studiograph 1.3.48-next.26 → 1.3.48-next.261

package/dist/server/routes/asset-api.js

@@ -4,50 +4,320 @@
  * POST /api/repos/:repo/entities/:type/:id/assets — multipart image upload
  * GET  /api/assets/*                               — serve local assets
  */
-import { SINGULAR_TO_PLURAL } from '../../core/validation.js';
-import { existsSync, createReadStream, readFileSync, statSync } from 'fs';
+import { reqGitUser } from './graph-api-access.js';
+import * as access from '../../services/access-control.js';
+import { listRepoAssets, listWorkspaceAssets } from '../../services/asset-listing.js';
+import { createEntityFromAsset } from '../../services/asset-import-service.js';
+import { computeAssetDeleteImpact } from '../../services/asset-delete-impact.js';
+import { computeAssetMoveImpact } from '../../services/asset-move-impact.js';
+import { computeAssetReferenceIndex } from '../../services/asset-reference-index.js';
+import { assetDeleteDenialByAssetId } from '../../services/asset-delete-authz.js';
+import { resolveWorkspaceAssetsRepo } from '../../services/workspace-assets-folder.js';
+import { Workspace } from '../../core/workspace.js';
+import { existsSync, createReadStream, statSync } from 'fs';
 import { join, extname } from 'path';
-/**
- * Read the `name:` field from a markdown file's YAML frontmatter without a
- * full YAML parse. Returns null if the file can't be read or has no name.
- * Used by the asset manager to label assets by entity name without paying
- * the cost of a full markdownService.parseFile() per entity.
- */
-function extractEntityName(mdPath) {
-    try {
-        const raw = readFileSync(mdPath, 'utf-8');
-        // Frontmatter is always at the top; don't read past ~2KB.
-        const head = raw.slice(0, 2048);
-        if (!head.startsWith('---'))
-            return null;
-        const end = head.indexOf('\n---', 3);
-        const block = end === -1 ? head : head.slice(0, end);
-        // Match `name: value` or `name: "value"` or `name: 'value'`.
-        const match = block.match(/^name:\s*(?:'([^']*)'|"([^"]*)"|(.+?))\s*$/m);
-        if (!match)
-            return null;
-        return (match[1] ?? match[2] ?? match[3]).trim() || null;
-    }
-    catch {
-        return null;
-    }
+import { artifactAssetKey } from '../../services/artifact-asset-token.js';
+import { mintArtifactAssetTokenForText } from '../artifact-asset-mint.js';
+import { encodeAssetFilename } from '../../core/artifact-asset-urls.js';
+/** Max bytes proxied same-origin through the artifact-asset token path.
+ *  `downloadAssetById` buffers, so this guard (checked BEFORE download against
+ *  the index size) bounds memory. Images well under this; refuse unknown size. */
+const ARTIFACT_PROXY_MAX_BYTES = 25 * 1024 * 1024;
+/** Extensions the artifact-asset token proxy will serve — images + fonts only.
+ *  An artifact embeds these; a same-repo doc/dataset/binary referenced in text
+ *  must NOT become a 12h bearer URL. */
+const PROXYABLE_ASSET_EXTS = new Set([
+    '.png', '.jpg', '.jpeg', '.gif', '.webp', '.svg', '.ico', '.avif',
+    '.woff', '.woff2', '.ttf', '.otf',
+]);
+/** Whether the same-origin proxy transport serves this file type (images +
+ *  fonts — the subresources a CSP-pinned sandboxed iframe loads). The share
+ *  asset route uses this to pick proxy vs the default serve for other types
+ *  (e.g. a PDF download link on a shared doc keeps the cached R2 302). */
+export function isProxyableAssetFilename(filename) {
+    return PROXYABLE_ASSET_EXTS.has(extname(filename).toLowerCase());
 }
 const MIME_TYPES = {
     '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',
     '.gif': 'image/gif', '.webp': 'image/webp', '.svg': 'image/svg+xml',
     '.ico': 'image/x-icon', '.avif': 'image/avif',
+    '.woff': 'font/woff', '.woff2': 'font/woff2',
+    '.ttf': 'font/ttf', '.otf': 'font/otf',
 };
-function hasRepoAccess(req, repoName, authService) {
+function isFontExtension(filename) {
+    return ['.woff', '.woff2', '.ttf', '.otf'].includes(extname(filename).toLowerCase());
+}
+function addFontResourceHeaders(reply, filename) {
+    if (!isFontExtension(filename))
+        return;
+    reply.header('Access-Control-Allow-Origin', '*');
+    reply.header('Cross-Origin-Resource-Policy', 'cross-origin');
+}
+function hasRepoAccess(req, repoName, workspaceManager, authService) {
     const user = req.user;
-    if (!user)
-        return true; // API key / open mode
-    return authService.getUserFolders(user.id).includes(repoName);
+    return access.hasRepoAccess(user, repoName, workspaceManager, authService);
 }
-export async function registerAssetApiRoutes(fastify, workspaceManager, authService) {
+/**
+ * Serve an immutable-key asset's bytes once authorization has already been
+ * decided by the caller. This is the shared serving entry behind BOTH the
+ * authed `/api/assets/:assetId/:filename` route (authz = hasRepoAccess) and the
+ * public `/api/share/:token/asset/...` route (authz = valid token + repo scope).
