studiograph 1.3.48-next.21 → 1.3.48-next.210

package/dist/services/oauth-server-store.d.ts

@@ -0,0 +1,147 @@
+/**
+ * OAuth 2.0 Authorization Server store
+ *
+ * Studiograph's `/mcp` server is an OAuth resource server AND authorization
+ * server: Claude Desktop's Chat/Cowork connector pipeline is OAuth-only, so a
+ * client registers (DCR), runs an authorization-code + PKCE flow, and exchanges
+ * the code for a short-lived access token (a JWT accepted on `/mcp`) plus a
+ * revocable refresh token.
+ *
+ * This class owns the three authorization-server tables in `auth.db` and all
+ * code/token minting. It is deliberately separate from AuthService so the
+ * internet-facing AS surface can be audited and unit-tested on its own. It does
+ * NOT resolve users or enforce access control itself — it reuses the shared
+ * identity primitives via the injected `resolveUser` callback and never
+ * declares a local access helper (a past leak came from a route duplicating the
+ * shared access check).
+ *
+ *   register ──▶ oauth_clients ──┐
+ *   authorize ─▶ oauth_auth_codes │ (single-use, ≤60s)
+ *   token ─────▶ consume code, mint access JWT (aud=/mcp) + refresh token
+ *   refresh ───▶ rotate (atomic consume-old + insert-new)
+ *   gc ────────▶ drop expired codes/refresh + orphan clients
+ *
+ * Token format:
+ *   - access:  JWT signed with the workspace jwtSecret, ~1h, claims
+ *              { userId, email, role, oauth:true, cid:<client_id>, aud:<resource> }.
+ *              Accepted by the existing verifyToken path; the auth hook scopes
+ *              it to `/mcp` + `/oauth/*` via the `oauth`/`aud` claims.
+ *   - refresh: opaque `sgr_…`, only its sha256 hash is stored, revocable,
+ *              with an absolute `expires_at`.
+ */
+import type Database from 'better-sqlite3';
+import type { AuthUser } from './auth-service.js';
+export interface OAuthClient {
+    client_id: string;
+    client_name: string;
+    redirect_uris: string[];
+    created_at: string;
+}
+export interface AuthCodeInput {
+    client_id: string;
+    user_id: number;
+    redirect_uri: string;
+    code_challenge: string;
+    scope: string;
+    resource: string;
+}
+export interface ConsumedCode {
+    client_id: string;
+    user_id: number;
+    redirect_uri: string;
+    code_challenge: string;
+    scope: string;
+    resource: string;
+}
+export interface IssuedTokens {
+    access_token: string;
+    refresh_token: string;
+    token_type: 'Bearer';
+    expires_in: number;
+    scope: string;
+}
+export interface OAuthGrant {
+    client_id: string;
+    client_name: string;
+    scope: string;
+    created_at: string;
+    last_used_at: string | null;
+}
+/**
+ * Validate a redirect URI presented at registration. Public OAuth clients are
+ * the riskiest open-redirect surface, so we reject anything that isn't a clean,
+ * absolute, fragment-free URL: HTTPS only, except http loopback for local dev.
+ */
+export declare function isValidRedirectUri(uri: string, opts?: {
+    allowLoopback?: boolean;
+}): boolean;
+export declare class OAuthServerStore {
+    private db;
+    private jwtSecret;
+    private resolveUser;
+    private consentSigner;
+    constructor(opts: {
+        db: Database.Database;
+        jwtSecret: string;
+        resolveUser: (userId: number) => AuthUser | null;
+    });
+    private initSchema;
+    signConsent(payload: Record<string, unknown>): string;
+    verifyConsent(token: string): Record<string, unknown> | null;
+    registerClient(input: {
+        client_name: string;
+        redirect_uris: string[];
+    }, opts?: {
+        allowLoopback?: boolean;
+    }): OAuthClient;
+    getClient(clientId: string): OAuthClient | null;
+    /** Exact-match redirect_uri against the client's registered set (RFC 8252). */
+    clientAllowsRedirect(clientId: string, redirectUri: string): boolean;
+    saveCode(input: AuthCodeInput): string;
+    /**
+     * Single-use exchange: atomically read the row and delete it. Returns null if
+     * the code is unknown, already consumed, or expired. The delete-inside-the-
+     * transaction is what makes a replayed/parallel exchange fail.
+     */
+    consumeCode(rawCode: string): ConsumedCode | null;
+    static verifyPkce(codeChallenge: string, codeVerifier: string): boolean;
+    private insertRefresh;
+    createRefreshToken(userId: number, clientId: string, scope: string): string;
+    /** Resolve a raw refresh token to its grant, bumping last_used_at. */
+    verifyRefreshToken(rawToken: string): {
+        user: AuthUser;
+        clientId: string;
+        scope: string;
+    } | null;
+    /**
+     * Rotate: atomically consume the presented refresh token and issue a new one.
