studiograph 1.3.48-next.21 → 1.3.48-next.210

package/dist/cli/commands/mcp.js

@@ -24,15 +24,32 @@
  * MCP protocol. Use console.error() for any diagnostic output.
  */
 import { Command } from 'commander';
+import { resolve } from 'path';
+import { realpathSync } from 'fs';
 import { Workspace } from '../../core/workspace.js';
 import { WorkspaceManager } from '../../core/workspace-manager.js';
 import { loadUserConfig } from '../../core/user-config.js';
-import { startMcpServer } from '../../mcp/server.js';
+import { tryResolve } from '../../core/secrets/read-flip.js';
+import { AuthService } from '../../services/auth-service.js';
+import { resolveStdioUser, createInProcessMcpClient } from '../../mcp/server.js';
+import { StdioProxy } from '../../mcp/stdio-proxy.js';
 export const mcpCommand = new Command('mcp')
     .description('Start the Studiograph MCP server for Claude Desktop integration')
     .argument('[workspace]', 'Path to workspace (defaults to current directory)')
     .action(async (workspaceArg) => {
-    const workspacePath = workspaceArg ?? process.cwd();
+    // Canonicalize (absolute + symlinks resolved) so the discovery
+    // `workspacePath` match against the running server is exact. The server
+    // writes `process.cwd()`, which Node already real-path-resolves; without
+    // realpath here a symlinked path (e.g. macOS /tmp → /private/tmp) would
+    // mismatch and the proxy would needlessly fall back to a local write.
+    const requested = resolve(workspaceArg ?? process.cwd());
+    let workspacePath = requested;
+    try {
+        workspacePath = realpathSync(requested);
+    }
+    catch {
+        /* path may not exist yet — the isWorkspace() check below handles it */
+    }
     const workspace = new Workspace(workspacePath);
     if (!workspace.isWorkspace()) {
         process.stderr.write('Not a Studiograph workspace.\n' +
@@ -40,10 +57,15 @@ export const mcpCommand = new Command('mcp')
         process.exit(1);
     }
     const config = await workspace.loadConfig();
-    // Propagate Anthropic API key from user config if not already set
+    // Propagate Anthropic API key from store (Phase 6) or user config
+    // if not already set. The store wins over user.json — post Phase 6,
+    // user.json is no longer authoritative for credentials. The MCP CLI
+    // assumes Anthropic since it's the original use case; if you've
+    // switched providers, set ANTHROPIC_API_KEY in your shell manually.
     const userConfig = loadUserConfig();
-    if (userConfig.api_key && !process.env.ANTHROPIC_API_KEY) {
-        process.env.ANTHROPIC_API_KEY = userConfig.api_key;
+    const apiKey = tryResolve('model.anthropic.api_key') ?? userConfig.api_key;
+    if (apiKey && !process.env.ANTHROPIC_API_KEY) {
+        process.env.ANTHROPIC_API_KEY = apiKey;
     }
     // MCP uses a service identity for git commits made via create/update tools
     const gitUser = {
@@ -52,6 +74,32 @@ export const mcpCommand = new Command('mcp')
         email: 'noreply@studiograph.local',
     };
     const workspaceManager = new WorkspaceManager(workspacePath, config, gitUser);
-    await startMcpServer(workspaceManager);
+    const authService = new AuthService(workspacePath);
+    // Resolve identity up front so the proxy fails closed (same message as the
+    // old direct stdio server) before opening the stdio transport.
+    const user = resolveStdioUser(authService);
+    const token = process.env.STUDIOGRAPH_MCP_TOKEN?.trim();
+    if (!user || !token) {
+        process.stderr.write('Studiograph MCP: STUDIOGRAPH_MCP_TOKEN is required.\n' +
+            'Generate a token with:\n' +
+            '  curl -X POST http://<host>/api/auth/tokens \\\n' +
+            '       -H "Content-Type: application/json" \\\n' +
+            '       -b __sg_token=<your-jwt> \\\n' +
+            '       -d \'{"name":"claude-desktop"}\'\n' +
+            'Then set STUDIOGRAPH_MCP_TOKEN=<token> in your Claude Desktop MCP config env.\n');
+        process.exit(1);
+    }
+    // Audit signal (stderr only — stdout is the JSON-RPC channel). Preserves the
+    // identity line the old direct stdio server logged on startup.