+ *
+ * It does serving ONLY — R2 302-redirect vs local stream, path-segment
+ * hardening, and cache headers. The index lookup, filename match, and the
+ * access decision stay in each route so neither surface can drift into serving
+ * a file the other wouldn't authorize.
+ *
+ * Mechanically this is a THIN WRAPPER over the generic `serveBackendObject`
+ * primitive (the same primitive that backs conversation-scratch images), so
+ * both surfaces share one serving codepath. Two asset-specific concerns stay
+ * here as pre-steps rather than leaking into the generic primitive:
+ *   1. The R2 FONT branch — fonts are proxied through the app origin (not 302'd)
+ *      with cross-origin CORS headers, and HEAD is answered from the indexed
+ *      size WITHOUT downloading the bytes. This is unique to the catalog.
+ *   2. The catalog's stricter local segment hardening (rejects a `.`-prefixed
+ *      filename, `/` or `\` in either segment), preserved verbatim.
+ *
+ * The owning `repo` must be resolved by the caller (from the asset index) so the
+ * correct graph/backend is selected. Always fail-closed with 404 — never leak
+ * existence.
+ */
+export async function serveIndexedAsset(workspaceManager, reply, opts) {
+    const { assetId, filename, repo, isHead, size } = opts;
+    let graph;
+    try {
+        graph = workspaceManager.getGraph(repo);
+    }
+    catch {
+        return reply.status(404).send({ error: 'Asset not found' });
+    }
+    const storage = graph.getAssetStorage();
+    // Artifact-asset token path: uniform same-origin serve for BOTH backends,
+    // with private/no-cache + a strong (content-immutable) ETag so revocation is
+    // enforced on every revalidation while a 304 avoids re-download. Restricted
+    // to images + fonts (no Range/video this pass).
+    if (opts.proxyR2) {
+        const ext = extname(filename).toLowerCase();
+        // Token proxy is restricted to images + fonts (the only types an artifact
+        // legitimately embeds). Refuse anything else so a same-repo doc/dataset/etc.
+        // referenced in artifact text can't be turned into a bearer URL.
+        if (!PROXYABLE_ASSET_EXTS.has(ext)) {
+            reply.log?.warn?.({ assetId, filename, ext }, 'artifact-asset proxy refused (non-image/font)');
+            return reply.status(404).send({ error: 'Asset not found' });
+        }
+        // ETag content must be ASCII-safe: the RAW stored filename can carry
+        // non-ASCII (e.g. `Söhne-Halbfett.woff2`), and an invalid char in a header
+        // value makes Node throw ERR_INVALID_CHAR at send time — which surfaced as
+        // an unhandledRejection that took the whole server down the first time a
+        // share-page iframe requested such a font. Use the percent-encoded segment
+        // (same encoder as asset URLs); the If-None-Match comparison below sees the
+        // client echo our own emitted string, so the round-trip is unaffected.
