studiograph 1.3.48-next.2 → 1.3.48-next.201

package/dist/server/yjs-text-diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"yjs-text-diff.js","sourceRoot":"","sources":["../../src/server/yjs-text-diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,MAAM,UAAU,GAAG,CAAC,CAAC;AACrB,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC;AAEvB;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAW,EAAE,KAAa,EAAE,MAAc,EAAE,MAAc;IACtF,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IACjC,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO;IAE/B,MAAM,GAAG,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7C,8EAA8E;IAC9E,0EAA0E;IAC1E,GAAG,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAEhC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE;QACjB,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;YAC/B,IAAI,EAAE,KAAK,UAAU,EAAE,CAAC;gBACtB,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC;YACrB,CAAC;iBAAM,IAAI,EAAE,KAAK,WAAW,EAAE,CAAC;gBAC9B,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC/B,uEAAuE;YACzE,CAAC;iBAAM,IAAI,EAAE,KAAK,WAAW,EAAE,CAAC;gBAC9B,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACxB,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC"}

package/dist/services/access-control.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Framework-free per-folder access control helpers.
+ *
+ * These functions decide what a given user can see or write in the workspace.
+ * They take `AuthUser | undefined` directly (not a Fastify request) so they
+ * can be reused across transports — HTTP (/api/*), MCP HTTP (/mcp), and
+ * MCP stdio all share the same rules.
+ *
+ * Rule summary:
+ * - `user === undefined` means "no identified user". On the **web** this is
+ *   API-key / open-mode (full access). On **MCP** the caller site rejects
+ *   unidentified requests before reaching these helpers, so every MCP tool
+ *   can assume a concrete user and `undefined` is never passed in.
+ * - A user can see a folder if they are an explicit member (folder_access row),
+ *   or if they are the workspace owner AND the folder has more than one member
+ *   (shared folders are visible to owners, solo folders stay private).
+ * - A user can write to a folder if they are a folder member (role = admin|editor),
+ *   or if they are the workspace owner on a shared folder.
+ * - A folder with `personal: true` is only visible/writable to its owner,
+ *   regardless of folder_access grants or workspace ownership. Stale grants
+ *   (from an older sharing attempt or test setup) cannot leak a user's
+ *   private notes to another account.
+ * - **Owner admin escalation**: workspace owners can lift the personal-
+ *   folder restriction by passing `{ includePrivate: true }` to these
+ *   helpers. The flag is enforced as owner-only inside the helpers — non-
+ *   owners passing it get no extra access. The owner-only CLI (`clone` /
+ *   `pull` / `push`) sends it unconditionally so the owner always sees every
+ *   folder; web / API surfaces opt in via the `?include_private=1` query
+ *   param on `/api/repos` or the `X-Studiograph-Include-Private: 1` header
+ *   for git transport. Used for migrations, audits, and offboarding.
+ */
+import type { WorkspaceManager } from '../core/workspace-manager.js';
+import type { RepoConfig } from '../core/types.js';
+import { type AuthService, type AuthUser } from './auth-service.js';
+/**
+ * Options accepted by the access helpers. `includePrivate` is an owner-
+ * gated admin escalation: workspace owners can opt into seeing every
+ * folder (including other users' personal ones) for migration / audit /
+ * offboarding work. Default operations stay scoped so the owner's daily
+ * workflow isn't cluttered with members' private content.
+ */
+export interface AccessOptions {
+    /** Owner-only override: when true AND caller is a workspace owner, the
+     *  personal-folder restriction is lifted. No-op for non-owners. */
+    includePrivate?: boolean;
+}
+/**
+ * Return the list of repos the user can access (content visibility).
+ * Unidentified caller (undefined) → full access, preserves legacy
+ * web / API-key behavior.
+ */
+export declare function getAccessibleRepos(user: AuthUser | undefined, workspaceManager: WorkspaceManager, authService: AuthService, opts?: AccessOptions): RepoConfig[];
+/** True if the user may read the given folder's contents. */
+export declare function hasRepoAccess(user: AuthUser | undefined, repoName: string, workspaceManager: WorkspaceManager, authService: AuthService, opts?: AccessOptions): boolean;
+/** True if the user is a folder admin on the given repo, OR a workspace
+ *  owner on a shared folder (>1 member). Solo/private folders require
+ *  actual folder-admin membership — workspace ownership alone does not
+ *  let owners rename, delete, or push members into a private folder. */
+export declare function isFolderAdminOrOwner(user: AuthUser | undefined, repoName: string, workspaceManager: WorkspaceManager, authService: AuthService): boolean;
+/**
+ * True if the user may write (create/update/delete entities) in the given folder.
+ * Membership grants write access regardless of role (both 'admin' and 'editor'
+ * can edit), and workspace owners can write to shared folders.