+    process.stderr.write(`Studiograph MCP: authenticated as ${user.email}\n`);
+    // Transparent stdio→HTTP proxy: forward tool calls to the running local
+    // server (so writes merge into any open editor) when one is reachable, else
+    // fall back to an in-process server (safe: no server ⇒ no live editor).
+    const proxy = new StdioProxy({
+        workspacePath,
+        token,
+        buildLocalClient: () => createInProcessMcpClient(workspaceManager, authService, user),
+    });
+    await proxy.start();
 });
 //# sourceMappingURL=mcp.js.map

package/dist/cli/commands/mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../src/cli/commands/mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC;KACzC,WAAW,CAAC,iEAAiE,CAAC;KAC9E,QAAQ,CAAC,aAAa,EAAE,mDAAmD,CAAC;KAC5E,MAAM,CAAC,KAAK,EAAE,YAAqB,EAAE,EAAE;IACtC,MAAM,aAAa,GAAG,YAAY,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACpD,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,aAAa,CAAC,CAAC;IAE/C,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gCAAgC;YAChC,gGAAgG,CACjG,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,CAAC;IAE5C,kEAAkE;IAClE,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,IAAI,UAAU,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,UAAU,CAAC,OAAO,CAAC;IACrD,CAAC;IAED,2EAA2E;IAC3E,MAAM,OAAO,GAAG;QACd,EAAE,EAAK,KAAK;QACZ,IAAI,EAAG,iBAAiB;QACxB,KAAK,EAAE,2BAA2B;KACnC,CAAC;IAEF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,aAAa,EACb,MAAM,EACN,OAAO,CACR,CAAC;IAEF,MAAM,cAAc,CAAC,gBAAgB,CAAC,CAAC;AACzC,CAAC,CAAC,CAAC"}
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../src/cli/commands/mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEtD,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC;KACzC,WAAW,CAAC,iEAAiE,CAAC;KAC9E,QAAQ,CAAC,aAAa,EAAE,mDAAmD,CAAC;KAC5E,MAAM,CAAC,KAAK,EAAE,YAAqB,EAAE,EAAE;IACtC,+DAA+D;IAC/D,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACzD,IAAI,aAAa,GAAG,SAAS,CAAC;IAC9B,IAAI,CAAC;QACH,aAAa,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;IACzE,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,aAAa,CAAC,CAAC;IAE/C,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gCAAgC;YAChC,gGAAgG,CACjG,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,CAAC;IAE5C,kEAAkE;IAClE,oEAAoE;IACpE,oEAAoE;IACpE,gEAAgE;IAChE,oEAAoE;IACpE,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,UAAU,CAAS,yBAAyB,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC;IACnF,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,MAAM,CAAC;IACzC,CAAC;IAED,2EAA2E;IAC3E,MAAM,OAAO,GAAG;QACd,EAAE,EAAK,KAAK;QACZ,IAAI,EAAG,iBAAiB;QACxB,KAAK,EAAE,2BAA2B;KACnC,CAAC;IAEF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,aAAa,EACb,MAAM,EACN,OAAO,CACR,CAAC;IAEF,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,aAAa,CAAC,CAAC;IAEnD,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,IAAI,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uDAAuD;YACvD,0BAA0B;YAC1B,mDAAmD;YACnD,iDAAiD;YACjD,sCAAsC;YACtC,2CAA2C;YAC3C,iFAAiF,CAClF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,6EAA6E;IAC7E,+DAA+D;IAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IAE1E,wEAAwE;IACxE,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC;QAC3B,aAAa;QACb,KAAK;QACL,gBAAgB,EAAE,GAAG,EAAE,CAAC,wBAAwB,CAAC,gBAAgB,EAAE,WAAW,EAAE,IAAI,CAAC;KACtF,CAAC,CAAC;IACH,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC,CAAC,CAAC"}

package/dist/cli/commands/r2.d.ts

@@ -6,6 +6,9 @@
  *     --prefix <path>                 Key prefix in bucket (e.g. fonts/)
  *   studiograph r2 sync               Upload local assets from tokens.json and
  *                                     markdown files to R2, rewriting URLs in place
+ *   studiograph r2 migrate-urls       Stage 2 — rewrite legacy absolute R2 URLs
+ *                                     in entity frontmatter and bodies to the
+ *                                     proxied /api/assets/* path
  */
 import { Command } from 'commander';
 export declare const r2Command: Command;

package/dist/cli/commands/r2.js

@@ -6,127 +6,24 @@
