studiograph 1.3.48-next.26 → 1.3.48-next.261

package/dist/services/personal-folder.js

@@ -0,0 +1,122 @@
+import { existsSync, renameSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { isSeedFolderName, seedFolderName, seedFolderDisplayName } from '../core/seed-folder.js';
+/**
+ * Provision the user's seed "My Folder" (named `entries-<userId>`) and grant
+ * them admin folder_access. Idempotent — safe to call repeatedly and on
+ * existing workspaces where the folder was provisioned before this helper
+ * existed (repairs the missing folder_access row).
+ *
+ * The seed is an ORDINARY folder: solo (private by membership) until the user
+ * shares it, freely deletable, and a user may create as many additional solo
+ * folders as they like. The only thing special is the `entries-<userId>` name,
+ * which lets the agent's repo:"private" default and the user's home capture /
+ * My-Tasks target resolve to a stable folder (see src/core/seed-folder.ts).
+ *
+ * Consolidated from four earlier call sites that each did half the work:
+ * setup endpoint, /api/auth/users POST, server startup sweep, and
+ * `studiograph user add` CLI. Skipping the grant left the user's own seed
+ * folder invisible in the sidebar because `getAccessibleRepos()` filters by
+ * folder_access.
+ */
+export async function ensureSeedFolder(workspace, authService, user) {
+    const folderName = seedFolderName(user.id);
+    const config = await workspace.loadConfig();
+    const alreadyRegistered = config.repos.some(r => r.name === folderName);
+    if (!alreadyRegistered) {
+        // Durable deletion: if the user deleted their seed "My Folder", do NOT
+        // resurrect it on the next boot sweep / login. Folders are just folders —
+        // deleting your home folder sticks until you recreate one.
+        if (authService.isSeedFolderDeleted(user.id))
+            return;
+        const users = authService.listUsers();
+        await workspace.registerRepo({
+            name: folderName,
+            // Stored default; the API derives this at read-time too (dedup tracks the
+            // live team), so this is just a sensible value for non-API consumers.
+            display_name: seedFolderDisplayName(user.id, user.displayName, users),
+            description: `Entries for ${user.displayName}`,
+            owner_id: user.id,
+        });
+    }
+    else if (authService.isSeedFolderDeleted(user.id)) {
+        // The seed exists again (e.g. restored from git) — clear the stale tombstone.
+        authService.setSeedFolderDeleted(user.id, false);
+    }
+    const hasAccess = authService.getUserFolders(user.id).includes(folderName);
+    if (!hasAccess) {
+        authService.grantFolderAccess(user.id, folderName, 'admin');
+    }
+}
+/**
+ * On user deletion, give the departed user's seed "My Folder" a plainly-named
+ * archive name so the actor who inherits it (via transferFoldersOnDelete)
+ * doesn't end up owning a folder literally called "My Folder" / the opaque
+ * `entries-<userId>` slug. Mirrors Google Drive's inherit-on-delete model:
+ * the content survives, the owner is reassigned, and the folder gets a clear
+ * name. This is a UX clarity rename, NOT special access handling — by the time
+ * this runs the folder has already transferred to the actor like any other
+ * sole-admin folder.
+ *
+ * Mutations applied (in order, best-effort non-atomic):
+ *  1. Pick a collision-free new name: `archive-{slug}-{YYYY-MM-DD}`,
+ *     escalating to `-2`, `-3`, … if needed.
+ *  2. Rename the folder directory on disk.
+ *  3. Update workspace.json: new name/path, display_name, clear the inert
+ *     personal/owner_id fields, and write the new `.studiograph` marker.
+ *  4. Update folder_access rows to the new name so the actor's inherited
+ *     admin row keeps working.
+ *  5. Push the updated workspace.json to the config remote (non-fatal).
+ *
+ * Returns the new folder name and display name so the caller can report
+ * them to the UI. The caller should `workspaceManager.reloadConfig()`
+ * after this completes to surface the change to in-memory graph state.