+ */
+export declare function canWriteRepo(user: AuthUser | undefined, repoName: string, workspaceManager: WorkspaceManager, authService: AuthService): boolean;
+/**
+ * Build a set of all entity IDs visible to the user across their accessible
+ * folders. Returns null when the caller is unidentified (no filtering needed —
+ * `filterWikilinks` treats null as "no-op").
+ */
+export declare function getAccessibleEntityIds(user: AuthUser | undefined, workspaceManager: WorkspaceManager, authService: AuthService): Set<string> | null;
+/** Filter a wikilink list to only entities the caller can access. */
+export declare function filterWikilinks(wikilinks: string[], accessibleIds: Set<string> | null): string[];

package/dist/services/access-control.js

@@ -0,0 +1,165 @@
+/**
+ * Framework-free per-folder access control helpers.
+ *
+ * These functions decide what a given user can see or write in the workspace.
+ * They take `AuthUser | undefined` directly (not a Fastify request) so they
+ * can be reused across transports — HTTP (/api/*), MCP HTTP (/mcp), and
+ * MCP stdio all share the same rules.
+ *
+ * Rule summary:
+ * - `user === undefined` means "no identified user". On the **web** this is
+ *   API-key / open-mode (full access). On **MCP** the caller site rejects
+ *   unidentified requests before reaching these helpers, so every MCP tool
+ *   can assume a concrete user and `undefined` is never passed in.
+ * - A user can see a folder if they are an explicit member (folder_access row),
+ *   or if they are the workspace owner AND the folder has more than one member
+ *   (shared folders are visible to owners, solo folders stay private).
+ * - A user can write to a folder if they are a folder member (role = admin|editor),
+ *   or if they are the workspace owner on a shared folder.
+ * - A folder with `personal: true` is only visible/writable to its owner,
+ *   regardless of folder_access grants or workspace ownership. Stale grants
+ *   (from an older sharing attempt or test setup) cannot leak a user's
+ *   private notes to another account.
+ * - **Owner admin escalation**: workspace owners can lift the personal-
+ *   folder restriction by passing `{ includePrivate: true }` to these
+ *   helpers. The flag is enforced as owner-only inside the helpers — non-
+ *   owners passing it get no extra access. The owner-only CLI (`clone` /
+ *   `pull` / `push`) sends it unconditionally so the owner always sees every
+ *   folder; web / API surfaces opt in via the `?include_private=1` query
+ *   param on `/api/repos` or the `X-Studiograph-Include-Private: 1` header
+ *   for git transport. Used for migrations, audits, and offboarding.
+ */
+import { isWorkspaceOwner } from './auth-service.js';
+/** True if the folder is `personal: true` and the caller is not its owner.
+ *  The personal flag is an owner-private invariant: it overrides folder_access
+ *  rows and workspace ownership. Unidentified callers (open mode / API key)
+ *  are never restricted — `undefined` user means full access. */
+function isRestrictedPersonalFolder(user, repoName, workspaceManager) {
+    if (!user)
+        return false;
+    const repo = workspaceManager.getRepoConfig(repoName);
+    if (!repo?.personal)
+        return false;
+    // Missing owner_id on a personal folder would be a config bug; err on
+    // the side of deny to avoid leaking content.
+    return repo.owner_id === undefined || repo.owner_id !== user.id;
+}
+/** True if the folder is workspace-wide (the reserved shared asset store).
+ *  Every authenticated member gets read + write (upload) without a
+ *  folder_access grant. This does NOT grant folder-admin (rename/delete the
+ *  folder) or per-asset deletion — those stay owner/uploader-scoped. A
+ *  workspace-wide folder must never also be `personal`. */
+function isWorkspaceWide(repoName, workspaceManager) {
+    return workspaceManager.getRepoConfig(repoName)?.workspace_wide === true;
+}
+/**
+ * Return the list of repos the user can access (content visibility).
+ * Unidentified caller (undefined) → full access, preserves legacy
+ * web / API-key behavior.
+ */
+export function getAccessibleRepos(user, workspaceManager, authService, opts = {}) {
+    const allRepos = workspaceManager.getAllRepoConfigs();
+    if (!user)
+        return allRepos;
+    const allowed = new Set(authService.getUserFolders(user.id));
+    const isOwner = isWorkspaceOwner(user.role);
+    const ownerOverride = isOwner && opts.includePrivate === true;
+    return allRepos.filter(r => {
+        if (ownerOverride)
+            return true;
+        // Personal folders are owner-only, regardless of grants.
+        if (r.personal && r.owner_id !== user.id)
+            return false;
+        // Workspace-wide folders (the shared asset store) are visible to every
+        // member without a grant. (Mutually exclusive with `personal`.)