  *     --prefix <path>                 Key prefix in bucket (e.g. fonts/)
  *   studiograph r2 sync               Upload local assets from tokens.json and
  *                                     markdown files to R2, rewriting URLs in place
+ *   studiograph r2 migrate-urls       Stage 2 — rewrite legacy absolute R2 URLs
+ *                                     in entity frontmatter and bodies to the
+ *                                     proxied /api/assets/* path
  */
 import { Command } from 'commander';
 import { intro, outro, text, confirm, spinner, log } from '@clack/prompts';
-import { readdirSync, statSync, readFileSync, writeFileSync, existsSync } from 'fs';
-import { join, relative, resolve, extname, dirname } from 'path';
+import { readdirSync, lstatSync, readFileSync, writeFileSync, existsSync } from 'fs';
+import { join, relative } from 'path';
 import { spawnSync } from 'child_process';
-import { S3Client, CreateBucketCommand, PutObjectCommand } from '@aws-sdk/client-s3';
+import { PutObjectCommand } from '@aws-sdk/client-s3';
 import { Workspace } from '../../core/workspace.js';
 import { loadUserConfig, saveUserConfig } from '../../core/user-config.js';
+import { buildR2Client, contentType, createR2Bucket, syncLocalAssetsToR2, walkDir, } from '../../services/assets/r2-sync.js';
 // ── Open a URL in the default browser (macOS + Linux) ────────────────────
 function openBrowser(url) {
     const cmd = process.platform === 'darwin' ? 'open' : 'xdg-open';
     spawnSync(cmd, [url], { stdio: 'ignore' });
 }
-// ── Content type map ──────────────────────────────────────────────────────
-const CONTENT_TYPES = {
-    '.woff': 'font/woff',
-    '.woff2': 'font/woff2',
-    '.ttf': 'font/ttf',
-    '.otf': 'font/otf',
-    '.eot': 'application/vnd.ms-fontobject',
-    '.svg': 'image/svg+xml',
-    '.png': 'image/png',
-    '.jpg': 'image/jpeg',
-    '.jpeg': 'image/jpeg',
-    '.webp': 'image/webp',
-    '.gif': 'image/gif',
-    '.pdf': 'application/pdf',
-    '.js': 'application/javascript',
-    '.css': 'text/css',
-    '.json': 'application/json',
-};
-function contentType(filePath) {
-    return CONTENT_TYPES[extname(filePath).toLowerCase()] ?? 'application/octet-stream';
-}
-// ── Local asset detection ─────────────────────────────────────────────────
-const ASSET_EXTS = new Set([
-    '.png', '.jpg', '.jpeg', '.webp', '.gif', '.svg',
-    '.mp4', '.webm', '.mov',
-    '.pdf',
-]);
-function isLocalAssetRef(ref) {
-    if (ref.startsWith('http://') ||
-        ref.startsWith('https://') ||
-        ref.startsWith('data:') ||
-        ref.startsWith('#'))
-        return false;
-    const ext = extname(ref.split('?')[0]).toLowerCase();
-    return ASSET_EXTS.has(ext);
-}
-// ── Walk a directory recursively ─────────────────────────────────────────
-function walkDir(dir) {
-    const files = [];
-    for (const entry of readdirSync(dir)) {
-        const full = join(dir, entry);
-        if (statSync(full).isDirectory()) {
-            files.push(...walkDir(full));
-        }
-        else {
-            files.push(full);
-        }
-    }
-    return files;
-}
-async function syncMarkdownAssets(cwd, repoPaths, client, r2, s) {
-    let uploaded = 0;
-    let rewrites = 0;
-    for (const repoPath of repoPaths) {
-        if (!existsSync(repoPath))
-            continue;
-        const mdFiles = walkDir(repoPath).filter(f => f.endsWith('.md'));
-        for (const mdFile of mdFiles) {
-            const original = readFileSync(mdFile, 'utf8');
-            const refs = new Set();
-            // Markdown images and links: ![alt](ref) or [text](ref)
-            for (const m of original.matchAll(/!?\[[^\]]*\]\(([^)\s]+)[^)]*\)/g)) {
-                if (isLocalAssetRef(m[1]))
-                    refs.add(m[1]);
-            }
-            // HTML src attributes: <img src="ref">, <video src="ref">, <source src="ref">
-            for (const m of original.matchAll(/\bsrc=["']([^"']+)["']/g)) {
-                if (isLocalAssetRef(m[1]))
-                    refs.add(m[1]);
-            }
-            if (refs.size === 0)
