studiograph 1.3.48-next.21 → 1.3.48-next.211

package/dist/cli/commands/about.d.ts

@@ -10,4 +10,5 @@
  *   studiograph about --set <file> # set from a file
  */
 import { Command } from 'commander';
+export declare function parseEditorCommand(editor: string): string[];
 export declare const aboutCommand: Command;

package/dist/cli/commands/about.js

@@ -12,11 +12,54 @@
 import { Command } from 'commander';
 import { existsSync, readFileSync } from 'fs';
 import { join } from 'path';
-import { execSync } from 'child_process';
+import { spawnSync } from 'child_process';
 import { text, log, outro, isCancel } from '@clack/prompts';
 import { Workspace } from '../../core/workspace.js';
 const SECTIONS = ['Vision', 'Mission', 'Profile', 'Capabilities', 'Values'];
 const TEMPLATE = SECTIONS.map(s => `## ${s}\n`).join('\n');
+export function parseEditorCommand(editor) {
+    const args = [];
+    let current = '';
+    let quote = null;
+    let escaping = false;
+    for (const ch of editor.trim()) {
+        if (escaping) {
+            current += ch;
+            escaping = false;
+            continue;
+        }
+        if (ch === '\\') {
+            escaping = true;
+            continue;
+        }
+        if (quote) {
+            if (ch === quote)
+                quote = null;
+            else
+                current += ch;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            continue;
+        }
+        if (/\s/.test(ch)) {
+            if (current) {
+                args.push(current);
+                current = '';
+            }
+            continue;
+        }
+        current += ch;
+    }
+    if (escaping)
+        current += '\\';
+    if (quote)
+        throw new Error('Unclosed quote in editor command');
+    if (current)
+        args.push(current);
+    return args;
+}
 export const aboutCommand = new Command('about')
     .description('Display or edit workspace ABOUT.md')
     .option('-e, --edit', 'Open ABOUT.md in $EDITOR')
@@ -78,10 +121,19 @@ export const aboutCommand = new Command('about')
         }
         const editor = process.env.EDITOR || process.env.VISUAL || 'vi';
         try {
-            execSync(`${editor} "${aboutPath}"`, { stdio: 'inherit' });
+            const [cmd, ...editorArgs] = parseEditorCommand(editor);
+            if (!cmd)
+                throw new Error('Editor command is empty');
+            const result = spawnSync(cmd, [...editorArgs, aboutPath], { stdio: 'inherit', shell: false });
+            if (result.error)
+                throw result.error;
+            if (result.status !== 0)
+                throw new Error(`Editor exited with status ${result.status ?? 'unknown'}`);
         }
-        catch {
+        catch (err) {
             console.error(`Failed to open editor: ${editor}`);
+            if (err?.message)
+                console.error(err.message);
             process.exit(1);
         }
         return;

