studiograph 1.3.48-next.21 → 1.3.48-next.210

package/dist/server/asset-index-queue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-index-queue.js","sourceRoot":"","sources":["../../src/server/asset-index-queue.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACpF,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,eAAe,GAGhB,MAAM,kCAAkC,CAAC;AA8B1C,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,MAAM,OAAO,eAAe;IAClB,IAAI,CAAsB;IAC1B,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1B,KAAK,GAA0C,IAAI,CAAC;IACpD,QAAQ,GAAG,KAAK,CAAC;IACjB,WAAW,CAAS;IACpB,UAAU,CAAS;IACnB,GAAG,CAAwB;IAEnC,YAAY,IAAyB;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;QACzD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,cAAc,EAAE,0BAA0B,CAAC,CAAC;IAChH,CAAC;IAED,4CAA4C;IAC5C,KAAK;QACH,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,0DAA0D;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,IAAI,SAAS;YAAE,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,OAAO;gBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5E,+DAA+D;QAC9D,IAAI,CAAC,KAAa,CAAC,KAAK,EAAE,EAAE,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,OAAe;QACrB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,qEAAqE;IACrE,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,aAAa;QACjB,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,IAAI,SAAS;YAAE,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,OAAO;gBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpE,wEAAwE;QACxE,OAAO,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,uCAAuC;QAC5E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC3C,uEAAuE;YACvE,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,OAAO,GAAG,CAAC;QACb,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,2DAA2D;IACnD,KAAK,CAAC,SAAS;QACrB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QAClC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,4EAA4E;QAC5E,qEAAqE;QACrE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,+DAA+D;YAC/D,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,2BAA2B,KAAK,CAAC,IAAI,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAClG,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,iFAAiF;IACzE,KAAK,CAAC,QAAQ,CAAC,UAA2C;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,eAAe,CAC/B;YACE,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB;YAC5C,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,EAAE;YAC5D,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;SACzC,EACD,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CACpG,CAAC;QACF,IAAI,GAAG,CAAC,OAAO,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;YAC7D,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,OAAO,aAAa,GAAG,CAAC,MAAM,YAAY,GAAG,CAAC,WAAW,aAAa,GAAG,CAAC,eAAe,aAAa,CAAC,CAAC;QAClI,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,oEAAoE;IACpE,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAEO,OAAO;QACb,MAAM,KAAK,GAAmB;YAC5B,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACjC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;SAChC,CAAC;QACF,IAAI,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACpG,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,WAAW,MAAM,CAAC;YACtC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC5D,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,wCAAwC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAmB,CAAC;YACrF,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxE,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,qCAAqC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1F,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/server/body-write-coordinator.d.ts