-                continue;
-            const replacements = new Map(); // ref → R2 URL
-            const uploads = [];
-            for (const ref of refs) {
-                const absPath = resolve(dirname(mdFile), ref);
-                if (!existsSync(absPath)) {
-                    log.warn(`Asset not found, skipping: ${absPath}`);
-                    continue;
-                }
-                const key = relative(cwd, absPath);
-                const r2Url = `${r2.public_url}/${key}`;
-                replacements.set(ref, r2Url);
-                s.message(`Uploading ${key}`);
-                uploads.push(client.send(new PutObjectCommand({
-                    Bucket: r2.bucket,
-                    Key: key,
-                    Body: readFileSync(absPath),
-                    ContentType: contentType(absPath),
-                    CacheControl: 'public, max-age=31536000, immutable',
-                })));
-                uploaded++;
-            }
-            if (replacements.size === 0)
-                continue;
-            await Promise.all(uploads);
-            let updated = original;
-            for (const [ref, r2Url] of replacements) {
-                const escaped = ref.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-                updated = updated.replace(new RegExp(escaped, 'g'), r2Url);
-            }
-            writeFileSync(mdFile, updated);
-            rewrites++;
-        }
-    }
-    return { uploaded, rewrites };
-}
 // ── r2 command group ──────────────────────────────────────────────────────
 export const r2Command = new Command('r2')
     .description('Manage Cloudflare R2 asset storage');
@@ -184,25 +81,17 @@ r2Command
         placeholder: defaultBucket,
     });
     const bucket = bucketInput.trim() || defaultBucket;
-    const client = new S3Client({
-        region: 'auto',
-        endpoint: `https://${accountId}.r2.cloudflarestorage.com`,
-        credentials: { accessKeyId, secretAccessKey },
-    });
     const s = spinner();
     s.start(`Creating bucket "${bucket}"...`);
     try {
-        await client.send(new CreateBucketCommand({ Bucket: bucket }));
-        s.stop(`Bucket "${bucket}" created`);
+        const result = await createR2Bucket({ accountId, accessKeyId, secretAccessKey }, bucket);
+        s.stop(result.alreadyExists
+            ? `Bucket "${bucket}" already exists — continuing`
+            : `Bucket "${bucket}" created`);
     }
     catch (e) {
-        if (e?.name === 'BucketAlreadyExists' || e?.name === 'BucketAlreadyOwnedByYou' || e?.$metadata?.httpStatusCode === 409) {
-            s.stop(`Bucket "${bucket}" already exists — continuing`);
-        }
-        else {
-            s.stop(`Failed to create bucket: ${e?.message ?? 'unknown error'}`);
-            process.exit(1);
-        }
+        s.stop(`Failed to create bucket: ${e?.message ?? 'unknown error'}`);
+        process.exit(1);
     }
     // ── Step 2: Enable public access ────────────────────────────────────
     log.step('Step 2 of 2 — Enable public access');
@@ -245,13 +134,10 @@ r2Command
         console.error('R2 credentials not found in user config. Run `studiograph r2 setup` first.');
         process.exit(1);
     }
-    const client = new S3Client({
-        region: 'auto',
-        endpoint: `https://${r2.account_id}.r2.cloudflarestorage.com`,
-        credentials: {
-            accessKeyId: creds.access_key_id,
-            secretAccessKey: creds.secret_access_key,
-        },
+    const client = buildR2Client({
+        accountId: r2.account_id,
+        accessKeyId: creds.access_key_id,
+        secretAccessKey: creds.secret_access_key,
     });
     const files = walkDir(dir);
     const prefix = opts.prefix.replace(/\/?$/, '/').replace(/^\//, '');
@@ -299,90 +185,223 @@ r2Command
         console.error('R2 credentials not found. Run `studiograph r2 setup` first.');
         process.exit(1);
     }
-    // Find all tokens.json files across all apps
     const cwd = process.cwd();
-    const appsDir = join(cwd, '.studiograph', 'apps');