package/dist/cli/commands/about.js.map

@@ -1 +1 @@
-{"version":3,"file":"about.js","sourceRoot":"","sources":["../../../src/cli/commands/about.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,CAAU,CAAC;AAErF,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;KAC7C,WAAW,CAAC,oCAAoC,CAAC;KACjD,MAAM,CAAC,YAAY,EAAE,0BAA0B,CAAC;KAChD,MAAM,CAAC,mBAAmB,EAAE,yCAAyC,CAAC;KACtE,MAAM,CAAC,kBAAkB,EAAE,0BAA0B,CAAC;KACtD,MAAM,CAAC,KAAK,EAAE,IAA6D,EAAE,EAAE;IAC9E,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;IAClC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;IAEjF,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChD,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;QAC7C,MAAM,cAAc,GAA2B,EAAE,CAAC;QAClD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,OAAO,iCAAiC,CAAC,CAAC;YACzE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,cAAc,CAAC,OAAO,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACrD,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;QAErE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC;gBACvB,OAAO,EAAE,OAAO;gBAChB,WAAW,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,iBAAiB,OAAO,CAAC,WAAW,EAAE,KAAK;gBACnF,YAAY,EAAE,cAAc,CAAC,OAAO,CAAC;aACtC,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpB,KAAK,CAAC,WAAW,CAAC,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,cAAc,CAAC,OAAO,CAAC,GAAI,KAAgB,CAAC,IAAI,EAAE,CAAC;QACrD,CAAC;QAED,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,CAAC;YAC9B,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAED,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACvC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC;QAChE,IAAI,CAAC;YACH,QAAQ,CAAC,GAAG,MAAM,KAAK,SAAS,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IAED,mBAAmB;IACnB,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;QAChF,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"about.js","sourceRoot":"","sources":["../../../src/cli/commands/about.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,CAAU,CAAC;AAErF,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAE3D,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,KAAK,GAAqB,IAAI,CAAC;IACnC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/B,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,IAAI,EAAE,CAAC;YACd,QAAQ,GAAG,KAAK,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,QAAQ,GAAG,IAAI,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,EAAE,KAAK,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC;;gBAC1B,OAAO,IAAI,EAAE,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,KAAK,GAAG,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAClB,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACnB,OAAO,GAAG,EAAE,CAAC;YACf,CAAC;YACD,SAAS;QACX,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,IAAI,QAAQ;QAAE,OAAO,IAAI,IAAI,CAAC;IAC9B,IAAI,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC/D,IAAI,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;KAC7C,WAAW,CAAC,oCAAoC,CAAC;KACjD,MAAM,CAAC,YAAY,EAAE,0BAA0B,CAAC;KAChD,MAAM,CAAC,mBAAmB,EAAE,yCAAyC,CAAC;KACtE,MAAM,CAAC,kBAAkB,EAAE,0BAA0B,CAAC;KACtD,MAAM,CAAC,KAAK,EAAE,IAA6D,EAAE,EAAE;IAC9E,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;IAClC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;IAEjF,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChD,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;QAC7C,MAAM,cAAc,GAA2B,EAAE,CAAC;QAClD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,OAAO,iCAAiC,CAAC,CAAC;YACzE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,cAAc,CAAC,OAAO,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACrD,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;QAErE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC;gBACvB,OAAO,EAAE,OAAO;gBAChB,WAAW,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,iBAAiB,OAAO,CAAC,WAAW,EAAE,KAAK;gBACnF,YAAY,EAAE,cAAc,CAAC,OAAO,CAAC;aACtC,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpB,KAAK,CAAC,WAAW,CAAC,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,cAAc,CAAC,OAAO,CAAC,GAAI,KAAgB,CAAC,IAAI,EAAE,CAAC;QACrD,CAAC;QAED,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,CAAC;YAC9B,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAED,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACvC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;YACxD,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,UAAU,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9F,IAAI,MAAM,CAAC,KAAK;gBAAE,MAAM,MAAM,CAAC,KAAK,CAAC;YACrC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QACtG,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAC;YAClD,IAAI,GAAG,EAAE,OAAO;gBAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IAED,mBAAmB;IACnB,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;QAChF,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/cli/commands/admin/audit-workspace.d.ts

@@ -0,0 +1,23 @@
+/**
+ * studiograph admin audit-workspace — read-only health aggregator.
+ *
+ * Wraps `analyzeGraphHealth()` from src/services/graph-maintenance.ts —
+ * the same service that powers the dashboard's health digest — and
+ * emits a markdown report. The point isn't to surface anything new; it's
+ * to give the owner a single command for the periodic sweep, instead of
+ * running `studiograph lint`, `studiograph orphans`, and chasing broken
+ * wikilinks by hand.
+ *
+ * Output is stdout by default (so it can be piped to `pbcopy`, `glow`,
+ * or `tee somewhere.md`). `--out <path>` writes to disk and prints just
+ * the summary table.
+ */
+import { Command } from 'commander';
+import { type GraphHealthReport } from '../../../services/graph-maintenance.js';
+export declare const adminAuditWorkspaceCommand: Command;
+/**
+ * Render the report as a markdown document. Sections are emitted only
+ * when they have content — an empty workspace produces a tight one-page
+ * doc, a full audit produces a long one.
+ */
+export declare function renderMarkdown(report: GraphHealthReport, workspaceName: string): string;