@@ -0,0 +1,161 @@
+/**
+ * Body-write coordinator — single critical section for entity markdown body writes.
+ *
+ * Owns the safe path that every server-side surface (autosave PUT, MCP
+ * update_entity, agent tools, event processor) shares. The contract:
+ *
+ *   1. assertWritable gate (server-write only — autosave is the client's
+ *      own write and must not be refused). Folded into lock acquisition so
+ *      a throwing gate releases the lock cleanly.
+ *   2. Per-doc lock — serializes server-side body writes for the same doc.
+ *      Inbound client MSG_SYNC frames queue while held (see
+ *      yjsManager.withDocLock + msgSyncQueue).
+ *   3. Base-hash precondition (autosave 412 path). Read inside the lock so
+ *      we see prior locked writes before deciding.
+ *   4. Atomic disk write via MarkdownService (tmp-write + fsync + rename).
+ *   5. mdRevisionHash bookkeeping (yjsManager.recordDiskBody) so the next
+ *      persistence flush captures the post-write state.
+ *   6. Git commit. On failure, register the dirty file with SessionManager
+ *      (if wired) and surface `CommitFailedDirtyError` to the caller.
+ *   7. Server-write only: post-commit `applyAgentContent` broadcast to the
+ *      live Y.Doc. Autosave skips this — its content originated in the
+ *      live Y.Doc; re-applying would race in-flight keystrokes.
+ *
+ * Scope boundary: body writes only. Structural ops (rename, delete,
+ * changeType, move, folder ops) keep their own paths on graph.ts using
+ * the existing transaction — they have a different concurrency profile
+ * (no per-doc lock, no base-hash precondition) and routing them through
+ * here would create a god-class.
+ *
+ * Also exposes `reconcileFromDisk` — the explicit external-disk-change
+ * primitive callable from startup boot, git-pull event handlers, and
+ * dev-tools "reload from disk". Not called from the normal write path.
+ */
+import type { GitUser } from '../services/git.js';
+import type { EntityData } from '../core/validation.js';
+/**
+ * Minimal surface the coordinator needs from YjsManager. Defined as an
+ * interface (rather than importing the concrete class) so unit tests can
+ * inject a fake without spinning up the real Y.Doc machinery.
+ */
+export interface BodyWriteYjsHooks {
+    assertWritable(docName: string): void;
+    withDocLock<T>(docName: string, fn: () => Promise<T>): Promise<T>;
+    applyAgentContent(docName: string, target: string): {
+        applied: 'no-doc' | 'unseeded' | 'ok';
+    };
+    recordDiskBody(docName: string, body: string): void;
+    reconcileFromDisk(docName: string): void;
+    /** Live body for a seeded Y.Doc, or null when no trustworthy live state
+     *  exists (no doc loaded / unseeded). Read side of the live-vs-disk gap.
+     *  Optional so coordinator-less / fake-hook test setups need not implement
+     *  it — `peekLiveBody` then reports null (disk is authoritative). */
+    peekLiveBody?(docName: string): string | null;
+    /** docNames of every currently-loaded Y.Doc. Optional so fake-hook test
+     *  setups need not implement it — `activeDocNames` then reports []. */
+    getActiveDocNames?(): string[];
+}
+/** Minimal SessionManager surface used by the coordinator. */
+export interface BodyWriteSessionHook {
+    markDirty(repo: string, user: GitUser, entityType: string, entityId: string, filePath: string): void;
+}
+/**
+ * Narrow commit surface, injected so the coordinator never reaches back
+ * through WorkspaceManager → getGraph → getGitService (which made a
+ * Graph → Coordinator → WorkspaceManager → Graph triangle). The composition
+ * root owns how a body write becomes a git commit.
+ *
+ * Contract: resolve when the commit lands (or is intentionally a no-op,
+ * e.g. a repo with no GitService). Throw to signal commit failure — the
+ * coordinator then registers the dirty file and surfaces
+ * {@link CommitFailedDirtyError}.
+ */
+export interface BodyWriteCommitHook {
+    commit(coords: EntityCoords, actor: GitUser, message: string): Promise<void>;
+}
+export interface EntityCoords {
+    repo: string;
+    entityType: string;
+    entityId: string;
+    /** Absolute path on disk where the markdown lives. */
+    entityPath: string;
+}
+export type BodyWriteSource = 'autosave' | 'server-write';
+export interface BodyWriteOptions {
+    /**
+     * Produce the frontmatter to persist, given the CURRENT on-disk
+     * frontmatter. Invoked INSIDE the per-doc lock so the merge happens
+     * against fresh disk state — a content-only autosave that waited on the
+     * lock won't clobber a metadata-only edit that committed during the wait.
+     */
+    prepareFrontmatter: (currentDiskFrontmatter: EntityData) => EntityData;
+    /** Optional precondition: SHA-256 hex of expected current body. */
+    baseHash?: string;
+    /** Required provenance — gates broadcast + assertWritable. */
+    source: BodyWriteSource;
+    /** Commit author. */
+    actor: GitUser;
+    /** Skip git commit (caller will commit later, e.g. import flow). */
+    skipCommit?: boolean;
+    /** Override commit message. */
+    commitMessage?: string;
+}
+export interface BodyWriteResult {
+    /**
+     * Post-commit broadcast disposition:
+     *  - 'ok'              applied to the live Y.Doc.
+     *  - 'no-doc'          no live editor open — disk write is the only effect.
+     *  - 'unseeded'        Y.Doc exists but hadn't synced; nothing to apply to.
+     *  - 'skipped'         autosave path — content originated in the live
+     *                      Y.Doc, so re-applying would race in-flight keystrokes.
+     *  - 'broadcast-failed' disk + git landed, but applyAgentContent threw.
+     *                      Clients were notified via a doc_conflict frame; the
+     *                      write itself succeeded. Distinct from 'ok' so
+     *                      observability can tell a clean apply from a recovered
+     *                      one rather than the failure hiding behind a success.
+     */
+    broadcast: 'ok' | 'no-doc' | 'unseeded' | 'skipped' | 'broadcast-failed';
+}
+export declare class BodyWriteCoordinator {
+    private commitHook;
+    private yjs;
+    private sessionManager?;
+    private markdownService;
+    constructor(commitHook: BodyWriteCommitHook, yjs: BodyWriteYjsHooks, sessionManager?: BodyWriteSessionHook | undefined);
+    /**
+     * Atomically write a body+frontmatter to disk, commit, and (for
+     * server-write) broadcast to live editors. The single body-write
+     * critical section shared by autosave + MCP + agent + event processor.
+     */
+    writeBody(coords: EntityCoords, body: string, opts: BodyWriteOptions): Promise<BodyWriteResult>;
+    /**
+     * Reconcile a live Y.Doc against the latest .md file on disk. EXPLICIT
+     * external-disk-change primitive — call this from startup boot, git-pull
+     * event handlers, and dev-tools "reload from disk" only. NOT called from
+     * the normal write path; server-side body writes route through
+     * {@link writeBody}, which broadcasts via `applyAgentContent` under the
+     * per-doc lock.
+     *
+     * Acquires the per-doc lock so a reconcile mid-write composes with the
+     * Phase 2 MSG_SYNC queue + write serialization.
+     */
+    reconcileFromDisk(coords: EntityCoords): Promise<void>;
+    /**
+     * Live body for an entity if a seeded editor doc is open, else null.
+     * Synchronous and lock-free — a point-in-time peek used by lossless reads
+     * (get_entity) and the asset-drop guard so they see the body the user is
+     * actually editing, not just the last-persisted disk state.
+     */
+    peekLiveBody(coords: {
+        repo: string;
+        entityType: string;
+        entityId: string;
+    }): string | null;
+    /**
+     * docNames of every Y.Doc the editor layer currently has loaded. Empty when
+     * no editor layer is wired (CLI/tests). Lets callers (e.g.
+     * `graph.pullAndReconcile`) cheaply decide whether any open editor needs a
+     * disk reconcile before doing per-file work.
+     */
+    activeDocNames(): string[];
+}