+     * Returns the new raw refresh token + grant, or null if the presented token
+     * is unknown/expired (replay of an already-rotated token therefore fails).
+     *
+     * `expectedClientId` is validated INSIDE the transaction, BEFORE the row is
+     * deleted: a token presented with the wrong client_id is rejected without
+     * consuming the victim's still-valid grant (no griefing-by-invalidation).
+     */
+    rotateRefreshToken(rawToken: string, expectedClientId?: string): {
+        refreshToken: string;
+        user: AuthUser;
+        clientId: string;
+        scope: string;
+    } | null;
+    revokeRefreshToken(rawToken: string): boolean;
+    /** Grants for a user — backs the deferred Settings "connected apps" view. */
+    listGrantsForUser(userId: number): OAuthGrant[];
+    /**
+     * Mint a ~1h access JWT. `cid` is the stable client_id (not the mutable
+     * display name); `aud` binds the token to the canonical `/mcp` resource so
+     * the auth hook can refuse it on non-MCP routes.
+     */
+    createAccessToken(user: AuthUser, clientId: string, resource: string): string;
+    /** Issue the full token set after a successful code exchange. */
+    issueTokens(user: AuthUser, clientId: string, scope: string, resource: string): IssuedTokens;
+    gcStale(): void;
+}
+export declare class OAuthRegistrationError extends Error {
+    code: string;
+    constructor(code: string, message: string);
+}

package/dist/services/oauth-server-store.js

@@ -0,0 +1,319 @@
+/**
+ * OAuth 2.0 Authorization Server store
+ *
+ * Studiograph's `/mcp` server is an OAuth resource server AND authorization
+ * server: Claude Desktop's Chat/Cowork connector pipeline is OAuth-only, so a
+ * client registers (DCR), runs an authorization-code + PKCE flow, and exchanges
+ * the code for a short-lived access token (a JWT accepted on `/mcp`) plus a
+ * revocable refresh token.
+ *
+ * This class owns the three authorization-server tables in `auth.db` and all
+ * code/token minting. It is deliberately separate from AuthService so the
+ * internet-facing AS surface can be audited and unit-tested on its own. It does
+ * NOT resolve users or enforce access control itself — it reuses the shared
+ * identity primitives via the injected `resolveUser` callback and never
+ * declares a local access helper (a past leak came from a route duplicating the
+ * shared access check).
+ *
+ *   register ──▶ oauth_clients ──┐
+ *   authorize ─▶ oauth_auth_codes │ (single-use, ≤60s)
+ *   token ─────▶ consume code, mint access JWT (aud=/mcp) + refresh token
+ *   refresh ───▶ rotate (atomic consume-old + insert-new)
+ *   gc ────────▶ drop expired codes/refresh + orphan clients
+ *
+ * Token format:
+ *   - access:  JWT signed with the workspace jwtSecret, ~1h, claims
+ *              { userId, email, role, oauth:true, cid:<client_id>, aud:<resource> }.
+ *              Accepted by the existing verifyToken path; the auth hook scopes
+ *              it to `/mcp` + `/oauth/*` via the `oauth`/`aud` claims.
+ *   - refresh: opaque `sgr_…`, only its sha256 hash is stored, revocable,
+ *              with an absolute `expires_at`.
+ */
+import { randomBytes, createHash, timingSafeEqual } from 'crypto';
+import jwt from 'jsonwebtoken';
+import { deriveConsentSigningKey, createConsentSigner } from '../mcp/state-signer.js';
+const ACCESS_TOKEN_TTL = '1h';
+const CODE_TTL_MS = 60_000; // authorization codes: ≤60s
+const REFRESH_TTL_MS = 30 * 24 * 60 * 60 * 1000; // refresh tokens: 30d absolute
+const CLIENT_GC_AGE_MS = 24 * 60 * 60 * 1000; // unused registered clients: 24h
+const MAX_REDIRECT_URIS = 5;
+const MAX_FIELD_LEN = 2048;
+function sha256(s) {
+    return createHash('sha256').update(s).digest('hex');
+}
+/**
+ * Validate a redirect URI presented at registration. Public OAuth clients are
+ * the riskiest open-redirect surface, so we reject anything that isn't a clean,
+ * absolute, fragment-free URL: HTTPS only, except http loopback for local dev.
