studiograph 1.3.48-next.26 → 1.3.48-next.261

package/dist/core/commit-messages.js

@@ -0,0 +1,85 @@
+/**
+ * Human-readable commit messages for entity + folder mutations.
+ *
+ * These strings are display-only — nothing parses them for behavior. Restore
+ * keys off the commit hash + the entity from the request, and the audit log
+ * only records the string. They surface in `git log`, the audit log, MCP file
+ * history, and any future cross-entity history view, where the entity name +
+ * type IS the useful context.
+ *
+ * The per-entity History panel renders its own change summary (computed from
+ * the file diff) and does NOT show these messages, so we optimize purely for
+ * how they read in a flat log.
+ *
+ * Format decisions:
+ *  - Past tense ("Created", "Edited", "Moved") — it's a log of what happened.
+ *  - `"Display Title" (Type)` — the title in quotes, the friendly type in parens.
+ *  - Batches enumerate up to 3 names + "(+N more)".
+ */
+/** Cap a title so it can't blow out a one-line subject. */
+const MAX_TITLE = 80;
+/**
+ * Title-case an internal type key for display:
+ *   "deal" → "Deal", "meeting_note" → "Meeting Note".
+ * Built-in types have no stored label, so this is their friendly name.
+ */
+export function titleCaseType(type) {
+    const cased = type
+        .split(/[_-]+/)
+        .filter(Boolean)
+        .map((w) => w.charAt(0).toUpperCase() + w.slice(1))
+        .join(' ');
+    return cased || type;
+}
+/** Collapse whitespace and cap length so a title is safe in a subject line. */
+function cleanTitle(title) {
+    if (!title)
+        return '';
+    const flat = String(title).replace(/\s+/g, ' ').trim();
+    return flat.length > MAX_TITLE ? `${flat.slice(0, MAX_TITLE - 1)}…` : flat;
+}
+/** The user-facing name for an entity: cleaned title, or the slug as fallback. */
+function displayName(ref) {
+    return cleanTitle(ref.title) || ref.id;
+}
+/** `"Acme Corp Redesign" (Deal)` */
+export function entityLabel(ref) {
+    return `"${displayName(ref)}" (${ref.typeLabel})`;
+}
+/** Just the quoted name (no type) — for batch enumeration. */
+function quotedName(ref) {
+    return `"${displayName(ref)}"`;
+}
+/** `"A", "B", "C" (+2 more)` — enumerate up to `max` names. */
+function enumerateNames(refs, max = 3) {
+    const names = refs.map(quotedName);
+    if (names.length <= max)
+        return names.join(', ');
+    return `${names.slice(0, max).join(', ')} (+${names.length - max} more)`;
+}
+const plural = (n) => (n === 1 ? 'entry' : 'entries');
+export const commitMessage = {
+    created: (ref) => `Created ${entityLabel(ref)}`,
+    edited: (ref) => `Edited ${entityLabel(ref)}`,
+    editedBatch: (refs) => `Edited ${enumerateNames(refs)}`,
+    deleted: (ref) => `Deleted ${entityLabel(ref)}`,
+    deletedBatch: (refs) => `Deleted ${enumerateNames(refs)}`,
+    /** Rename changes the slug id; the title may be unchanged, so show the ids. */
+    renamed: (typeLabel, oldId, newId) => `Renamed "${oldId}" → "${newId}" (${typeLabel})`,
+    changedType: (ref, fromLabel, toLabel) => `Changed ${quotedName(ref)} from ${fromLabel} to ${toLabel}`,
+    /** `folder` is the destination path display, or "(root)" for the repo root. */
+    movedTo: (ref, folder) => `Moved ${entityLabel(ref)} → ${folder}`,
+    /** Bulk move: count + destination reads cleaner than enumerate + target. */
+    movedBatch: (count, where) => `Moved ${count} ${plural(count)} → ${where}`,
+    receivedBatch: (count, fromRepo) => `Received ${count} ${plural(count)} from ${fromRepo}`,
+    restored: (ref, shortHash) => `Restored ${entityLabel(ref)} from ${shortHash}`,
+    relinked: (oldId, newId) => `Relinked "${oldId}" → "${newId}"`,
+    // Folders are path-based (no type/title).