package/dist/server/body-write-coordinator.js

@@ -0,0 +1,182 @@
+/**
+ * Body-write coordinator — single critical section for entity markdown body writes.
+ *
+ * Owns the safe path that every server-side surface (autosave PUT, MCP
+ * update_entity, agent tools, event processor) shares. The contract:
+ *
+ *   1. assertWritable gate (server-write only — autosave is the client's
+ *      own write and must not be refused). Folded into lock acquisition so
+ *      a throwing gate releases the lock cleanly.
+ *   2. Per-doc lock — serializes server-side body writes for the same doc.
+ *      Inbound client MSG_SYNC frames queue while held (see
+ *      yjsManager.withDocLock + msgSyncQueue).
+ *   3. Base-hash precondition (autosave 412 path). Read inside the lock so
+ *      we see prior locked writes before deciding.
+ *   4. Atomic disk write via MarkdownService (tmp-write + fsync + rename).
+ *   5. mdRevisionHash bookkeeping (yjsManager.recordDiskBody) so the next
+ *      persistence flush captures the post-write state.
+ *   6. Git commit. On failure, register the dirty file with SessionManager
+ *      (if wired) and surface `CommitFailedDirtyError` to the caller.
+ *   7. Server-write only: post-commit `applyAgentContent` broadcast to the
+ *      live Y.Doc. Autosave skips this — its content originated in the
+ *      live Y.Doc; re-applying would race in-flight keystrokes.
+ *
+ * Scope boundary: body writes only. Structural ops (rename, delete,
+ * changeType, move, folder ops) keep their own paths on graph.ts using
+ * the existing transaction — they have a different concurrency profile
+ * (no per-doc lock, no base-hash precondition) and routing them through
+ * here would create a god-class.
+ *
+ * Also exposes `reconcileFromDisk` — the explicit external-disk-change
+ * primitive callable from startup boot, git-pull event handlers, and
+ * dev-tools "reload from disk". Not called from the normal write path.
+ */
+import { createHash } from 'node:crypto';
+import { MarkdownService } from '../services/markdown.js';
+import { CommitFailedDirtyError, StaleBaseRevisionError } from '../core/graph.js';
+function sha256OfBody(body) {
+    return createHash('sha256').update(body, 'utf-8').digest('hex');
+}
+export class BodyWriteCoordinator {
+    commitHook;
+    yjs;
+    sessionManager;
+    markdownService = new MarkdownService();
+    constructor(commitHook, yjs, sessionManager) {
+        this.commitHook = commitHook;
+        this.yjs = yjs;
+        this.sessionManager = sessionManager;
+    }
+    /**
+     * Atomically write a body+frontmatter to disk, commit, and (for
+     * server-write) broadcast to live editors. The single body-write
+     * critical section shared by autosave + MCP + agent + event processor.
+     */
+    async writeBody(coords, body, opts) {
+        const docName = `${coords.repo}/${coords.entityType}/${coords.entityId}`;
+        return this.yjs.withDocLock(docName, async () => {
+            // assertWritable for server-write (autosave is the client's own write
+            // and never refused). Inside the lock so a throwing gate releases via
+            // withDocLock's try/finally — without that, a future change could
+            // deadlock the write path.
+            if (opts.source === 'server-write') {
+                this.yjs.assertWritable(docName);
+            }
+            // Single parse inside the lock: yields the current body (for the
+            // base-hash precondition) AND the current frontmatter (to merge
+            // against). Both must reflect any prior locked write before we decide.
+            const current = this.markdownService.parseFile(coords.entityPath);
+            // Optimistic-concurrency check.
+            if (opts.baseHash !== undefined) {
+                const currentHash = sha256OfBody(current.content);
+                if (currentHash !== opts.baseHash) {
+                    throw new StaleBaseRevisionError(coords.entityType, coords.entityId, opts.baseHash, currentHash);
+                }
+            }
+            // Merge frontmatter against fresh on-disk state, inside the lock.
+            const frontmatter = opts.prepareFrontmatter(current.frontmatter);
+            this.markdownService.writeFile(coords.entityPath, {
+                frontmatter,
+                content: body,
+                wikilinks: this.markdownService.extractWikilinks(body, frontmatter),
+            });
+            // Pin the live entry.mdRevisionHash to disk state. No-op when no
+            // Y.Doc is loaded for this entity.
+            try {
+                this.yjs.recordDiskBody(docName, body);
+            }
+            catch (err) {
+                console.warn(`[coordinator] recordDiskBody failed for ${coords.entityType}/${coords.entityId}:`, err);
+            }
+            if (!opts.skipCommit) {
+                const message = opts.commitMessage ?? `Update ${coords.entityType}: ${coords.entityId}`;