+        if (r.workspace_wide)
+            return true;
+        if (allowed.has(r.name))
+            return true;
+        if (isOwner && authService.getFolderMembers(r.name).length > 1)
+            return true;
+        return false;
+    });
+}
+/** True if the user may read the given folder's contents. */
+export function hasRepoAccess(user, repoName, workspaceManager, authService, opts = {}) {
+    if (!user)
+        return true;
+    const isOwner = isWorkspaceOwner(user.role);
+    if (isOwner && opts.includePrivate === true)
+        return true;
+    if (isRestrictedPersonalFolder(user, repoName, workspaceManager))
+        return false;
+    if (isWorkspaceWide(repoName, workspaceManager))
+        return true;
+    if (authService.getUserFolders(user.id).includes(repoName))
+        return true;
+    if (isOwner && authService.getFolderMembers(repoName).length > 1)
+        return true;
+    return false;
+}
+/** True if the user is a folder admin on the given repo, OR a workspace
+ *  owner on a shared folder (>1 member). Solo/private folders require
+ *  actual folder-admin membership — workspace ownership alone does not
+ *  let owners rename, delete, or push members into a private folder. */
+export function isFolderAdminOrOwner(user, repoName, workspaceManager, authService) {
+    if (!user)
+        return true;
+    if (isRestrictedPersonalFolder(user, repoName, workspaceManager))
+        return false;
+    if (authService.isFolderAdmin(user.id, repoName))
+        return true;
+    if (isWorkspaceOwner(user.role) && authService.getFolderMembers(repoName).length > 1)
+        return true;
+    return false;
+}
+/**
+ * True if the user may write (create/update/delete entities) in the given folder.
+ * Membership grants write access regardless of role (both 'admin' and 'editor'
+ * can edit), and workspace owners can write to shared folders.
+ */
+export function canWriteRepo(user, repoName, workspaceManager, authService) {
+    if (!user)
+        return true;
+    if (isRestrictedPersonalFolder(user, repoName, workspaceManager))
+        return false;
+    // Workspace-wide store: any member may upload (create/update). Per-asset
+    // DELETE is restricted separately at the asset-delete route (uploader +
+    // workspace owner) — write access here does not imply delete-anyone's-asset.
+    if (isWorkspaceWide(repoName, workspaceManager))
+        return true;
+    const role = authService.getFolderRole(user.id, repoName);
+    if (role === 'admin' || role === 'editor')
+        return true;
+    if (isWorkspaceOwner(user.role) && authService.getFolderMembers(repoName).length > 1)
+        return true;
+    return false;
+}
+/**
+ * Build a set of all entity IDs visible to the user across their accessible
+ * folders. Returns null when the caller is unidentified (no filtering needed —
+ * `filterWikilinks` treats null as "no-op").
+ */
+export function getAccessibleEntityIds(user, workspaceManager, authService) {
+    if (!user)
+        return null;
+    const repos = getAccessibleRepos(user, workspaceManager, authService);
+    const ids = new Set();
+    for (const repo of repos) {
+        try {
+            const graph = workspaceManager.getGraph(repo.name);
+            for (const e of graph.search({})) {
+                ids.add(e.id);
+            }
+        }
+        catch { /* skip unmounted repos */ }
+    }
+    return ids;
+}
+/** Filter a wikilink list to only entities the caller can access. */
+export function filterWikilinks(wikilinks, accessibleIds) {
+    if (!accessibleIds)
+        return wikilinks;
+    return wikilinks.filter(id => accessibleIds.has(id));
+}
+//# sourceMappingURL=access-control.js.map

package/dist/services/access-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control.js","sourceRoot":"","sources":["../../src/services/access-control.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAIH,OAAO,EAAE,gBAAgB,EAAmC,MAAM,mBAAmB,CAAC;AAEtF;;;iEAGiE;AACjE,SAAS,0BAA0B,CACjC,IAA0B,EAC1B,QAAgB,EAChB,gBAAkC;IAElC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,IAAI,GAAG,gBAAgB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI,EAAE,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClC,sEAAsE;IACtE,6CAA6C;IAC7C,OAAO,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;;;2DAI2D;AAC3D,SAAS,eAAe,CACtB,QAAgB,EAChB,gBAAkC;IAElC,OAAO,gBAAgB,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,cAAc,KAAK,IAAI,CAAC;AAC3E,CAAC;AAeD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAA0B,EAC1B,gBAAkC,EAClC,WAAwB,EACxB,OAAsB,EAAE;IAExB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,iBAAiB,EAAE,CAAC;IACtD,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,OAAO,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC;IAC9D,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACzB,IAAI,aAAa;YAAE,OAAO,IAAI,CAAC;QAC/B,yDAAyD;QACzD,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QACvD,uEAAuE;QACvE,gEAAgE;QAChE,IAAI,CAAC,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QAClC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