+    folderCreated: (path) => `Created folder "${path}"`,
+    folderRenamed: (from, to) => `Renamed folder "${from}" → "${to}"`,
+    folderDisplayRenamed: (path) => `Renamed folder "${path}"`,
+    folderDeleted: (path) => `Deleted folder "${path}"`,
+    folderMoved: (from, toRepo, to) => `Moved folder "${from}" → ${toRepo}:${to || '/'}`,
+    folderReceived: (fromRepo, from, to) => `Received folder from ${fromRepo}:${from} → ${to || '/'}`,
+};
+//# sourceMappingURL=commit-messages.js.map

package/dist/core/commit-messages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commit-messages.js","sourceRoot":"","sources":["../../src/core/commit-messages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,2DAA2D;AAC3D,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI;SACf,KAAK,CAAC,OAAO,CAAC;SACd,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAClD,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC;AAED,+EAA+E;AAC/E,SAAS,UAAU,CAAC,KAAqB;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,OAAO,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7E,CAAC;AAWD,kFAAkF;AAClF,SAAS,WAAW,CAAC,GAAc;IACjC,OAAO,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;AACzC,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,WAAW,CAAC,GAAc;IACxC,OAAO,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,SAAS,GAAG,CAAC;AACpD,CAAC;AAED,8DAA8D;AAC9D,SAAS,UAAU,CAAC,GAAc;IAChC,OAAO,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;AACjC,CAAC;AAED,+DAA+D;AAC/D,SAAS,cAAc,CAAC,IAAiB,EAAE,GAAG,GAAG,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,MAAM,GAAG,GAAG,QAAQ,CAAC;AAC3E,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAE9D,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,CAAC,GAAc,EAAE,EAAE,CAAC,WAAW,WAAW,CAAC,GAAG,CAAC,EAAE;IAC1D,MAAM,EAAE,CAAC,GAAc,EAAE,EAAE,CAAC,UAAU,WAAW,CAAC,GAAG,CAAC,EAAE;IACxD,WAAW,EAAE,CAAC,IAAiB,EAAE,EAAE,CAAC,UAAU,cAAc,CAAC,IAAI,CAAC,EAAE;IAEpE,OAAO,EAAE,CAAC,GAAc,EAAE,EAAE,CAAC,WAAW,WAAW,CAAC,GAAG,CAAC,EAAE;IAC1D,YAAY,EAAE,CAAC,IAAiB,EAAE,EAAE,CAAC,WAAW,cAAc,CAAC,IAAI,CAAC,EAAE;IAEtE,+EAA+E;IAC/E,OAAO,EAAE,CAAC,SAAiB,EAAE,KAAa,EAAE,KAAa,EAAE,EAAE,CAC3D,YAAY,KAAK,QAAQ,KAAK,MAAM,SAAS,GAAG;IAElD,WAAW,EAAE,CAAC,GAAc,EAAE,SAAiB,EAAE,OAAe,EAAE,EAAE,CAClE,WAAW,UAAU,CAAC,GAAG,CAAC,SAAS,SAAS,OAAO,OAAO,EAAE;IAE9D,+EAA+E;IAC/E,OAAO,EAAE,CAAC,GAAc,EAAE,MAAc,EAAE,EAAE,CAAC,SAAS,WAAW,CAAC,GAAG,CAAC,MAAM,MAAM,EAAE;IAEpF,4EAA4E;IAC5E,UAAU,EAAE,CAAC,KAAa,EAAE,KAAa,EAAE,EAAE,CAAC,SAAS,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,EAAE;IAC1F,aAAa,EAAE,CAAC,KAAa,EAAE,QAAgB,EAAE,EAAE,CACjD,YAAY,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,QAAQ,EAAE;IAEvD,QAAQ,EAAE,CAAC,GAAc,EAAE,SAAiB,EAAE,EAAE,CAAC,YAAY,WAAW,CAAC,GAAG,CAAC,SAAS,SAAS,EAAE;IAEjG,QAAQ,EAAE,CAAC,KAAa,EAAE,KAAa,EAAE,EAAE,CAAC,aAAa,KAAK,QAAQ,KAAK,GAAG;IAE9E,0CAA0C;IAC1C,aAAa,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,mBAAmB,IAAI,GAAG;IAC3D,aAAa,EAAE,CAAC,IAAY,EAAE,EAAU,EAAE,EAAE,CAAC,mBAAmB,IAAI,QAAQ,EAAE,GAAG;IACjF,oBAAoB,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,mBAAmB,IAAI,GAAG;IAClE,aAAa,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,mBAAmB,IAAI,GAAG;IAC3D,WAAW,EAAE,CAAC,IAAY,EAAE,MAAc,EAAE,EAAU,EAAE,EAAE,CACxD,iBAAiB,IAAI,OAAO,MAAM,IAAI,EAAE,IAAI,GAAG,EAAE;IACnD,cAAc,EAAE,CAAC,QAAgB,EAAE,IAAY,EAAE,EAAU,EAAE,EAAE,CAC7D,wBAAwB,QAAQ,IAAI,IAAI,MAAM,EAAE,IAAI,GAAG,EAAE;CAC5D,CAAC"}

package/dist/core/embeds.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Asset-embed extraction + diffing.
+ *
+ * Entry bodies reference binary assets two ways:
+ *   - Obsidian-style transclusion embeds:  ![[Foo.png]]  /  ![[Foo.png|alt]]
+ *   - Standard markdown images:            ![alt](/api/assets/asset/<id>/<file>)
+ *
+ * Asset *binaries* live outside git (the workspace `.studiograph/assets/`
+ * tree for the local backend, or Cloudflare R2), so git history can only ever
+ * recover the *reference* — the embed text in the body, not the bytes. These
+ * helpers let the write path detect when a whole-body rewrite would drop a
+ * reference the prior body had, and let the history tools report which embeds
+ * exist at a given revision.
