — not merely a same-repo
+            // sibling. Re-resolve the entry through the same existence + identity
+            // guard the body read uses (so an asset 404s after a delete+recreate),
+            // then confirm the body references this immutable asset URL. Uses the
+            // same grammar `rewriteImmutableAssetUrls` rewrote it from on the read.
+            const entity = resolveSharedEntity(workspaceManager, link);
+            if (!entity)
+                return reply.status(404).send({ error: 'Asset not found' });
+            const embedded = extractImmutableAssetRefs(entity.document?.content ?? '');
+            if (!embedded.some((ref) => ref.assetId === assetId && ref.filename === filename)) {
+                return reply.status(404).send({ error: 'Asset not found' });
+            }
+            return serveIndexedAsset(workspaceManager, reply, { assetId, filename, repo: row.repo, isHead });
+        },
+    });
+}
+//# sourceMappingURL=share-api.js.map

package/dist/server/routes/share-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-api.js","sourceRoot":"","sources":["../../../src/server/routes/share-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,MAAM,MAAM,kCAAkC,CAAC;AAG3D,OAAO,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,SAAS,iBAAiB,CAAC,gBAAkC,EAAE,IAAY;IACzE,MAAM,MAAM,GAAG,gBAAgB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,IAAyC,EAAE,UAAkB;IAChF,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,KAAK,CAAC;IACvC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AACrE,CAAC;AAED;gFACgF;AAChF,SAAS,eAAe,CAAC,MAAW;IAClC,MAAM,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC;IACpC,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,gBAAkC,EAAE,IAA0F;IACzJ,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QAAC,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IACrD,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACtB,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QAAC,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAuB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACvE,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACtB,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,eAAe,IAAI,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IACzF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAwB,EACxB,gBAAkC,EAClC,WAAwB,EACxB,gBAAkC;IAGlC,0EAA0E;IAC1E,2EAA2E;IAC3E,OAAO,CAAC,IAAI,CACV,gDAAgD,EAChD,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC/E,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAEtC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;YACrE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,IAAI,aAAa,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,2EAA2E;QAC3E,yEAAyE;QACzE,yEAAyE;QACzE,iEAAiE;QACjE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;YACpE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC;YAC/C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,0EAA0E;QAC1E,uEAAuE;QACvE,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YAAC,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAChD,OAAO,GAAQ,EAAE,CAAC;YAAC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC;QAC3E,IAAI,eAAe,GAAkB,IAAI,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAkB,EAAE,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACzF,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,qBAAqB,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;QAC7E,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC,CACF,CAAC;IAEF,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,OAAO,CAAC,GAAG,CACT,gDAAgD,EAChD,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC/E,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;YACrE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,IAAI,aAAa,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,uEAAuE;QACvE,sEAAsE;QACtE,4BAA4B;QAC5B,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC;YAC/C,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9G,CAAC,CACF,CAAC;IAEF,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,8EAA8E;IAC9E,uBAAuB;IACvB,OAAO,CAAC,MAAM,CACZ,gDAAgD,EAChD,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC/E,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;YACrE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,IAAI,aAAa,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;YACpE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC,CACF,CAAC;IAEF,kEAAkE;IAClE,OAAO,CAAC,GAAG,CACT,mBAAmB,EACnB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxD,+DAA+D;QAC/D,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC5E,wEAAwE;QACxE,gDAAgD;QAChD,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,0EAA0E;QAC1E,oDAAoD;QACpD,MAAM,MAAM,GAAG,mBAAmB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAE9E,MAAM,UAAU,GAAW,MAAM,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC;QAC1D,yEAAyE;QACzE,6CAA6C;QAC7C,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC1C,2EAA2E;QAC3E,+DAA+D;QAC/D,OAAO,KAAK,CAAC,IAAI,CAAC;YAChB,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,IAA2C,EAAE,IAAI,CAAC,OAAO,CAAC;YACpF,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS;YAC/C,OAAO,EAAE,yBAAyB,CAChC,UAAU,EACV,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,cAAc,IAAI,CAAC,KAAK,UAAU,OAAO,IAAI,QAAQ,EAAE,CAC/E;SACF,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,wEAAwE;IACxE,OAAO,CAAC,KAAK,CAAmE;QAC9E,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,GAAG,EAAE,4CAA4C;QACjD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAmB,EAAE,EAAE;YAC1C,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;YAChD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC;YAErC,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAEvE,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC9D,CAAC;YAED,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1D,uEAAuE;YACvE,yCAAyC;YACzC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBAChE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC9D,CAAC;YAED,0EAA0E;YAC1E,sEAAsE;YACtE,uEAAuE;YACvE,sEAAsE;YACtE,wEAAwE;YACxE,MAAM,MAAM,GAAG,mBAAmB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACzE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;YAC3E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAClF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC9D,CAAC;YAED,OAAO,iBAAiB,CAAC,gBAAgB,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACnG,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/server/routes/url-api.d.ts