+                try {
+                    await this.commitHook.commit(coords, opts.actor, message);
+                }
+                catch (err) {
+                    // Disk write already landed; commit failed. Register the
+                    // dirty file with sessionManager (if wired) so the existing
+                    // dirty-flush retry has a chance to recover. Then surface a
+                    // typed error so the caller knows the repo is dirty.
+                    try {
+                        this.sessionManager?.markDirty(coords.repo, opts.actor, coords.entityType, coords.entityId, coords.entityPath);
+                    }
+                    catch (registerErr) {
+                        console.warn(`[coordinator] markDirty failed for ${coords.entityType}/${coords.entityId}:`, registerErr);
+                    }
+                    throw new CommitFailedDirtyError(coords.entityType, coords.entityId, coords.entityPath, err);
+                }
+            }
+            // Server-write body updates apply to the live Y.Doc AFTER commit.
+            // Returns 'no-doc' / 'unseeded' when there's no live editor — the
+            // disk write is the only side effect, which is correct.
+            // Autosave does NOT re-apply: its content originated in the live
+            // Y.Doc and re-applying would race in-flight keystrokes typed
+            // during the PUT round-trip.
+            if (opts.source === 'server-write') {
+                // Only propagate to the live Y.Doc when the body actually CHANGED on
+                // disk (`current.content` is the pre-write disk body, read above inside
+                // this lock). A server-write whose body equals disk — e.g. an agent
+                // that meant to change only frontmatter but echoed back the unchanged
+                // body — must NOT applyAgentContent: `applyTextDiff(ytext, body)` would
+                // wipe a live editor's un-autosaved edits to a body this write never
+                // touched. (The retired LiveEditorPendingError gate refused the whole
+                // write here; this narrower guard preserves the no-op-body case while
+                // still merging real body changes.)
+                if (body === current.content) {
+                    return { broadcast: 'skipped' };
+                }
+                try {
+                    const { applied } = this.yjs.applyAgentContent(docName, body);
+                    return { broadcast: applied };
+                }
+                catch (err) {
+                    // applyAgentContent already sent a doc_conflict frame to live
+                    // clients. Log but do not rethrow — disk + git are
+                    // authoritative; surfacing the error to the caller would
+                    // suggest the write failed when in fact only the Y.Doc broadcast
+                    // did.
+                    console.warn(`[coordinator] applyAgentContent failed post-commit for ${coords.entityType}/${coords.entityId} — clients notified via doc_conflict`, err);
+                    return { broadcast: 'broadcast-failed' };
+                }
+            }
+            return { broadcast: 'skipped' };
+        });
+    }
+    /**
+     * Reconcile a live Y.Doc against the latest .md file on disk. EXPLICIT
+     * external-disk-change primitive — call this from startup boot, git-pull
+     * event handlers, and dev-tools "reload from disk" only. NOT called from
+     * the normal write path; server-side body writes route through
+     * {@link writeBody}, which broadcasts via `applyAgentContent` under the
+     * per-doc lock.
+     *
+     * Acquires the per-doc lock so a reconcile mid-write composes with the
+     * Phase 2 MSG_SYNC queue + write serialization.
+     */
+    async reconcileFromDisk(coords) {
+        const docName = `${coords.repo}/${coords.entityType}/${coords.entityId}`;
+        await this.yjs.withDocLock(docName, async () => {
+            this.yjs.reconcileFromDisk(docName);
+        });
+    }
+    /**
+     * Live body for an entity if a seeded editor doc is open, else null.
+     * Synchronous and lock-free — a point-in-time peek used by lossless reads
+     * (get_entity) and the asset-drop guard so they see the body the user is
+     * actually editing, not just the last-persisted disk state.
+     */
+    peekLiveBody(coords) {
+        return this.yjs.peekLiveBody?.(`${coords.repo}/${coords.entityType}/${coords.entityId}`) ?? null;
+    }
+    /**
+     * docNames of every Y.Doc the editor layer currently has loaded. Empty when
+     * no editor layer is wired (CLI/tests). Lets callers (e.g.
+     * `graph.pullAndReconcile`) cheaply decide whether any open editor needs a
+     * disk reconcile before doing per-file work.
+     */
+    activeDocNames() {
+        return this.yjs.getActiveDocNames?.() ?? [];
+    }
+}
+//# sourceMappingURL=body-write-coordinator.js.map