+ *
+ * Callers pass the markdown body (post-frontmatter). Embed syntax is a body
+ * construct; frontmatter is not scanned.
+ */
+/**
+ * Extract every embedded asset reference from a markdown body,
+ * de-duplicated, transclusions first then markdown images. Returns the raw
+ * target (transclusion target or image URL) so callers can compare
+ * references across revisions and surface them to users/agents.
+ */
+export declare function extractAssetEmbeds(body: string): string[];
+/**
+ * The canonical, render-safe markdown embed for an asset: `![filename](url)`.
+ * This is exactly what the editor inserts on drop/paste
+ * (web FormattingPalette), so any agent-placed embed that uses this form is
+ * guaranteed to render. Agents must NOT invent `![[filename]]` transclusion
+ * placeholders — those don't resolve to a stored asset and render as dead text.
+ */
+export declare function assetEmbed(filename: string, url: string): string;
+/**
+ * Derive a human display name from a filename: drop the extension, turn
+ * `_`/`-` runs into spaces, and Title-Case each word
+ * (`haneya_sake.jpg` → `Haneya Sake`). Shared by every free-standing-asset
+ * creation path (manager upload, presign finalize, chat-image promote) so the
+ * label rule never drifts. Returns "" for an extension-only name; callers add
+ * their own fallback (filename / assetId).
+ */
+export declare function deriveAssetDisplayName(filename: string): string;
+/**
+ * References present in `before` but absent from `after` — i.e. embeds a
+ * body rewrite would drop. Set semantics on the CANONICALIZED reference
+ * (decoded asset identity — see {@link canonicalAssetRef}); the returned
+ * strings are the original `before` refs so messages show what the body said.
+ */
+export declare function droppedAssetEmbeds(before: string, after: string): string[];
+/**
+ * Strip a leading YAML frontmatter block (`---\n…\n---`) so embed extraction
+ * runs against the body only. Returns the input unchanged when there is no
+ * frontmatter. Mirrors the lightweight frontmatter sniff the history tools
+ * already use, avoiding a full markdown parse for a read-only report.
+ */
+export declare function stripFrontmatter(fileContent: string): string;
+export interface LegacyAssetRef {
+    /** Full matched URL, e.g. /api/assets/note/critique/172-shot.png */
+    url: string;
+    /** Storage key {type}/{id}/{filename} the blob lives at today. */
+    oldKey: string;
+    type: string;
+    id: string;
+    filename: string;
+}
+/** Every legacy `/api/assets/{type}/{id}/{filename}` reference in a file,
+ *  de-duplicated by URL. Pass the RAW file (frontmatter + body). */
+export declare function extractLegacyAssetUrls(fileContent: string): LegacyAssetRef[];
+/**
+ * Rewrite every immutable `/api/assets/{assetId}/{filename}` reference in a
+ * body via `replace(assetId, filename)`. Legacy three-segment URLs and
+ * `![[transclusions]]` are left untouched. Used by the public share read to
+ * point embedded images at the token-scoped `/api/share/{token}/asset/...`
+ * surface without leaking the authed `/api/assets` URLs to guests.
+ *
+ * D5 identity contract: `filename` reaches the callback DECODED (the raw
+ * stored name). A callback that emits a URL must percent-encode the segment
+ * it splices (`encodeAssetFilename`) — emitting the raw name breaks markdown/
+ * HTML URL parsing on spaces and parens.
+ */
+export declare function rewriteImmutableAssetUrls(body: string, replace: (assetId: string, filename: string) => string): string;
+/**
+ * Every immutable `/api/assets/{assetId}/{filename}` reference embedded in a
+ * body, de-duplicated by `{assetId}/{filename}`. Uses the SAME grammar as
+ * `rewriteImmutableAssetUrls` (the public share read rewrites exactly these
+ * URLs), so the public asset handler can scope itself to the assets a shared
+ * entry actually embeds — not every asset that merely shares its repo. Legacy
+ * three-segment URLs and `![[transclusions]]` are intentionally ignored, the
+ * same way the rewrite leaves them untouched.
+ *
+ * D5 identity contract: `filename` is the DECODED raw stored name, directly
+ * comparable to `assets.db.filename` and to a Fastify-decoded route param —
+ * comparing the encoded URL segment against either was the latent
+ * special-char 404 on public shares (share-api embedded-asset check).
+ */
+export declare function extractImmutableAssetRefs(body: string): Array<{
+    assetId: string;
+    filename: string;
+}>;
+/**
+ * Every immutable assetId an entity embeds — in its markdown `body` OR any
+ * string frontmatter value (e.g. a `thumbnail` / `link` url, or an array of
+ * urls). De-duplicated. This is the single definition of "what assets does this
+ * entry embed", shared by the caption fold (`VectorService.resolveEmbeddedCaptions`,
+ * which reads each embedded image's caption into the entry's search text) and
+ * the caption sweep's embedder re-index — so the two never disagree on coverage.