+ */
+export function isValidRedirectUri(uri, opts) {
+    if (typeof uri !== 'string' || uri.length === 0 || uri.length > MAX_FIELD_LEN)
+        return false;
+    let url;
+    try {
+        url = new URL(uri);
+    }
+    catch {
+        return false;
+    }
+    if (url.hash)
+        return false; // no fragments (RFC 6749 §3.1.2)
+    if (url.username || url.password)
+        return false;
+    if (url.href.includes('*'))
+        return false; // no wildcards
+    if (url.protocol === 'https:')
+        return true;
+    if (url.protocol === 'http:' && opts?.allowLoopback) {
+        return url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '[::1]';
+    }
+    return false;
+}
+export class OAuthServerStore {
+    db;
+    jwtSecret;
+    resolveUser;
+    consentSigner;
+    constructor(opts) {
+        this.db = opts.db;
+        this.jwtSecret = opts.jwtSecret;
+        this.resolveUser = opts.resolveUser;
+        this.consentSigner = createConsentSigner(deriveConsentSigningKey(opts.jwtSecret));
+        this.initSchema();
+    }
+    initSchema() {
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS oauth_clients (
+        client_id TEXT PRIMARY KEY,
+        client_name TEXT NOT NULL,
+        redirect_uris TEXT NOT NULL,
+        client_secret_hash TEXT,
+        created_at TEXT NOT NULL DEFAULT (datetime('now')),
+        last_token_at TEXT
+      );
+      CREATE TABLE IF NOT EXISTS oauth_auth_codes (
+        code_hash TEXT PRIMARY KEY,
+        client_id TEXT NOT NULL,
+        user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+        redirect_uri TEXT NOT NULL,
+        code_challenge TEXT NOT NULL,
+        scope TEXT NOT NULL,
+        resource TEXT NOT NULL,
+        expires_at INTEGER NOT NULL,
+        created_at TEXT NOT NULL DEFAULT (datetime('now'))
+      );
+      CREATE TABLE IF NOT EXISTS oauth_refresh_tokens (
+        token_hash TEXT PRIMARY KEY,
+        client_id TEXT NOT NULL,
+        user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+        scope TEXT NOT NULL,
+        expires_at INTEGER NOT NULL,
+        created_at TEXT NOT NULL DEFAULT (datetime('now')),
+        last_used_at TEXT
+      );
+      CREATE INDEX IF NOT EXISTS idx_oauth_refresh_user ON oauth_refresh_tokens(user_id);
+    `);
+    }
+    // ── Consent binding (signed blob carried through the consent screen) ──
+    signConsent(payload) {
+        return this.consentSigner.sign(payload);
+    }
+    verifyConsent(token) {
+        return this.consentSigner.verify(token);
+    }
+    // ── Dynamic client registration ──
+    registerClient(input, opts) {
+        const name = (input.client_name || '').trim();
+        if (!name || name.length > MAX_FIELD_LEN) {
+            throw new OAuthRegistrationError('invalid_client_metadata', 'client_name is required');
+        }
+        const uris = Array.isArray(input.redirect_uris) ? input.redirect_uris : [];
+        if (uris.length === 0 || uris.length > MAX_REDIRECT_URIS) {
+            throw new OAuthRegistrationError('invalid_redirect_uri', `redirect_uris must be 1..${MAX_REDIRECT_URIS} entries`);
+        }
+        for (const uri of uris) {
+            if (!isValidRedirectUri(uri, opts)) {
+                throw new OAuthRegistrationError('invalid_redirect_uri', `invalid redirect_uri: ${uri}`);
+            }
+        }
+        const client_id = `oc_${randomBytes(16).toString('hex')}`;
+        this.db.prepare('INSERT INTO oauth_clients (client_id, client_name, redirect_uris) VALUES (?, ?, ?)').run(client_id, name, JSON.stringify(uris));
+        return { client_id, client_name: name, redirect_uris: uris, created_at: new Date().toISOString() };
+    }
+    getClient(clientId) {
+        if (!clientId)
+            return null;
+        const row = this.db.prepare('SELECT client_id, client_name, redirect_uris, created_at FROM oauth_clients WHERE client_id = ?').get(clientId);
+        if (!row)
+            return null;
+        let uris = [];
+        try {
+            uris = JSON.parse(row.redirect_uris);
+        }
+        catch { /* corrupt row → empty */ }
+        return { client_id: row.client_id, client_name: row.client_name, redirect_uris: uris, created_at: row.created_at };
+    }
+    /** Exact-match redirect_uri against the client's registered set (RFC 8252). */
+    clientAllowsRedirect(clientId, redirectUri) {
+        const client = this.getClient(clientId);
+        if (!client)
+            return false;
+        return client.redirect_uris.includes(redirectUri);
+    }
+    // ── Authorization codes ──
+    saveCode(input) {
+        const code = `oac_${randomBytes(32).toString('hex')}`;
+        this.db.prepare(`INSERT INTO oauth_auth_codes
+         (code_hash, client_id, user_id, redirect_uri, code_challenge, scope, resource, expires_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(sha256(code), input.client_id, input.user_id, input.redirect_uri, input.code_challenge, input.scope, input.resource, Date.now() + CODE_TTL_MS);
+        return code;
+    }
+    /**
+     * Single-use exchange: atomically read the row and delete it. Returns null if
+     * the code is unknown, already consumed, or expired. The delete-inside-the-
+     * transaction is what makes a replayed/parallel exchange fail.