,OAAO,IAAI,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,aAAa,CAC3B,IAA0B,EAC1B,QAAgB,EAChB,gBAAkC,EAClC,WAAwB,EACxB,OAAsB,EAAE;IAExB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,OAAO,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,0BAA0B,CAAC,IAAI,EAAE,QAAQ,EAAE,gBAAgB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,IAAI,eAAe,CAAC,QAAQ,EAAE,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,OAAO,IAAI,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;wEAGwE;AACxE,MAAM,UAAU,oBAAoB,CAClC,IAA0B,EAC1B,QAAgB,EAChB,gBAAkC,EAClC,WAAwB;IAExB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,0BAA0B,CAAC,IAAI,EAAE,QAAQ,EAAE,gBAAgB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,IAAI,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClG,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,IAA0B,EAC1B,QAAgB,EAChB,gBAAkC,EAClC,WAAwB;IAExB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,0BAA0B,CAAC,IAAI,EAAE,QAAQ,EAAE,gBAAgB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,yEAAyE;IACzE,wEAAwE;IACxE,6EAA6E;IAC7E,IAAI,eAAe,CAAC,QAAQ,EAAE,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,IAAI,GAAG,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC1D,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClG,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAA0B,EAC1B,gBAAkC,EAClC,WAAwB;IAExB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;gBACjC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,eAAe,CAAC,SAAmB,EAAE,aAAiC;IACpF,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IACrC,OAAO,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/dist/services/asset-caption-service.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Asset caption + OCR service (P3b — indexing pillar).
+ *
+ * Turns an image asset's bytes into searchable text: a concise factual
+ * description plus an OCR transcription of any legible text. That text lands in
+ * the SAME sidecar `VectorService.readAssetSidecar` already folds into the
+ * FTS/embedding input (`.studiograph/assets-text/asset/<entityId>.txt`), so a
+ * captioned image becomes findable by its content, not just its filename.
+ *
+ * This module owns ONLY the model call + the bounded fan-out. It does NOT touch
+ * disk, git, or LanceDB — the sweep (asset-index-sweep.ts) wires those so the
+ * service stays a pure, unit-testable transform over `(bytes) → text`.
+ *
+ * Guardrails (decision A3 + Codex):
+ *  - **Bounded concurrency** (default 2): vision is not a free background
+ *    service; a bulk import / first-boot migration must not fan out unbounded.
+ *  - **Per-call timeout**: a hung provider call can't wedge the pool.
+ *  - **Retry cap → permanent `failed`**: transient errors retry up to a cap,
+ *    then the asset is honestly marked filename-only.
+ *  - **Failure isolation**: one image's failure never aborts the batch.
+ *  - **Gateway degrade (option a)**: `completeSimple()` cannot reach the
+ *    Studiograph Credits gateway (it routes through its own client), so in
+ *    gateway mode captioning is skipped and the image stays honestly
+ *    filename-only — NOT routed through the gateway here.
+ */
+/** Model coordinates resolved by the caller (orchestrator pattern). */
+export interface CaptionModelConfig {
+    provider: string;
+    modelId: string;
+    apiKey: string;
+}
+/** Outcome of a single caption attempt. */
+export interface CaptionResult {
+    /** `full` = caption text produced; `failed` = honest filename-only. */
+    status: 'full' | 'failed';
+    /** The caption + OCR text (present only when status === 'full'). */
+    text?: string;
+    /** Machine-readable reason when failed (gateway | no-vision | no-api-key | error | timeout | empty). */
+    reason?: string;
+}
+/**
+ * Minimal stand-in for pi-ai's `completeSimple`. Injectable so tests exercise
+ * the retry / timeout / concurrency logic without a live provider.
+ */
+export type CaptionCompleteFn = (model: unknown, context: unknown, options: {
+    apiKey: string;
+    maxTokens?: number;
+}) => Promise<{
+    content: Array<{
+        type: string;
+        text?: string;
+    }>;
+    stopReason?: string;
+    errorMessage?: string;
+}>;
+export interface CaptionOptions {
+    /** Per-call wall-clock budget. Default 60s. */
+    timeoutMs?: number;
+    /** Total attempts per image (initial + retries). Default 2. */
+    maxAttempts?: number;
+    /** Max caption tokens. Default 1024. */
+    maxTokens?: number;
+    /** Bytes above which the image is skipped (filename-only) instead of sent. */
+    maxBytes?: number;
+    /** Override the model call (tests). Defaults to pi-ai `completeSimple`. */
+    completeFn?: CaptionCompleteFn;
+}
+/** Bounded caption fan-out — vision is metered, keep it small (A3). */
+export declare const DEFAULT_CAPTION_CONCURRENCY = 2;
+/**
+ * Is captioning reachable for this model config right now? Separate from
+ * `supportsVision` because the gateway IS vision-capable yet unreachable via
+ * `completeSimple` (decision A6 + the gateway-degrade note).