package/dist/cli/commands/admin/audit-workspace.js

@@ -0,0 +1,133 @@
+/**
+ * studiograph admin audit-workspace — read-only health aggregator.
+ *
+ * Wraps `analyzeGraphHealth()` from src/services/graph-maintenance.ts —
+ * the same service that powers the dashboard's health digest — and
+ * emits a markdown report. The point isn't to surface anything new; it's
+ * to give the owner a single command for the periodic sweep, instead of
+ * running `studiograph lint`, `studiograph orphans`, and chasing broken
+ * wikilinks by hand.
+ *
+ * Output is stdout by default (so it can be piped to `pbcopy`, `glow`,
+ * or `tee somewhere.md`). `--out <path>` writes to disk and prints just
+ * the summary table.
+ */
+import { Command } from 'commander';
+import { intro, outro, log, spinner } from '@clack/prompts';
+import { writeFileSync } from 'fs';
+import { resolve } from 'path';
+import { Workspace } from '../../../core/workspace.js';
+import { WorkspaceManager } from '../../../core/workspace-manager.js';
+import { analyzeGraphHealth, } from '../../../services/graph-maintenance.js';
+export const adminAuditWorkspaceCommand = new Command('audit-workspace')
+    .description('Read-only workspace health report (lint + orphans + stale + broken wikilinks)')
+    .option('--out <path>', 'Write the markdown report to <path> instead of stdout')
+    .option('--quiet', 'Suppress the intro/outro decorations (useful in pipes)')
+    .action(async (opts) => {
+    if (!opts.quiet)
+        intro('Studiograph workspace audit');
+    const workspace = new Workspace();
+    if (!workspace.isWorkspace()) {
+        if (!opts.quiet)
+            outro('Not a Studiograph workspace. Run from your workspace root.');
+        else
+            console.error('Not a Studiograph workspace.');
+        process.exit(1);
+        return;
+    }
+    const config = await workspace.loadConfig();
+    const gitUser = { id: 'system', name: 'system', email: 'system@local' };
+    const manager = new WorkspaceManager(process.cwd(), config, gitUser);
+    const spin = opts.quiet ? null : spinner();
+    spin?.start('Aggregating health metrics');
+    const report = await analyzeGraphHealth(manager);
+    spin?.stop('Done');
+    const markdown = renderMarkdown(report, config.team_name ?? 'workspace');
+    if (opts.out) {
+        const path = resolve(opts.out);
+        writeFileSync(path, markdown, 'utf-8');
+        if (!opts.quiet)
+            log.success(`Wrote ${path}`);
+        printSummary(report);
+    }
+    else {
+        // Stdout path. clack's log helpers add prefixes that fight pipes, so
+        // use plain console.log for the report and reserve clack for the
+        // intro/outro framing (skipped under --quiet).
+        console.log(markdown);
+    }
+    if (!opts.quiet)
+        outro(`${report.summary.totalIssues} issue(s) across ${report.summary.totalEntities} entities.`);
+});
+function printSummary(report) {
+    const s = report.summary;
+    log.message(`Summary:\n` +
+        `  entities:        ${s.totalEntities}\n` +
+        `  missing fields:  ${s.missingFields}\n` +
+        `  orphans:         ${s.orphanEntities}\n` +
+        `  stale:           ${s.staleEntities}\n` +
+        `  broken wikilinks: ${s.brokenWikilinks}\n` +
+        `  total issues:    ${s.totalIssues}`);
+}
+/**
+ * Render the report as a markdown document. Sections are emitted only
+ * when they have content — an empty workspace produces a tight one-page
+ * doc, a full audit produces a long one.
+ */
+export function renderMarkdown(report, workspaceName) {
+    const s = report.summary;
+    const lines = [];
+    lines.push(`# Workspace audit — ${workspaceName}`);
+    lines.push('');
+    lines.push(`_Generated ${report.generatedAt}_`);
+    lines.push('');
+    lines.push('## Summary');
+    lines.push('');
+    lines.push('| Metric | Count |');
+    lines.push('| --- | ---: |');
+    lines.push(`| Entities | ${s.totalEntities} |`);
+    lines.push(`| Total issues | ${s.totalIssues} |`);
+    lines.push(`| Missing-field issues | ${s.missingFields} |`);
+    lines.push(`| Orphan entities | ${s.orphanEntities} |`);
+    lines.push(`| Stale entities (>30d) | ${s.staleEntities} |`);
+    lines.push(`| Broken wikilinks | ${s.brokenWikilinks} |`);
+    lines.push('');
+    if (s.totalIssues === 0) {
+        lines.push('No issues found.');
+        return lines.join('\n') + '\n';
+    }
+    if (report.missingFields.length > 0) {
+        lines.push('## Missing fields');
+        lines.push('');
+        for (const issue of report.missingFields) {
+            lines.push(`- **${issue.entityType}** \`${issue.entityId}\` (${issue.repo}) — ${issue.missingFields.join(', ')}`);
+        }
+        lines.push('');
+    }
+    if (report.orphans.length > 0) {
+        lines.push('## Orphans (zero inbound references)');
+        lines.push('');
+        for (const o of report.orphans) {
+            lines.push(`- **${o.entityType}** \`${o.entityId}\` (${o.repo}) — ${o.name}`);
+        }
+        lines.push('');
+    }
+    if (report.stale.length > 0) {
+        lines.push('## Stale entities (no edits in >30 days)');
+        lines.push('');
+        for (const st of report.stale) {
+            lines.push(`- **${st.entityType}** \`${st.entityId}\` (${st.repo}) — ${st.name}, last touched ${st.lastUpdated} (${st.daysSinceUpdate}d ago)`);
+        }
+        lines.push('');
+    }
+    if (report.brokenLinks.length > 0) {
+        lines.push('## Broken wikilinks');
+        lines.push('');
+        for (const bl of report.brokenLinks) {
+            lines.push(`- **${bl.entityType}** \`${bl.entityId}\` (${bl.repo}) — ${bl.name} → \`[[${bl.brokenLink}]]\``);
+        }
+        lines.push('');
+    }
+    return lines.join('\n') + '\n';
+}
+//# sourceMappingURL=audit-workspace.js.map