+ */
+export async function archiveSeedFolderOnUserDelete(workspace, oldName, targetDisplayName, authService) {
+    const config = await workspace.loadConfig();
+    const repo = config.repos.find(r => r.name === oldName);
+    if (!repo) {
+        throw new Error(`Cannot archive '${oldName}' — folder not found in workspace config`);
+    }
+    if (!isSeedFolderName(oldName)) {
+        throw new Error(`Cannot archive '${oldName}' — not a seed folder`);
+    }
+    const slug = slugify(targetDisplayName);
+    const date = new Date().toISOString().slice(0, 10); // YYYY-MM-DD
+    const baseName = `archive-${slug}-${date}`;
+    let newName = baseName;
+    let suffix = 2;
+    while (config.repos.some(r => r.name === newName)) {
+        newName = `${baseName}-${suffix}`;
+        suffix += 1;
+    }
+    const wsPath = workspace.workspacePath;
+    const oldPath = join(wsPath, repo.path);
+    const newPath = join(wsPath, newName);
+    if (existsSync(oldPath)) {
+        renameSync(oldPath, newPath);
+    }
+    repo.name = newName;
+    repo.path = newName;
+    repo.display_name = `Archive: ${targetDisplayName} (${date})`;
+    delete repo.personal;
+    delete repo.owner_id;
+    const markerPath = join(newPath, '.studiograph');
+    if (existsSync(markerPath)) {
+        writeFileSync(markerPath, JSON.stringify({ repo_name: newName }, null, 2), 'utf-8');
+    }
+    workspace.writeConfig(config);
+    authService.renameFolder(oldName, newName);
+    workspace.pushWorkspaceConfig(`Archive seed folder on user delete: ${oldName} → ${newName}`);
+    return { newName, newDisplayName: repo.display_name };
+}
+function slugify(name) {
+    const cleaned = name
+        .normalize('NFKD')
+        .replace(/[̀-ͯ]/g, '') // strip combining diacritics
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+    return cleaned || 'user';
+}
+//# sourceMappingURL=personal-folder.js.map

package/dist/services/personal-folder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"personal-folder.js","sourceRoot":"","sources":["../../src/services/personal-folder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAGjG;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAoB,EACpB,WAAwB,EACxB,IAAc;IAEd,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,CAAC;IAC5C,MAAM,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAExE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,uEAAuE;QACvE,0EAA0E;QAC1E,2DAA2D;QAC3D,IAAI,WAAW,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO;QACrD,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,SAAS,CAAC,YAAY,CAAC;YAC3B,IAAI,EAAE,UAAU;YAChB,0EAA0E;YAC1E,sEAAsE;YACtE,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC;YACrE,WAAW,EAAE,eAAe,IAAI,CAAC,WAAW,EAAE;YAC9C,QAAQ,EAAE,IAAI,CAAC,EAAE;SAClB,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,WAAW,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACpD,8EAA8E;QAC9E,WAAW,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC3E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,SAAoB,EACpB,OAAe,EACf,iBAAyB,EACzB,WAAwB;IAExB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,0CAA0C,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,uBAAuB,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa;IACjE,MAAM,QAAQ,GAAG,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC;IAE3C,IAAI,OAAO,GAAG,QAAQ,CAAC;IACvB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,CAAC;QAClD,OAAO,GAAG,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAI,SAAiB,CAAC,aAAuB,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEtC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC;IACpB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC;IACpB,IAAI,CAAC,YAAY,GAAG,YAAY,iBAAiB,KAAK,IAAI,GAAG,CAAC;IAC9D,OAAQ,IAAY,CAAC,QAAQ,CAAC;IAC9B,OAAQ,IAAY,CAAC,QAAQ,CAAC;IAE9B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACjD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACtF,CAAC;IAED,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9B,WAAW,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,SAAS,CAAC,mBAAmB,CAAC,uCAAuC,OAAO,MAAM,OAAO,EAAE,CAAC,CAAC;IAE7F,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,YAAa,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,OAAO,GAAG,IAAI;SACjB,SAAS,CAAC,MAAM,CAAC;SACjB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,6BAA6B;SACnD,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,OAAO,IAAI,MAAM,CAAC;AAC3B,CAAC"}

package/dist/services/playwright-bootstrap.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Playwright Chromium bootstrap for server deploys.
+ *
+ * `inspect_artifact` and the artifact PDF/PNG export render through Playwright's
+ * Chromium. A bare Node host (e.g. the Railway `node:20` image) ships neither the
+ * Chromium browser nor the OS libraries it needs, so those tools fail with
+ * "Install the Playwright Chromium runtime with: npx playwright install chromium".
+ *
+ * This ensures the runtime is present WITHOUT blocking server startup:
+ *   - Opt-in via `STUDIOGRAPH_INSTALL_PLAYWRIGHT=1` (the deploy sets it; local
+ *     `studiograph serve` stays lean and never downloads ~150MB unprompted).
+ *   - PROBE-FIRST: boot runs a real `chromium.launch()` probe. When the browser
+ *     binary AND its OS libraries are already present (persistent
+ *     `PLAYWRIGHT_BROWSERS_PATH` volume + an image with the deps baked in, e.g.
+ *     `mcr.microsoft.com/playwright`), the install is skipped entirely — no apt
+ *     churn, no downloads, ready in seconds. The probe is the only honest check
+ *     for the OS deps: they live in the ephemeral rootfs, so "did the install
+ *     run before" stamps can't be trusted across restarts.