+ * A cheap substring pre-check skips the regex for the common no-asset entry.
+ */
+export declare function embeddedAssetIds(body: string, frontmatter: Record<string, unknown>): Set<string>;

package/dist/core/embeds.js

@@ -0,0 +1,226 @@
+/**
+ * Asset-embed extraction + diffing.
+ *
+ * Entry bodies reference binary assets two ways:
+ *   - Obsidian-style transclusion embeds:  ![[Foo.png]]  /  ![[Foo.png|alt]]
+ *   - Standard markdown images:            ![alt](/api/assets/asset/<id>/<file>)
+ *
+ * Asset *binaries* live outside git (the workspace `.studiograph/assets/`
+ * tree for the local backend, or Cloudflare R2), so git history can only ever
+ * recover the *reference* — the embed text in the body, not the bytes. These
+ * helpers let the write path detect when a whole-body rewrite would drop a
+ * reference the prior body had, and let the history tools report which embeds
+ * exist at a given revision.
+ *
+ * Callers pass the markdown body (post-frontmatter). Embed syntax is a body
+ * construct; frontmatter is not scanned.
+ */
+// ![[target]] or ![[target|alias]] — capture the target (pre-pipe).
+const TRANSCLUSION_RE = /!\[\[([^\]|]+)(?:\|[^\]]*)?\]\]/g;
+// ![alt](url) — capture the url. Stops at the first closing paren; asset
+// embed URLs in this app never contain parens.
+const MARKDOWN_IMAGE_RE = /!\[[^\]]*\]\(([^)]+)\)/g;
+// D5 identity (decode-at-parse-boundary): URL segments are percent-encoded on
+// emit (`encodeAssetFilename`), while the asset index (`row.filename`) and a
+// Fastify-decoded route param speak the raw name. Everything that REASONS
+// about identity uses the decoded form; everything that EMITS a URL must
+// re-encode. One owner for both directions: core/artifact-asset-urls.
+import { decodeAssetFilenameSegment } from './artifact-asset-urls.js';
+/**
+ * Extract every embedded asset reference from a markdown body,
+ * de-duplicated, transclusions first then markdown images. Returns the raw
+ * target (transclusion target or image URL) so callers can compare
+ * references across revisions and surface them to users/agents.
+ */
+export function extractAssetEmbeds(body) {
+    if (!body)
+        return [];
+    const out = [];
+    const seen = new Set();
+    const push = (ref) => {
+        const trimmed = ref.trim();
+        if (!trimmed || seen.has(trimmed))
+            return;
+        seen.add(trimmed);
+        out.push(trimmed);
+    };
+    let m;
+    TRANSCLUSION_RE.lastIndex = 0;
+    while ((m = TRANSCLUSION_RE.exec(body)) !== null)
+        push(m[1]);
+    MARKDOWN_IMAGE_RE.lastIndex = 0;
+    while ((m = MARKDOWN_IMAGE_RE.exec(body)) !== null)
+        push(m[1]);
+    return out;
+}
+/**
+ * The canonical, render-safe markdown embed for an asset: `![filename](url)`.
+ * This is exactly what the editor inserts on drop/paste
+ * (web FormattingPalette), so any agent-placed embed that uses this form is
+ * guaranteed to render. Agents must NOT invent `![[filename]]` transclusion
+ * placeholders — those don't resolve to a stored asset and render as dead text.
+ */
+export function assetEmbed(filename, url) {
+    return `![${filename}](${url})`;
+}
+/**
+ * Derive a human display name from a filename: drop the extension, turn
+ * `_`/`-` runs into spaces, and Title-Case each word
+ * (`haneya_sake.jpg` → `Haneya Sake`). Shared by every free-standing-asset
+ * creation path (manager upload, presign finalize, chat-image promote) so the
+ * label rule never drifts. Returns "" for an extension-only name; callers add
+ * their own fallback (filename / assetId).
+ */
+export function deriveAssetDisplayName(filename) {
+    const stem = filename.replace(/\.[^.]+$/, '');
+    return stem.replace(/[_-]+/g, ' ').replace(/\b\w/g, (c) => c.toUpperCase());
+}
+/**
+ * Canonicalize an embed reference for identity comparison: any immutable
+ * `/api/assets/<assetId>/<filename>` URL inside it has its filename segment
+ * decoded to the RAW stored name. An editor-inserted encoded embed
+ * (`page%281%29.png`) and an agent-re-emitted raw one are the SAME asset —
+ * comparing the verbatim strings false-tripped ASSET_REMOVAL_BLOCKED on
+ * rewrites that didn't drop anything. Non-asset refs pass through unchanged.