package/dist/server/body-write-coordinator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-write-coordinator.js","sourceRoot":"","sources":["../../src/server/body-write-coordinator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AA0FlF,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,OAAO,oBAAoB;IAIrB;IACA;IACA;IALF,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;IAEhD,YACU,UAA+B,EAC/B,GAAsB,EACtB,cAAqC;QAFrC,eAAU,GAAV,UAAU,CAAqB;QAC/B,QAAG,GAAH,GAAG,CAAmB;QACtB,mBAAc,GAAd,cAAc,CAAuB;IAC5C,CAAC;IAEJ;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,MAAoB,EAAE,IAAY,EAAE,IAAsB;QACxE,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAEzE,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,IAA8B,EAAE;YACxE,sEAAsE;YACtE,sEAAsE;YACtE,kEAAkE;YAClE,2BAA2B;YAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;gBACnC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YACnC,CAAC;YAED,iEAAiE;YACjE,gEAAgE;YAChE,uEAAuE;YACvE,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAElE,gCAAgC;YAChC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAClD,IAAI,WAAW,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAClC,MAAM,IAAI,sBAAsB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;gBACnG,CAAC;YACH,CAAC;YAED,kEAAkE;YAClE,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,WAAyB,CAAC,CAAC;YAE/E,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE;gBAChD,WAAW;gBACX,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,IAAI,EAAE,WAAW,CAAC;aACpE,CAAC,CAAC;YAEH,iEAAiE;YACjE,mCAAmC;YACnC,IAAI,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,2CAA2C,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,GAAG,EAAE,GAAG,CAAC,CAAC;YACxG,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBACrB,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,IAAI,UAAU,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACxF,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC5D,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,yDAAyD;oBACzD,4DAA4D;oBAC5D,4DAA4D;oBAC5D,qDAAqD;oBACrD,IAAI,CAAC;wBACH,IAAI,CAAC,cAAc,EAAE,SAAS,CAC5B,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAC/E,CAAC;oBACJ,CAAC;oBAAC,OAAO,WAAW,EAAE,CAAC;wBACrB,OAAO,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,GAAG,EAAE,WAAW,CAAC,CAAC;oBAC3G,CAAC;oBACD,MAAM,IAAI,sBAAsB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;gBAC/F,CAAC;YACH,CAAC;YAED,kEAAkE;YAClE,kEAAkE;YAClE,wDAAwD;YACxD,iEAAiE;YACjE,8DAA8D;YAC9D,6BAA6B;YAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;gBACnC,qEAAqE;gBACrE,wEAAwE;gBACxE,oEAAoE;gBACpE,sEAAsE;gBACtE,wEAAwE;gBACxE,qEAAqE;gBACrE,sEAAsE;gBACtE,sEAAsE;gBACtE,oCAAoC;gBACpC,IAAI,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;oBAC7B,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;gBAClC,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBAC9D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,8DAA8D;oBAC9D,mDAAmD;oBACnD,yDAAyD;oBACzD,iEAAiE;oBACjE,OAAO;oBACP,OAAO,CAAC,IAAI,CACV,0DAA0D,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,sCAAsC,EACpI,GAAG,CACJ,CAAC;oBACF,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;gBAC3C,CAAC;YACH,CAAC;YAED,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAAoB;QAC1C,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACzE,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YAC7C,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,YAAY,CAAC,MAA8D;QACzE,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,IAAI,CAAC;IACnG,CAAC;IAED;;;;;OAKG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,CAAC;IAC9C,CAAC;CACF"}