+ *   - The install runs through the BUNDLED playwright CLI
+ *     (`node node_modules/playwright/cli.js`), not `npx playwright` — npx
+ *     re-downloaded the standalone playwright package on every boot and could
+ *     drift to a different version (and browser build) than the one
+ *     `import('playwright')` resolves. npx remains as a fallback only.
+ *   - Runs in the background after the server is already listening, at reduced
+ *     CPU priority (best-effort `os.setPriority`) so apt/dpkg churn can't
+ *     starve the event loop of live requests.
+ *   - Readiness is observable via {@link playwrightReadiness}: render entry
+ *     points return a clear "still installing" state instead of racing the
+ *     background install on fresh rollouts.
+ *   - Set `STUDIOGRAPH_PLAYWRIGHT_BROWSER_ONLY=1` to drop `--with-deps` when
+ *     the OS libs are baked into the image. Point `PLAYWRIGHT_BROWSERS_PATH`
+ *     at a persistent volume so the browser downloads once, not per boot.
+ *
+ * Best-effort throughout: any failure is logged and swallowed — the worst case is
+ * the pre-existing "inspect unavailable" behavior, never a crashed boot.
+ */
+export type PlaywrightReadinessState = 'idle' | 'checking' | 'installing' | 'ready' | 'failed';
+export interface PlaywrightReadiness {
+    /** `idle` = bootstrap not requested (local serve, tests) — render paths
+     *  proceed and surface their own errors. `checking`/`installing` = the
+     *  background pass is in flight. `ready` = launch probe passed. `failed` =
+     *  install or post-install probe failed; `detail` carries why. */
+    state: PlaywrightReadinessState;
+    /** Why the install started (probe failure) or why the pass failed. */
+    detail?: string;
+    /** Epoch ms when the current checking/installing pass began. */
+    startedAt?: number;
+}
+export declare function playwrightReadiness(): PlaywrightReadiness;
+export declare function __resetPlaywrightBootstrapForTests(): void;
+/** ONE set of headless-launch options shared by the boot probe and the render
+ *  path (artifact-render-export's launchChromium) — they must agree, or the
+ *  probe could pass while renders fail (or vice versa). */
+export declare const CHROMIUM_LAUNCH_OPTIONS: {
+    headless: boolean;
+    args: string[];
+};
+/** Launch failures that mean "the playwright-managed browser isn't INSTALLED
+ *  here" (vs a transient crash / OOM / sandbox error). Used to decide whether to
+ *  install chromium and whether the dev-only system-`chrome` fallback is worth
+ *  trying. Deliberately TIGHT: the old predicate also matched the bare token
+ *  `browserType.launch`, which appears in almost EVERY Playwright launch error
+ *  message — so a transient bundled-launch crash was misclassified as
+ *  "missing browser" and detoured to the `chrome` channel, which on a deploy
+ *  with no system Chrome failed with "Chromium distribution 'chrome' is not
+ *  found", masking the real error. Match only the genuinely missing-binary /
+ *  missing-deps / wrong-distribution signatures. */
+export declare function isMissingBrowserError(err: unknown): boolean;
+/** Whether to try the system-`chrome` channel when the bundled chromium launch
+ *  fails. ONLY in a non-managed environment (local `studiograph serve`, tests):
+ *  there a developer may have Chrome but not the bundled chromium, so the
+ *  fallback is a convenience. A managed DEPLOY sets
+ *  `STUDIOGRAPH_INSTALL_PLAYWRIGHT=1` and ships the bundled chromium as the
+ *  contract — there is no system Chrome, so the fallback can only FAIL and MASK
+ *  the real bundled-launch error. Shared by the boot probe and the render path
+ *  so their verdicts stay in agreement. */
+export declare function systemChromeFallbackAllowed(): boolean;
+export declare function ensurePlaywrightChromium(log?: (message: string) => void): void;

package/dist/services/playwright-bootstrap.js

@@ -0,0 +1,219 @@
+/**
+ * Playwright Chromium bootstrap for server deploys.
+ *
+ * `inspect_artifact` and the artifact PDF/PNG export render through Playwright's
+ * Chromium. A bare Node host (e.g. the Railway `node:20` image) ships neither the
+ * Chromium browser nor the OS libraries it needs, so those tools fail with
+ * "Install the Playwright Chromium runtime with: npx playwright install chromium".
+ *
+ * This ensures the runtime is present WITHOUT blocking server startup:
+ *   - Opt-in via `STUDIOGRAPH_INSTALL_PLAYWRIGHT=1` (the deploy sets it; local
+ *     `studiograph serve` stays lean and never downloads ~150MB unprompted).