package/dist/cli/commands/admin/audit-workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-workspace.js","sourceRoot":"","sources":["../../../../src/cli/commands/admin/audit-workspace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AACtE,OAAO,EACL,kBAAkB,GAEnB,MAAM,wCAAwC,CAAC;AAOhD,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,OAAO,CAAC,iBAAiB,CAAC;KACrE,WAAW,CAAC,+EAA+E,CAAC;KAC5F,MAAM,CAAC,cAAc,EAAE,uDAAuD,CAAC;KAC/E,MAAM,CAAC,SAAS,EAAE,wDAAwD,CAAC;KAC3E,MAAM,CAAC,KAAK,EAAE,IAAe,EAAE,EAAE;IAChC,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAEtD,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;IAClC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,KAAK,CAAC,4DAA4D,CAAC,CAAC;;YAChF,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IACxE,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAErE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3C,IAAI,EAAE,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,IAAI,WAAW,CAAC,CAAC;IAEzE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAC9C,YAAY,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,qEAAqE;QACrE,iEAAiE;QACjE,+CAA+C;QAC/C,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,oBAAoB,MAAM,CAAC,OAAO,CAAC,aAAa,YAAY,CAAC,CAAC;AACpH,CAAC,CAAC,CAAC;AAEL,SAAS,YAAY,CAAC,MAAyB;IAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;IACzB,GAAG,CAAC,OAAO,CACT,YAAY;QACV,sBAAsB,CAAC,CAAC,aAAa,IAAI;QACzC,sBAAsB,CAAC,CAAC,aAAa,IAAI;QACzC,sBAAsB,CAAC,CAAC,cAAc,IAAI;QAC1C,sBAAsB,CAAC,CAAC,aAAa,IAAI;QACzC,uBAAuB,CAAC,CAAC,eAAe,IAAI;QAC5C,sBAAsB,CAAC,CAAC,WAAW,EAAE,CACxC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAyB,EAAE,aAAqB;IAC7E,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;IACzB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,uBAAuB,aAAa,EAAE,CAAC,CAAC;IACnD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACjC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC7B,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC;IAClD,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC;IAC5D,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC;IACxD,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC;IAC7D,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC;IAC1D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,CAAC,CAAC,WAAW,KAAK,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACjC,CAAC;IAED,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CACR,OAAO,KAAK,CAAC,UAAU,QAAQ,KAAK,CAAC,QAAQ,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtG,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,UAAU,QAAQ,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,UAAU,QAAQ,EAAE,CAAC,QAAQ,OAAO,EAAE,CAAC,IAAI,OAAO,EAAE,CAAC,IAAI,kBAAkB,EAAE,CAAC,WAAW,KAAK,EAAE,CAAC,eAAe,QAAQ,CAAC,CAAC;QACjJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,UAAU,QAAQ,EAAE,CAAC,QAAQ,OAAO,EAAE,CAAC,IAAI,OAAO,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC,UAAU,MAAM,CAAC,CAAC;QAC/G,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC"}