package/dist/server/cloud-billing-flow.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Cloud-inference billing flow helpers.
+ *
+ * Wrap a single hosted-inference run in the Studiograph Cloud
+ * reserve → settle/release lifecycle. Shared by every server route that
+ * drives the agent (chat + quick capture + the import pipeline that calls
+ * capture), so hosted inference is metered consistently — not just on chat.
+ *
+ * Semantics (unchanged from the original chat.ts implementation):
+ *  - reserve: on failure, throw only when billing is REQUIRED; otherwise log
+ *    and proceed unmetered (best-effort).
+ *  - settle: report actual usage; release the reservation when there was no
+ *    billable usage.
+ *  - release: return an unsettled reservation (error/abort path).
+ *
+ * When Cloud billing isn't configured (self-hosted / non-managed), the client
+ * is not configured: reserve() returns null and settle/release no-op, so local
+ * behavior is unchanged.
+ */
+import { createCloudInferenceBillingClient, type CloudInferenceReservation, type InferenceUsageSummary } from '../services/cloud-inference-billing.js';
+type CloudBillingClient = ReturnType<typeof createCloudInferenceBillingClient>;
+/** Minimal structural view of the orchestrator — avoids a circular import. */
+interface ModelSelector {
+    getModelSelection(): {
+        provider: string;
+        modelId: string;
+    };
+}
+export declare function reserveCloudInference(cloudBilling: CloudBillingClient, agent: ModelSelector, description: string): Promise<CloudInferenceReservation | null>;
+export declare function settleCloudInference(cloudBilling: CloudBillingClient, reservation: CloudInferenceReservation | null, usage: InferenceUsageSummary | undefined): Promise<void>;
+export declare function releaseCloudInference(cloudBilling: CloudBillingClient, reservation: CloudInferenceReservation | null, reason: string): Promise<void>;
+export {};