-    const tokensFiles = [];
-    if (existsSync(appsDir)) {
-        for (const app of readdirSync(appsDir)) {
-            const tokensPath = join(appsDir, app, 'theme', 'tokens.json');
-            if (existsSync(tokensPath))
-                tokensFiles.push(tokensPath);
-        }
-    }
-    if (tokensFiles.length === 0) {
-        log.warn('No tokens.json files found in .studiograph/apps/*/theme/');
-        return;
-    }
-    const client = new S3Client({
-        region: 'auto',
-        endpoint: `https://${r2.account_id}.r2.cloudflarestorage.com`,
+    const repoPaths = config.repos.map((r) => join(cwd, r.path));
+    const s = spinner();
+    s.start('Syncing local assets to R2...');
+    const result = await syncLocalAssetsToR2({
+        workspacePath: cwd,
+        repoPaths,
         credentials: {
+            accountId: r2.account_id,
             accessKeyId: creds.access_key_id,
             secretAccessKey: creds.secret_access_key,
         },
+        bucket: r2.bucket,
+        publicUrl: r2.public_url,
+        onProgress: (p) => {
+            if (p.currentFile)
+                s.message(`Uploading ${p.currentFile}`);
+        },
     });
-    const s = spinner();
-    let totalUploaded = 0;
-    let totalRewrites = 0;
-    for (const tokensPath of tokensFiles) {
-        const appName = tokensPath.split('/').slice(-3)[0];
-        const tokensRaw = readFileSync(tokensPath, 'utf8');
-        const tokens = JSON.parse(tokensRaw);
-        let modified = false;
-        const uploads = [];
-        // Walk all string values, replace file: references
-        const rewrite = (obj, basePath) => {
-            if (typeof obj === 'string' && obj.startsWith('file:')) {
-                const localPath = join(basePath, obj.slice(5));
-                if (!existsSync(localPath)) {
-                    log.warn(`File not found, skipping: ${localPath}`);
-                    return obj;
-                }
-                const key = relative(cwd, localPath);
-                const body = readFileSync(localPath);
-                s.message(`Uploading ${key}`);
-                uploads.push(client.send(new PutObjectCommand({
-                    Bucket: r2.bucket,
-                    Key: key,
-                    Body: body,
-                    ContentType: contentType(localPath),
-                    CacheControl: 'public, max-age=31536000, immutable',
-                })));
-                totalUploaded++;
-                modified = true;
-                return `${r2.public_url}/${key}`;
+    s.stop(result.uploaded > 0
+        ? `Uploaded ${result.uploaded} asset(s), rewrote ${result.rewritten} file(s)` +
+            (result.failed > 0 ? ` (${result.failed} failed)` : '')
+        : 'No local asset references found');
+    if (result.uploaded > 0) {
+        log.success(`Assets available at ${r2.public_url}/`);
+    }
+});
+// Entity-typed prefixes that the GET /api/assets/:type/:id/:filename
+// route can resolve. The route does authz via findEntityById regardless
+// of the entity type, so any of these prefixes is safe to rewrite. New
+// uploads land under `asset/`; legacy image references uploaded before
+// Stage 2 sit under `reference/` (per docs/asset-architecture.md §1.5
+// — those `reference` entities were intentionally never migrated to
+// the new `asset` type). Both shapes need to migrate from absolute R2
+// URLs to proxied paths before the bucket can flip private.
+//
+// Other top-level prefixes that may appear under the same R2 bucket
+// (`fonts/`, `tokens/`, `<app>/theme/...` from `r2 sync`) are NOT
+// entity-backed — the proxy can't resolve them. We leave those alone.
+const ENTITY_ASSET_PREFIXES = ['asset', 'reference'];
+function rewriteR2UrlsInText(text, publicUrlPrefix) {
+    const escapedPrefix = publicUrlPrefix.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    // One alternation across all entity-asset prefixes:
+    // `<public>/(asset|reference)/...` → `/api/assets/(asset|reference)/...`.
+    // Capture group preserves the entity-type segment in the rewrite.