+        const etag = `"${assetId}/${encodeAssetFilename(filename)}"`;
+        reply.header('ETag', etag);
+        reply.header('Cache-Control', 'private, no-cache');
+        reply.header('X-Content-Type-Options', 'nosniff');
+        // Neutralize active content (legacy/migrated SVGs) served same-origin.
+        reply.header('Content-Security-Policy', "default-src 'none'; style-src 'unsafe-inline'; sandbox");
+        reply.header('Content-Type', MIME_TYPES[ext] || 'application/octet-stream');
+        addFontResourceHeaders(reply, filename);
+        if (opts.ifNoneMatch === etag)
+            return reply.status(304).send();
+        try {
+            if (graph.getAssetStorage() === 'r2') {
+                // The index `size` is advisory and often null (migrate-assets/sweep
+                // never set it), so DON'T fail-closed on unknown size — the normal
+                // serve path doesn't either. Pre-reject only a KNOWN-oversize asset;
+                // for HEAD with a known size, answer without downloading.
+                if (typeof size === 'number' && size > ARTIFACT_PROXY_MAX_BYTES) {
+                    reply.log?.warn?.({ assetId, filename, size }, 'artifact-asset proxy refused (oversized)');
+                    return reply.status(404).send({ error: 'Asset not found' });
+                }
+                if (isHead) {
+                    if (typeof size === 'number' && size > 0)
+                        reply.header('Content-Length', size);
+                    return reply.send();
+                }
+                const bytes = await graph.downloadAssetById(assetId, filename);
+                // Post-download cap bounds what we serve when size was unknown.
+                if (bytes.length > ARTIFACT_PROXY_MAX_BYTES) {
+                    reply.log?.warn?.({ assetId, filename, len: bytes.length }, 'artifact-asset proxy refused (oversized after download)');
+                    return reply.status(404).send({ error: 'Asset not found' });
+                }
+                reply.header('Content-Length', bytes.length);
+                return reply.send(bytes);
+            }
+            // Local backend: stream from disk (same path-hardening as below).
+            if (filename.includes('..') || filename.includes('/') || filename.includes('\\') || filename.startsWith('.') ||
+                assetId.includes('..') || assetId.includes('/') || assetId.includes('\\')) {
+                return reply.status(404).send({ error: 'Asset not found' });
+            }
+            const base = workspaceManager.workspacePath ?? process.cwd();
+            const fp = join(base, '.studiograph', 'assets', assetId, filename);
+            if (!existsSync(fp))
+                return reply.status(404).send({ error: 'Asset not found' });
+            reply.header('Content-Length', statSync(fp).size);
+            if (isHead)
+                return reply.send();
+            return reply.send(createReadStream(fp));
+        }
+        catch (err) {
+            reply.log?.warn?.({ err, assetId, filename }, 'artifact-asset proxy serve failed');
+            return reply.status(404).send({ error: 'Asset not found' });
+        }
+    }
+    // (1) R2 font pre-step — catalog-only CORS proxy + HEAD-from-size optimization.
+    if (storage === 'r2' && isFontExtension(filename)) {
+        try {
+            const ext = extname(filename).toLowerCase();
+            if (isHead && typeof size === 'number') {
+                reply.header('Content-Type', MIME_TYPES[ext] || 'application/octet-stream');
+                reply.header('Content-Length', size);
+                reply.header('Cache-Control', 'private, max-age=14400');
+                reply.header('X-Content-Type-Options', 'nosniff');
+                addFontResourceHeaders(reply, filename);
+                return reply.send();
+            }
+            const bytes = await graph.downloadAssetById(assetId, filename);
+            reply.header('Content-Type', MIME_TYPES[ext] || 'application/octet-stream');
+            reply.header('Content-Length', bytes.length);
+            reply.header('Cache-Control', 'private, max-age=14400');
+            reply.header('X-Content-Type-Options', 'nosniff');
+            addFontResourceHeaders(reply, filename);
+            if (isHead)
+                return reply.send();
+            return reply.send(bytes);
+        }
+        catch (err) {
+            reply.log?.warn?.({ err, assetId, filename }, 'asset r2 signed-url generation failed');
+            return reply.status(404).send({ error: 'Asset not found' });
+        }
+    }
+    // (2) Local-backend catalog segment hardening (stricter than the generic
+    // primitive: also rejects a `.`-prefixed filename). Applied before delegation
+    // so observable behavior is identical to the pre-unification serve path.