+ */
+export declare function canCaption(config: CaptionModelConfig): {
+    ok: boolean;
+    reason?: string;
+};
+/**
+ * Caption + OCR a single image. Gated by `canCaption`; never throws — a
+ * permanent failure resolves to `{ status: 'failed', reason }` so the caller
+ * can record honest index state.
+ */
+export declare function captionImage(buffer: Buffer, mimeType: string, config: CaptionModelConfig, opts?: CaptionOptions): Promise<CaptionResult>;
+/** One image to caption, paired with a caller-chosen key (e.g. entity id). */
+export interface CaptionJob {
+    key: string;
+    buffer: Buffer;
+    mimeType: string;
+}
+/** A caption result tagged with its job key. */
+export interface CaptionBatchResult extends CaptionResult {
+    key: string;
+}
+/**
+ * Caption a batch of images with bounded concurrency and full failure
+ * isolation — a single image throwing or timing out never sinks the batch.
+ * Results come back in input order, each tagged with its job key.
+ */
+export declare function captionImages(jobs: CaptionJob[], config: CaptionModelConfig, opts?: CaptionOptions & {
+    concurrency?: number;
+}): Promise<CaptionBatchResult[]>;

package/dist/services/asset-caption-service.js

@@ -0,0 +1,184 @@
+/**
+ * Asset caption + OCR service (P3b — indexing pillar).
+ *
+ * Turns an image asset's bytes into searchable text: a concise factual
+ * description plus an OCR transcription of any legible text. That text lands in
+ * the SAME sidecar `VectorService.readAssetSidecar` already folds into the
+ * FTS/embedding input (`.studiograph/assets-text/asset/<entityId>.txt`), so a
+ * captioned image becomes findable by its content, not just its filename.
+ *
+ * This module owns ONLY the model call + the bounded fan-out. It does NOT touch
+ * disk, git, or LanceDB — the sweep (asset-index-sweep.ts) wires those so the
+ * service stays a pure, unit-testable transform over `(bytes) → text`.
+ *
+ * Guardrails (decision A3 + Codex):
+ *  - **Bounded concurrency** (default 2): vision is not a free background
+ *    service; a bulk import / first-boot migration must not fan out unbounded.
+ *  - **Per-call timeout**: a hung provider call can't wedge the pool.
+ *  - **Retry cap → permanent `failed`**: transient errors retry up to a cap,
+ *    then the asset is honestly marked filename-only.
+ *  - **Failure isolation**: one image's failure never aborts the batch.
+ *  - **Gateway degrade (option a)**: `completeSimple()` cannot reach the
+ *    Studiograph Credits gateway (it routes through its own client), so in
+ *    gateway mode captioning is skipped and the image stays honestly
+ *    filename-only — NOT routed through the gateway here.
+ */
+import { getModel, completeSimple } from '@mariozechner/pi-ai';
+import { isStudiographCreditsMode } from './cloud-inference-billing.js';
+import { supportsVision } from './model-capabilities.js';
+const DEFAULT_TIMEOUT_MS = 60_000;
+const DEFAULT_MAX_ATTEMPTS = 2;
+const DEFAULT_MAX_TOKENS = 1024;
+/**
+ * Bytes above which we skip captioning. Base64-encoding inflates the buffer
+ * ~33% into the request body, and most vision providers reject large payloads
+ * (413) or time out — both of which would otherwise burn the retry cap and
+ * mark a perfectly valid image permanently `failed`. The doc extractor has the
+ * analogous `SIDECAR_EXTRACT_BYTES_CAP` guard; this is its image-path peer.
+ * An oversized image stays honestly filename-only.
+ */
+const DEFAULT_CAPTION_MAX_BYTES = 8 * 1024 * 1024;
+/**
+ * Image MIME types vision models actually accept. The presign allowlist was
+ * widened (P4) to png/jpeg/gif/webp/avif/heic, but Anthropic + most providers
+ * only decode png/jpeg/gif/webp; shipping image/avif or image/heic returns a
+ * 400 that would burn the retry cap and land terminal `failed` for a
+ * perfectly real image. Skip those up-front so they read honestly as
+ * filename-only (reason `unsupported-mime`) instead of a wasted vision call.
+ * Note `application/octet-stream` is intentionally absent — an asset whose
+ * mime wasn't classified shouldn't be guessed as captionable.