+ */
+function canonicalAssetRef(ref) {
+    return ref.replace(IMMUTABLE_ASSET_URL_RE, (_m, assetId, filename) => `/api/assets/${assetId}/${decodeAssetFilenameSegment(filename)}`);
+}
+/**
+ * References present in `before` but absent from `after` — i.e. embeds a
+ * body rewrite would drop. Set semantics on the CANONICALIZED reference
+ * (decoded asset identity — see {@link canonicalAssetRef}); the returned
+ * strings are the original `before` refs so messages show what the body said.
+ */
+export function droppedAssetEmbeds(before, after) {
+    const beforeRefs = extractAssetEmbeds(before);
+    if (beforeRefs.length === 0)
+        return [];
+    const afterRefs = new Set(extractAssetEmbeds(after).map(canonicalAssetRef));
+    return beforeRefs.filter((ref) => !afterRefs.has(canonicalAssetRef(ref)));
+}
+/**
+ * Strip a leading YAML frontmatter block (`---\n…\n---`) so embed extraction
+ * runs against the body only. Returns the input unchanged when there is no
+ * frontmatter. Mirrors the lightweight frontmatter sniff the history tools
+ * already use, avoiding a full markdown parse for a read-only report.
+ */
+export function stripFrontmatter(fileContent) {
+    return fileContent.replace(/^---\s*\n[\s\S]*?\n---\s*\n?/, '');
+}
+// Three path segments after /api/assets/ (type/id/filename). New-scheme URLs
+// have only two (assetId/filename), so they never match — the migration is
+// idempotent against already-rewritten content. Segments stop at the chars
+// that terminate a URL in markdown/YAML: whitespace, ) " ' ]. The backslash is
+// in the terminator set too: inside an artifact's JSON-bundle body a URL is
+// serialized as `\"/api/assets/<type>/<id>/<file>\"`, so without it the filename
+// group would greedily eat the trailing `\` (capturing `icon.png\`), the blob
+// lookup would miss, and the migration would silently skip the embedded URL.
+const LEGACY_ASSET_URL_RE = /\/api\/assets\/([^/\s)"'\\\]]+)\/([^/\s)"'\\\]]+)\/([^/\s)"'\\\]]+)/g;
+/** Every legacy `/api/assets/{type}/{id}/{filename}` reference in a file,
+ *  de-duplicated by URL. Pass the RAW file (frontmatter + body). */
+export function extractLegacyAssetUrls(fileContent) {
+    if (!fileContent)
+        return [];
+    const out = [];
+    const seen = new Set();
+    let m;
+    LEGACY_ASSET_URL_RE.lastIndex = 0;
+    while ((m = LEGACY_ASSET_URL_RE.exec(fileContent)) !== null) {
+        const url = m[0];
+        if (seen.has(url))
+            continue;
+        seen.add(url);
+        out.push({ url, type: m[1], id: m[2], filename: m[3], oldKey: `${m[1]}/${m[2]}/${m[3]}` });
+    }
+    return out;
+}
+// ── Immutable-key asset URLs ──────────────────────────────────────────────
+//
+// New-scheme references have exactly two segments after /api/assets/:
+// `{assetId}/{filename}`. Uses the SAME terminator set as LEGACY_ASSET_URL_RE
+// (whitespace, ) " ' ] \) plus < > for raw HTML `src`, so both grammars classify
+// URL boundaries identically. The backslash terminator matters for the share
+// read + asset allowlist (share-api.ts), which run this grammar over ANY shared
+// body — including an artifact's JSON bundle, where a 2-segment URL is serialized
+// as `\"/api/assets/<assetId>/<file>\"`; without it the filename group eats the
+// trailing `\` (→ `file.png\`), so the rewrite emits a wrong share URL and the
+// embed-allowlist check fails the image closed. The trailing lookahead pins the
+// match to two segments (filename is the last segment), so a three-segment legacy
+// URL — whose second segment is followed by another `/` — never matches.
+const IMMUTABLE_ASSET_URL_RE = /\/api\/assets\/([^/\s)"'\\\]<>]+)\/([^/\s)"'\\\]<>]+)(?=[\s)"'\\\]<>]|$)/g;
+/**
+ * Rewrite every immutable `/api/assets/{assetId}/{filename}` reference in a
+ * body via `replace(assetId, filename)`. Legacy three-segment URLs and
+ * `![[transclusions]]` are left untouched. Used by the public share read to
+ * point embedded images at the token-scoped `/api/share/{token}/asset/...`
+ * surface without leaking the authed `/api/assets` URLs to guests.
+ *
+ * D5 identity contract: `filename` reaches the callback DECODED (the raw
+ * stored name). A callback that emits a URL must percent-encode the segment
+ * it splices (`encodeAssetFilename`) — emitting the raw name breaks markdown/
+ * HTML URL parsing on spaces and parens.
