studiograph 1.3.48-next.21 → 1.3.48-next.210

package/dist/services/asset-listing.js

@@ -0,0 +1,321 @@
+/**
+ * Shared repo-asset listing.
+ *
+ * Builds the list of assets owned by entries in a single repo, merging the two
+ * storage schemes (legacy `{type}/{id}/{filename}` blobs surfaced by the
+ * backend's listAll, and immutable-keyed assets tracked only in the ownership
+ * index). Extracted from the asset-api route so the HTTP endpoints and the MCP
+ * `list_assets` tool return an identical shape — including a render-safe
+ * `embed` string callers can paste straight into an entry body.
+ */
+import { publicUrlFor, publicUrlForAssetId } from './assets/index.js';
+import { assetEmbed } from '../core/embeds.js';
+import { readFileSync } from 'fs';
+/** Owner kinds that mean "free-standing" — the asset is owned by a folder or
+ *  the workspace, not by an entity, so it has no owning markdown file and is
+ *  deleted/managed by its assetId rather than an entity coordinate. */
+export const FREE_STANDING_OWNER_TYPES = new Set(['folder', 'workspace']);
+export function isFreeStandingOwner(ownerType) {
+    return FREE_STANDING_OWNER_TYPES.has(ownerType);
+}
+/** Map an immutable-index row → RepoAsset, shared by the per-repo and
+ *  workspace-wide listings (both merge index rows the same way). `meta` is the
+ *  owning entity's resolved name/createdAt (null for free-standing rows, which
+ *  have no owning entity). Free-standing rows label by the asset's own name. */
+function indexRowToRepoAsset(row, meta) {
+    const freeStanding = isFreeStandingOwner(row.ownerType);
+    const url = publicUrlForAssetId(row.assetId, row.filename);
+    return {
+        filename: row.filename,
+        // Real byte size lives in the index (`size` column, recorded at upload);
+        // fall back to 0 for legacy rows written before the column existed.
+        size: row.size ?? 0,
+        contentType: row.contentType,
+        url,
+        embed: assetEmbed(row.filename, url),
+        assetId: row.assetId,
+        ownerType: row.ownerType,
+        entityType: row.ownerType,
+        entityId: row.ownerId,
+        // Free-standing: the asset's own name (or filename). Entity-owned: the
+        // owning entity's name, falling back to its id.
+        entityName: freeStanding ? (row.name ?? row.filename) : (meta.name ?? row.ownerId),
+        mediaType: row.mediaType,
+        // Prefer the entity's created_at for a meaningful "created" date; fall back
+        // to the index row's own timestamp when the entity has none.
+        createdAt: meta.createdAt ?? row.createdAt ?? null,
+    };
+}
+/**
+ * Read the owning entity's `name:` and `created_at:` from a markdown file's
+ * YAML frontmatter without a full YAML parse. Lets the asset list label assets
+ * by entity name and sort by creation date without a markdownService.parseFile()
+ * per entity. Either field may be null if absent.
+ */
+function matchScalar(block, field) {
+    const m = block.match(new RegExp(`^${field}:\\s*(?:'([^']*)'|"([^"]*)"|(.+?))\\s*$`, 'm'));
+    if (!m)
+        return null;
+    return (m[1] ?? m[2] ?? m[3]).trim() || null;
+}
+function extractEntityMeta(mdPath) {
+    try {
+        const raw = readFileSync(mdPath, 'utf-8');
+        // Frontmatter is always at the top; don't read past ~2KB.
+        const head = raw.slice(0, 2048);
+        if (!head.startsWith('---'))
+            return { name: null, createdAt: null };
+        const end = head.indexOf('\n---', 3);
+        const block = end === -1 ? head : head.slice(0, end);
+        return { name: matchScalar(block, 'name'), createdAt: matchScalar(block, 'created_at') };
+    }
+    catch {
+        return { name: null, createdAt: null };
+    }
+}
+/**
+ * Build the asset list for a single repo. Returns [] if the repo's graph can't
+ * be loaded (right for the bulk endpoint; single-repo callers should check
+ * repo existence themselves first if they want a 404).
+ *
+ * Algorithm (works for both local and R2 backends):
+ *   1. One listAllAssets() call — single filesystem walk or one paginated S3
+ *      ListObjectsV2 request. No HEAD round-trips, no markdown parsing.
+ *   2. Resolve each asset's entity markdown path via the graph's file index
+ *      (not a `{plural}/{id}.md` guess, which misses root/nested entries).
+ *   3. Merge in immutable-keyed assets from the ownership index — these live
+ *      under an `{assetId}/` prefix the backend's listAll can't see.