+ */
+const CAPTIONABLE_MIME = new Set(['image/png', 'image/jpeg', 'image/gif', 'image/webp']);
+/** Bounded caption fan-out — vision is metered, keep it small (A3). */
+export const DEFAULT_CAPTION_CONCURRENCY = 2;
+const CAPTION_SYSTEM_PROMPT = 'You index images for full-text search. Given one image, output plain text ' +
+    'with two parts and nothing else:\n' +
+    '1. A concise, factual description (subjects, setting, document/diagram/chart ' +
+    'type, notable colors). One short paragraph.\n' +
+    '2. On a new line starting with "OCR:", transcribe ALL legible text in the ' +
+    'image verbatim. If there is no text, write "OCR: (none)".\n' +
+    'No preamble, no markdown, no commentary. Keep it under ~250 words.';
+const CAPTION_USER_PROMPT = 'Describe this image and transcribe any text it contains, following the ' +
+    'system instructions exactly.';
+/**
+ * Is captioning reachable for this model config right now? Separate from
+ * `supportsVision` because the gateway IS vision-capable yet unreachable via
+ * `completeSimple` (decision A6 + the gateway-degrade note).
+ */
+export function canCaption(config) {
+    if (isStudiographCreditsMode())
+        return { ok: false, reason: 'gateway' };
+    if (!config.apiKey)
+        return { ok: false, reason: 'no-api-key' };
+    if (!supportsVision(config.provider, config.modelId))
+        return { ok: false, reason: 'no-vision' };
+    return { ok: true };
+}
+/** Reject a promise that outruns `ms`. */
+function withTimeout(p, ms) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new Error(`caption call timed out after ${ms}ms`)), ms);
+        p.then((v) => { clearTimeout(timer); resolve(v); }, (e) => { clearTimeout(timer); reject(e); });
+    });
+}
+/**
+ * Caption + OCR a single image. Gated by `canCaption`; never throws — a
+ * permanent failure resolves to `{ status: 'failed', reason }` so the caller
+ * can record honest index state.
+ */
+export async function captionImage(buffer, mimeType, config, opts = {}) {
+    const gate = canCaption(config);
+    if (!gate.ok)
+        return { status: 'failed', reason: gate.reason };
+    // The model can only decode a subset of the (widened) presign image set.
+    // Skip avif/heic/etc. before spending a vision call that would 400.
+    if (!CAPTIONABLE_MIME.has(mimeType.toLowerCase())) {
+        return { status: 'failed', reason: 'unsupported-mime' };
+    }
+    const maxBytes = opts.maxBytes ?? DEFAULT_CAPTION_MAX_BYTES;
+    if (buffer.length > maxBytes) {
+        // Too large to ship to the vision model — skip rather than 413/timeout into
+        // a permanent failure. `oversize` reads honestly as filename-only.
+        return { status: 'failed', reason: 'oversize' };
+    }
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const maxAttempts = Math.max(1, opts.maxAttempts ?? DEFAULT_MAX_ATTEMPTS);
+    const maxTokens = opts.maxTokens ?? DEFAULT_MAX_TOKENS;
+    const complete = opts.completeFn ?? completeSimple;
+    // Resolve a pi-ai model. Unknown-to-pi-ai models still pass canCaption via
+    // the capability map; completeSimple would then reject them, which surfaces
+    // as a (correct) failure below. A best-effort placeholder keeps the call
+    // shape intact and lets an injected completeFn ignore it.
+    let model;
+    try {
+        model = getModel(config.provider, config.modelId);
+    }
+    catch {
+        model = { provider: config.provider, id: config.modelId };
+    }
+    const context = {
+        systemPrompt: CAPTION_SYSTEM_PROMPT,
+        messages: [
+            {
+                role: 'user',
+                content: [
+                    { type: 'image', data: buffer.toString('base64'), mimeType },
+                    { type: 'text', text: CAPTION_USER_PROMPT },
+                ],
+                timestamp: Date.now(),
+            },
+        ],
+    };
+    let lastReason = 'error';
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+        try {
+            const result = await withTimeout(complete(model, context, { apiKey: config.apiKey, maxTokens }), timeoutMs);
+            if (result.stopReason === 'error') {
+                lastReason = 'error';
+                continue;
+            }
+            const text = (result.content ?? [])
+                .filter((c) => c.type === 'text')
+                .map((c) => c.text ?? '')
+                .join('')
+                .trim();
+            if (text)
+                return { status: 'full', text };
+            lastReason = 'empty';
+        }
+        catch (err) {
+            lastReason = err instanceof Error && /timed out/.test(err.message) ? 'timeout' : 'error';
+        }
+    }
+    return { status: 'failed', reason: lastReason };
+}
+/**
+ * Caption a batch of images with bounded concurrency and full failure
+ * isolation — a single image throwing or timing out never sinks the batch.
+ * Results come back in input order, each tagged with its job key.