+ *   - PROBE-FIRST: boot runs a real `chromium.launch()` probe. When the browser
+ *     binary AND its OS libraries are already present (persistent
+ *     `PLAYWRIGHT_BROWSERS_PATH` volume + an image with the deps baked in, e.g.
+ *     `mcr.microsoft.com/playwright`), the install is skipped entirely — no apt
+ *     churn, no downloads, ready in seconds. The probe is the only honest check
+ *     for the OS deps: they live in the ephemeral rootfs, so "did the install
+ *     run before" stamps can't be trusted across restarts.
+ *   - The install runs through the BUNDLED playwright CLI
+ *     (`node node_modules/playwright/cli.js`), not `npx playwright` — npx
+ *     re-downloaded the standalone playwright package on every boot and could
+ *     drift to a different version (and browser build) than the one
+ *     `import('playwright')` resolves. npx remains as a fallback only.
+ *   - Runs in the background after the server is already listening, at reduced
+ *     CPU priority (best-effort `os.setPriority`) so apt/dpkg churn can't
+ *     starve the event loop of live requests.
+ *   - Readiness is observable via {@link playwrightReadiness}: render entry
+ *     points return a clear "still installing" state instead of racing the
+ *     background install on fresh rollouts.
+ *   - Set `STUDIOGRAPH_PLAYWRIGHT_BROWSER_ONLY=1` to drop `--with-deps` when
+ *     the OS libs are baked into the image. Point `PLAYWRIGHT_BROWSERS_PATH`
+ *     at a persistent volume so the browser downloads once, not per boot.
+ *
+ * Best-effort throughout: any failure is logged and swallowed — the worst case is
+ * the pre-existing "inspect unavailable" behavior, never a crashed boot.
+ */
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import os from 'node:os';
+import path from 'node:path';
+let readiness = { state: 'idle' };
+let kicked = false;
+export function playwrightReadiness() {
+    return readiness;
+}
+export function __resetPlaywrightBootstrapForTests() {
+    kicked = false;
+    readiness = { state: 'idle' };
+}
+function errorMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/** ONE set of headless-launch options shared by the boot probe and the render
+ *  path (artifact-render-export's launchChromium) — they must agree, or the
+ *  probe could pass while renders fail (or vice versa). */
+export const CHROMIUM_LAUNCH_OPTIONS = {
+    headless: true,
+    args: ['--no-sandbox', '--disable-dev-shm-usage'],
+};
+/** Launch failures that mean "the playwright-managed browser isn't INSTALLED
+ *  here" (vs a transient crash / OOM / sandbox error). Used to decide whether to
+ *  install chromium and whether the dev-only system-`chrome` fallback is worth
+ *  trying. Deliberately TIGHT: the old predicate also matched the bare token
+ *  `browserType.launch`, which appears in almost EVERY Playwright launch error
+ *  message — so a transient bundled-launch crash was misclassified as
+ *  "missing browser" and detoured to the `chrome` channel, which on a deploy
+ *  with no system Chrome failed with "Chromium distribution 'chrome' is not
+ *  found", masking the real error. Match only the genuinely missing-binary /
+ *  missing-deps / wrong-distribution signatures. */
+export function isMissingBrowserError(err) {
+    const message = err instanceof Error ? err.message : String(err ?? '');
+    return /Executable doesn't exist|Host system is missing|Chromium distribution|playwright install/i.test(message);
+}
+/** Whether to try the system-`chrome` channel when the bundled chromium launch
+ *  fails. ONLY in a non-managed environment (local `studiograph serve`, tests):
+ *  there a developer may have Chrome but not the bundled chromium, so the
+ *  fallback is a convenience. A managed DEPLOY sets
+ *  `STUDIOGRAPH_INSTALL_PLAYWRIGHT=1` and ships the bundled chromium as the
+ *  contract — there is no system Chrome, so the fallback can only FAIL and MASK
+ *  the real bundled-launch error. Shared by the boot probe and the render path
+ *  so their verdicts stay in agreement. */
+export function systemChromeFallbackAllowed() {
+    return process.env.STUDIOGRAPH_INSTALL_PLAYWRIGHT !== '1';
+}
+/** The honest readiness check: the executable exists AND a headless launch
+ *  succeeds (which exercises the OS shared libraries). Mirrors the render
+ *  path's launcher — shared options plus the same system-`chrome` channel
+ *  fallback — so a passing probe means renders will pass too, and a probe
+ *  failure means they wouldn't have. (Deliberate asymmetry: a MISSING
+ *  chromium executable goes straight to install even where system chrome
+ *  might render — installing chromium is this bootstrap's job.) */
+async function probeChromiumLaunch() {
+    let playwright;
+    try {
+        playwright = await import('playwright');
+    }
+    catch (err) {
+        return { ok: false, reason: `playwright package unavailable: ${errorMessage(err)}` };
+    }
+    try {
+        const exe = playwright.chromium.executablePath();
+        if (!exe || !existsSync(exe)) {
+            return { ok: false, reason: `chromium executable missing${exe ? ` at ${exe}` : ''}` };
+        }
+    }
+    catch (err) {
+        return { ok: false, reason: `chromium executablePath failed: ${errorMessage(err)}` };
+    }
+    let browser;
+    try {
+        browser = await playwright.chromium.launch(CHROMIUM_LAUNCH_OPTIONS);
+    }
+    catch (err) {
+        // The system-`chrome` channel fallback is a LOCAL-DEV convenience only, and
+        // it must match what the render path (launchChromium) does or the probe
+        // would lie. In a deploy the fallback is disallowed, so the real
+        // bundled-launch error becomes the probe's verdict (surfaced via
+        // /api/health → readiness.detail) instead of a misleading "chrome not
+        // found". A non-missing-browser failure (crash/OOM/sandbox) always fails
+        // the probe regardless.