+ */
+export async function listRepoAssets(repo, workspaceManager) {
+    let graph;
+    try {
+        graph = workspaceManager.getGraph(repo);
+    }
+    catch {
+        return [];
+    }
+    let allAssets;
+    try {
+        allAssets = await graph.listAllAssets();
+    }
+    catch {
+        return [];
+    }
+    const metaCache = new Map();
+    const result = [];
+    for (const asset of allAssets) {
+        const mdPath = graph.getEntityFilePath(asset.entityType, asset.entityId);
+        if (!mdPath)
+            continue;
+        const key = `${asset.entityType}/${asset.entityId}`;
+        let meta = metaCache.get(key);
+        if (meta === undefined) {
+            meta = extractEntityMeta(mdPath);
+            metaCache.set(key, meta);
+        }
+        const url = publicUrlFor(asset, asset.entityType, asset.entityId);
+        result.push({
+            filename: asset.filename,
+            size: asset.size,
+            contentType: asset.contentType,
+            url,
+            embed: assetEmbed(asset.filename, url),
+            assetId: null,
+            ownerType: asset.entityType,
+            entityType: asset.entityType,
+            entityId: asset.entityId,
+            entityName: meta.name ?? asset.entityId,
+            mediaType: asset.mediaType,
+            createdAt: meta.createdAt,
+        });
+    }
+    // Immutable-keyed assets live in the ownership index, not under a
+    // {type}/{id} key prefix, so backend.listAll() can't see them. Merge them in
+    // from assets.db. (During the migration cutover — after migrate, before
+    // old-blob cleanup — an asset can appear via both paths; that transient
+    // duplicate clears when the legacy blobs are deleted.)
+    const index = workspaceManager.getAssetIndex?.();
+    if (index) {
+        for (const row of index.listByRepo(repo)) {
+            // Free-standing assets (owned by a folder/workspace, not an entity) have
+            // no owning markdown file: don't resolve one, and label them by the
+            // asset's own name rather than a non-existent owning entity.
+            const freeStanding = isFreeStandingOwner(row.ownerType);
+            const mdPath = freeStanding
+                ? null
+                : graph.getEntityFilePath(row.ownerType, row.ownerId);
+            const key = `${row.ownerType}/${row.ownerId}`;
+            let meta = metaCache.get(key);
+            if (meta === undefined) {
+                meta = mdPath ? extractEntityMeta(mdPath) : { name: null, createdAt: null };
+                metaCache.set(key, meta);
+            }
+            result.push(indexRowToRepoAsset(row, meta));
+        }
+    }
+    return result;
+}
+/**
+ * Process-lifetime cache of the one slow R2/bucket walk.
+ *
+ * Transitional bridge, NOT permanent infrastructure. The asset backend is
+ * workspace-global and `listAllAssets()` enumerates the WHOLE bucket via
+ * sequential paginated `ListObjectsV2` — on a large bucket that's several
+ * network round-trips (measured ~7-8s here), and it's the entire reason the
+ * asset-manager cold load was slow. The manager is now driven from the LOCAL
+ * ownership index (`assets.db`, ~14ms); this walk exists only to also surface
+ * un-migrated *legacy* blobs (`{type}/{id}/{filename}`) that predate the
+ * immutable-key scheme and so have no index row.
+ *
+ * New uploads are always immutable-keyed (they get an index row), so the set of
+ * legacy blobs can only SHRINK — it never grows. That makes a once-per-process
+ * cache correct: re-walking gains nothing. When the separate legacy-blob
+ * cleanup finishes, the walk returns no stragglers and this code path becomes
+ * an inert no-op that can be deleted outright. `clearLegacyBucketCache()` exists
+ * for tests and for an explicit refresh after a bulk cleanup.
+ */
+// Keyed by workspace path so a multi-workspace process never crosses snapshots.
+// Only SUCCESSFUL walks are cached — a transient backend/list failure must retry
+// on the next call, not hide every legacy asset until restart (codex P2).
+const legacyBucketCache = new Map();
+/** Drop the cached legacy-bucket walk(s) (tests; post-delete/cleanup refresh). */
+export function clearLegacyBucketCache() {
+    legacyBucketCache.clear();
+}
+async function getLegacyBucketSnapshot(workspaceKey, graph) {
+    const cached = legacyBucketCache.get(workspaceKey);
+    if (cached)
+        return cached;
+    let assets;
+    try {
+        assets = await graph.listAllAssets();
+    }
+    catch {
+        return [];
+    } // transient/no-backend — return empty WITHOUT caching so the next call retries
+    legacyBucketCache.set(workspaceKey, assets); // cache only on success (an empty bucket is a valid success)
+    return assets;
+}
+/**
+ * List assets across MANY repos for the workspace-wide manager — index-first.
+ *
+ * The fast path is the local ownership index (`assets.db`): one cheap scan per
+ * repo yields every immutable-keyed asset with no network I/O. On top of that we
+ * fold in any surviving *legacy* blobs via the cached bucket walk above (see
+ * `getLegacyBucketSnapshot`) so un-migrated assets still appear. Dedup prefers
+ * the immutable entry, so a legacy blob that has already been migrated collapses
+ * into its index row rather than double-listing.
+ *
+ * A legacy blob whose owning entity exists in K accessible repos surfaces under
+ * each of those K (entity ids can — rarely — collide across folders), matching
+ * the old per-repo behaviour.
