studiograph 1.3.48-next.21 → 1.3.48-next.210

package/dist/core/secrets/probes/tavily.js

@@ -0,0 +1,58 @@
+/**
+ * Test-connection probe for the Tavily Search API.
+ *
+ * Makes a small real search call against
+ *   POST https://api.tavily.com/search
+ * with the configured key and a fixed probe query. Returns `ok: true`
+ * on HTTP 200, `ok: false` on auth / network / other errors. This is the
+ * same endpoint + request shape the runtime search tool uses
+ * (see agent/tools/web-tools.ts), so a green probe means search will work.
+ *
+ * The probe never echoes the upstream error body — only a generic canned
+ * phrase and the HTTP status code (no headers, no payload).
+ *
+ * `fetchImpl` is injectable so unit tests can exercise the status mapping
+ * without contacting the real upstream (mirrors the Anthropic probe).
+ */
+const TAVILY_URL = 'https://api.tavily.com/search';
+const PROBE_QUERY = 'studiograph probe';
+export async function probeTavily(apiKey, _ctx, fetchImpl = fetch) {
+    const started = Date.now();
+    if (!apiKey || typeof apiKey !== 'string' || apiKey.length === 0) {
+        return { ok: false, message: 'No API key provided', durationMs: Date.now() - started };
+    }
+    try {
+        const res = await fetchImpl(TAVILY_URL, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                api_key: apiKey,
+                query: PROBE_QUERY,
+                max_results: 1,
+                search_depth: 'basic',
+            }),
+        });
+        const durationMs = Date.now() - started;
+        if (res.ok) {
+            return { ok: true, durationMs };
+        }
+        if (res.status === 401 || res.status === 403) {
+            return { ok: false, message: 'API key rejected', durationMs };
+        }
+        if (res.status === 429) {
+            return { ok: false, message: 'Rate limited (try again shortly)', durationMs };
+        }
+        if (res.status >= 500) {
+            return { ok: false, message: `Upstream ${res.status}`, durationMs };
+        }
+        return { ok: false, message: `HTTP ${res.status}`, durationMs };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            message: err instanceof Error && err.message ? err.message.slice(0, 100) : 'Network error',
+            durationMs: Date.now() - started,
+        };
+    }
+}
+//# sourceMappingURL=tavily.js.map

package/dist/core/secrets/probes/tavily.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tavily.js","sourceRoot":"","sources":["../../../../src/core/secrets/probes/tavily.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,MAAM,UAAU,GAAG,+BAA+B,CAAC;AACnD,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,IAAc,EACd,YAA0B,KAAK;IAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IACzF,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE;YACtC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,MAAM;gBACf,KAAK,EAAE,WAAW;gBAClB,WAAW,EAAE,CAAC;gBACd,YAAY,EAAE,OAAO;aACtB,CAAC;SACH,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QACxC,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAClC,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,CAAC;QAChE,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,kCAAkC,EAAE,UAAU,EAAE,CAAC;QAChF,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,GAAG,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC;QACtE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe;YAC1F,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SACjC,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/core/secrets/probes/voyage.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Test-connection probe for Voyage AI embeddings API.
+ *
+ * Makes a small real embedding call against
+ *   POST https://api.voyageai.com/v1/embeddings
+ * with the configured model (voyage-3) and a fixed test input. Returns
+ * `ok: true` on HTTP 200, `ok: false` on auth / network / other errors.
+ *
+ * The probe never echoes the upstream error body — only a generic
+ * canned phrase and the HTTP status code (no headers, no payload).
+ */
+import type { TestResult } from './anthropic.js';
+export declare function probeVoyage(apiKey: string): Promise<TestResult>;