+     */
+    consumeCode(rawCode) {
+        if (!rawCode)
+            return null;
+        const hash = sha256(rawCode);
+        const tx = this.db.transaction((h) => {
+            const row = this.db.prepare(`SELECT client_id, user_id, redirect_uri, code_challenge, scope, resource, expires_at
+           FROM oauth_auth_codes WHERE code_hash = ?`).get(h);
+            if (!row)
+                return null;
+            this.db.prepare('DELETE FROM oauth_auth_codes WHERE code_hash = ?').run(h);
+            if (row.expires_at < Date.now())
+                return null;
+            return {
+                client_id: row.client_id, user_id: row.user_id, redirect_uri: row.redirect_uri,
+                code_challenge: row.code_challenge, scope: row.scope, resource: row.resource,
+            };
+        });
+        return tx(hash);
+    }
+    // ── PKCE (S256 only) ──
+    static verifyPkce(codeChallenge, codeVerifier) {
+        if (!codeChallenge || !codeVerifier)
+            return false;
+        const computed = createHash('sha256').update(codeVerifier).digest('base64url');
+        const a = Buffer.from(computed);
+        const b = Buffer.from(codeChallenge);
+        if (a.length !== b.length)
+            return false;
+        return timingSafeEqual(a, b);
+    }
+    // ── Refresh tokens ──
+    insertRefresh(userId, clientId, scope) {
+        const token = `sgr_${randomBytes(32).toString('hex')}`;
+        this.db.prepare(`INSERT INTO oauth_refresh_tokens (token_hash, client_id, user_id, scope, expires_at)
+       VALUES (?, ?, ?, ?, ?)`).run(sha256(token), clientId, userId, scope, Date.now() + REFRESH_TTL_MS);
+        return token;
+    }
+    createRefreshToken(userId, clientId, scope) {
+        return this.insertRefresh(userId, clientId, scope);
+    }
+    /** Resolve a raw refresh token to its grant, bumping last_used_at. */
+    verifyRefreshToken(rawToken) {
+        if (!rawToken)
+            return null;
+        const hash = sha256(rawToken);
+        const row = this.db.prepare('SELECT client_id, user_id, scope, expires_at FROM oauth_refresh_tokens WHERE token_hash = ?').get(hash);
+        if (!row)
+            return null;
+        if (row.expires_at < Date.now())
+            return null;
+        const user = this.resolveUser(row.user_id);
+        if (!user)
+            return null;
+        this.db.prepare("UPDATE oauth_refresh_tokens SET last_used_at = datetime('now') WHERE token_hash = ?").run(hash);
+        return { user, clientId: row.client_id, scope: row.scope };
+    }
+    /**
+     * Rotate: atomically consume the presented refresh token and issue a new one.
+     * Returns the new raw refresh token + grant, or null if the presented token
+     * is unknown/expired (replay of an already-rotated token therefore fails).
+     *
+     * `expectedClientId` is validated INSIDE the transaction, BEFORE the row is
+     * deleted: a token presented with the wrong client_id is rejected without
+     * consuming the victim's still-valid grant (no griefing-by-invalidation).
+     */
+    rotateRefreshToken(rawToken, expectedClientId) {
+        if (!rawToken)
+            return null;
+        const hash = sha256(rawToken);
+        const tx = this.db.transaction((h) => {
+            const row = this.db.prepare('SELECT client_id, user_id, scope, expires_at FROM oauth_refresh_tokens WHERE token_hash = ?').get(h);
+            if (!row)
+                return null;
+            // Validate client binding before deleting — a mismatch must NOT consume
+            // the token (it may belong to a victim and still be valid for them).
+            if (expectedClientId !== undefined && row.client_id !== expectedClientId)
+                return null;
+            this.db.prepare('DELETE FROM oauth_refresh_tokens WHERE token_hash = ?').run(h);
+            if (row.expires_at < Date.now())
+                return null;
+            const user = this.resolveUser(row.user_id);
+            if (!user)
+                return null;
+            const refreshToken = this.insertRefresh(row.user_id, row.client_id, row.scope);
+            return { refreshToken, user, clientId: row.client_id, scope: row.scope };
+        });
+        return tx(hash);
+    }
+    revokeRefreshToken(rawToken) {
+        if (!rawToken)
+            return false;
+        const res = this.db.prepare('DELETE FROM oauth_refresh_tokens WHERE token_hash = ?').run(sha256(rawToken));
+        return res.changes > 0;
+    }
+    /** Grants for a user — backs the deferred Settings "connected apps" view. */
+    listGrantsForUser(userId) {
+        return this.db.prepare(`SELECT r.client_id AS client_id, c.client_name AS client_name, r.scope AS scope,
+              r.created_at AS created_at, r.last_used_at AS last_used_at
+         FROM oauth_refresh_tokens r
+         LEFT JOIN oauth_clients c ON c.client_id = r.client_id
+        WHERE r.user_id = ? AND r.expires_at >= ?