+ */
+export async function captionImages(jobs, config, opts = {}) {
+    const concurrency = Math.max(1, opts.concurrency ?? DEFAULT_CAPTION_CONCURRENCY);
+    const results = new Array(jobs.length);
+    let next = 0;
+    async function worker() {
+        while (true) {
+            const i = next++;
+            if (i >= jobs.length)
+                return;
+            const job = jobs[i];
+            try {
+                const r = await captionImage(job.buffer, job.mimeType, config, opts);
+                results[i] = { key: job.key, ...r };
+            }
+            catch {
+                // captionImage is designed not to throw, but isolate regardless.
+                results[i] = { key: job.key, status: 'failed', reason: 'error' };
+            }
+        }
+    }
+    const workers = Array.from({ length: Math.min(concurrency, jobs.length) }, () => worker());
+    await Promise.all(workers);
+    return results;
+}
+//# sourceMappingURL=asset-caption-service.js.map

package/dist/services/asset-caption-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-caption-service.js","sourceRoot":"","sources":["../../src/services/asset-caption-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AA8CzD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC;;;;;;;GAOG;AACH,MAAM,yBAAyB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAClD;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;AACzF,uEAAuE;AACvE,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAE7C,MAAM,qBAAqB,GACzB,4EAA4E;IAC5E,oCAAoC;IACpC,+EAA+E;IAC/E,+CAA+C;IAC/C,4EAA4E;IAC5E,6DAA6D;IAC7D,oEAAoE,CAAC;AAEvE,MAAM,mBAAmB,GACvB,yEAAyE;IACzE,8BAA8B,CAAC;AAEjC;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,MAA0B;IACnD,IAAI,wBAAwB,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC/D,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAChG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,0CAA0C;AAC1C,SAAS,WAAW,CAAI,CAAa,EAAE,EAAU;IAC/C,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9F,CAAC,CAAC,IAAI,CACJ,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAC3C,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC3C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,QAAgB,EAChB,MAA0B,EAC1B,OAAuB,EAAE;IAEzB,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAE/D,yEAAyE;IACzE,oEAAoE;IACpE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,yBAAyB,CAAC;IAC5D,IAAI,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC7B,4EAA4E;QAC5E,mEAAmE;QACnE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAK,cAA+C,CAAC;IAErF,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,0DAA0D;IAC1D,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAe,EAAE,MAAM,CAAC,OAAc,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,OAAO,GAAG;QACd,YAAY,EAAE,qBAAqB;QACnC,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE;oBAC5D,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE;iBAC5C;gBACD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB;SACF;KACF,CAAC;IAEF,IAAI,UAAU,GAAG,OAAO,CAAC;IACzB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;YAC5G,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;gBAClC,UAAU,GAAG,OAAO,CAAC;gBACrB,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;iBAChC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;iBAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;iBACxB,IAAI,CAAC,EAAE,CAAC;iBACR,IAAI,EAAE,CAAC;YACV,IAAI,IAAI;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC1C,UAAU,GAAG,OAAO,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,GAAG,GAAG,YAAY,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;QAC3F,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAClD,CAAC;AAcD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAkB,EAClB,MAA0B,EAC1B,OAAkD,EAAE;IAEpD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,IAAI,2BAA2B,CAAC,CAAC;IACjF,MAAM,OAAO,GAAyB,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,IAAI,GAAG,CAAC,CAAC;IAEb,KAAK,UAAU,MAAM;QACnB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;gBAAE,OAAO;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;gBACrE,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,iEAAiE;gBACjE,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YACnE,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3F,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/services/asset-delete-authz.d.ts

@@ -0,0 +1,31 @@
+import type { RepoConfig } from '../core/types.js';
+import type { AssetIndexService } from './assets/asset-index-service.js';
+import { type AuthUser } from './auth-service.js';
+/**
+ * Delete authorization for the workspace-wide Assets store (codex-review P1 / D2).
+ *
+ * `workspace_wide` grants every member write (upload) access, so deletion needs
+ * a tighter rule than folder-write: only the asset's uploader (recorded
+ * `uploader_user_id`) or a workspace owner may delete it. Returns a denial
+ * message, or `null` when the delete is allowed.
+ *
+ * Pass `filename` for single-file deletes (the filename route): the gate then
+ * keys on the row for THAT file, and a legacy file with no index row is
+ * owner-only — so a member can't delete a co-located legacy blob just by owning
+ * a different indexed asset under the same entity (codex P1). Omit `filename`
+ * for whole-entity deletes (gate on every indexed row).
+ *
+ * Scope: only gates `workspace_wide` folders. Non-workspace_wide folders return
+ * `null` here (normal folder-write semantics already applied upstream).
+ * Open-mode / API-key callers (`user` undefined) are unrestricted. An entity
+ * with no indexed assets in the shared store is unexpected → owner-only.