package/dist/core/secrets/probes/voyage.js

@@ -0,0 +1,52 @@
+/**
+ * Test-connection probe for Voyage AI embeddings API.
+ *
+ * Makes a small real embedding call against
+ *   POST https://api.voyageai.com/v1/embeddings
+ * with the configured model (voyage-3) and a fixed test input. Returns
+ * `ok: true` on HTTP 200, `ok: false` on auth / network / other errors.
+ *
+ * The probe never echoes the upstream error body — only a generic
+ * canned phrase and the HTTP status code (no headers, no payload).
+ */
+const VOYAGE_URL = 'https://api.voyageai.com/v1/embeddings';
+const VOYAGE_MODEL = 'voyage-3';
+const PROBE_INPUT = 'studiograph probe';
+export async function probeVoyage(apiKey) {
+    const started = Date.now();
+    if (!apiKey || typeof apiKey !== 'string' || apiKey.length === 0) {
+        return { ok: false, message: 'No API key provided', durationMs: Date.now() - started };
+    }
+    try {
+        const res = await fetch(VOYAGE_URL, {
+            method: 'POST',
+            headers: {
+                'Authorization': `Bearer ${apiKey}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({ input: PROBE_INPUT, model: VOYAGE_MODEL }),
+        });
+        const durationMs = Date.now() - started;
+        if (res.ok) {
+            return { ok: true, durationMs };
+        }
+        if (res.status === 401 || res.status === 403) {
+            return { ok: false, message: 'API key rejected', durationMs };
+        }
+        if (res.status === 429) {
+            return { ok: false, message: 'Rate limited (try again shortly)', durationMs };
+        }
+        if (res.status >= 500) {
+            return { ok: false, message: `Upstream ${res.status}`, durationMs };
+        }
+        return { ok: false, message: `HTTP ${res.status}`, durationMs };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            message: err instanceof Error && err.message ? err.message.slice(0, 100) : 'Network error',
+            durationMs: Date.now() - started,
+        };
+    }
+}
+//# sourceMappingURL=voyage.js.map

package/dist/core/secrets/probes/voyage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"voyage.js","sourceRoot":"","sources":["../../../../src/core/secrets/probes/voyage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,MAAM,UAAU,GAAG,wCAAwC,CAAC;AAC5D,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IACzF,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,MAAM,EAAE;gBACnC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;SAClE,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QACxC,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAClC,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,CAAC;QAChE,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,kCAAkC,EAAE,UAAU,EAAE,CAAC;QAChF,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,GAAG,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC;QACtE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe;YAC1F,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SACjC,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/core/secrets/r2-structural-migration.d.ts

@@ -0,0 +1,39 @@
+/**
+ * R2 structural-fields migration (2026-05-12).
+ *
+ * Backstory: when the encrypted store landed, the R2 credentials
+ * (`r2.access_key_id`, `r2.secret_access_key`) moved into the registry
+ * but the three structural fields — `account_id`, `bucket`, and
+ * `public_url` — kept living in `workspace.json:r2_config.*`. That left
+ * the Settings UI broken: users could enter credentials, hit save, and
+ * AssetService still picked `local` because workspace-manager gates on
+ * the structural fields from workspace.json. Until those fields were
+ * also reachable via the store, the UI couldn't fully configure R2.
+ *
+ * Phase 12 (2026-05-12) already removed the first-run importer that
+ * would have piggybacked the structural-field migration onto the
+ * existing migrationSource pipeline. So this standalone one-shot fills
+ * the gap: it runs at boot, copies pre-existing values from
+ * `workspace.json:r2_config.*` into the store on first encounter, and
+ * marks a meta flag so it never repeats.
+ *
+ * Operators who configured R2 via `studiograph r2 setup` before this
+ * change see zero behavior difference. Operators who set R2 via the UI
+ * post-change write directly to the store and never touch this code.
+ *
+ * Idempotent. Non-fatal on any single error — we'd rather boot with the
+ * legacy fallback path than refuse to start because workspace.json went
+ * sideways.
+ */
+import type { SqliteEncryptedStore } from './SqliteEncryptedStore.js';
+interface MigrationOptions {
+    workspaceJsonPath: string;
+    store: SqliteEncryptedStore;
+}
+export interface MigrationResult {
+    skipped: boolean;
+    /** Keys actually written to the store (skipping ones already present). */
+    written: string[];
+}
+export declare function migrateR2Structural(opts: MigrationOptions): Promise<MigrationResult>;
+export {};