+        ORDER BY r.created_at DESC`).all(userId, Date.now());
+    }
+    // ── Access token (JWT) ──
+    /**
+     * Mint a ~1h access JWT. `cid` is the stable client_id (not the mutable
+     * display name); `aud` binds the token to the canonical `/mcp` resource so
+     * the auth hook can refuse it on non-MCP routes.
+     */
+    createAccessToken(user, clientId, resource) {
+        return jwt.sign({ userId: user.id, email: user.email, role: user.role, oauth: true, cid: clientId, aud: resource }, this.jwtSecret, { expiresIn: ACCESS_TOKEN_TTL });
+    }
+    /** Issue the full token set after a successful code exchange. */
+    issueTokens(user, clientId, scope, resource) {
+        const access_token = this.createAccessToken(user, clientId, resource);
+        const refresh_token = this.createRefreshToken(user.id, clientId, scope);
+        this.db.prepare("UPDATE oauth_clients SET last_token_at = datetime('now') WHERE client_id = ?").run(clientId);
+        return { access_token, refresh_token, token_type: 'Bearer', expires_in: 3600, scope };
+    }
+    // ── Garbage collection (called opportunistically from /oauth/token) ──
+    gcStale() {
+        const now = Date.now();
+        try {
+            this.db.prepare('DELETE FROM oauth_auth_codes WHERE expires_at < ?').run(now);
+            this.db.prepare('DELETE FROM oauth_refresh_tokens WHERE expires_at < ?').run(now);
+            // Orphan clients: registered >24h ago and never used to mint a token.
+            this.db.prepare(`DELETE FROM oauth_clients
+          WHERE last_token_at IS NULL
+            AND created_at < datetime('now', ?)`).run(`-${Math.floor(CLIENT_GC_AGE_MS / 1000)} seconds`);
+        }
+        catch {
+            // GC must never block token issuance.
+        }
+    }
+}
+export class OAuthRegistrationError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'OAuthRegistrationError';
+    }
+}
+//# sourceMappingURL=oauth-server-store.js.map

package/dist/services/oauth-server-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-server-store.js","sourceRoot":"","sources":["../../src/services/oauth-server-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAc,eAAe,EAAE,MAAM,QAAQ,CAAC;AAC9E,OAAO,GAAG,MAAM,cAAc,CAAC;AAE/B,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAsB,MAAM,wBAAwB,CAAC;AAE1G,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,WAAW,GAAG,MAAM,CAAC,CAAoB,4BAA4B;AAC3E,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,+BAA+B;AAChF,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAE,iCAAiC;AAChF,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,aAAa,GAAG,IAAI,CAAC;AA2C3B,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,IAAkC;IAChF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,aAAa;QAAE,OAAO,KAAK,CAAC;IAC5F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC,CAAkB,iCAAiC;IAC9E,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,CAAI,eAAe;IAC5D,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,EAAE,aAAa,EAAE,CAAC;QACpD,OAAO,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;IAClG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,gBAAgB;IACnB,EAAE,CAAoB;IACtB,SAAS,CAAS;IAClB,WAAW,CAAsC;IACjD,aAAa,CAAgB;IAErC,YAAY,IAIX;QACC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAClB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,aAAa,GAAG,mBAAmB,CAAC,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA8BZ,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IAEzE,WAAW,CAAC,OAAgC;QAC1C,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,aAAa,CAAC,KAAa;QACzB,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,oCAAoC;IAEpC,cAAc,CAAC,KAAuD,EAAE,IAAkC;QACxG,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YACzC,MAAM,IAAI,sBAAsB,CAAC,yBAAyB,EAAE,yBAAyB,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;YACzD,MAAM,IAAI,sBAAsB,CAAC,sBAAsB,EAAE,4BAA4B,iBAAiB,UAAU,CAAC,CAAC;QACpH,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,sBAAsB,CAAC,sBAAsB,EAAE,yBAAyB,GAAG,EAAE,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,EAAE,CAAC,OAAO,CACb,oFAAoF,CACrF,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACrG,CAAC;IAED,SAAS,CAAC,QAAgB;QACxB,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACzB,iGAAiG,CAClG,CAAC,GAAG,CAAC,QAAQ,CAAsG,CAAC;QACrH,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,IAAI,GAAa,EAAE,CAAC;QACxB,IAAI,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;QACjF,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;IACrH,CAAC;IAED,+EAA+E;IAC/E,oBAAoB,CAAC,QAAgB,EAAE,WAAmB;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,CAAC;IAED,4BAA4B;IAE5B,QAAQ,CAAC,KAAoB;QAC3B,MAAM,IAAI,GAAG,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,OAAO,CACb;;uCAEiC,CAClC,CAAC,GAAG,CACH,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,EAChE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAC5E,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,WAAW,CAAC,OAAe;QACzB,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAS,EAAuB,EAAE;YAChE,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACzB;qDAC6C,CAC9C,CAAC,GAAG,CAAC,CAAC,CAEM,CAAC;YACd,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,kDAAkD,