package/dist/cli/commands/admin/audit.d.ts

@@ -0,0 +1,21 @@
+/**
+ * studiograph audit — read-only operator view of the append-only audit log.
+ *
+ *   studiograph audit list [filters]
+ *     --key <pattern>            Filter by key name (exact match)
+ *     --actor <user-id>          Filter by actor user-id
+ *     --action <action>          Filter by action type
+ *                                (set|delete|test|describe|migrate|...)
+ *     --since <iso-date>         Only events at-or-after this time
+ *     --until <iso-date>         Only events at-or-before this time
+ *     --limit <n>                Page size (default 50, max 500)
+ *     --offset <n>               Pagination offset
+ *     --format <table|json>      Output format (default table)
+ *
+ * Audit reads aren't audited themselves (append-only log; reading
+ * doesn't change state). The UI used to surface this as a Settings →
+ * Audit Log tab; removed because filtering and exporting are much
+ * better in a terminal.
+ */
+import { Command } from 'commander';
+export declare const auditCommand: Command;

package/dist/cli/commands/admin/audit.js

@@ -0,0 +1,174 @@
+/**
+ * studiograph audit — read-only operator view of the append-only audit log.
+ *
+ *   studiograph audit list [filters]
+ *     --key <pattern>            Filter by key name (exact match)
+ *     --actor <user-id>          Filter by actor user-id
+ *     --action <action>          Filter by action type
+ *                                (set|delete|test|describe|migrate|...)
+ *     --since <iso-date>         Only events at-or-after this time
+ *     --until <iso-date>         Only events at-or-before this time
+ *     --limit <n>                Page size (default 50, max 500)
+ *     --offset <n>               Pagination offset
+ *     --format <table|json>      Output format (default table)
+ *
+ * Audit reads aren't audited themselves (append-only log; reading
+ * doesn't change state). The UI used to surface this as a Settings →
+ * Audit Log tab; removed because filtering and exporting are much
+ * better in a terminal.
+ */
+import { Command } from 'commander';
+import { log } from '@clack/prompts';
+import { homedir } from 'os';
+import { existsSync } from 'fs';
+import { join } from 'path';
+import { SqliteEncryptedStore, loadMasterKey, loadPreviousMasterKey, setSecretStore, } from '../../../core/secrets/index.js';
+function openStore() {
+    const loaded = loadMasterKey();
+    const previous = loadPreviousMasterKey();
+    const sgRoot = process.env.RAILWAY_ENVIRONMENT && existsSync('/workspace')
+        ? '/workspace'
+        : join(homedir(), '.studiograph');
+    const dbPath = join(sgRoot, 'secrets.db');
+    if (!existsSync(dbPath)) {
+        log.error(`Secrets store not found at ${dbPath}`);
+        log.info('Run `studiograph init` first, or start `studiograph serve` to initialize the store.');
+        process.exit(1);
+    }
+    const store = new SqliteEncryptedStore({
+        dbPath,
+        masterKey: loaded.key,
+        previousMasterKey: previous,
+    });
+    setSecretStore(store);
+    return store;
+}
+function parseTs(v) {
+    if (!v)
+        return undefined;
+    const n = Number(v);
+    if (Number.isFinite(n) && n > 0)
+        return n;
+    const d = Date.parse(v);
+    return Number.isFinite(d) ? d : undefined;
+}
+function fmtTs(ms) {
+    return new Date(ms).toISOString();
+}
+function fmtActor(row) {
+    return row.actor_type === 'user'
+        ? `user:${row.actor_user_id ?? '?'}`
+        : `system:${row.actor_system_id ?? '?'}`;
+}
+function fmtTable(rows) {
+    if (rows.length === 0)
+        return '';
+    const cols = Object.keys(rows[0]);
+    const widths = cols.map((c) => Math.max(c.length, ...rows.map((r) => r[c]?.length ?? 0)));
+    const header = cols.map((c, i) => c.padEnd(widths[i])).join('  ');
+    const sep = widths.map((w) => '─'.repeat(w)).join('  ');
+    const body = rows.map((r) => cols.map((c, i) => (r[c] ?? '').padEnd(widths[i])).join('  ')).join('\n');
+    return `${header}\n${sep}\n${body}`;
+}
+export const auditCommand = new Command('audit')
+    .description('Read the append-only audit log (formerly the Settings → Audit Log tab)');