package/dist/core/secrets/r2-structural-migration.js

@@ -0,0 +1,109 @@
+/**
+ * R2 structural-fields migration (2026-05-12).
+ *
+ * Backstory: when the encrypted store landed, the R2 credentials
+ * (`r2.access_key_id`, `r2.secret_access_key`) moved into the registry
+ * but the three structural fields — `account_id`, `bucket`, and
+ * `public_url` — kept living in `workspace.json:r2_config.*`. That left
+ * the Settings UI broken: users could enter credentials, hit save, and
+ * AssetService still picked `local` because workspace-manager gates on
+ * the structural fields from workspace.json. Until those fields were
+ * also reachable via the store, the UI couldn't fully configure R2.
+ *
+ * Phase 12 (2026-05-12) already removed the first-run importer that
+ * would have piggybacked the structural-field migration onto the
+ * existing migrationSource pipeline. So this standalone one-shot fills
+ * the gap: it runs at boot, copies pre-existing values from
+ * `workspace.json:r2_config.*` into the store on first encounter, and
+ * marks a meta flag so it never repeats.
+ *
+ * Operators who configured R2 via `studiograph r2 setup` before this
+ * change see zero behavior difference. Operators who set R2 via the UI
+ * post-change write directly to the store and never touch this code.
+ *
+ * Idempotent. Non-fatal on any single error — we'd rather boot with the
+ * legacy fallback path than refuse to start because workspace.json went
+ * sideways.
+ */
+import { existsSync, readFileSync } from 'fs';
+const META_KEY = 'r2_structural_migrated_at';
+/**
+ * Map of registry key → dot-path inside workspace.json's r2_config block.
+ * Mirrors the same shape the legacy `migrationSource` annotations encoded
+ * for other fields before Phase 12b dropped them.
+ */
+const FIELD_MAP = [
+    { key: 'r2.account_id', path: 'account_id' },
+    { key: 'r2.bucket', path: 'bucket' },
+    { key: 'r2.public_url', path: 'public_url' },
+];
+/**
+ * Pull a nested string out of an object — same shape as dual-write's
+ * readPath. Returns undefined for any missing intermediate or non-string
+ * leaf. We intentionally only accept strings because the registry's
+ * validators all expect string values for the R2 structural fields.
+ */
+function readString(obj, path) {
+    if (!obj || typeof obj !== 'object')
+        return undefined;
+    const parts = path.split('.');
+    let cur = obj;
+    for (const p of parts) {
+        if (cur == null || typeof cur !== 'object')
+            return undefined;
+        cur = cur[p];
+    }
+    return typeof cur === 'string' && cur.length > 0 ? cur : undefined;
+}
+export async function migrateR2Structural(opts) {
+    if (opts.store.getMeta(META_KEY)) {
+        return { skipped: true, written: [] };
+    }
+    // Stamp the marker even on the no-source path so we don't re-scan
+    // workspace.json on every boot. This is the same shape scope-collapse
+    // uses for fresh DBs.
+    if (!existsSync(opts.workspaceJsonPath)) {
+        opts.store.setMeta(META_KEY, String(Date.now()));
+        return { skipped: false, written: [] };
+    }
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(opts.workspaceJsonPath, 'utf-8'));
+    }
+    catch {
+        // Unparseable workspace.json — mark migrated anyway and let the
+        // boot path surface the file error elsewhere. Trying to recover
+        // from a corrupt config from inside a secrets migration would
+        // mask the real problem.
+        opts.store.setMeta(META_KEY, String(Date.now()));
+        return { skipped: false, written: [] };
+    }
+    const r2Config = raw?.r2_config;
+    const written = [];
+    // Best-effort writes. Each field is independent — a bad URL on one
+    // field shouldn't stop the others from migrating. The store's
+    // workspace-setting writer doesn't run the registry validator at
+    // write time, so a malformed URL would survive the write; the
+    // Settings UI surfaces validation on subsequent edits.
+    const actor = { type: 'system', systemId: 'r2-structural-migration' };
+    for (const { key, path } of FIELD_MAP) {
+        const value = readString(r2Config, path);
+        if (!value)
+            continue;
+        // Don't clobber a value that's already in the store — the UI may
+        // have written one before the importer ran on a freshly-redeployed
+        // workspace where workspace.json got re-synced from a backup.
+        if (opts.store.get(key) !== undefined)
+            continue;
+        try {
+            await opts.store.set({ key, value }, actor);
+            written.push(key);
+        }
+        catch {
+            // Skip and continue — see module comment on non-fatal stance.
+        }
+    }
+    opts.store.setMeta(META_KEY, String(Date.now()));
+    return { skipped: false, written };
+}
+//# sourceMappingURL=r2-structural-migration.js.map