+    if (storage !== 'r2') {
+        if (filename.includes('..') || filename.includes('/') || filename.includes('\\') || filename.startsWith('.') ||
+            assetId.includes('..') || assetId.includes('/') || assetId.includes('\\')) {
+            return reply.status(404).send({ error: 'Asset not found' });
+        }
+    }
+    // Delegate to the shared primitive. The catalog key is `{assetId}/{filename}`.
+    // LOCAL serves with no-cache + a strong ETag: bytes never change at a key,
+    // so every revisit is a free 304 — but a DELETED asset 404s on the next
+    // render instead of ghosting from a year-long immutable cache (the founder
+    // QA case: delete in the Library, the embed must flip to the unavailable
+    // note everywhere). R2 keeps the 4h-cached 302 (the signed URL varies per
+    // mint, so revalidating the redirect would force full re-downloads —
+    // bounded staleness is the cheaper trade there).
+    return serveBackendObject(workspaceManager, reply, {
+        repo,
+        key: `${assetId}/${filename}`,
+        filename,
+        isHead,
+        cacheControl: { r2: 'private, max-age=14400', local: 'private, no-cache' },
+        fontHeaders: true,
+        notFoundError: 'Asset not found',
+        ifNoneMatch: opts.ifNoneMatch,
+        signR2Url: (method) => graph.getAssetSignedUrlByAssetId(assetId, filename, method),
+    });
+}
+/**
+ * Generic backend-object serving primitive (composer-vision-attach / E2a). Serves
+ * bytes for a RAW backend key once the caller has decided authorization: R2 → 302
+ * to a method-bound signed URL; local → stream from `.studiograph/assets/{key}`
+ * with a sandbox CSP + nosniff. The R2 signer is INJECTED so the caller controls
+ * which keyspace is signed (catalog asset vs conversation-scratch image), and the
+ * cache header may be a single value or a per-backend pair. Always fail-closed 404.
+ *
+ * This is the single serving codepath behind BOTH `serveIndexedAsset` (the
+ * catalog, which layers an R2 font pre-step + stricter segment hardening on top)
+ * and the conversation-scratch image route.
+ */
+export async function serveBackendObject(workspaceManager, reply, opts) {
+    const { repo, key, filename, contentType, isHead, cacheControl, fontHeaders, signR2Url } = opts;
+    const notFound = opts.notFoundError ?? 'Not found';
+    const r2Cache = typeof cacheControl === 'string' ? cacheControl : cacheControl.r2;
+    const localCache = typeof cacheControl === 'string' ? cacheControl : cacheControl.local;
+    let graph;
+    try {
+        graph = workspaceManager.getGraph(repo);
+    }
+    catch {
+        return reply.status(404).send({ error: notFound });
+    }
+    if (graph.getAssetStorage() === 'r2') {
+        try {
+            const signed = await signR2Url(isHead ? 'HEAD' : 'GET');
+            reply.header('Cache-Control', r2Cache);
+            return reply.redirect(signed, 302);
+        }
+        catch (err) {
+            reply.log?.warn?.({ err, key }, 'backend object r2 signed-url generation failed');
+            return reply.status(404).send({ error: notFound });
+        }
+    }
+    // Local backend: stream from .studiograph/assets/{key}. Defense-in-depth
+    // segment validation (the key is stored server-side, but never trust it).
+    for (const seg of key.split('/')) {
+        if (seg === '' || seg === '.' || seg === '..' || seg.includes('\\')) {
+            return reply.status(404).send({ error: notFound });
+        }
+    }
+    const localBase = workspaceManager.workspacePath ?? process.cwd();
+    const filePath = join(localBase, '.studiograph', 'assets', key);
+    if (!existsSync(filePath)) {
+        return reply.status(404).send({ error: notFound });
+    }
+    // Strong ETag = the immutable key (percent-encoded: header values must be
+    // ASCII-safe — the raw filename can carry non-ASCII, and an invalid header
+    // char throws at send time; see the artifact-proxy incident). Bytes at a
+    // key never change, so a match is always a valid 304.