+ */
+export declare function assetDeleteDenial(index: AssetIndexService | undefined, repoConfig: RepoConfig | undefined, user: AuthUser | undefined, repo: string, entityType: string, entityId: string, filename?: string): string | null;
+/**
+ * Delete authorization for a free-standing asset addressed by its immutable
+ * `assetId` (the asset-manager delete-by-id route). Same uploader/owner gate as
+ * {@link assetDeleteDenial}, but keyed directly on the asset row rather than an
+ * entity coordinate. Only gates `workspace_wide` folders; open-mode callers are
+ * unrestricted. A missing row resolves owner-only via `index.canDelete`.
+ */
+export declare function assetDeleteDenialByAssetId(index: AssetIndexService | undefined, repoConfig: RepoConfig | undefined, user: AuthUser | undefined, assetId: string): string | null;

package/dist/services/asset-delete-authz.js

@@ -0,0 +1,61 @@
+import { isWorkspaceOwner } from './auth-service.js';
+const DENIAL = 'Only the uploader or a workspace owner can delete assets in the shared Assets folder.';
+/**
+ * Delete authorization for the workspace-wide Assets store (codex-review P1 / D2).
+ *
+ * `workspace_wide` grants every member write (upload) access, so deletion needs
+ * a tighter rule than folder-write: only the asset's uploader (recorded
+ * `uploader_user_id`) or a workspace owner may delete it. Returns a denial
+ * message, or `null` when the delete is allowed.
+ *
+ * Pass `filename` for single-file deletes (the filename route): the gate then
+ * keys on the row for THAT file, and a legacy file with no index row is
+ * owner-only — so a member can't delete a co-located legacy blob just by owning
+ * a different indexed asset under the same entity (codex P1). Omit `filename`
+ * for whole-entity deletes (gate on every indexed row).
+ *
+ * Scope: only gates `workspace_wide` folders. Non-workspace_wide folders return
+ * `null` here (normal folder-write semantics already applied upstream).
+ * Open-mode / API-key callers (`user` undefined) are unrestricted. An entity
+ * with no indexed assets in the shared store is unexpected → owner-only.
+ */
+export function assetDeleteDenial(index, repoConfig, user, repo, entityType, entityId, filename) {
+    if (!repoConfig?.workspace_wide)
+        return null;
+    if (!user)
+        return null;
+    const owner = isWorkspaceOwner(user.role);
+    if (!index)
+        return owner ? null : DENIAL;
+    let rows = index.listByOwner(repo, entityType, entityId);
+    if (filename !== undefined) {
+        // Single-file delete: only the row for this exact file is relevant. No
+        // matching row = a legacy/un-indexed blob → owner-only (can't be claimed
+        // by owning a sibling asset under the same entity).
+        rows = rows.filter(r => r.filename === filename);
+        if (rows.length === 0)
+            return owner ? null : DENIAL;
+    }
+    else if (rows.length === 0) {
+        return owner ? null : DENIAL;
+    }
+    return rows.every(r => index.canDelete(r.assetId, user.id, owner)) ? null : DENIAL;
+}
+/**
+ * Delete authorization for a free-standing asset addressed by its immutable
+ * `assetId` (the asset-manager delete-by-id route). Same uploader/owner gate as
+ * {@link assetDeleteDenial}, but keyed directly on the asset row rather than an
+ * entity coordinate. Only gates `workspace_wide` folders; open-mode callers are
+ * unrestricted. A missing row resolves owner-only via `index.canDelete`.
+ */
+export function assetDeleteDenialByAssetId(index, repoConfig, user, assetId) {
+    if (!repoConfig?.workspace_wide)
+        return null;
+    if (!user)
+        return null;
+    const owner = isWorkspaceOwner(user.role);
+    if (!index)
+        return owner ? null : DENIAL;
+    return index.canDelete(assetId, user.id, owner) ? null : DENIAL;
+}
+//# sourceMappingURL=asset-delete-authz.js.map

package/dist/services/asset-delete-authz.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-delete-authz.js","sourceRoot":"","sources":["../../src/services/asset-delete-authz.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAiB,MAAM,mBAAmB,CAAC;AAEpE,MAAM,MAAM,GAAG,uFAAuF,CAAC;AAEvG;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAoC,EACpC,UAAkC,EAClC,IAA0B,EAC1B,IAAY,EACZ,UAAkB,EAClB,QAAgB,EAChB,QAAiB;IAEjB,IAAI,CAAC,UAAU,EAAE,cAAc;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,uEAAuE;QACvE,yEAAyE;QACzE,oDAAoD;QACpD,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACjD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IACtD,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACrF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAoC,EACpC,UAAkC,EAClC,IAA0B,EAC1B,OAAe;IAEf,IAAI,CAAC,UAAU,EAAE,cAAc;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IACzC,OAAO,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AAClE,CAAC"}