package/dist/core/secrets/r2-structural-migration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2-structural-migration.js","sourceRoot":"","sources":["../../../src/core/secrets/r2-structural-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAG9C,MAAM,QAAQ,GAAG,2BAA2B,CAAC;AAa7C;;;;GAIG;AACH,MAAM,SAAS,GAAiD;IAC9D,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE;IAC5C,EAAE,GAAG,EAAE,WAAW,EAAM,IAAI,EAAE,QAAQ,EAAE;IACxC,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE;CAC7C,CAAC;AAEF;;;;;GAKG;AACH,SAAS,UAAU,CAAC,GAAY,EAAE,IAAY;IAC5C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,GAAQ,GAAG,CAAC;IACnB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC7D,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;IACD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAsB;IAC9D,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACxC,CAAC;IAED,kEAAkE;IAClE,sEAAsE;IACtE,sBAAsB;IACtB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzC,CAAC;IAED,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;QAChE,gEAAgE;QAChE,8DAA8D;QAC9D,yBAAyB;QACzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,QAAQ,GAAI,GAA+B,EAAE,SAAS,CAAC;IAC7D,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,mEAAmE;IACnE,8DAA8D;IAC9D,iEAAiE;IACjE,8DAA8D;IAC9D,uDAAuD;IACvD,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,QAAiB,EAAE,QAAQ,EAAE,yBAAyB,EAAE,CAAC;IAC/E,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,iEAAiE;QACjE,mEAAmE;QACnE,8DAA8D;QAC9D,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,SAAS;QAChD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;IACH,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC"}

package/dist/core/secrets/read-flip.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Read-flip helpers — Phase 6 of the secrets refactor.
+ *
+ * Call sites that historically read directly from `~/.studiograph/user.json`
+ * / `workspace.json` / `process.env.*` route through this module so the
+ * flip is uniform across the codebase.
+ *
+ * Contract: every helper here returns `undefined` when the resolver
+ * returns `unset` (or when the store hasn't been initialized yet —
+ * very early boot or test harness without a store). Callers MUST fall
+ * back to their pre-existing legacy read in that case. This is the
+ * transitional safety net documented in the plan: if the importer
+ * hasn't run yet (boot race, mis-provisioned redeploy), the resolver
+ * sees empty slots and we don't want to regress to "no value at all".
+ *
+ * When the resolver returns a value, callers MUST use it and skip the
+ * legacy read. The store is the source of truth in production.
+ *
+ * Why a thin wrapper rather than inlining `getSettingsResolver()?.resolve()`
+ * at every call site:
+ *   1. Single place to handle the "store not yet initialized" guard.
+ *   2. Single place to flip the implementation again in Phase 9 (when
+ *      legacy fallbacks are removed).
+ *   3. Concise call sites: `tryResolve('model.anthropic.api_key')` is
+ *      shorter than the resolver dance.
+ *
+ * Historical note: the `STUDIOGRAPH_NEW_STORE` env flag previously
+ * gated these helpers (returned undefined when off). The flag was
+ * removed once Phase 6 was proven stable in production — the store is
+ * now unconditional. The env var can still be set on Railway services
+ * for backwards-compat; it is silently ignored.
+ */
+import type { ResolverContext } from './SettingsResolver.js';
+/**
+ * Try to resolve a value through the new store. Returns `undefined`
+ * when the flag is off OR the resolver returns unset. Callers handle
+ * `undefined` by falling back to their legacy reader.
+ *
+ * For non-secret values, this hits the `settings` table directly via
+ * the resolver's read path. The value type is whatever was JSON-stored,
+ * cast to T at the boundary.
+ *
+ * For secret values, this calls `unsafeGetForResolver` through the
+ * resolver — same access pattern as the legacy reader, except the
+ * value lands from an encrypted SQLite row rather than a 0o600 JSON
+ * file. The "unsafe" prefix on the underlying call is a marker for
+ * "value crosses the resolver boundary" — UI/API callers must use
+ * `describe()` instead and never touch this helper.
+ */
+export declare function tryResolve<T = string>(key: string, ctx?: ResolverContext): T | undefined;
+/**
+ * Same shape but also returns the resolution source. Useful for
+ * surfaces that want to show a "shadowed by environment" banner in
+ * the UI without re-doing the lookup.
+ */
+export declare function tryResolveWithSource<T = string>(key: string, ctx?: ResolverContext): {
+    value: T | undefined;
+    source: 'env' | 'store' | 'default' | 'unset';
+} | undefined;