+ */
+export async function listWorkspaceAssets(repos, workspaceManager) {
+    // Resolve each repo's graph once; skip repos whose graph can't be loaded
+    // (matches listRepoAssets' fail-soft posture for the bulk path).
+    const graphs = new Map();
+    for (const repo of repos) {
+        try {
+            graphs.set(repo, workspaceManager.getGraph(repo));
+        }
+        catch { /* unreadable repo — omit */ }
+    }
+    if (graphs.size === 0)
+        return [];
+    // Frontmatter (name + created_at) read at most once per (repo,type,id).
+    const metaCache = new Map();
+    const metaFor = (repo, graph, type, id) => {
+        const key = `${repo}/${type}/${id}`;
+        let meta = metaCache.get(key);
+        if (meta === undefined) {
+            const mdPath = graph.getEntityFilePath(type, id);
+            meta = mdPath ? extractEntityMeta(mdPath) : { name: null, createdAt: null };
+            metaCache.set(key, meta);
+        }
+        return meta;
+    };
+    // Dedup per repo, preferring the immutable-index entry.
+    const byKey = new Map();
+    const add = (repo, asset) => {
+        const key = `${repo}/${asset.entityType}/${asset.entityId}/${asset.filename}`;
+        const existing = byKey.get(key);
+        if (!existing || (existing.assetId == null && asset.assetId != null))
+            byKey.set(key, asset);
+    };
+    // ── Pass 1 (fast path): immutable-keyed assets from the local ownership
+    // index, per repo. No network I/O. Added first so dedup prefers them. ──
+    const index = workspaceManager.getAssetIndex?.();
+    if (index) {
+        for (const [repo, graph] of graphs) {
+            for (const row of index.listByRepo(repo)) {
+                // Free-standing assets (folder/workspace-owned) have no owning entity —
+                // skip entity-meta resolution; the shared mapper labels them by name.
+                const meta = isFreeStandingOwner(row.ownerType)
+                    ? { name: null, createdAt: null }
+                    : metaFor(repo, graph, row.ownerType, row.ownerId);
+                add(repo, { ...indexRowToRepoAsset(row, meta), repo });
+            }
+        }
+    }
+    // ── Pass 2 (transitional): surviving legacy {type}/{id}/{filename} blobs ──
+    // from the cached bucket snapshot. Already-migrated blobs collapse into the
+    // Pass-1 index entry; only un-migrated stragglers survive `add()`.
+    const anyGraph = graphs.values().next().value;
+    const bucket = await getLegacyBucketSnapshot(workspaceManager.getWorkspacePath(), anyGraph);
+    if (bucket.length > 0) {
+        // FAIL CLOSED on ambiguous legacy blobs (codex P1). A legacy key is
+        // {type}/{id}/{filename} with NO repo identity, so a blob whose (type/id)
+        // exists in more than one repo can't be safely attributed — surfacing it
+        // under an accessible repo would leak an inaccessible folder's blob when a
+        // slug collides (e.g. a private folder's `note/foo` vs an accessible
+        // `note/foo`). Build ownership across ALL repos (incl. inaccessible) and
+        // only surface a blob when EXACTLY ONE repo owns its (type/id) AND that
+        // repo is accessible. Immutable assets (Pass 1) are unaffected — they carry
+        // their owning repo in the index.
+        const accessibleSet = new Set(graphs.keys());
+        const allOwners = new Map();
+        for (const cfg of workspaceManager.getAllRepoConfigs()) {
+            let g;
+            try {
+                g = workspaceManager.getGraph(cfg.name);
+            }
+            catch {
+                continue;
+            }
+            for (const { entityType, id } of g.listEntityIds()) {
+                const k = `${entityType}/${id}`;
+                let set = allOwners.get(k);
+                if (!set)
+                    allOwners.set(k, (set = new Set()));
+                set.add(cfg.name);
+            }
+        }
+        for (const asset of bucket) {
+            const owners = allOwners.get(`${asset.entityType}/${asset.entityId}`);
+            if (!owners || owners.size !== 1)
+                continue; // unknown or ambiguous → fail closed
+            const repo = owners.values().next().value;
+            if (!accessibleSet.has(repo))
+                continue; // sole owner is an inaccessible folder
+            const meta = metaFor(repo, graphs.get(repo), asset.entityType, asset.entityId);
+            const url = publicUrlFor(asset, asset.entityType, asset.entityId);
+            add(repo, {
+                filename: asset.filename,
+                size: asset.size,
+                contentType: asset.contentType,
+                url,
+                embed: assetEmbed(asset.filename, url),
+                assetId: null,
+                ownerType: asset.entityType,
+                entityType: asset.entityType,
+                entityId: asset.entityId,
+                entityName: meta.name ?? asset.entityId,
+                mediaType: asset.mediaType,
+                createdAt: meta.createdAt,
+                repo,
+            });
+        }
+    }
+    return [...byKey.values()];
+}
+//# sourceMappingURL=asset-listing.js.map