+    const etag = `"${encodeURIComponent(key)}"`;
+    reply.header('ETag', etag);
+    reply.header('Cache-Control', localCache);
+    if (opts.ifNoneMatch === etag) {
+        if (fontHeaders)
+            addFontResourceHeaders(reply, filename);
+        return reply.status(304).send();
+    }
+    const ext = extname(filename).toLowerCase();
+    reply.header('Content-Type', contentType || MIME_TYPES[ext] || 'application/octet-stream');
+    reply.header('Content-Length', statSync(filePath).size);
+    if (fontHeaders)
+        addFontResourceHeaders(reply, filename);
+    // Neutralize active content served from the app origin. SVG uploads are
+    // blocked, but legacy/migrated/indexed SVGs would otherwise run script when
+    // opened directly as image/svg+xml — now reachable anonymously via the share
+    // route. A sandbox CSP blocks script + plugins on direct navigation (img
+    // embeds still render, since <img> never executes SVG script), and nosniff
+    // stops a mislabeled asset from being re-interpreted as HTML.
+    reply.header('Content-Security-Policy', "default-src 'none'; style-src 'unsafe-inline'; sandbox");
+    reply.header('X-Content-Type-Options', 'nosniff');
+    if (isHead)
+        return reply.send();
+    return reply.send(createReadStream(filePath));
+}
+export async function registerAssetApiRoutes(fastify, workspaceManager, authService, wsHub) {
+    // Peers' Library views refresh on repo_sync (the same event uploads
+    // broadcast from graph-api) — every asset mutation here must emit it or a
+    // move/delete stays invisible to other connected members until reload.
+    // `summary` is the human verb-phrase the toast renders ("{actor} {summary}
+    // in {folder}"); omit it and the client falls back to a generic "updated".
+    const broadcastAssetChange = (repo, req, summary) => {
+        wsHub?.broadcast({
+            type: 'repo_sync',
+            repo,
+            actor: req?.user?.displayName ?? 'API',
+            source: 'api',
+            summary,
+            workspaceWide: access.isWorkspaceWide(repo, workspaceManager),
+            timestamp: new Date().toISOString(),
+        });
+    };
     // POST /api/repos/:repo/entities/:type/:id/assets — upload an image
     fastify.post('/api/repos/:repo/entities/:type/:id/assets', async (req, reply) => {
         const { repo, type, id } = req.params;
-        if (!hasRepoAccess(req, repo, authService)) {
+        if (!hasRepoAccess(req, repo, workspaceManager, authService)) {
             return reply.status(404).send({ error: `Folder "${repo}" not found` });
         }
         let graph;
@@ -63,15 +333,29 @@ export async function registerAssetApiRoutes(fastify, workspaceManager, authServ
         if (!file.mimetype.startsWith('image/')) {
             return reply.status(400).send({ error: 'Only image files are supported' });
         }
+        // Block SVG: stored XSS — SVG can contain <script> and the GET route
+        // serves it inline as image/svg+xml, executing in the app origin.
+        if (file.mimetype === 'image/svg+xml' || file.filename?.toLowerCase().endsWith('.svg')) {
+            return reply.status(415).send({ error: 'SVG uploads are not supported (stored XSS risk).' });
+        }
         const buffer = await file.toBuffer();
         const filename = `${Date.now()}-${file.filename.replace(/[^a-zA-Z0-9._-]/g, '_')}`;
+        const uploader = req.user;
         try {
-            const asset = await graph.uploadAsset(type, id, filename, buffer);
-            // For local storage, return an HTTP-servable URL instead of the filesystem path
-            const url = asset.url.startsWith('file://') || !asset.url.startsWith('http')
-                ? `/api/assets/${type}/${id}/${asset.filename}`
-                : asset.path; // R2 returns a full public URL
-            return reply.send({ url, filename: asset.filename, size: asset.size });
+            // Assets-referenced-not-owned (P1, D2): an image pasted/uploaded into
+            // an entry is homed to the ENTRY'S OWN FOLDER (owner_type='folder',
+            // owner_id=repo), inheriting the folder's permission boundary — never
+            // owned by the entity. The entry merely references it via the returned
+            // immutable URL (the editor inserts the embed), so deleting or moving
+            // the entry never destroys or strands the image. (type, id) are kept
+            // for the route shape but ignored for ownership.