package/dist/server/cloud-billing-flow.js

@@ -0,0 +1,75 @@
+/**
+ * Cloud-inference billing flow helpers.
+ *
+ * Wrap a single hosted-inference run in the Studiograph Cloud
+ * reserve → settle/release lifecycle. Shared by every server route that
+ * drives the agent (chat + quick capture + the import pipeline that calls
+ * capture), so hosted inference is metered consistently — not just on chat.
+ *
+ * Semantics (unchanged from the original chat.ts implementation):
+ *  - reserve: on failure, throw only when billing is REQUIRED; otherwise log
+ *    and proceed unmetered (best-effort).
+ *  - settle: report actual usage; release the reservation when there was no
+ *    billable usage.
+ *  - release: return an unsettled reservation (error/abort path).
+ *
+ * When Cloud billing isn't configured (self-hosted / non-managed), the client
+ * is not configured: reserve() returns null and settle/release no-op, so local
+ * behavior is unchanged.
+ */
+import { createInferenceUsageSummary, inferenceUsageToBillableCents, } from '../services/cloud-inference-billing.js';
+import { log } from '../utils/log.js';
+export async function reserveCloudInference(cloudBilling, agent, description) {
+    try {
+        const model = agent.getModelSelection();
+        return await cloudBilling.reserve({
+            estimatedCents: cloudBilling.estimateCents(),
+            provider: model.provider,
+            model: model.modelId,
+            requestId: cloudBilling.nextRequestId('chat'),
+            description,
+        });
+    }
+    catch (err) {
+        if (cloudBilling.isRequired())
+            throw err;
+        log.warn(`[cloud-billing] reservation skipped: ${err instanceof Error ? err.message : String(err)}`);
+        return null;
+    }
+}
+export async function settleCloudInference(cloudBilling, reservation, usage) {
+    if (!reservation)
+        return;
+    const summary = usage ?? createInferenceUsageSummary();
+    const actualCents = inferenceUsageToBillableCents(summary);
+    try {
+        if (actualCents === null) {
+            await cloudBilling.release(reservation, 'No billable model usage was reported.');
+            return;
+        }
+        await cloudBilling.settle(reservation, {
+            actualCents,
+            inputTokens: summary.inputTokens,
+            outputTokens: summary.outputTokens,
+            description: 'Settled hosted Studiograph inference.',
+        });
+    }
+    catch (err) {
+        if (cloudBilling.isRequired())
+            throw err;
+        log.warn(`[cloud-billing] settlement skipped: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+export async function releaseCloudInference(cloudBilling, reservation, reason) {
+    if (!reservation)
+        return;
+    try {
+        await cloudBilling.release(reservation, reason);
+    }
+    catch (err) {
+        if (cloudBilling.isRequired())
+            throw err;
+        log.warn(`[cloud-billing] release skipped: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+//# sourceMappingURL=cloud-billing-flow.js.map

package/dist/server/cloud-billing-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-billing-flow.js","sourceRoot":"","sources":["../../src/server/cloud-billing-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAEL,2BAA2B,EAC3B,6BAA6B,GAG9B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAStC,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAAgC,EAChC,KAAoB,EACpB,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACxC,OAAO,MAAM,YAAY,CAAC,OAAO,CAAC;YAChC,cAAc,EAAE,YAAY,CAAC,aAAa,EAAE;YAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,KAAK,CAAC,OAAO;YACpB,SAAS,EAAE,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC;YAC7C,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,YAAY,CAAC,UAAU,EAAE;YAAE,MAAM,GAAG,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,wCAAwC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrG,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAgC,EAChC,WAA6C,EAC7C,KAAwC;IAExC,IAAI,CAAC,WAAW;QAAE,OAAO;IAEzB,MAAM,OAAO,GAAG,KAAK,IAAI,2BAA2B,EAAE,CAAC;IACvD,MAAM,WAAW,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAE3D,IAAI,CAAC;QACH,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,uCAAuC,CAAC,CAAC;YACjF,OAAO;QACT,CAAC;QAED,MAAM,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE;YACrC,WAAW;YACX,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,WAAW,EAAE,uCAAuC;SACrD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,YAAY,CAAC,UAAU,EAAE;YAAE,MAAM,GAAG,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,uCAAuC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAAgC,EAChC,WAA6C,EAC7C,MAAc;IAEd,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,YAAY,CAAC,UAAU,EAAE;YAAE,MAAM,GAAG,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC;AACH,CAAC"}

package/dist/server/commit-audit.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Commit audit log — append-only JSONL trail of every commit landed by
+ * the server, tagged by source so operators can answer "who committed
+ * this?" with one grep.
+ *
+ * Best-effort: a write failure logs and returns. The audit log is not
+ * load-bearing for correctness — it's diagnostic.
+ */
+import type { GitUser } from '../services/git.js';
+export type CommitSource = 'web-ui' | 'agent' | 'mcp' | 'cli' | 'recovery' | 'recovery-persisted' | 'session-flush' | 'graph-mutation';
+export interface CommitAuditRecord {
+    ts: string;
+    repo: string;
+    source: CommitSource;
+    user: string;
+    email: string;
+    message: string;
+    fileCount: number;
+}
+export declare function recordCommitAudit(workspacePath: string, entry: {
+    repo: string;
+    source: CommitSource;
+    user: GitUser;
+    message: string;
+    fileCount: number;
+}): void;