package/dist/services/asset-listing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-listing.js","sourceRoot":"","sources":["../../src/services/asset-listing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAElC;;uEAEuE;AACvE,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAC1E,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,OAAO,yBAAyB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAClD,CAAC;AAED;;;gFAGgF;AAChF,SAAS,mBAAmB,CAC1B,GAAkB,EAClB,IAAuD;IAEvD,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3D,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,yEAAyE;QACzE,oEAAoE;QACpE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC;QACnB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,GAAG;QACH,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC;QACpC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,UAAU,EAAE,GAAG,CAAC,SAAS;QACzB,QAAQ,EAAE,GAAG,CAAC,OAAO;QACrB,uEAAuE;QACvE,gDAAgD;QAChD,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC;QAClF,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,4EAA4E;QAC5E,6DAA6D;QAC7D,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI;KACnD,CAAC;AACJ,CAAC;AAwBD;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAa,EAAE,KAAa;IAC/C,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,yCAAyC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AAC/C,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1C,0DAA0D;QAC1D,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAY,EACZ,gBAAkC;IAElC,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QAAC,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAChD,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;IAEpB,IAAI,SAAS,CAAC;IACd,IAAI,CAAC;QAAC,SAAS,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC;IAAC,CAAC;IAChD,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;IAEpB,MAAM,SAAS,GAAG,IAAI,GAAG,EAA6D,CAAC;IACvF,MAAM,MAAM,GAAgB,EAAE,CAAC;IAE/B,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,UAAwB,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvF,IAAI,CAAC,MAAM;YAAE,SAAS;QAEtB,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpD,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACjC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClE,MAAM,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,GAAG;YACH,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC;YACtC,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK,CAAC,UAAU;YAC3B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ;YACvC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,kEAAkE;IAClE,6EAA6E;IAC7E,wEAAwE;IACxE,wEAAwE;IACxE,uDAAuD;IACvD,MAAM,KAAK,GAAG,gBAAgB,CAAC,aAAa,EAAE,EAAE,CAAC;IACjD,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,yEAAyE;YACzE,oEAAoE;YACpE,6DAA6D;YAC7D,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,YAAY;gBACzB,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAuB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACtE,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAC9C,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;gBAC5E,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC3B,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAKD;;;;;;;;;;;;;;;;;;GAkBG;AACH,gFAAgF;AAChF,iFAAiF;AACjF,0EAA0E;AAC1E,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAyB,CAAC;AAE3D,kFAAkF;AAClF,MAAM,UAAU,sBAAsB;IACpC,iBAAiB,CAAC,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,YAAoB,EAAE,KAAuB;IAClF,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACnD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QAAC,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC;IAAC,CAAC;IAC7C,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC,CAAC,+EAA+E;IACpG,iBAAiB,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,6DAA6D;IAC1G,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAe,EACf,gBAAkC;IAElC,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IACnD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAAC,CAAC;QAC1D,MAAM,CAAC,CAAC,4BAA4B,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEjC,wEAAwE;IACxE,MAAM,SAAS,GAAG,IAAI,GAAG,EAA6D,CAAC;IACvF,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,KAAuB,EAAE,IAAY,EAAE,EAAU,EAAE,EAAE;QAClF,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,CAAC,IAAkB,EAAE,EAAE,CAAC,CAAC;YAC/D,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC5E,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,wDAAwD;IACxD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAChD,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,KAAqB,EAAE,EAAE;QAClD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC9E,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,IAAI,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9F,CAAC,CAAC;IAEF,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,KAAK,GAAG,gBAAgB,CAAC,aAAa,EAAE,EAAE,CAAC;IACjD,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;YACnC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,wEAAwE;gBACxE,sEAAsE;gBACtE,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC;oBAC7C,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;oBACjC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBACrD,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAyB,CAAC;IAClE,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC5F,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,oEAAoE;QACpE,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,qEAAqE;QACrE,yEAAyE;QACzE,wEAAwE;QACxE,4EAA4E;QAC5E,kCAAkC;QAClC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;QACjD,KAAK,MAAM,GAAG,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,EAAE,CAAC;YACvD,IAAI,CAAmB,CAAC;YACxB,IAAI,CAAC;gBAAC,CAAC,GAAG,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,SAAS;YAAC,CAAC;YACpE,KAAK,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC;gBACnD,MAAM,CAAC,GAAG,GAAG,UAAU,IAAI,EAAE,EAAE,CAAC;gBAChC,IAAI,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC3B,IAAI,CAAC,GAAG;oBAAE,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC9C,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACtE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,SAAS,CAAC,qCAAqC;YACjF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC;YACpD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS,CAAC,uCAAuC;YAC/E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAE,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAChF,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAClE,GAAG,CAAC,IAAI,EAAE;gBACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,GAAG;gBACH,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC;gBACtC,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,KAAK,CAAC,UAAU;gBAC3B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ;gBACvC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,IAAI;aACL,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7B,CAAC"}

package/dist/services/asset-presign-service.d.ts

@@ -0,0 +1,68 @@
+/**
+ * MCP pre-signed asset upload — STEP 1 of 3.