@@ -0,0 +1,7 @@
+/**
+ * URL Fetch API
+ *
+ * POST /api/fetch-url — fetch a URL and extract readable text content
+ */
+import type { FastifyInstance } from 'fastify';
+export declare function registerUrlRoutes(fastify: FastifyInstance): Promise<void>;

package/dist/server/routes/url-api.js

@@ -0,0 +1,74 @@
+/**
+ * URL Fetch API
+ *
+ * POST /api/fetch-url — fetch a URL and extract readable text content
+ */
+export async function registerUrlRoutes(fastify) {
+    fastify.post('/api/fetch-url', async (req, reply) => {
+        const { url } = req.body || {};
+        if (!url || typeof url !== 'string') {
+            return reply.status(400).send({ error: 'url is required' });
+        }
+        // Basic URL validation
+        let parsed;
+        try {
+            parsed = new URL(url);
+        }
+        catch {
+            return reply.status(400).send({ error: 'Invalid URL' });
+        }
+        if (!['http:', 'https:'].includes(parsed.protocol)) {
+            return reply.status(400).send({ error: 'Only HTTP/HTTPS URLs are supported' });
+        }
+        try {
+            const response = await fetch(url, {
+                headers: {
+                    'User-Agent': 'Studiograph/1.0 (knowledge graph import)',
+                    'Accept': 'text/html,application/xhtml+xml,text/plain',
+                },
+                signal: AbortSignal.timeout(15000),
+            });
+            if (!response.ok) {
+                return reply.status(502).send({ error: `Failed to fetch: ${response.status} ${response.statusText}` });
+            }
+            const contentType = response.headers.get('content-type') ?? '';
+            const html = await response.text();
+            // Plain text — return directly
+            if (contentType.includes('text/plain')) {
+                return reply.send({ url, title: parsed.hostname, text: html.trim() });
+            }
+            // HTML — extract readable content via Readability
+            const { parseHTML } = await import('linkedom');
+            const { Readability } = await import('@mozilla/readability');
+            const { document } = parseHTML(html);
+            const reader = new Readability(document);
+            const article = reader.parse();
+            if (article?.textContent) {
+                return reply.send({
+                    url,
+                    title: article.title || parsed.hostname,
+                    text: article.textContent.trim(),
+                });
+            }
+            // Fallback: strip tags manually
+            const text = html
+                .replace(/<script[^>]*>[\s\S]*?<\/script>/gi, '')
+                .replace(/<style[^>]*>[\s\S]*?<\/style>/gi, '')
+                .replace(/<[^>]+>/g, ' ')
+                .replace(/\s+/g, ' ')
+                .trim();
+            return reply.send({
+                url,
+                title: parsed.hostname,
+                text: text.slice(0, 50000), // cap at 50k chars
+            });
+        }
+        catch (err) {
+            if (err.name === 'TimeoutError' || err.name === 'AbortError') {
+                return reply.status(504).send({ error: 'URL fetch timed out' });
+            }
+            return reply.status(502).send({ error: err.message ?? 'Failed to fetch URL' });
+        }
+    });
+}
+//# sourceMappingURL=url-api.js.map

package/dist/server/routes/url-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-api.js","sourceRoot":"","sources":["../../../src/server/routes/url-api.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAwB;IAC9D,OAAO,CAAC,IAAI,CACV,gBAAgB,EAChB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAE/B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,uBAAuB;QACvB,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,OAAO,EAAE;oBACP,YAAY,EAAE,0CAA0C;oBACxD,QAAQ,EAAE,4CAA4C;iBACvD;gBACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;aACnC,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACzG,CAAC;YAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAC/D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAEnC,+BAA+B;YAC/B,IAAI,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBACvC,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACxE,CAAC;YAED,kDAAkD;YAClD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;YAC/C,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAE7D,MAAM,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,QAAe,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;YAE/B,IAAI,OAAO,EAAE,WAAW,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC,IAAI,CAAC;oBAChB,GAAG;oBACH,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ;oBACvC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE;iBACjC,CAAC,CAAC;YACL,CAAC;YAED,gCAAgC;YAChC,MAAM,IAAI,GAAG,IAAI;iBACd,OAAO,CAAC,mCAAmC,EAAE,EAAE,CAAC;iBAChD,OAAO,CAAC,iCAAiC,EAAE,EAAE,CAAC;iBAC9C,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;iBACxB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;iBACpB,IAAI,EAAE,CAAC;YAEV,OAAO,KAAK,CAAC,IAAI,CAAC;gBAChB,GAAG;gBACH,KAAK,EAAE,MAAM,CAAC,QAAQ;gBACtB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,mBAAmB;aAChD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC7D,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,qBAAqB,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/server/routes/views-api.js