package/dist/server/commit-audit.js

@@ -0,0 +1,30 @@
+/**
+ * Commit audit log — append-only JSONL trail of every commit landed by
+ * the server, tagged by source so operators can answer "who committed
+ * this?" with one grep.
+ *
+ * Best-effort: a write failure logs and returns. The audit log is not
+ * load-bearing for correctness — it's diagnostic.
+ */
+import { appendFileSync, mkdirSync } from 'fs';
+import { join } from 'path';
+export function recordCommitAudit(workspacePath, entry) {
+    try {
+        mkdirSync(join(workspacePath, '.studiograph'), { recursive: true });
+        const auditPath = join(workspacePath, '.studiograph', 'commit-audit.jsonl');
+        const record = {
+            ts: new Date().toISOString(),
+            repo: entry.repo,
+            source: entry.source,
+            user: entry.user.name,
+            email: entry.user.email,
+            message: entry.message.slice(0, 200),
+            fileCount: entry.fileCount,
+        };
+        appendFileSync(auditPath, JSON.stringify(record) + '\n', 'utf-8');
+    }
+    catch (err) {
+        console.warn(`[commit-audit] failed to write audit record:`, err.message);
+    }
+}
+//# sourceMappingURL=commit-audit.js.map

package/dist/server/commit-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commit-audit.js","sourceRoot":"","sources":["../../src/server/commit-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAuB5B,MAAM,UAAU,iBAAiB,CAC/B,aAAqB,EACrB,KAAgG;IAEhG,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,oBAAoB,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAsB;YAChC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;YACrB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;YACvB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACpC,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;QACF,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,8CAA8C,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IACvF,CAAC;AACH,CAAC"}

package/dist/server/index.d.ts

@@ -4,20 +4,46 @@
  * Hosts:
  *   - Graph API (read-only REST over WorkspaceManager)
  *   - Agent chat via POST /api/chat and SSE GET /api/chat/stream
- *   - App plugins mounted via PluginLoader
+ *   - Static web UI (SvelteKit build) with SPA fallback
  */
 import { type FastifyInstance } from 'fastify';
 import { WorkspaceManager } from '../core/workspace-manager.js';
 import { GitUser } from '../services/git.js';
 import { WorkspaceConfig } from '../core/types.js';
+import { AuthService } from '../services/auth-service.js';
 export interface ServerConfig {
     workspaceManager: WorkspaceManager;
     workspacePath: string;
     workspaceConfig: WorkspaceConfig;
     gitUser: GitUser;
-    appsDir: string;
     port: number;
     host: string;
-    apiKeys: string[];
+    /**
+     * Phase 8: master key + version for AuthService's per-user encryption
+     * path (oauth_tokens.data_ciphertext, user_preferences.settings_ciphertext).
+     * Caller is `serve.ts`. Absent in tests that don't boot the full
+     * server (AuthService then stays on the legacy plaintext path).
+     */
+    authCryptoOptions?: {
+        masterKey: Uint8Array;
+        keyVersion?: string;
+    };
+    /**
+     * Random per-boot id (set by serve.ts). Echoed by GET /api/server-info and
+     * written to `.studiograph/server.json` so the stdio MCP proxy can confirm
+     * it is talking to the server that owns this workspace before sending it a
+     * Bearer token. Absent in tests / non-serve callers.
+     */
+    serverId?: string;
 }
+export declare function resolveStaticFilePath(webDir: string, urlPath: string): string | null;
+export declare function buildAllowedCorsOrigins(workspaceConfig: WorkspaceConfig, port: number): Set<string>;
+export declare function isCorsOriginAllowed(origin: string | undefined, allowedOrigins: Set<string>): boolean;
+/**
+ * Auth middleware — validates JWT cookie or Authorization: Bearer <key> header.
+ * When users exist in the auth database, all routes require authentication
+ * (except auth endpoints and static assets). When no users exist, everything
+ * is open (backward compatible).
+ */
+export declare function createAuthHook(authService: AuthService, workspaceConfig: Record<string, unknown>): (req: any, reply: any) => Promise<any>;
 export declare function createServer(config: ServerConfig): Promise<FastifyInstance>;