+ *
+ * Validates the request, resolves the target folder, signs a PUT URL the
+ * agent uploads to directly, and mints an HMAC token the agent later passes
+ * back to `finalizeAssetUpload`. Bytes never traverse the model context.
+ *
+ * Authz: `canWriteRepo` on the resolved repo. For the default-home case
+ * (`input.repo` omitted) this lands on the workspace_wide Assets store,
+ * which grants write to any authed user. Finalize re-checks `canWriteRepo`
+ * because a 15-min token outlives a folder-access revoke.
+ *
+ * Mime + filename are pinned at presign:
+ *   - mime: only registry presign-safe raw assets pass (raster images and
+ *     font files — `presignMimeAllowlist()`). SVG is excluded because it carries
+ *     `sanitize: 'svg'` and the app never holds the bytes on this path, so it
+ *     can't sanitize (V2 — SVG goes through the inline-bytes tool). The chosen
+ *     mime is pinned into the PUT signature so the agent must send a matching
+ *     Content-Type header or R2 rejects with SignatureDoesNotMatch — the
+ *     wire-level guarantee behind "no SVG polyglots."
+ *   - filename: validateFilename() (path-traversal / hidden / forbidden /
+ *     length cap) → safeFilename() (key-segment safety). Both shared with
+ *     the in-process upload path via services/assets/base.ts.
+ *
+ * See ~/.claude/plans/mcp-presigned-asset-upload.md.
+ */
+import type { WorkspaceManager } from '../core/workspace-manager.js';
+import type { AuthService, AuthUser } from './auth-service.js';
+/**
+ * MIME types accepted by the presign path. Historically `'image/png' |
+ * 'image/jpeg'`; now whatever the format registry declares presign-safe
+ * (`presignMimeAllowlist()`). Kept as `string` at the type level because the
+ * authoritative gate is the runtime allowlist check below — the registry is the
+ * single source of truth, not a hand-maintained union that would drift from it.
+ */
+export type AssetPresignMime = string;
+export interface PresignAssetInput {
+    workspaceManager: WorkspaceManager;
+    authService: AuthService;
+    user: AuthUser;
+    /** Target repo. Omit → default to the workspace_wide Assets store
+     *  (resolved lazily, created on first use). */
+    repo?: string;
+    /** Owning entity. Omit → asset is self-owned: ownerType='asset',
+     *  ownerId=assetId. */
+    entity?: {
+        type: string;
+        id: string;
+    };
+    filename: string;
+    mimeType: AssetPresignMime;
+}
+export interface PresignAssetOutput {
+    assetId: string;
+    /** Pre-signed PUT URL. Bytes go directly here; the app server never sees
+     *  them. Expires in 15 min. */
+    uploadUrl: string;
+    /** Headers the agent must set verbatim on the PUT (notably Content-Type
+     *  which is pinned into the signature). */
+    headers: Record<string, string>;
+    /** HMAC token the agent passes to finalize_asset_upload. */
+    token: string;
+    /** ISO timestamp the upload URL + token expire at. */
+    expiresAt: string;
+    /** Resolved target repo (useful for the MCP tool description / debugging). */
+    repo: string;
+}
+export declare function presignAssetUpload(input: PresignAssetInput): Promise<PresignAssetOutput>;

package/dist/services/asset-presign-service.js

@@ -0,0 +1,124 @@
+/**
+ * MCP pre-signed asset upload — STEP 1 of 3.
+ *
+ * Validates the request, resolves the target folder, signs a PUT URL the
+ * agent uploads to directly, and mints an HMAC token the agent later passes
+ * back to `finalizeAssetUpload`. Bytes never traverse the model context.
+ *
+ * Authz: `canWriteRepo` on the resolved repo. For the default-home case
+ * (`input.repo` omitted) this lands on the workspace_wide Assets store,
+ * which grants write to any authed user. Finalize re-checks `canWriteRepo`
+ * because a 15-min token outlives a folder-access revoke.
+ *
+ * Mime + filename are pinned at presign:
+ *   - mime: only registry presign-safe raw assets pass (raster images and
+ *     font files — `presignMimeAllowlist()`). SVG is excluded because it carries
+ *     `sanitize: 'svg'` and the app never holds the bytes on this path, so it
+ *     can't sanitize (V2 — SVG goes through the inline-bytes tool). The chosen
+ *     mime is pinned into the PUT signature so the agent must send a matching
+ *     Content-Type header or R2 rejects with SignatureDoesNotMatch — the
+ *     wire-level guarantee behind "no SVG polyglots."
+ *   - filename: validateFilename() (path-traversal / hidden / forbidden /
+ *     length cap) → safeFilename() (key-segment safety). Both shared with
+ *     the in-process upload path via services/assets/base.ts.