+        if (!systemChromeFallbackAllowed() || !isMissingBrowserError(err)) {
+            return { ok: false, reason: `chromium launch failed: ${errorMessage(err)}` };
+        }
+        try {
+            browser = await playwright.chromium.launch({ ...CHROMIUM_LAUNCH_OPTIONS, channel: 'chrome' });
+        }
+        catch {
+            return { ok: false, reason: `chromium launch failed: ${errorMessage(err)}` };
+        }
+    }
+    // The launch IS the probe — a failed close must not read as launch failure.
+    await browser.close().catch(() => { });
+    return { ok: true };
+}
+/** Prefer the playwright CLI bundled in our own node_modules: same version
+ *  (and browser build) as the `import('playwright')` the render path uses,
+ *  and no per-boot npx package download. */
+function installCommand(browserOnly) {
+    const installArgs = ['install', ...(browserOnly ? [] : ['--with-deps']), 'chromium'];
+    try {
+        const require = createRequire(import.meta.url);
+        const pkgPath = require.resolve('playwright/package.json');
+        const pkg = require('playwright/package.json');
+        const bin = typeof pkg.bin === 'string' ? pkg.bin : pkg.bin?.playwright;
+        if (bin) {
+            const cli = path.join(path.dirname(pkgPath), bin);
+            if (existsSync(cli)) {
+                return { command: process.execPath, args: [cli, ...installArgs], via: `bundled playwright ${pkg.version ?? ''}`.trim() };
+            }
+        }
+    }
+    catch {
+        // Resolution failure → npx fallback below.
+    }
+    return { command: 'npx', args: ['--yes', 'playwright', ...installArgs], via: 'npx fallback' };
+}
+function runInstall(command, args, log) {
+    return new Promise((resolve) => {
+        const child = spawn(command, args, { stdio: 'inherit', env: process.env });
+        // Deprioritize the installer: apt/dpkg churn during the install used to
+        // starve the event loop for minutes (the window in which the entities-route
+        // double-send race fired). Best-effort — unsupported platforms just skip it.
+        try {
+            if (typeof child.pid === 'number')
+                os.setPriority(child.pid, 10);
+        }
+        catch {
+            // os.setPriority unavailable/denied — proceed at normal priority.