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3E,IAAI,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC7C,OAAO;gBACL,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9E,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ;aAC7E,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,yBAAyB;IAEzB,MAAM,CAAC,UAAU,CAAC,aAAqB,EAAE,YAAoB;QAC3D,IAAI,CAAC,aAAa,IAAI,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC;QAClD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC/E,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACrC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED,uBAAuB;IAEf,aAAa,CAAC,MAAc,EAAE,QAAgB,EAAE,KAAa;QACnE,MAAM,KAAK,GAAG,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,EAAE,CAAC,OAAO,CACb;8BACwB,CACzB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC;QAC3E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,kBAAkB,CAAC,MAAc,EAAE,QAAgB,EAAE,KAAa;QAChE,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,sEAAsE;IACtE,kBAAkB,CAAC,QAAgB;QACjC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACzB,6FAA6F,CAC9F,CAAC,GAAG,CAAC,IAAI,CAA0F,CAAC;QACrG,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,qFAAqF,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IAC7D,CAAC;IAED;;;;;;;;OAQG;IACH,kBAAkB,CAAC,QAAgB,EAAE,gBAAyB;QAC5D,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAS,EAAE,EAAE;YAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACzB,6FAA6F,CAC9F,CAAC,GAAG,CAAC,CAAC,CAA0F,CAAC;YAClG,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,wEAAwE;YACxE,qEAAqE;YACrE,IAAI,gBAAgB,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,gBAAgB;gBAAE,OAAO,IAAI,CAAC;YACtF,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAChF,IAAI,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/E,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;QAC3E,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,kBAAkB,CAAC,QAAgB;QACjC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC3G,OAAO,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,6EAA6E;IAC7E,iBAAiB,CAAC,MAAc;QAC9B,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CACpB;;;;;mCAK6B,CAC9B,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAiB,CAAC;IAC5C,CAAC;IAED,2BAA2B;IAE3B;;;;OAIG;IACH,iBAAiB,CAAC,IAAc,EAAE,QAAgB,EAAE,QAAgB;QAClE,OAAO,GAAG,CAAC,IAAI,CACb,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,EAClG,IAAI,CAAC,SAAS,EACd,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAChC,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,WAAW,CAAC,IAAc,EAAE,QAAgB,EAAE,KAAa,EAAE,QAAgB;QAC3E,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACtE,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACxE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,8EAA8E,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9G,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACxF,CAAC;IAED,wEAAwE;IAExE,OAAO;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9E,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClF,sEAAsE;YACtE,IAAI,CAAC,EAAE,CAAC,OAAO,CACb;;gDAEwC,CACzC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC5B;IAAnB,YAAmB,IAAY,EAAE,OAAe;QAC9C,KAAK,CAAC,OAAO,CAAC,CAAC;QADE,SAAI,GAAJ,IAAI,CAAQ;QAE7B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF"}

package/dist/services/orphan-service.js

@@ -14,7 +14,7 @@ import { MarkdownService, slugifyWikilink } from './markdown.js';
  */
 function buildReferencedSet(manager, markdown) {
     const referenced = new Set();
-    const allRepos = manager.getAllRepoConfigs();
+    const allRepos = manager.getContentRepoConfigs();
     for (const repoConfig of allRepos) {
         let graph;
         try {
@@ -42,7 +42,7 @@ function buildReferencedSet(manager, markdown) {
 export function findOrphans(manager, filters) {
     const markdown = new MarkdownService();
     const referenced = buildReferencedSet(manager, markdown);
-    const allRepos = manager.getAllRepoConfigs();
+    const allRepos = manager.getContentRepoConfigs();
     const repos = filters?.repos
         ? allRepos.filter(r => filters.repos.includes(r.name))
         : allRepos;

package/dist/services/orphan-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"orphan-service.js","sourceRoot":"","sources":["../../src/services/orphan-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAwBjE;;;GAGG;AACH,SAAS,kBAAkB,CACzB,OAAyB,EACzB,QAAyB;IAEzB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAE7C,KAAK,MAAM,UAAU,IAAI,QAAQ,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC9B,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,iEAAiE;YACjE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;gBAC7C,wDAAwD;gBACxD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC;gBAChD,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC1B,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CACzB,OAAyB,EACzB,OAAuB;IAEvB,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEzD,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK;QAC1B,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC,CAAC,QAAQ,CAAC;IAEb,MAAM,gBAAgB,GAAG,OAAO,EAAE,WAAW;QAC3C,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC;QAC9B,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,CAAC,OAAO,EAAE