+auditCommand
+    .command('list')
+    .description('List recent audit events, newest first. Filters compose with AND.')
+    .option('--key <key>', 'Filter by key name (exact match)')
+    .option('--actor <user-id>', 'Filter by actor user-id')
+    .option('--actor-type <type>', 'Filter by actor type: user or system')
+    .option('--action <action>', 'Filter by action (set, delete, test, describe, migrate, decrypt_fail, rotate_master, bundle_export, bundle_import)')
+    .option('--since <iso-date>', 'Only events at-or-after this time (ISO date or epoch ms)')
+    .option('--until <iso-date>', 'Only events at-or-before this time (ISO date or epoch ms)')
+    .option('--limit <n>', 'Page size, default 50, max 500', '50')
+    .option('--offset <n>', 'Pagination offset', '0')
+    .option('--format <format>', 'Output format: table (default) or json', 'table')
+    .action(async (opts) => {
+    const store = openStore();
+    try {
+        const where = [];
+        const params = [];
+        if (opts.key) {
+            where.push('key = ?');
+            params.push(opts.key);
+        }
+        if (opts.actor) {
+            where.push('actor_user_id = ?');
+            params.push(opts.actor);
+        }
+        if (opts.actorType) {
+            where.push('actor_type = ?');
+            params.push(opts.actorType);
+        }
+        if (opts.action) {
+            where.push('action = ?');
+            params.push(opts.action);
+        }
+        const since = parseTs(opts.since);
+        const until = parseTs(opts.until);
+        if (since !== undefined) {
+            where.push('ts >= ?');
+            params.push(since);
+        }
+        if (until !== undefined) {
+            where.push('ts <= ?');
+            params.push(until);
+        }
+        const limit = Math.min(Math.max(parseInt(opts.limit, 10) || 50, 1), 500);
+        const offset = Math.max(parseInt(opts.offset, 10) || 0, 0);
+        const sql = `SELECT id, ts, actor_type, actor_user_id, actor_system_id, action,
+                key, success, ip, user_agent, detail_json
+           FROM audit_log
+          ${where.length ? `WHERE ${where.join(' AND ')}` : ''}
+          ORDER BY ts DESC
+          LIMIT ? OFFSET ?`;
+        // `store.db` is private; the route code already reaches in via `(store as any).db`
+        // and we follow the same pattern. Refactoring the store to expose a public
+        // query helper is out of scope for this CLI.
+        const rows = (store.db
+            .prepare(sql)
+            .all(...params, limit, offset));
+        const totalRow = (store.db
+            .prepare(`SELECT COUNT(*) AS n FROM audit_log ${where.length ? `WHERE ${where.join(' AND ')}` : ''}`)
+            .get(...params));
+        if (opts.format === 'json') {
+            console.log(JSON.stringify({
+                total: totalRow.n,
+                limit,
+                offset,
+                items: rows.map((r) => ({
+                    id: r.id,
+                    ts: r.ts,
+                    actor_type: r.actor_type,
+                    actor_user_id: r.actor_user_id,
+                    actor_system_id: r.actor_system_id,
+                    action: r.action,
+                    key: r.key,
+                    success: !!r.success,
+                    ip: r.ip,
+                    user_agent: r.user_agent,
+                    detail: r.detail_json ? JSON.parse(r.detail_json) : null,
+                })),
+            }, null, 2));
+            return;
+        }
+        if (rows.length === 0) {
+            log.info(`No audit events found${where.length ? ' for the given filters' : ''}.`);
+            return;
+        }
+        const tableRows = rows.map((r) => ({
+            time: fmtTs(r.ts),
+            actor: fmtActor(r),
+            action: r.action,
+            key: r.key ?? '—',
+            result: r.success ? 'ok' : 'fail',
+        }));
+        console.log(fmtTable(tableRows));
+        console.log(`\nShowing ${rows.length} of ${totalRow.n} events (offset=${offset}, limit=${limit})`);
+    }
+    finally {
+        store.close();
+    }
+});
+//# sourceMappingURL=audit.js.map