+    const re = new RegExp(`${escapedPrefix}/(${ENTITY_ASSET_PREFIXES.join('|')})/`, 'g');
+    let count = 0;
+    const out = text.replace(re, (_, entityType) => {
+        count++;
+        return `/api/assets/${entityType}/`;
+    });
+    return { text: out, rewrites: count };
+}
+async function migrateRepo(repoPath, publicUrlPrefix) {
+    const stats = {
+        filesScanned: 0, filesRewritten: 0, rewrites: 0, rewrittenFiles: [],
+    };
+    if (!existsSync(repoPath))
+        return stats;
+    const mdFiles = walkMarkdown(repoPath);
+    for (const mdFile of mdFiles) {
+        stats.filesScanned++;
+        const original = readFileSync(mdFile, 'utf8');
+        if (!original.includes(publicUrlPrefix))
+            continue;
+        const { text: updated, rewrites } = rewriteR2UrlsInText(original, publicUrlPrefix);
+        if (rewrites === 0 || updated === original)
+            continue;
+        writeFileSync(mdFile, updated);
+        stats.filesRewritten++;
+        stats.rewrites += rewrites;
+        stats.rewrittenFiles.push(mdFile);
+    }
+    return stats;
+}
+/**
+ * Migration-safe markdown walker: skips VCS / dependency / studiograph
+ * internals and refuses to follow symlinks. The shared `walkDir` at the
+ * top of this file recurses into everything (it's used for fonts/asset
+ * uploads where that's the right behavior); the migration touches every
+ * .md file it sees, so it must be more conservative.
+ */
+function walkMarkdown(dir) {
+    const SKIP_DIRS = new Set(['.git', 'node_modules', '.studiograph', '.collaborator', 'dist', 'build']);
+    const files = [];
+    const visit = (d) => {
+        let entries;
+        try {
+            entries = readdirSync(d);
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (SKIP_DIRS.has(entry))
+                continue;
+            const full = join(d, entry);
+            let st;
+            try {
+                st = lstatSync(full);
+            }
+            catch {
+                continue;
             }
-            if (obj && typeof obj === 'object') {
-                const out = Array.isArray(obj) ? [] : {};
-                for (const k of Object.keys(obj))
-                    out[k] = rewrite(obj[k], basePath);
-                return out;
+            if (st.isSymbolicLink())
+                continue;
+            if (st.isDirectory())
+                visit(full);
+            else if (st.isFile() && full.endsWith('.md'))
+                files.push(full);
+        }
+    };
+    visit(dir);
+    return files;
+}
+r2Command
+    .command('migrate-urls')
+    .description('Rewrite legacy absolute R2 URLs in entities to proxied /api/assets/* paths (Stage 2). Idempotent.')
+    .option('--dry-run', 'Show what would change without writing or committing')
+    .action(async (opts) => {
+    const workspace = new Workspace();
+    if (!workspace.isWorkspace()) {
+        console.error('Not a Studiograph workspace. Run `studiograph init` first.');
+        process.exit(1);
+    }
+    const config = await workspace.loadConfig();
+    const r2 = config.r2_config;
+    if (!r2?.public_url) {
+        console.error('No r2_config.public_url in workspace.json — nothing to migrate.');
+        process.exit(1);
+    }
+    // Anchor strictly on the configured public URL with trailing slash
+    // stripped, so a typo like `https://pub-xxx.r2.dev` won't bleed into
+    // unrelated `https://pub-xxxabc.example/...` matches.
+    const prefix = r2.public_url.replace(/\/+$/, '');
+    intro(opts.dryRun ? 'r2 migrate-urls — dry run' : 'r2 migrate-urls');
+    const cwd = workspace.getWorkspacePath();
+    let totalRewrites = 0;
+    let totalFilesRewritten = 0;
+    let totalFilesScanned = 0;
+    // Per-repo list of files we actually rewrote, so the commit step
+    // stages exactly those paths instead of `git add -A` (which would
+    // sweep up unrelated dirty changes — agent-staged entries, WIP,
+    // anything pending in the workspace at run time).