package/dist/core/secrets/read-flip.js

@@ -0,0 +1,87 @@
+/**
+ * Read-flip helpers — Phase 6 of the secrets refactor.
+ *
+ * Call sites that historically read directly from `~/.studiograph/user.json`
+ * / `workspace.json` / `process.env.*` route through this module so the
+ * flip is uniform across the codebase.
+ *
+ * Contract: every helper here returns `undefined` when the resolver
+ * returns `unset` (or when the store hasn't been initialized yet —
+ * very early boot or test harness without a store). Callers MUST fall
+ * back to their pre-existing legacy read in that case. This is the
+ * transitional safety net documented in the plan: if the importer
+ * hasn't run yet (boot race, mis-provisioned redeploy), the resolver
+ * sees empty slots and we don't want to regress to "no value at all".
+ *
+ * When the resolver returns a value, callers MUST use it and skip the
+ * legacy read. The store is the source of truth in production.
+ *
+ * Why a thin wrapper rather than inlining `getSettingsResolver()?.resolve()`
+ * at every call site:
+ *   1. Single place to handle the "store not yet initialized" guard.
+ *   2. Single place to flip the implementation again in Phase 9 (when
+ *      legacy fallbacks are removed).
+ *   3. Concise call sites: `tryResolve('model.anthropic.api_key')` is
+ *      shorter than the resolver dance.
+ *
+ * Historical note: the `STUDIOGRAPH_NEW_STORE` env flag previously
+ * gated these helpers (returned undefined when off). The flag was
+ * removed once Phase 6 was proven stable in production — the store is
+ * now unconditional. The env var can still be set on Railway services
+ * for backwards-compat; it is silently ignored.
+ */
+import { getSettingsResolver, hasSecretStore } from './index.js';
+/**
+ * Try to resolve a value through the new store. Returns `undefined`
+ * when the flag is off OR the resolver returns unset. Callers handle
+ * `undefined` by falling back to their legacy reader.
+ *
+ * For non-secret values, this hits the `settings` table directly via
+ * the resolver's read path. The value type is whatever was JSON-stored,
+ * cast to T at the boundary.
+ *
+ * For secret values, this calls `unsafeGetForResolver` through the
+ * resolver — same access pattern as the legacy reader, except the
+ * value lands from an encrypted SQLite row rather than a 0o600 JSON
+ * file. The "unsafe" prefix on the underlying call is a marker for
+ * "value crosses the resolver boundary" — UI/API callers must use
+ * `describe()` instead and never touch this helper.
+ */
+export function tryResolve(key, ctx = {}) {
+    if (!hasSecretStore())
+        return undefined;
+    const resolver = getSettingsResolver();
+    if (!resolver)
+        return undefined;
+    try {
+        return resolver.resolve(key, ctx);
+    }
+    catch {
+        // Unknown key — registry didn't include it. Treat as "no value"
+        // and let the caller fall through. The resolver only throws when
+        // the registry lookup fails; that means the call site is passing
+        // a key name that isn't registered, which is a programmer error
+        // worth surfacing — but not by crashing a runtime read path.
+        return undefined;
+    }
+}
+/**
+ * Same shape but also returns the resolution source. Useful for
+ * surfaces that want to show a "shadowed by environment" banner in
+ * the UI without re-doing the lookup.
+ */
+export function tryResolveWithSource(key, ctx = {}) {
+    if (!hasSecretStore())
+        return undefined;
+    const resolver = getSettingsResolver();
+    if (!resolver)
+        return undefined;
+    try {
+        const r = resolver.resolveWithSource(key, ctx);
+        return { value: r.value, source: r.source };
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=read-flip.js.map

package/dist/core/secrets/read-flip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-flip.js","sourceRoot":"","sources":["../../../src/core/secrets/read-flip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAGjE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,UAAU,CACxB,GAAW,EACX,MAAuB,EAAE;IAEzB,IAAI,CAAC,cAAc,EAAE;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACvC,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,OAAO,CAAI,GAAG,EAAE,GAAG,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;QAChE,iEAAiE;QACjE,iEAAiE;QACjE,gEAAgE;QAChE,6DAA6D;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,MAAuB,EAAE;IAEzB,IAAI,CAAC,cAAc,EAAE;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACvC,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,CAAC,iBAAiB,CAAI,GAAG,EAAE,GAAG,CAAC,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/core/secrets/registry.d.ts