,UAAU,IAAI,CAAC,CAAC,GAAG,UAAU,CAAC;IAEzD,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAE9B,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;YAE3C,wBAAwB;YACxB,IAAI,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,SAAS;YAEpE,YAAY,EAAE,CAAC;YAEf,8CAA8C;YAC9C,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;YACrB,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC9D,SAAS;YACX,CAAC;YAED,oBAAoB;YACpB,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjB,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAgC,CAAC;gBAChE,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;oBACjD,IAAI,GAAG,GAAG,SAAS,GAAG,QAAQ;wBAAE,SAAS;gBAC3C,CAAC;YACH,CAAC;YAED,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,UAAU;gBACV,QAAQ,EAAE,EAAE;gBACZ,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAgC;gBACvD,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAA0B;aAC7C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO;QACP,YAAY;QACZ,YAAY,EAAE,OAAO,CAAC,MAAM;KAC7B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"orphan-service.js","sourceRoot":"","sources":["../../src/services/orphan-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAwBjE;;;GAGG;AACH,SAAS,kBAAkB,CACzB,OAAyB,EACzB,QAAyB;IAEzB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAEjD,KAAK,MAAM,UAAU,IAAI,QAAQ,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC9B,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,iEAAiE;YACjE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;gBAC7C,wDAAwD;gBACxD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC;gBAChD,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC1B,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CACzB,OAAyB,EACzB,OAAuB;IAEvB,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEzD,MAAM,QAAQ,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC;IACjD,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK;QAC1B,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC,CAAC,QAAQ,CAAC;IAEb,MAAM,gBAAgB,GAAG,OAAO,EAAE,WAAW;QAC3C,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC;QAC9B,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,CAAC,OAAO,EAAE,UAAU,IAAI,CAAC,CAAC,GAAG,UAAU,CAAC;IAEzD,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAE9B,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;YAE3C,wBAAwB;YACxB,IAAI,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,SAAS;YAEpE,YAAY,EAAE,CAAC;YAEf,8CAA8C;YAC9C,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;YACrB,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC9D,SAAS;YACX,CAAC;YAED,oBAAoB;YACpB,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjB,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAgC,CAAC;gBAChE,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;oBACjD,IAAI,GAAG,GAAG,SAAS,GAAG,QAAQ;wBAAE,SAAS;gBAC3C,CAAC;YACH,CAAC;YAED,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,UAAU;gBACV,QAAQ,EAAE,EAAE;gBACZ,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAgC;gBACvD,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAA0B;aAC7C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO;QACP,YAAY;QACZ,YAAY,EAAE,OAAO,CAAC,MAAM;KAC7B,CAAC;AACJ,CAAC"}

package/dist/services/personal-folder.d.ts

@@ -0,0 +1,40 @@
+import { Workspace } from '../core/workspace.js';
+import type { AuthService, AuthUser } from './auth-service.js';
+/**
+ * Register the user's personal "My Folder" folder and grant them admin
+ * folder_access. Idempotent — safe to call repeatedly and on existing
+ * workspaces where the folder was provisioned before this helper existed
+ * (repairs the missing folder_access row).
+ *
+ * Consolidated from four earlier call sites that each did half the work:
+ * setup endpoint, /api/auth/users POST, server startup sweep, and
+ * `studiograph user add` CLI. Skipping the grant left the user's own
+ * personal folder invisible in the sidebar because `getAccessibleRepos()`
+ * filters by folder_access.
+ */
+export declare function ensurePersonalFolder(workspace: Workspace, authService: AuthService, user: AuthUser): Promise<void>;
+/**
+ * Convert a departed user's personal folder into a normal (non-personal)
+ * archive folder owned by the actor who deleted them. Matches Google
+ * Drive's inherit-on-delete model: the content survives, the owner is
+ * reassigned, and the "personal" semantics fall away so the folder
+ * doesn't clash with the one-personal-folder-per-user invariant.
+ *
+ * Mutations applied (in order, best-effort non-atomic):
+ *  1. Pick a collision-free new name: `archive-{slug}-{YYYY-MM-DD}`,
+ *     escalating to `-2`, `-3`, … if needed.
+ *  2. Rename the folder directory on disk.
+ *  3. Update workspace.json: new name/path, display_name, clear the
+ *     personal/owner_id flags, and write the new `.studiograph` marker.
+ *  4. Update folder_access rows to the new name so the actor's inherited
+ *     admin row keeps working.
+ *  5. Push the updated workspace.json to the config remote (non-fatal).
+ *
+ * Returns the new folder name and display name so the caller can report
+ * them to the UI. The caller should `workspaceManager.reloadConfig()`
+ * after this completes to surface the change to in-memory graph state.