+ */
+export function rewriteImmutableAssetUrls(body, replace) {
+    return body.replace(IMMUTABLE_ASSET_URL_RE, (_m, assetId, filename) => replace(assetId, decodeAssetFilenameSegment(filename)));
+}
+/**
+ * Every immutable `/api/assets/{assetId}/{filename}` reference embedded in a
+ * body, de-duplicated by `{assetId}/{filename}`. Uses the SAME grammar as
+ * `rewriteImmutableAssetUrls` (the public share read rewrites exactly these
+ * URLs), so the public asset handler can scope itself to the assets a shared
+ * entry actually embeds — not every asset that merely shares its repo. Legacy
+ * three-segment URLs and `![[transclusions]]` are intentionally ignored, the
+ * same way the rewrite leaves them untouched.
+ *
+ * D5 identity contract: `filename` is the DECODED raw stored name, directly
+ * comparable to `assets.db.filename` and to a Fastify-decoded route param —
+ * comparing the encoded URL segment against either was the latent
+ * special-char 404 on public shares (share-api embedded-asset check).
+ */
+export function extractImmutableAssetRefs(body) {
+    if (!body)
+        return [];
+    const out = [];
+    const seen = new Set();
+    let m;
+    IMMUTABLE_ASSET_URL_RE.lastIndex = 0;
+    while ((m = IMMUTABLE_ASSET_URL_RE.exec(body)) !== null) {
+        const filename = decodeAssetFilenameSegment(m[2]);
+        const key = `${m[1]}/${filename}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push({ assetId: m[1], filename });
+    }
+    return out;
+}
+/**
+ * Every immutable assetId an entity embeds — in its markdown `body` OR any
+ * string frontmatter value (e.g. a `thumbnail` / `link` url, or an array of
+ * urls). De-duplicated. This is the single definition of "what assets does this
+ * entry embed", shared by the caption fold (`VectorService.resolveEmbeddedCaptions`,
+ * which reads each embedded image's caption into the entry's search text) and
+ * the caption sweep's embedder re-index — so the two never disagree on coverage.
+ * A cheap substring pre-check skips the regex for the common no-asset entry.
+ */
+export function embeddedAssetIds(body, frontmatter) {
+    const ids = new Set();
+    const scan = (s) => {
+        if (!s || s.indexOf('/api/assets/') === -1)
+            return;
+        for (const ref of extractImmutableAssetRefs(s))
+            ids.add(ref.assetId);
+    };
+    scan(body);
+    for (const v of Object.values(frontmatter)) {
+        if (typeof v === 'string')
+            scan(v);
+        else if (Array.isArray(v))
+            for (const x of v)
+                if (typeof x === 'string')
+                    scan(x);
+    }
+    return ids;
+}
+//# sourceMappingURL=embeds.js.map

package/dist/core/embeds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"embeds.js","sourceRoot":"","sources":["../../src/core/embeds.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,oEAAoE;AACpE,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAC3D,yEAAyE;AACzE,+CAA+C;AAC/C,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AAEpD,8EAA8E;AAC9E,6EAA6E;AAC7E,0EAA0E;AAC1E,yEAAyE;AACzE,sEAAsE;AACtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAEtE;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO;QAC1C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC,CAAC;IACF,IAAI,CAAyB,CAAC;IAC9B,eAAe,CAAC,SAAS,GAAG,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI;QAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,iBAAiB,CAAC,SAAS,GAAG,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI;QAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,GAAW;IACtD,OAAO,KAAK,QAAQ,KAAK,GAAG,GAAG,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,GAAW;IACpC,OAAO,GAAG,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,CACnE,eAAe,OAAO,IAAI,0BAA0B,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,KAAa;IAC9D,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC5E,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,OAAO,WAAW,CAAC,OAAO,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC;AACjE,CAAC;AAqBD,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,+EAA+E;AAC/E,4EAA4E;AAC5E,iFAAiF;AACjF,8EAA8E;AAC9E,6EAA6E;AAC7E,MAAM,mBAAmB,GAAG,sEAAsE,CAAC;AAEnG;oEACoE;AACpE,MAAM,UAAU,sBAAsB,CAAC,WAAmB;IACxD,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,CAAyB,CAAC;IAC9B,mBAAmB,CAAC,SAAS,GAAG,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5D,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6EAA6E;AAC7E,EAAE;AACF,sEAAsE;AACtE,8EAA8E;AAC9E,iFAAiF;AACjF,6EAA6E;AAC7E,gFAAgF;AAChF,kFAAkF;AAClF,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,kFAAkF;AAClF,yEAAyE;AACzE,MAAM,sBAAsB,GAAG,2EAA2E,CAAC;AAE3G;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAY,EACZ,OAAsD;IAEtD,OAAO,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,CACpE,OAAO,CAAC,OAAO,EAAE,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,GAAG,GAAiD,EAAE,CAAC;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,CAAyB,CAAC;IAC9B,sBAAsB,CAAC,SAAS,GAAG,CAAC,CAAC;IACrC,OAAO,CAAC,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACxD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,WAAoC;IACjF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,CAAS,EAAQ,EAAE;QAC/B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO;QACnD,KAAK,MAAM,GAAG,IAAI,yBAAyB,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3C,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,IAAI,CAAC,CAAC,CAAC,CAAC;aAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,KAAK,MAAM,CAAC,IAAI,CAAC;gBAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/core/entity-body-templates.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Built-in markdown body templates for each canonical entity type.