@@ -0,0 +1,188 @@
+/**
+ * Key Registry — single source of truth for every configurable key.
+ *
+ * Every consumer (resolver, importer, validator, redactor, audit logger,
+ * exporter, test suite) reads from this module. If a `process.env.<KEY>`
+ * appears in `src/`, it MUST be either listed under some entry's
+ * `envAliases` or covered by `SYSTEM_ALLOWLIST` / `OPERATIONAL_ALLOWLIST`.
+ * The registry-completeness test enforces this — orphans fail CI with
+ * their names printed.
+ *
+ * Adding a new env var? Two-step: pick the right classification, add the
+ * KeyDef here. The completeness test will keep you honest.
+ */
+import { type ZodType } from 'zod';
+import { type TestResult } from './probes/anthropic.js';
+export type Classification = 'bootstrap' | 'workspace-secret' | 'workspace-setting' | 'user-secret' | 'user-setting';
+export type RedactionMode = 'never' | 'value-only' | 'always';
+export interface KeyDef<T = unknown> {
+    /** Canonical name, e.g. `anthropic.api_key`. Lowercase, dot-separated. */
+    name: string;
+    classification: Classification;
+    /** All env-var spellings that should resolve to this key. UPPER_SNAKE_CASE. */
+    envAliases: string[];
+    default?: T;
+    /** zod validator for the parsed value. */
+    validate: ZodType<T>;
+    redact: RedactionMode;
+    /** Included in /api/config/bundle and pushSeed? */
+    exportable: boolean;
+    testConnection?: (value: T) => Promise<TestResult>;
+    rotationHint?: string;
+    /**
+     * Optional URL where users obtain this credential — e.g. a provider's
+     * API-keys page. Surfaced in the UI as a "Get an API key →" link below
+     * the field. Only set on credential-bearing keys; plain settings leave
+     * this undefined.
+     */
+    consoleUrl?: string;
+}
+/**
+ * System-level env vars provided by the OS or container runtime. Not
+ * registry-managed — they do not represent product configuration; we just
+ * read them when they happen to be set.
+ */
+export declare const SYSTEM_ALLOWLIST: ReadonlySet<string>;
+/**
+ * Operational env vars that toggle runtime behaviour but aren't
+ * configurable settings (no UI surface, no persistence, no precedence
+ * chain). Not registry-managed.
+ */
+export declare const OPERATIONAL_ALLOWLIST: ReadonlySet<string>;
+/**
+ * The canonical registry. Order is informative (matches plan §2 grouping)
+ * but every consumer should look up by name.
+ */
+export declare const REGISTRY: ReadonlyArray<KeyDef>;
+/**
+ * Look up a registry entry by canonical name.
+ *
+ * Handles two cases:
+ *   1. Exact match on `name` — the common path.
+ *   2. Connector pattern match — concrete keys like
+ *      `connector.linear.auth` resolve to the template entry
+ *      `connector.<name>.auth`. The template's classification + redaction
+ *      flags apply to the concrete key.
+ *
+ * Returns undefined for genuinely unknown keys; callers (importer, store
+ * setters) treat this as "not in the registry, reject the write."
+ */
+export declare function getKeyDef(name: string): KeyDef | undefined;
+/**
+ * Match a concrete connector key (`connector.<name>.<slot>`) against the
+ * template entries in the registry. Returns a synthetic KeyDef carrying
+ * the template's classification/redaction/exportable flags but with the
+ * concrete `name` so audit and store rows record the actual slot, not
+ * the placeholder.
+ */
+export declare function resolveConnectorKeyDef(name: string): KeyDef | undefined;
+/**
+ * Reverse lookup: given an env-var spelling, return the registry entry that
+ * claims it as an alias. Returns `undefined` for unregistered names — the
+ * caller should fall back to the allowlists.
+ */
+export declare function getKeyDefByEnvAlias(envName: string): KeyDef | undefined;
+/**
+ * Set of every env-var spelling claimed by the registry. Used by tests and
+ * by the resolver to decide whether an env-var is "ours" vs ambient.
+ */
+export declare function allRegisteredEnvAliases(): ReadonlySet<string>;
+/**
+ * Per-provider recommended model IDs.
+ *
+ * Surfaced via the `/api/settings/schema` response on the `model.id`
+ * entry so the ProvidersPanel combobox can render a non-blocking