+ */
+export declare function archivePersonalFolder(workspace: Workspace, oldName: string, targetDisplayName: string, authService: AuthService): Promise<{
+    newName: string;
+    newDisplayName: string;
+}>;

package/dist/services/personal-folder.js

@@ -0,0 +1,101 @@
+import { existsSync, renameSync, writeFileSync } from 'fs';
+import { join } from 'path';
+/**
+ * Register the user's personal "My Folder" folder and grant them admin
+ * folder_access. Idempotent — safe to call repeatedly and on existing
+ * workspaces where the folder was provisioned before this helper existed
+ * (repairs the missing folder_access row).
+ *
+ * Consolidated from four earlier call sites that each did half the work:
+ * setup endpoint, /api/auth/users POST, server startup sweep, and
+ * `studiograph user add` CLI. Skipping the grant left the user's own
+ * personal folder invisible in the sidebar because `getAccessibleRepos()`
+ * filters by folder_access.
+ */
+export async function ensurePersonalFolder(workspace, authService, user) {
+    const folderName = `entries-${user.id}`;
+    const config = await workspace.loadConfig();
+    const alreadyRegistered = config.repos.some(r => r.name === folderName);
+    if (!alreadyRegistered) {
+        await workspace.registerRepo({
+            name: folderName,
+            display_name: 'My Folder',
+            description: `Personal entries for ${user.displayName}`,
+            personal: true,
+            owner_id: user.id,
+        });
+    }
+    const hasAccess = authService.getUserFolders(user.id).includes(folderName);
+    if (!hasAccess) {
+        authService.grantFolderAccess(user.id, folderName, 'admin');
+    }
+}
+/**
+ * Convert a departed user's personal folder into a normal (non-personal)
+ * archive folder owned by the actor who deleted them. Matches Google
+ * Drive's inherit-on-delete model: the content survives, the owner is
+ * reassigned, and the "personal" semantics fall away so the folder
+ * doesn't clash with the one-personal-folder-per-user invariant.
+ *
+ * Mutations applied (in order, best-effort non-atomic):
+ *  1. Pick a collision-free new name: `archive-{slug}-{YYYY-MM-DD}`,
+ *     escalating to `-2`, `-3`, … if needed.
+ *  2. Rename the folder directory on disk.
+ *  3. Update workspace.json: new name/path, display_name, clear the
+ *     personal/owner_id flags, and write the new `.studiograph` marker.
+ *  4. Update folder_access rows to the new name so the actor's inherited
+ *     admin row keeps working.
+ *  5. Push the updated workspace.json to the config remote (non-fatal).
+ *
+ * Returns the new folder name and display name so the caller can report
+ * them to the UI. The caller should `workspaceManager.reloadConfig()`
+ * after this completes to surface the change to in-memory graph state.
+ */
+export async function archivePersonalFolder(workspace, oldName, targetDisplayName, authService) {
+    const config = await workspace.loadConfig();
+    const repo = config.repos.find(r => r.name === oldName);
+    if (!repo) {
+        throw new Error(`Cannot archive '${oldName}' — folder not found in workspace config`);
+    }
+    if (!repo.personal) {
+        throw new Error(`Cannot archive '${oldName}' — not a personal folder`);
+    }
+    const slug = slugify(targetDisplayName);
+    const date = new Date().toISOString().slice(0, 10); // YYYY-MM-DD
+    const baseName = `archive-${slug}-${date}`;
+    let newName = baseName;
+    let suffix = 2;
+    while (config.repos.some(r => r.name === newName)) {
+        newName = `${baseName}-${suffix}`;
+        suffix += 1;
+    }
+    const wsPath = workspace.workspacePath;
+    const oldPath = join(wsPath, repo.path);
+    const newPath = join(wsPath, newName);
+    if (existsSync(oldPath)) {
+        renameSync(oldPath, newPath);
+    }
+    repo.name = newName;
+    repo.path = newName;
+    repo.display_name = `Archive: ${targetDisplayName} (${date})`;
+    delete repo.personal;
+    delete repo.owner_id;
+    const markerPath = join(newPath, '.studiograph');
+    if (existsSync(markerPath)) {
+        writeFileSync(markerPath, JSON.stringify({ repo_name: newName }, null, 2), 'utf-8');
+    }
+    workspace.writeConfig(config);
+    authService.renameFolder(oldName, newName);
+    workspace.pushWorkspaceConfig(`Archive personal folder on user delete: ${oldName} → ${newName}`);
+    return { newName, newDisplayName: repo.display_name };
+}
+function slugify(name) {
+    const cleaned = name
+        .normalize('NFKD')
+        .replace(/[̀-ͯ]/g, '') // strip combining diacritics
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+    return cleaned || 'user';
+}
+//# sourceMappingURL=personal-folder.js.map