+ *
+ * Shared between:
+ *   - `src/core/schema-registry.ts` — server-side default-body lookup
+ *   - `web/src/lib/components/layout/Sidebar.svelte` — New Entry picker
+ *
+ * Previously the Sidebar shipped its own copy of this map, which drifted
+ * from the server version (e.g. `deck:` was briefly slides-renderer
+ * markup on the frontend while the server had a renderer-agnostic
+ * outline). Keeping one source avoids that trap.
+ *
+ * Pure data, no runtime deps — safe to import from the web bundle via
+ * the `@core/entity-body-templates` alias.
+ */
+export declare const BUILTIN_BODY_TEMPLATES: Record<string, string>;
+/**
+ * Look up the default body template for a canonical type.
+ * Returns null when the type has no template (e.g. `note`).
+ */
+export declare function getBuiltinBodyTemplate(entityType: string): string | null;

package/dist/core/entity-body-templates.js

@@ -0,0 +1,66 @@
+/**
+ * Built-in markdown body templates for each canonical entity type.
+ *
+ * Shared between:
+ *   - `src/core/schema-registry.ts` — server-side default-body lookup
+ *   - `web/src/lib/components/layout/Sidebar.svelte` — New Entry picker
+ *
+ * Previously the Sidebar shipped its own copy of this map, which drifted
+ * from the server version (e.g. `deck:` was briefly slides-renderer
+ * markup on the frontend while the server had a renderer-agnostic
+ * outline). Keeping one source avoids that trap.
+ *
+ * Pure data, no runtime deps — safe to import from the web bundle via
+ * the `@core/entity-body-templates` alias.
+ */
+export const BUILTIN_BODY_TEMPLATES = {
+    // CRM
+    person: '## Bio\n\n## Notes\n\n',
+    organization: '## Profile\n\n## Notes\n\n',
+    position: '## Responsibilities\n\n## Requirements\n\n## Notes\n\n',
+    deal: '## Opportunity\n\n## Scope\n\n## Next Actions\n\n## Notes\n\n',
+    // PM
+    project: '## Overview\n\n## Deliverables\n\n## Notes\n\n',
+    event: '## Summary\n\n## Notes\n\n## Action Items\n\n',
+    task: '## Description\n\n## Notes\n\n',
+    deliverable: '## Overview\n\n## Scope\n\n## Notes\n\n',
+    // KM — authored
+    document: '## Overview\n\n## Details\n\n',
+    deck: '## Outline\n\n## Slides\n\n## Speaker Notes\n\n',
+    artifact: `{
+  "artifactId": "untitled-artifact",
+  "title": "Untitled artifact",
+  "frames": [
+    {
+      "id": "frame-1",
+      "layout": "artboard",
+      "geometry": { "width": 1440, "height": 900 },
+      "content": ""
+    }
+  ]
+}
+`,
+    publication: '## Content\n\n## Distribution\n\n## Notes\n\n',
+    'case-study': '## Objective\n\n## Solution\n\n## Outcome\n\n## Team\n\n',
+    service: '## Overview\n\n## Steps\n\n## Best Practices\n\n**Do:**\n-\n\n**Don\'t:**\n-\n\n## Notes\n\n',
+    // skill: the body IS the prompt content the agent loads at runtime. The
+    // four-section scaffold mirrors Anthropic's recommended SKILL.md shape
+    // (when to trigger, how to run, hard constraints, reference material)
+    // minus the redundant h1 (title lives in frontmatter name).
+    skill: '## When to use\n- Trigger conditions\n- Scope boundaries\n\n## Workflow\n1. Step one\n2. Step two\n3. Step three\n\n## Rules\n- Hard requirements\n- Constraints\n- Anti-patterns\n\n## References\n- File paths\n- Examples\n- Templates\n',
+    // Capture
+    reference: '## Description\n\n## Notes\n\n',
+    // dataset body is CSV, not markdown. Start a picker-created dataset with a
+    // 3×3 grid (header row + three empty rows) so there's a usable shape to edit
+    // immediately. The header row IS the column list — there's no separate
+    // schema. The empty `,,` rows survive the grid's skipEmptyLines parse.
+    dataset: 'Column 1,Column 2,Column 3\n,,\n,,\n,,\n',
+};
+/**
+ * Look up the default body template for a canonical type.
+ * Returns null when the type has no template (e.g. `note`).