@@ -8,34 +8,51 @@ export async function registerViewsApiRoutes(fastify, authService, workspaceMana
     function getUserId(req) {
         return req.user?.id ?? 0;
     }
-    function hasTasks() {
+    function getEntityTypeCounts() {
+        const counts = {};
         try {
             for (const repo of workspaceManager.getAllRepoConfigs()) {
                 const graph = workspaceManager.getGraph(repo.name);
-                const tasks = graph.search({ entityType: 'task' });
-                if (tasks.length > 0)
-                    return true;
+                const entities = graph.search({});
+                for (const e of entities) {
+                    const type = e.data?.entity_type;
+                    if (type)
+                        counts[type] = (counts[type] ?? 0) + 1;
+                }
             }
         }
         catch { /* ignore */ }
-        return false;
+        return counts;
     }
     // GET /api/views — list user's views (auto-creates defaults on first access)
     fastify.get('/api/views', async (req, reply) => {
         const userId = getUserId(req);
-        authService.ensureDefaultViews(userId, hasTasks());
+        authService.ensureDefaultViews(userId, getEntityTypeCounts());
         return reply.send(authService.getUserViews(userId));
     });
     // POST /api/views — create a new view
     fastify.post('/api/views', async (req, reply) => {
         const userId = getUserId(req);
+        const user = req.user;
         const { name, viewType, config } = req.body ?? {};
         if (!name) {
             return reply.status(400).send({ error: 'name is required' });
         }
-        const view = authService.createUserView(userId, name, viewType ?? 'list', config ?? {});
+        const view = authService.createUserView(userId, name, viewType ?? 'list', config ?? {}, user?.displayName ?? user?.email);
         return reply.send(view);
     });
+    // POST /api/views/:id/share — toggle view visibility
+    fastify.post('/api/views/:id/share', async (req, reply) => {
+        const userId = getUserId(req);
+        const viewId = Number(req.params.id);
+        const existing = authService.getUserView(viewId, userId);
+        if (!existing) {
+            return reply.status(404).send({ error: 'View not found' });
+        }
+        const visibility = req.body?.visibility ?? 'private';
+        authService.setViewVisibility(viewId, userId, visibility);
+        return reply.send({ ok: true, visibility });
+    });
     // PUT /api/views/:id — update a view
     fastify.put('/api/views/:id', async (req, reply) => {
         const userId = getUserId(req);
@@ -62,5 +79,56 @@ export async function registerViewsApiRoutes(fastify, authService, workspaceMana
         authService.deleteUserView(viewId, userId);
         return reply.send({ ok: true });
     });
+    // ── Workspace views (folder-views redesign) ──
+    // Workspace-shared, scope-keyed view sets. Scope is `folder:<id>` |
+    // `type:<entityType>` | `recent`. Not per-user — everyone sees the same set.
+    const VIEW_TYPES = new Set(['list', 'gallery', 'kanban', 'timeline', 'calendar', 'graph']);
+    // GET /api/workspace-views?scope=… — ordered views for a scope (seeds defaults
+    // on first access: a List, plus Calendar+Graph for `recent`).
+    fastify.get('/api/workspace-views', async (req, reply) => {
+        const scope = req.query?.scope;
+        if (!scope)
+            return reply.status(400).send({ error: 'scope is required' });
+        return reply.send(authService.ensureViewsForScope(scope));
+    });
+    // POST /api/workspace-views — add a view to a scope. One-of-each is enforced
+    // by the DB.
+    fastify.post('/api/workspace-views', async (req, reply) => {
+        const user = req.user;
+        const { scope, viewType, config } = req.body ?? {};
+        if (!scope)
+            return reply.status(400).send({ error: 'scope is required' });
+        if (!viewType || !VIEW_TYPES.has(viewType)) {
+            return reply.status(400).send({ error: 'valid viewType is required' });
+        }
+        const view = authService.createWorkspaceView(scope, viewType, config ?? {}, user?.displayName ?? user?.email);
+        return reply.send(view);
+    });
+    // PUT /api/workspace-views/:id — update config / position / name.
+    fastify.put('/api/workspace-views/:id', async (req, reply) => {
+        const viewId = Number(req.params.id);
+        const existing = authService.getWorkspaceView(viewId);
+        if (!existing)
+            return reply.status(404).send({ error: 'View not found' });
+        authService.updateWorkspaceView(viewId, {
+            config: req.body?.config,
+            position: req.body?.position,
+            name: req.body?.name,
+        });
+        return reply.send({ ok: true });
+    });
+    // DELETE /api/workspace-views/:id — remove a view. List is un-removable
+    // (every scope keeps ≥1 view); every other view is removable from any scope.
+    fastify.delete('/api/workspace-views/:id', async (req, reply) => {
+        const viewId = Number(req.params.id);
+        const existing = authService.getWorkspaceView(viewId);
+        if (!existing)
+            return reply.status(404).send({ error: 'View not found' });
+        if (existing.viewType === 'list') {
+            return reply.status(400).send({ error: 'The List view cannot be removed' });
+        }
+        authService.deleteWorkspaceView(viewId);
+        return reply.send({ ok: true });
+    });
 }
 //# sourceMappingURL=views-api.js.map