+    const rewrittenByRepo = new Map();
+    for (const repo of config.repos) {
+        const repoPath = join(cwd, repo.path);
+        if (opts.dryRun) {
+            const counts = countRepoMatches(repoPath, prefix);
+            totalFilesScanned += counts.filesScanned;
+            totalFilesRewritten += counts.filesWithMatches;
+            totalRewrites += counts.rewrites;
+            if (counts.rewrites > 0) {
+                log.info(`${repo.name}: ${counts.rewrites} rewrites across ${counts.filesWithMatches} file(s)`);
             }
-            return obj;
-        };
-        s.start(`Syncing ${appName} tokens...`);
-        const updated = rewrite(tokens, cwd);
-        await Promise.all(uploads);
-        if (modified) {
-            writeFileSync(tokensPath, JSON.stringify(updated, null, 2) + '\n');
-            totalRewrites++;
-            s.stop(`${appName}: updated tokens.json`);
+            continue;
         }
-        else {
-            s.stop(`${appName}: no file: references found`);
+        const stats = await migrateRepo(repoPath, prefix);
+        totalFilesScanned += stats.filesScanned;
+        totalFilesRewritten += stats.filesRewritten;
+        totalRewrites += stats.rewrites;
+        if (stats.rewrittenFiles.length > 0) {
+            rewrittenByRepo.set(repo.name, stats.rewrittenFiles);
+        }
+        if (stats.rewrites > 0) {
+            log.info(`${repo.name}: ${stats.rewrites} rewrites across ${stats.filesRewritten} file(s)`);
         }
     }
-    // ── Pass 2: markdown files across all workspace repos ─────────────────
-    const repoPaths = config.repos.map((r) => join(cwd, r.path));
-    s.start('Scanning markdown files for local asset references...');
-    const mdResult = await syncMarkdownAssets(cwd, repoPaths, client, r2, s);
-    totalUploaded += mdResult.uploaded;
-    s.stop(mdResult.rewrites > 0
-        ? `Markdown: ${mdResult.uploaded} asset(s) uploaded, ${mdResult.rewrites} file(s) rewritten`
-        : 'Markdown: no local asset references found');
-    if (totalUploaded > 0) {
-        log.success(`Assets available at ${r2.public_url}/`);
+    if (totalRewrites === 0) {
+        outro(`Nothing to migrate (scanned ${totalFilesScanned} files, no R2 URLs matching ${prefix}).`);
+        return;
     }
+    if (opts.dryRun) {
+        outro(`Dry run: would rewrite ${totalRewrites} URL(s) in ${totalFilesRewritten} file(s).`);
+        return;
+    }
+    // One commit per repo, staging ONLY the files this command rewrote
+    // (never `git add -A`). Uses the local git user.name/user.email
+    // already configured for the repo (no override) — this is a
+    // maintenance command, not user-attributed.
+    for (const repo of config.repos) {
+        const files = rewrittenByRepo.get(repo.name);
+        if (!files || files.length === 0)
+            continue;
+        const repoPath = join(cwd, repo.path);
+        // Pass repo-relative paths to git add so the same commit message
+        // works regardless of where the rewritten file sat in the tree.
+        const relFiles = files.map(f => relative(repoPath, f));
+        const addRes = spawnSync('git', ['add', '--', ...relFiles], { cwd: repoPath, encoding: 'utf8' });
+        if (addRes.status !== 0) {
+            log.warn(`${repo.name}: git add failed — skipping commit (${addRes.stderr?.trim()})`);
+            continue;
+        }
+        const commitRes = spawnSync('git', ['commit', '-m', 'chore(assets): migrate R2 URLs to /api/assets/* paths'], { cwd: repoPath, encoding: 'utf8' });
+        if (commitRes.status !== 0) {
+            log.warn(`${repo.name}: git commit failed (${commitRes.stderr?.trim()})`);
+        }
+    }
+    outro(`Rewrote ${totalRewrites} URL(s) in ${totalFilesRewritten} file(s) across ${config.repos.length} repo(s).`);
 });
+/** Dry-run counter: count matches without modifying any file. */
+function countRepoMatches(repoPath, publicUrlPrefix) {
+    const result = { filesScanned: 0, filesWithMatches: 0, rewrites: 0 };
+    if (!existsSync(repoPath))
+        return result;
+    const mdFiles = walkMarkdown(repoPath);
+    for (const mdFile of mdFiles) {
+        result.filesScanned++;
+        const text = readFileSync(mdFile, 'utf8');
+        if (!text.includes(publicUrlPrefix))
+            continue;
+        const { rewrites } = rewriteR2UrlsInText(text, publicUrlPrefix);
+        if (rewrites > 0) {
+            result.filesWithMatches++;
+            result.rewrites += rewrites;
+        }
+    }
+    return result;
+}
 //# sourceMappingURL=r2.js.map