+ */
+export function getBuiltinBodyTemplate(entityType) {
+    return BUILTIN_BODY_TEMPLATES[entityType] ?? null;
+}
+//# sourceMappingURL=entity-body-templates.js.map

package/dist/core/entity-body-templates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-body-templates.js","sourceRoot":"","sources":["../../src/core/entity-body-templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAA2B;IAC5D,MAAM;IACN,MAAM,EAAW,wBAAwB;IACzC,YAAY,EAAK,4BAA4B;IAC7C,QAAQ,EAAS,wDAAwD;IACzE,IAAI,EAAa,+DAA+D;IAEhF,KAAK;IACL,OAAO,EAAU,gDAAgD;IACjE,KAAK,EAAY,+CAA+C;IAChE,IAAI,EAAa,gCAAgC;IACjD,WAAW,EAAM,yCAAyC;IAE1D,gBAAgB;IAChB,QAAQ,EAAS,+BAA+B;IAChD,IAAI,EAAa,iDAAiD;IAClE,QAAQ,EAAS;;;;;;;;;;;;CAYlB;IACC,WAAW,EAAM,+CAA+C;IAChE,YAAY,EAAK,0DAA0D;IAC3E,OAAO,EAAU,8FAA8F;IAC/G,wEAAwE;IACxE,uEAAuE;IACvE,sEAAsE;IACtE,4DAA4D;IAC5D,KAAK,EAAY,6OAA6O;IAE9P,UAAU;IACV,SAAS,EAAQ,gCAAgC;IACjD,2EAA2E;IAC3E,6EAA6E;IAC7E,uEAAuE;IACvE,uEAAuE;IACvE,OAAO,EAAU,0CAA0C;CAC5D,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACvD,OAAO,sBAAsB,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;AACpD,CAAC"}

package/dist/core/entity-types-catalog.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Curated entity-type catalog for Studiograph.
+ *
+ * The full canonical schema set lives in `validation.ts` (ENTITY_SCHEMAS).
+ * This file exposes two cross-cutting concerns:
+ *
+ * 1. `DEFAULT_BASIC_ENTITY_TYPES` — the small default set every fresh
+ *    workspace surfaces in the New Entry modal's "basic" tier. The tier
+ *    grows for each user as entries of other curated types appear in
+ *    folders that user can access (see the picker in
+ *    web/src/lib/components/entity/NewEntryTypePicker.svelte). There is no
+ *    persistent per-workspace "active set" — visibility is derived from
+ *    graph presence + folder permissions.
+ *
+ * 2. `CURATED_ENTITY_TYPE_DESCRIPTIONS` — short one-line descriptions for
+ *    every canonical type. Used by the agent system prompt, tool reference,
+ *    and the picker's detail pane.
+ *
+ * This module is pure data — no runtime dependencies on Node APIs or Zod —
+ * so it is safe to import from the web bundle via the
+ * `@core/entity-types-catalog` alias.
+ */
+/**
+ * Default "basic" tier for a fresh workspace. Just the three capture
+ * primitives — the answer to "what do you want to create right now?".
+ * Project / person / organization are organizational types that surface
+ * automatically via the presence-based rule the moment someone creates
+ * their first one. The picker augments this default with any curated
+ * types already present in folders the user can access.
+ */
+export declare const DEFAULT_BASIC_ENTITY_TYPES: readonly ["note", "event", "task"];
+export type DefaultBasicEntityType = typeof DEFAULT_BASIC_ENTITY_TYPES[number];
+export declare function isDefaultBasicEntityType(type: string): boolean;
+/**
+ * Notable fields for each canonical type — the ones worth surfacing in the
+ * New Entry picker's detail pane as "what this type captures" chips. Not a
+ * complete field list; that lives in the Zod schemas. Base fields
+ * (entity_type, entity_id, created_at, etc.) are never listed here.
+ *
+ * Labels are Title Case to match the user-facing property panel.
+ */
+export declare const CURATED_ENTITY_TYPE_FIELDS: Record<string, string[]>;
+export declare function getCuratedEntityTypeFields(type: string): readonly string[];
+/**
+ * One-line descriptions for every canonical entity type. Terse on purpose —
+ * full schema detail lives in validation.ts and is available on demand via
+ * the `get_entity_schema` tool.
+ */
+export declare const CURATED_ENTITY_TYPE_DESCRIPTIONS: Record<string, string>;
+/**
+ * The canonical list of curated entity types, in catalog order. Derived
+ * from CURATED_ENTITY_TYPE_DESCRIPTIONS so descriptions and the type list
+ * stay in sync without this module taking a Zod dependency.
+ */
+export declare const CURATED_ENTITY_TYPES: readonly string[];
+export declare function isCuratedEntityType(type: string): boolean;
+export declare function getCuratedEntityTypeDescription(type: string): string | undefined;
+/**
+ * Compute the "basic" tier of entity types for a given user:
+ * defaults ∪ curated types already present in folders the user can access.
+ * `presentTypes` comes from the permission-filtered /api/repos response —
+ * so this helper respects folder access for free. Non-curated types in
+ * `presentTypes` (e.g. workspace custom types) pass through unchanged.
+ */
+export declare function computeBasicEntityTypes(presentTypes: Iterable<string>): string[];