+ * "Recommended" group. The list is intentionally short (3–4 per
+ * provider) — power users can always type a preview-tagged value
+ * directly; the combobox never blocks freeform input.
+ *
+ * Provider keys must align 1:1 with the `model.provider` enum values
+ * — there's a registry-completeness test that guards this. Seed
+ * values below are best-effort and SHOULD BE USER-VERIFIED; the IDs
+ * shift fast and stale entries here just degrade the dropdown UX
+ * without breaking anything (free typing still works).
+ */
+export declare const RECOMMENDED_MODELS: Record<string, readonly string[]>;
+/**
+ * UI-renderable shape describing what kind of value a key accepts. Drives
+ * dropdowns, toggles, and text inputs in the settings panels — single
+ * source of truth, no hardcoded option lists in Svelte components.
+ *
+ * `enum` exposes the discrete set of allowed values (e.g. model.provider).
+ * `boolean` flags toggle inputs. Anything else (plain string, URL, regex)
+ * returns `undefined`; the UI defaults to a freeform text input.
+ */
+export type KeyConstraint = {
+    type: 'enum';
+    values: readonly string[];
+} | {
+    type: 'boolean';
+};
+/**
+ * Introspect a registered key's zod validator to recover what kind of
+ * value it accepts. Walks ZodOptional/ZodNullable/ZodDefault wrappers to
+ * the inner type. Returns `undefined` for unknown keys and for plain
+ * string-ish schemas — the UI treats absence-of-constraint as "render a
+ * text input."
+ *
+ * Implementation note: zod doesn't expose a stable type-introspection
+ * API across versions. We peek into `_def` and check `typeName` /
+ * `entries`. Wrap in try/catch and degrade to undefined if the shape
+ * changes upstream — losing a dropdown is preferable to crashing the
+ * settings panel.
+ */
+export declare function getKeyConstraint(name: string): KeyConstraint | undefined;
+/**
+ * Metadata describing a registered workspace-setting key for UI
+ * consumption. Mirrors the shape the settings panel needs: classification
+ * (so the UI knows whether to render a SecretInput vs a plain Input),
+ * env aliases (for the "shadowed by env" banner), default value, and
+ * a UI-renderable constraint.
+ *
+ * `value` is intentionally NOT included here — that's a runtime lookup
+ * against the resolver. Schema is the static shape; value comes from
+ * `GET /api/settings`.
+ */
+/**
+ * Optional per-provider recommendations on a setting entry. Currently
+ * only `model.id` carries this — the ProvidersPanel reads it off the
+ * schema to populate the combobox's "Recommended" group, keyed by the
+ * currently-selected provider. Other entries omit the field entirely.
+ */
+export interface SettingRecommendations {
+    /** Map of provider name → ordered list of recommended values. */
+    byProvider: Record<string, readonly string[]>;
+}
+export interface SettingSchemaEntry {
+    key: string;
+    classification: Classification;
+    redact: RedactionMode;
+    env_aliases: readonly string[];
+    default?: unknown;
+    constraint?: KeyConstraint;
+    /**
+     * Optional recommendations payload. Only present on `model.id` today
+     * — entries without it render as plain text inputs.
+     */
+    recommendations?: SettingRecommendations;
+}
+/**
+ * Enumerate every registered workspace-setting (non-secret) entry for
+ * the settings panels. Workspace-secrets are excluded — they go through
+ * `GET /api/secrets`, which never returns plaintext values.
+ *
+ * Connector template entries (`connector.<name>.*`) are excluded too —
+ * they're matched dynamically at resolution time, not enumerated in the
+ * UI as fixed slots.
+ */
+export declare function listWorkspaceSettingsSchema(): SettingSchemaEntry[];
+/**
+ * Flat map of canonical key → console URL for every registered key that
+ * carries one. The settings UI uses this to render a "Get an API key →"
+ * link below credential fields. The map covers BOTH workspace-secret
+ * entries (API keys, R2 credentials) and any workspace-setting that
+ * happens to grow a consoleUrl later — same lookup, single roundtrip.
+ *
+ * Keys without a registered consoleUrl are simply absent from the map.
+ */
+export declare function getAllConsoleUrls(): Record<string, string>;