+        }
+        child.on('exit', (code) => resolve(code));
+        child.on('error', (err) => {
+            log(`[playwright] chromium install could not start: ${err.message}`);
+            resolve(null);
+        });
+    });
+}
+export function ensurePlaywrightChromium(log = console.log) {
+    if (kicked)
+        return; // one attempt per process
+    kicked = true;
+    if (process.env.STUDIOGRAPH_INSTALL_PLAYWRIGHT !== '1')
+        return;
+    const browserOnly = process.env.STUDIOGRAPH_PLAYWRIGHT_BROWSER_ONLY === '1';
+    readiness = { state: 'checking', startedAt: Date.now() };
+    void (async () => {
+        try {
+            const probe = await probeChromiumLaunch();
+            if (probe.ok) {
+                readiness = { state: 'ready' };
+                log('[playwright] chromium runtime ready — launch probe passed, install skipped');
+                return;
+            }
+            readiness = { state: 'installing', detail: probe.reason, startedAt: Date.now() };
+            const { command, args, via } = installCommand(browserOnly);
+            log(`[playwright] chromium runtime not ready (${probe.reason}) — installing in the background via ${via}: ${command} ${args.join(' ')}`);
+            const code = await runInstall(command, args, log);
+            if (code !== 0) {
+                readiness = { state: 'failed', detail: `install exited ${code ?? 'without starting'}` };
+                log(`[playwright] chromium install exited ${code ?? 'null'} (inspect_artifact/export stay unavailable)`);
+                return;
+            }
+            const recheck = await probeChromiumLaunch();
+            if (recheck.ok) {
+                readiness = { state: 'ready' };
+                log('[playwright] chromium runtime ready — inspect_artifact/export enabled');
+            }
+            else {
+                readiness = { state: 'failed', detail: `install completed but ${recheck.reason}` };
+                log(`[playwright] install completed but the launch probe still fails: ${recheck.reason}`);
+            }
+        }
+        catch (err) {
+            readiness = { state: 'failed', detail: errorMessage(err) };
+            log(`[playwright] chromium bootstrap failed (inspect_artifact stays unavailable): ${errorMessage(err)}`);
+        }
+    })();
+}
+//# sourceMappingURL=playwright-bootstrap.js.map

package/dist/services/playwright-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"playwright-bootstrap.js","sourceRoot":"","sources":["../../src/services/playwright-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAgB7B,IAAI,SAAS,GAAwB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACvD,IAAI,MAAM,GAAG,KAAK,CAAC;AAEnB,MAAM,UAAU,mBAAmB;IACjC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,kCAAkC;IAChD,MAAM,GAAG,KAAK,CAAC;IACf,SAAS,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED;;2DAE2D;AAC3D,MAAM,CAAC,MAAM,uBAAuB,GAA0C;IAC5E,QAAQ,EAAE,IAAI;IACd,IAAI,EAAE,CAAC,cAAc,EAAE,yBAAyB,CAAC;CAClD,CAAC;AAEF;;;;;;;;;oDASoD;AACpD,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO,2FAA2F,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACnH,CAAC;AAED;;;;;;;2CAO2C;AAC3C,MAAM,UAAU,2BAA2B;IACzC,OAAO,OAAO,CAAC,GAAG,CAAC,8BAA8B,KAAK,GAAG,CAAC;AAC5D,CAAC;AAED;;;;;;mEAMmE;AACnE,KAAK,UAAU,mBAAmB;IAChC,IAAI,UAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACjD,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,GAAG,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;QACxF,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,OAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4EAA4E;QAC5E,wEAAwE;QACxE,iEAAiE;QACjE,iEAAiE;QACjE,sEAAsE;QACtE,yEAAyE;QACzE,wBAAwB;QACxB,IAAI,CAAC,2BAA2B,EAAE,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,uBAAuB,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,4EAA4E;IAC5E,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;4CAE4C;AAC5C,SAAS,cAAc,CAAC,WAAoB;IAC1C,MAAM,WAAW,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACrF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,yBAAyB,CAAgE,CAAC;QAC9G,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC;QACxE,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;YAClD,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,EAAE,GAAG,EAAE,sBAAsB,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3H,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,WAAW,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;AAChG,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,IAAc,EAAE,GAA8B;IACjF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3E,wEAAwE;QACxE,4EAA4E;QAC5E,6EAA6E;QAC7E,IAAI,CAAC;YACH,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;gBAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;QACD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,GAAG,CAAC,kDAAkD,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACrE,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAiC,OAAO,CAAC,GAAG;IACnF,IAAI,MAAM;QAAE,OAAO,CAAC,0BAA0B;IAC9C,MAAM,GAAG,IAAI,CAAC;IACd,IAAI,OAAO,CAAC,GAAG,CAAC,8BAA8B,KAAK,GAAG;QAAE,OAAO;IAE/D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,mCAAmC,KAAK,GAAG,CAAC;IAC5E,SAAS,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAEzD,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,mBAAmB,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;gBACb,SAAS,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;gBAC/B,GAAG,CAAC,4EAA4E,CAAC,CAAC;gBAClF,OAAO;YACT,CAAC;YAED,SAAS,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACjF,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;YAC3D,GAAG,CAAC,4CAA4C,KAAK,CAAC,MAAM,wCAAwC,GAAG,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAEzI,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAClD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,SAAS,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,IAAI,IAAI,kBAAkB,EAAE,EAAE,CAAC;gBACxF,GAAG,CAAC,wCAAwC,IAAI,IAAI,MAAM,6CAA6C,CAAC,CAAC;gBACzG,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;gBACf,SAAS,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;gBAC/B,GAAG,CAAC,uEAAuE,CAAC,CAAC;YAC/E,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,yBAAyB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnF,GAAG,CAAC,oEAAoE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,gFAAgF,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;AACP,CAAC"}

package/dist/services/scratch-asset-promote.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Promote a conversation-scratch file (image OR doc) into a curated,
+ * library-visible asset (composer-vision-attach / E2a "Save to library",
+ * generalized to any file in PR3).