+ *
+ * See ~/.claude/plans/mcp-presigned-asset-upload.md.
+ */
+import { randomUUID } from 'node:crypto';
+import { Workspace } from '../core/workspace.js';
+import { canWriteRepo } from './access-control.js';
+import { resolveWorkspaceAssetsRepo } from './workspace-assets-folder.js';
+import { validateFilename, safeFilename } from './assets/base.js';
+import { presignMimeAllowlist, resolveFormat } from '../core/format-registry.js';
+import { signAssetUploadToken } from './asset-upload-token.js';
+import { ForbiddenError, InvalidFilenameError, InvalidMimeTypeError, LocalBackendNotSupportedError, } from './asset-upload-errors.js';
+import { log } from '../utils/log.js';
+/** Registry-derived presign MIME allowlist (P4-V1). Computed once at module
+ *  load from `presignMimeAllowlist()` — the format registry is the single
+ *  source of truth, so this can't drift from the multipart/inline gates. SVG is
+ *  excluded by construction (it carries `sanitize: 'svg'`, so `isPresignSafe`
+ *  rejects it — V2). */
+const ALLOWED_MIME = new Set(presignMimeAllowlist());
+const URL_TTL_SECONDS = 15 * 60;
+export async function presignAssetUpload(input) {
+    // 1. Mime gate (registry-derived — see ALLOWED_MIME)
+    if (!ALLOWED_MIME.has(input.mimeType)) {
+        throw new InvalidMimeTypeError(`Unsupported mime type "${input.mimeType}". The presign flow accepts: ${[...ALLOWED_MIME].sort().join(', ')}. ` +
+            `Other formats (incl. SVG and documents) must use the inline-bytes upload tool, which sanitizes server-side.`);
+    }
+    // 2. Filename gate (shared validator → typed error). Runs before the
+    //    mime/filename coupling so a malformed/empty filename fails as
+    //    InvalidFilenameError, not a confusing mime mismatch.
+    try {
+        validateFilename(input.filename);
+    }
+    catch (err) {
+        throw new InvalidFilenameError(err instanceof Error ? err.message : 'Invalid filename');
+    }
+    // 2b. Mime/filename coupling. The mime is pinned into the PUT signature AND
+    //     the asset entity derives asset_kind/asset_mime from the FILENAME at
+    //     finalize. If the two disagree (e.g. mime=image/heic, filename=a.png),
+    //     the stored entity would claim image/png while the bytes are heic, and
+    //     the caption path would ship the wrong mime. Require the declared mime
+    //     to be one the filename's registry format actually carries.
+    if (!resolveFormat(input.filename).mimeTypes.includes(input.mimeType)) {
+        throw new InvalidMimeTypeError(`Mime type "${input.mimeType}" does not match the extension of "${input.filename}". ` +
+            `Pass a filename whose extension matches the content type.`);
+    }
+    // 3. Resolve target repo. resolveWorkspaceAssetsRepo (not the lower-level
+    //    ensureWorkspaceAssetsFolder) so workspaceManager.reloadConfig() runs
+    //    after first-write provisioning — otherwise wm.getGraph(repo) would
+    //    miss the freshly-created folder later.
+    const workspace = new Workspace(input.workspaceManager.getWorkspacePath());
+    const repo = input.repo
+        ?? (await resolveWorkspaceAssetsRepo(workspace, input.workspaceManager));
+    // 4. Authz on the resolved repo
+    if (!canWriteRepo(input.user, repo, input.workspaceManager, input.authService)) {
+        throw new ForbiddenError(`No write access to folder "${repo}"`);
+    }
+    // 5. Backend must support the full presign lifecycle (PUT + HEAD + copy)
+    let graph;
+    try {
+        graph = input.workspaceManager.getGraph(repo);
+    }
+    catch {
+        throw new ForbiddenError(`Folder "${repo}" not found`);
+    }
+    const assetService = graph.getAssetService();
+    if (!assetService || !assetService.supportsPresignedUploads()) {
+        throw new LocalBackendNotSupportedError('Pre-signed uploads require an R2-backed asset store. This workspace is using local filesystem storage; upload via the multipart endpoint (POST /api/repos/:repo/assets) instead.');
+    }
+    // 6. Mint identifiers
+    const assetId = randomUUID();
+    const filename = safeFilename(input.filename);
+    // 7. Sign PUT URL — ContentType is pinned in the signature
+    const { uploadUrl, headers } = await assetService.signPendingPutUrl(assetId, filename, input.mimeType, URL_TTL_SECONDS);
+    // 8. Owner shape
+    const ownerType = input.entity?.type ?? 'asset';
+    const ownerId = input.entity?.id ?? assetId;
+    // 9. Sign token (15-min TTL matches the URL — see asset-upload-token.ts)
+    const token = signAssetUploadToken({
+        assetId,
+        repo,
+        ownerType,
+        ownerId,
+        uploaderUserId: String(input.user.id),
+        mime: input.mimeType,
+        filename,
+    }, input.authService.getJwtSecret());
+    // 10. Audit log (R3) — single line, key=value-ish so a grep can reconstruct
+    //     the flow.