package/dist/cli/commands/admin/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../../src/cli/commands/admin/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,qBAAqB,EACrB,cAAc,GACf,MAAM,gCAAgC,CAAC;AAExC,SAAS,SAAS;IAChB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,UAAU,CAAC,YAAY,CAAC;QACxE,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;QAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,oBAAoB,CAAC;QACrC,MAAM;QACN,SAAS,EAAE,MAAM,CAAC,GAAG;QACrB,iBAAiB,EAAE,QAAQ;KAC5B,CAAC,CAAC;IACH,cAAc,CAAC,KAAK,CAAC,CAAC;IACtB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,CAAqB;IACpC,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,QAAQ,CAAC,GAAa;IAC7B,OAAO,GAAG,CAAC,UAAU,KAAK,MAAM;QAC9B,CAAC,CAAC,QAAQ,GAAG,CAAC,aAAa,IAAI,GAAG,EAAE;QACpC,CAAC,CAAC,UAAU,GAAG,CAAC,eAAe,IAAI,GAAG,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,IAAmC;IACnD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvG,OAAO,GAAG,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE,CAAC;AACtC,CAAC;AAgBD,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;KAC7C,WAAW,CAAC,wEAAwE,CAAC,CAAC;AAEzF,YAAY;KACT,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,mEAAmE,CAAC;KAChF,MAAM,CAAC,aAAa,EAAE,kCAAkC,CAAC;KACzD,MAAM,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;KACtD,MAAM,CAAC,qBAAqB,EAAE,sCAAsC,CAAC;KACrE,MAAM,CAAC,mBAAmB,EAAE,oHAAoH,CAAC;KACjJ,MAAM,CAAC,oBAAoB,EAAE,0DAA0D,CAAC;KACxF,MAAM,CAAC,oBAAoB,EAAE,2DAA2D,CAAC;KACzF,MAAM,CAAC,aAAa,EAAE,gCAAgC,EAAE,IAAI,CAAC;KAC7D,MAAM,CAAC,cAAc,EAAE,mBAAmB,EAAE,GAAG,CAAC;KAChD,MAAM,CAAC,mBAAmB,EAAE,wCAAwC,EAAE,OAAO,CAAC;KAC9E,MAAM,CAAC,KAAK,EAAE,IAUd,EAAE,EAAE;IACH,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAC/D,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAC7E,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAClF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QACxE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QACvE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAEvE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAE3D,MAAM,GAAG,GACP;;;YAGI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;;2BAEnC,CAAC;QACtB,mFAAmF;QACnF,2EAA2E;QAC3E,6CAA6C;QAC7C,MAAM,IAAI,GAAG,CAAE,KAAyF,CAAC,EAAE;aACxG,OAAO,CAAC,GAAG,CAAC;aACZ,GAAG,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAe,CAAC;QAEhD,MAAM,QAAQ,GAAG,CAAE,KAA4F,CAAC,EAAE;aAC/G,OAAO,CAAC,uCAAuC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;aACpG,GAAG,CAAC,GAAG,MAAM,CAAC,CAAkB,CAAC;QAEpC,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;gBACzB,KAAK,EAAE,QAAQ,CAAC,CAAC;gBACjB,KAAK;gBACL,MAAM;gBACN,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACtB,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,UAAU,EAAE,CAAC,CAAC,UAAU;oBACxB,aAAa,EAAE,CAAC,CAAC,aAAa;oBAC9B,eAAe,EAAE,CAAC,CAAC,eAAe;oBAClC,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO;oBACpB,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,UAAU,EAAE,CAAC,CAAC,UAAU;oBACxB,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;iBACzD,CAAC,CAAC;aACJ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,IAAI,CAAC,wBAAwB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACjB,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;YAClB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG;YACjB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;SAClC,CAAC,CAAC,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,MAAM,OAAO,QAAQ,CAAC,CAAC,mBAAmB,MAAM,WAAW,KAAK,GAAG,CAAC,CAAC;IACrG,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/cli/commands/admin/backup.d.ts