+ *
+ * Uploaded scratch files live in the `chat-scratch/{sessionId}/{fileId}/{filename}`
+ * keyspace with NO asset-index row — they're ephemeral conversation context,
+ * not catalogued assets (see the E2a section of
+ * `~/.claude/plans/composer-vision-attach.md`). This service is the deliberate
+ * retention path: it copies the scratch bytes into a FREE-STANDING asset (new
+ * immutable assetId + index row + caption trigger), exactly like the global
+ * asset-manager upload, so the result shows up in the asset library.
+ *
+ * Default destination = the reserved workspace-wide "Assets" folder
+ * (`workspace-assets`), which is lazily auto-provisioned and undeletable — so
+ * unlike a per-user personal folder it is ALWAYS resolvable and writable by any
+ * member. The user can then move it into a specific folder via the existing
+ * asset-manager move UI. A caller may override with an explicit `targetRepo`
+ * (the agent tool exposes this as a `folder` argument); we verify write access
+ * to it first.
+ *
+ * The scratch copy is intentionally LEFT in place — it remains the
+ * conversation's vision context and is cleaned up when the chat is deleted.
+ */
+import type { WorkspaceManager } from '../core/workspace-manager.js';
+import type { ChatSessionService } from './chat-session-service.js';
+import type { AuthService, AuthUser } from './auth-service.js';
+/** Typed failure so callers (HTTP route / agent tool) can map to the right
+ *  status / message instead of string-matching. */
+export type PromoteScratchErrorCode = 'SCRATCH_NOT_FOUND' | 'NO_WRITE_ACCESS' | 'NOT_SAVABLE' | 'STORAGE_UNAVAILABLE';
+export declare class PromoteScratchError extends Error {
+    code: PromoteScratchErrorCode;
+    constructor(code: PromoteScratchErrorCode, message: string);
+}
+export interface PromoteScratchResult {
+    assetId: string;
+    /** Canonical immutable public URL of the new asset. */
+    url: string;
+    /** Folder the asset now lives in. */
+    repo: string;
+    filename: string;
+    /** Human display name recorded on the asset row. */
+    displayName: string;
+}
+/**
+ * Promote one scratch file (image OR doc) to a free-standing asset. Returns the
+ * new asset's coordinates. Throws {@link PromoteScratchError} on the typed
+ * failures above.
+ */
+export declare function promoteScratchFileToAssets(workspaceManager: WorkspaceManager, chatSessionService: ChatSessionService, authService: AuthService, args: {
+    sessionId: string;
+    fileId: string;
+    /** The authenticated caller (owner check + write-access check). */
+    user: AuthUser;
+    /** Optional explicit destination folder; defaults to the Assets store. */
+    targetRepo?: string;
+}): Promise<PromoteScratchResult>;

package/dist/services/scratch-asset-promote.js

@@ -0,0 +1,95 @@
+/**
+ * Promote a conversation-scratch file (image OR doc) into a curated,
+ * library-visible asset (composer-vision-attach / E2a "Save to library",
+ * generalized to any file in PR3).
+ *
+ * Uploaded scratch files live in the `chat-scratch/{sessionId}/{fileId}/{filename}`
+ * keyspace with NO asset-index row — they're ephemeral conversation context,
+ * not catalogued assets (see the E2a section of
+ * `~/.claude/plans/composer-vision-attach.md`). This service is the deliberate
+ * retention path: it copies the scratch bytes into a FREE-STANDING asset (new
+ * immutable assetId + index row + caption trigger), exactly like the global
+ * asset-manager upload, so the result shows up in the asset library.
+ *
+ * Default destination = the reserved workspace-wide "Assets" folder
+ * (`workspace-assets`), which is lazily auto-provisioned and undeletable — so
+ * unlike a per-user personal folder it is ALWAYS resolvable and writable by any
+ * member. The user can then move it into a specific folder via the existing
+ * asset-manager move UI. A caller may override with an explicit `targetRepo`
+ * (the agent tool exposes this as a `folder` argument); we verify write access
+ * to it first.
+ *
+ * The scratch copy is intentionally LEFT in place — it remains the
+ * conversation's vision context and is cleaned up when the chat is deleted.
+ */
+import { Workspace } from '../core/workspace.js';
+import { resolveWorkspaceAssetsRepo } from './workspace-assets-folder.js';
+import { deriveAssetDisplayName } from '../core/embeds.js';
+import * as access from './access-control.js';
+export class PromoteScratchError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'PromoteScratchError';
+    }
+}
+/**
+ * Promote one scratch file (image OR doc) to a free-standing asset. Returns the
+ * new asset's coordinates. Throws {@link PromoteScratchError} on the typed
+ * failures above.