+    log.info('[asset-presign]', {
+        event: 'asset-presign',
+        userId: String(input.user.id),
+        repo,
+        ownerType,
+        ownerId,
+        assetId,
+        mime: input.mimeType,
+        filename,
+    });
+    const expiresAt = new Date(Date.now() + URL_TTL_SECONDS * 1000).toISOString();
+    return { assetId, uploadUrl, headers, token, expiresAt, repo };
+}
+//# sourceMappingURL=asset-presign-service.js.map

package/dist/services/asset-presign-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-presign-service.js","sourceRoot":"","sources":["../../src/services/asset-presign-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAyCtC;;;;wBAIwB;AACxB,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS,oBAAoB,EAAE,CAAC,CAAC;AAC7D,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,CAAC;AAEhC,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAwB;IAExB,qDAAqD;IACrD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,KAAK,CAAC,QAAQ,gCAAgC,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC/G,6GAA6G,CAC9G,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,mEAAmE;IACnE,0DAA0D;IAC1D,IAAI,CAAC;QACH,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,oBAAoB,CAC5B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CACxD,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,iEAAiE;IACjE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,oBAAoB,CAC5B,cAAc,KAAK,CAAC,QAAQ,sCAAsC,KAAK,CAAC,QAAQ,KAAK;YACrF,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,4CAA4C;IAC5C,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI;WAClB,CAAC,MAAM,0BAA0B,CAAC,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAE3E,gCAAgC;IAChC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,cAAc,CAAC,8BAA8B,IAAI,GAAG,CAAC,CAAC;IAClE,CAAC;IAED,yEAAyE;IACzE,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,cAAc,CAAC,WAAW,IAAI,aAAa,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,eAAe,EAAE,CAAC;IAC7C,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,CAAC,wBAAwB,EAAE,EAAE,CAAC;QAC9D,MAAM,IAAI,6BAA6B,CACrC,kLAAkL,CACnL,CAAC;IACJ,CAAC;IAED,sBAAsB;IACtB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAE9C,2DAA2D;IAC3D,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,iBAAiB,CACjE,OAAO,EACP,QAAQ,EACR,KAAK,CAAC,QAAQ,EACd,eAAe,CAChB,CAAC;IAEF,iBAAiB;IACjB,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,IAAI,OAAO,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,OAAO,CAAC;IAE5C,yEAAyE;IACzE,MAAM,KAAK,GAAG,oBAAoB,CAChC;QACE,OAAO;QACP,IAAI;QACJ,SAAS;QACT,OAAO;QACP,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,EAAE,KAAK,CAAC,QAAQ;QACpB,QAAQ;KACT,EACD,KAAK,CAAC,WAAW,CAAC,YAAY,EAAE,CACjC,CAAC;IAEF,4EAA4E;IAC5E,gBAAgB;IAChB,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE;QAC1B,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,IAAI;QACJ,SAAS;QACT,OAAO;QACP,OAAO;QACP,IAAI,EAAE,KAAK,CAAC,QAAQ;QACpB,QAAQ;KACT,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACjE,CAAC"}

package/dist/services/asset-sidecar-service.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Asset document text extraction.
+ *
+ * A pure helper that turns a document asset's bytes into searchable text. Under
+ * asset-as-embed the extracted text is seeded straight into the imported
+ * entry's BODY (in-memory), so there is no on-disk sidecar to persist — the
+ * import path (`asset-import-service.ts`) is the only caller. (Image captions
+ * are a separate async pass — `asset-index-sweep.ts` — and land in
+ * `assets.db.caption`, not here.)
+ *
+ * The `writeAssetSidecar` persistence helper + the `.studiograph/assets-text/`
+ * tree were removed with the entity-keyed caption pipeline; the `Sidecar` in
+ * the name is historical.
+ */
+import { type FormatExtractor } from '../core/format-registry.js';
+/**
+ * Extract searchable text from a document asset for its index sidecar (P3 —
+ * generalized from PDF-only). Driven by the format registry's `extractor`:
+ * pdf → pdf-parse (also yields page count), docx → mammoth raw text, xlsx →
+ * every non-empty sheet as CSV. `image-caption` and `null` produce no sidecar
+ * here — image captioning is the async P3b pass, opaque assets stay
+ * filename-only. Best-effort: extraction errors return empty text (the asset
+ * is still stored + indexed by frontmatter).
+ */
+export declare function extractSidecarText(buffer: Buffer, extractor: FormatExtractor, entityId: string): Promise<{
+    text: string;
+    pages?: number;
+}>;

package/dist/services/asset-sidecar-service.js

@@ -0,0 +1,79 @@
+/**
+ * Asset document text extraction.