@@ -0,0 +1,54 @@
+/**
+ * studiograph admin backup — produce a passphrase-wrapped, manifest-aware
+ * snapshot of the entire local workspace.
+ *
+ * Pairs with `admin restore`. Distinct from `clone`:
+ *   - `clone` pulls from a running server; strips machine-specific config
+ *     (r2_config, railway, master-key, JWT secret); good for setting up
+ *     a new dev machine.
+ *   - `admin backup` snapshots the local workspace; includes secrets.db,
+ *     auth.db, r2_config, railway IDs, and a manifest of the Railway env
+ *     vars (master key, JWT secret) the owner provides at backup time;
+ *     good for "server is dead, restore me."
+ *
+ * Bundle contents (encrypted as a single .sgbackup file):
+ *   - manifest.json — env-var values + Railway IDs + workspace name + ts
+ *   - workspace/ — tar of the workspace directory, minus
+ *     node_modules/, .DS_Store, and any *.log files
+ *
+ * Crypto: passphrase → scrypt → key → xchacha20poly1305(tar.gz).
+ * See [src/cli/crypto-bundle.ts] for the wire format.
+ *
+ * Refuses to write the bundle to a destination directory unless it
+ * exists with mode 0700, or is being created (we make it 0700). Bundle
+ * file is written with mode 0600. Defense against world-readable backups
+ * that contain bcrypt hashes from auth.db.
+ */
+import { Command } from 'commander';
+interface BackupManifest {
+    workspace_name: string;
+    created_at: string;
+    format_version: 1;
+    /** Railway-side env vars the operator supplied at backup time. The
+     *  backup intentionally re-prompts for these (rather than reading from
+     *  the workspace's secrets.db) so a single passphrase-wrapped bundle
+     *  carries everything restore needs. */
+    env: {
+        STUDIOGRAPH_MASTER_KEY: string;
+        STUDIOGRAPH_JWT_SECRET: string;
+    };
+    /** Railway link, if any. Each field is optional in workspace.json
+     *  schema, so the manifest carries them as optional too — restore
+     *  reports the gap if a value is missing rather than rejecting the
+     *  whole bundle. */
+    railway?: {
+        project_id?: string;
+        service_id?: string;
+        environment_id?: string;
+    };
+    /** Cosmetic only — restore uses this to print "this bundle is from
+     *  workspace X, created Y". Does not affect the restore behavior. */
+    notes?: string;
+}
+export declare const adminBackupCommand: Command;
+export type { BackupManifest };