+ */
+export async function promoteScratchFileToAssets(workspaceManager, chatSessionService, authService, args) {
+    const { sessionId, fileId, user, targetRepo } = args;
+    // 1. Authorize: the scratch row must exist AND be owned by the caller. Same
+    //    fail-closed posture as the serve route — never reveal another user's row.
+    const row = chatSessionService.getScratchFile(sessionId, fileId);
+    if (!row || row.userId !== user.id) {
+        throw new PromoteScratchError('SCRATCH_NOT_FOUND', 'File not found.');
+    }
+    // A library-sourced file is ALREADY a curated asset — nothing to promote.
+    if (row.source === 'library') {
+        throw new PromoteScratchError('NOT_SAVABLE', 'This file is already in your library.');
+    }
+    // 2. Resolve the destination folder.
+    let repo;
+    if (targetRepo) {
+        if (!access.canWriteRepo(user, targetRepo, workspaceManager, authService)) {
+            throw new PromoteScratchError('NO_WRITE_ACCESS', `You can't save to "${targetRepo}".`);
+        }
+        repo = targetRepo;
+    }
+    else {
+        // Default: the reserved workspace-wide Assets store (lazy create-if-missing,
+        // undeletable → always resolvable + writable by any member).
+        const workspace = new Workspace(workspaceManager.getWorkspacePath());
+        repo = await resolveWorkspaceAssetsRepo(workspace, workspaceManager);
+    }
+    // 3. Copy bytes from the scratch blob into a free-standing asset on `repo`.
+    //    The graph for the destination repo records the index row under THIS repo
+    //    and reaches the same workspace-global blob backend the scratch bytes live
+    //    in, so download + upload share one backend.
+    const graph = workspaceManager.getGraph(repo);
+    const svc = graph.getAssetService?.();
+    if (!svc) {
+        throw new PromoteScratchError('STORAGE_UNAVAILABLE', 'Asset storage is not configured.');
+    }
+    const bytes = await svc.download(row.blobKey);
+    const displayName = deriveAssetDisplayName(row.filename) || row.filename;
+    const stored = await graph.uploadAsset('material', // ignored for ownership when `owner` is set
+    'asset', // ignored
+    row.filename, bytes, row.contentType, // preserve the file's MIME (image or doc)
+    {
+        owner: { type: 'folder', id: repo }, // free-standing, folder-owned
+        uploaderUserId: String(user.id),
+        name: displayName,
+    });
+    return {
+        assetId: stored.assetId,
+        url: stored.publicUrl,
+        repo,
+        filename: stored.filename,
+        displayName,
+    };
+}
+//# sourceMappingURL=scratch-asset-promote.js.map

package/dist/services/scratch-asset-promote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scratch-asset-promote.js","sourceRoot":"","sources":["../../src/services/scratch-asset-promote.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAC;AAU9C,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACzB;IAAnB,YAAmB,IAA6B,EAAE,OAAe;QAC/D,KAAK,CAAC,OAAO,CAAC,CAAC;QADE,SAAI,GAAJ,IAAI,CAAyB;QAE9C,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAaD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,gBAAkC,EAClC,kBAAsC,EACtC,WAAwB,EACxB,IAOC;IAED,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAErD,4EAA4E;IAC5E,+EAA+E;IAC/E,MAAM,GAAG,GAAG,kBAAkB,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACjE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;IACxE,CAAC;IACD,0EAA0E;IAC1E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,mBAAmB,CAAC,aAAa,EAAE,uCAAuC,CAAC,CAAC;IACxF,CAAC;IAED,qCAAqC;IACrC,IAAI,IAAY,CAAC;IACjB,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,sBAAsB,UAAU,IAAI,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,GAAG,UAAU,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,6EAA6E;QAC7E,6DAA6D;QAC7D,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACrE,IAAI,GAAG,MAAM,0BAA0B,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACvE,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,+EAA+E;IAC/E,iDAAiD;IACjD,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;IACtC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,EAAE,kCAAkC,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CACpC,UAAwB,EAAE,4CAA4C;IACtE,OAAO,EAAmB,UAAU;IACpC,GAAG,CAAC,QAAQ,EACZ,KAAK,EACL,GAAG,CAAC,WAAW,EAAW,0CAA0C;IACpE;QACE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,8BAA8B;QACnE,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,IAAI,EAAE,WAAW;KAClB,CACF,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAQ;QACxB,GAAG,EAAE,MAAM,CAAC,SAAS;QACrB,IAAI;QACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW;KACZ,CAAC;AACJ,CAAC"}