+ *
+ * A pure helper that turns a document asset's bytes into searchable text. Under
+ * asset-as-embed the extracted text is seeded straight into the imported
+ * entry's BODY (in-memory), so there is no on-disk sidecar to persist — the
+ * import path (`asset-import-service.ts`) is the only caller. (Image captions
+ * are a separate async pass — `asset-index-sweep.ts` — and land in
+ * `assets.db.caption`, not here.)
+ *
+ * The `writeAssetSidecar` persistence helper + the `.studiograph/assets-text/`
+ * tree were removed with the entity-keyed caption pipeline; the `Sidecar` in
+ * the name is historical.
+ */
+import { log } from '../utils/log.js';
+/** Bytes above which we skip request-thread text extraction. The parsers
+ *  (pdf-parse / mammoth / SheetJS) are CPU-bound and synchronous; a huge file
+ *  would stall the event loop for every other in-flight request. The asset
+ *  still uploads — it just isn't sidecar-searchable until a later re-extract. */
+const SIDECAR_EXTRACT_BYTES_CAP = 25 * 1024 * 1024;
+/**
+ * Extract searchable text from a document asset for its index sidecar (P3 —
+ * generalized from PDF-only). Driven by the format registry's `extractor`:
+ * pdf → pdf-parse (also yields page count), docx → mammoth raw text, xlsx →
+ * every non-empty sheet as CSV. `image-caption` and `null` produce no sidecar
+ * here — image captioning is the async P3b pass, opaque assets stay
+ * filename-only. Best-effort: extraction errors return empty text (the asset
+ * is still stored + indexed by frontmatter).
+ */
+export async function extractSidecarText(buffer, extractor, entityId) {
+    if (!extractor || extractor === 'image-caption')
+        return { text: '' };
+    if (buffer.length > SIDECAR_EXTRACT_BYTES_CAP) {
+        log.warn(`[asset-upload] sidecar extraction skipped for ${entityId}: ${buffer.length} bytes > ${SIDECAR_EXTRACT_BYTES_CAP} cap`);
+        return { text: '' };
+    }
+    try {
+        if (extractor === 'pdf') {
+            const { PDFParse } = await import('pdf-parse');
+            const parser = new PDFParse({ data: buffer });
+            try {
+                // pageJoiner: '' suppresses pdf-parse's default `-- N of M --` page
+                // markers, which otherwise litter both the search sidecar AND the
+                // seeded document body (asset-import-service reuses this text).
+                const result = await parser.getText({ pageJoiner: '' });
+                return { text: result.text?.trim() ?? '', pages: result.total && result.total > 0 ? result.total : undefined };
+            }
+            finally {
+                // Always release the parser — on an encrypted/malformed PDF getText()
+                // throws, and without finally the handle/buffers would leak.
+                await parser.destroy();
+            }
+        }
+        if (extractor === 'docx') {
+            const mammoth = await import('mammoth');
+            const result = await mammoth.extractRawText({ buffer });
+            return { text: result.value?.trim() ?? '' };
+        }
+        if (extractor === 'xlsx') {
+            const XLSX = await import('xlsx');
+            const wb = XLSX.read(buffer, { type: 'buffer' });
+            const parts = [];
+            for (const name of wb.SheetNames) {
+                const sheet = wb.Sheets[name];
+                if (!sheet || !sheet['!ref'])
+                    continue;
+                const csv = XLSX.utils.sheet_to_csv(sheet, { blankrows: false }).trim();
+                if (csv)
+                    parts.push(`# ${name}\n${csv}`);
+            }
+            return { text: parts.join('\n\n').trim() };
+        }
+    }
+    catch (err) {
+        log.warn(`[asset-extract] text extraction failed for ${entityId} (${extractor}): ${err instanceof Error ? err.message : err}`);
+    }
+    return { text: '' };
+}
+//# sourceMappingURL=asset-sidecar-service.js.map

package/dist/services/asset-sidecar-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-sidecar-service.js","sourceRoot":"","sources":["../../src/services/asset-sidecar-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAGtC;;;iFAGiF;AACjF,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,SAA0B,EAC1B,QAAgB;IAEhB,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,eAAe;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACrE,IAAI,MAAM,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,iDAAiD,QAAQ,KAAK,MAAM,CAAC,MAAM,YAAY,yBAAyB,MAAM,CAAC,CAAC;QACjI,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACtB,CAAC;IACD,IAAI,CAAC;QACH,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACxB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9C,IAAI,CAAC;gBACH,oEAAoE;gBACpE,kEAAkE;gBAClE,gEAAgE;gBAChE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;gBACxD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YACjH,CAAC;oBAAS,CAAC;gBACT,sEAAsE;gBACtE,6DAA6D;gBAC7D,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,CAAC;QACH,CAAC;QACD,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YACxD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9C,CAAC;QACD,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YACjD,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC9B,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACvC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACxE,IAAI,GAAG;oBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,8CAA8C,QAAQ,KAAK,SAAS,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACjI,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AACtB,CAAC"}