package/dist/server/routes/views-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"views-api.js","sourceRoot":"","sources":["../../../src/server/routes/views-api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAwB,EACxB,WAAwB,EACxB,gBAAkC;IAGlC,SAAS,SAAS,CAAC,GAAQ;QACzB,OAAS,GAAW,CAAC,IAA6B,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED,SAAS,QAAQ;QACf,IAAI,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBACxD,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;gBACnD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC;YACpC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6EAA6E;IAC7E,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,WAAW,CAAC,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnD,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,sCAAsC;IACtC,OAAO,CAAC,IAAI,CACV,YAAY,EACZ,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,IAAI,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;QACxF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CACF,CAAC;IAEF,qCAAqC;IACrC,OAAO,CAAC,GAAG,CACT,gBAAgB,EAChB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,WAAW,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE;YACzC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI;YACpB,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM;YACxB,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS;SAC/B,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;IAEF,wCAAwC;IACxC,OAAO,CAAC,MAAM,CACZ,gBAAgB,EAChB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,WAAW,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"views-api.js","sourceRoot":"","sources":["../../../src/server/routes/views-api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAwB,EACxB,WAAwB,EACxB,gBAAkC;IAGlC,SAAS,SAAS,CAAC,GAAQ;QACzB,OAAS,GAAW,CAAC,IAA6B,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED,SAAS,mBAAmB;QAC1B,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBACxD,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAClC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,WAAqB,CAAC;oBAC3C,IAAI,IAAI;wBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBACnD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,6EAA6E;IAC7E,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,WAAW,CAAC,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,sCAAsC;IACtC,OAAO,CAAC,IAAI,CACV,YAAY,EACZ,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,IAAI,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,IAAI,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1H,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CACF,CAAC;IAEF,qDAAqD;IACrD,OAAO,CAAC,IAAI,CACV,sBAAsB,EACtB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,UAAU,IAAI,SAAS,CAAC;QACrD,WAAW,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAC9C,CAAC,CACF,CAAC;IAEF,qCAAqC;IACrC,OAAO,CAAC,GAAG,CACT,gBAAgB,EAChB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,WAAW,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE;YACzC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI;YACpB,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM;YACxB,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS;SAC/B,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;IAEF,wCAAwC;IACxC,OAAO,CAAC,MAAM,CACZ,gBAAgB,EAChB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,WAAW,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;IAEF,gDAAgD;IAChD,oEAAoE;IACpE,6EAA6E;IAE7E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAE3F,+EAA+E;IAC/E,8DAA8D;IAC9D,OAAO,CAAC,GAAG,CACT,sBAAsB,EACtB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC;QAC/B,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC1E,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5D,CAAC,CACF,CAAC;IAEF,6EAA6E;IAC7E,aAAa;IACb,OAAO,CAAC,IAAI,CACV,sBAAsB,EACtB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,IAAI,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9G,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CACF,CAAC;IAEF,kEAAkE;IAClE,OAAO,CAAC,GAAG,CACT,0BAA0B,EAC1B,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC1E,WAAW,CAAC,mBAAmB,CAAC,MAAM,EAAE;YACtC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM;YACxB,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ;YAC5B,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI;SACrB,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;IAEF,wEAAwE;IACxE,6EAA6E;IAC7E,OAAO,CAAC,MAAM,CACZ,0BAA0B,EAC1B,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC1E,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,WAAW,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/server/routes/workspace-api.d.ts

@@ -6,4 +6,5 @@
 import type { FastifyInstance } from 'fastify';
 import { WorkspaceManager } from '../../core/workspace-manager.js';
 import { GitUser } from '../../services/git.js';
-export declare function registerWorkspaceApiRoutes(fastify: FastifyInstance, workspaceManager: WorkspaceManager, gitUser: GitUser): Promise<void>;
+import { type AuthService } from '../../services/auth-service.js';
+export declare function registerWorkspaceApiRoutes(fastify: FastifyInstance, workspaceManager: WorkspaceManager, gitUser: GitUser, authService: AuthService): Promise<void>;