+            const asset = await graph.uploadAsset(type, id, filename, buffer, undefined, {
+                owner: { type: 'folder', id: repo },
+                uploaderUserId: uploader?.id != null ? String(uploader.id) : null,
+            });
+            // uploadAsset returns the canonical public URL (immutable-key scheme
+            // when the index is wired, legacy otherwise) — don't re-derive it.
+            return reply.send({ url: asset.publicUrl, filename: asset.filename, size: asset.size });
         }
         catch (err) {
             if (err.message?.includes('not configured')) {
@@ -80,102 +364,445 @@ export async function registerAssetApiRoutes(fastify, workspaceManager, authServ
             return reply.status(400).send({ error: err.message });
         }
     });
-    // GET /api/assets/:type/:id/:filename — serve local assets
-    fastify.get('/api/assets/:type/:id/:filename', async (req, reply) => {
-        const { type, id, filename } = req.params;
-        const workspacePath = workspaceManager.workspacePath ?? process.cwd();
-        const filePath = join(workspacePath, '.studiograph', 'assets', type, id, filename);
-        if (!existsSync(filePath)) {
-            return reply.status(404).send({ error: 'Asset not found' });
+    // POST /api/repos/:repo/entities/artifact/:id/asset-token — mint a short-lived
+    // (12h), ARTIFACT-SCOPED capability token so a sandboxed iframe (opaque origin,
+    // no cookie) can load the exact images this artifact embeds. Authz: a normal
+    // session with repo access. The allowlist is the set of indexed assets the
+    // bundle references that actually live in THIS repo — cross-repo / unknown /
+    // filename-mismatched refs are dropped (fail-closed).
+    fastify.post('/api/repos/:repo/entities/artifact/:id/asset-token', async (req, reply) => {
+        const { repo, id } = req.params;
+        const user = req.user;
+        if (!hasRepoAccess(req, repo, workspaceManager, authService)) {
+            return reply.status(404).send({ error: `Folder "${repo}" not found` });
         }
-        const ext = extname(filename).toLowerCase();
-        const contentType = MIME_TYPES[ext] || 'application/octet-stream';
-        const stats = statSync(filePath);
-        reply.header('Content-Type', contentType);
-        reply.header('Content-Length', stats.size);
-        reply.header('Cache-Control', 'public, max-age=31536000, immutable');
-        return reply.send(createReadStream(filePath));
+        let graph;
+        try {
+            graph = workspaceManager.getGraph(repo);
+        }
+        catch (err) {
+            return reply.status(404).send({ error: err.message });
+        }
+        // Allowlist source = the EXACT version being rendered. For a history
+        // preview the client passes the version's commit; we derive the allowlist
+        // from the artifact body AT THAT COMMIT (server-trusted, not client refs),
+        // so a preview token authorizes the previewed version's assets — not the
+        // current ones. Otherwise use the live body.
+        const commit = typeof req.query.commit === 'string' && /^[0-9a-f]{7,40}$/i.test(req.query.commit)
+            ? req.query.commit : null;
+        let text;
+        if (commit) {
+            const atCommit = graph.getEntityAtCommit('artifact', id, commit);
+            if (!atCommit)
+                return reply.status(404).send({ error: 'Artifact version not found' });
+            text = atCommit.content;
+        }
+        else {
+            let entity;
+            try {
+                entity = graph.get('artifact', id);
+            }
+            catch {
+                return reply.status(404).send({ error: 'Artifact not found' });
+            }
+            if (!entity)
+                return reply.status(404).send({ error: 'Artifact not found' });
+            text = entity.document?.content ?? '';
+        }
+        return reply.send(mintArtifactAssetTokenForText(workspaceManager, authService, repo, id, text, user ? String(user.id) : '0'));
     });
-    // GET /api/repos/:repo/assets — list all assets in a folder.
+    // GET / HEAD /api/assets/:assetId/:filename — IMMUTABLE-KEY serve route.
     //
-    // Algorithm (works for both local and R2 backends):
-    //   1. One listAll() call into the asset backend — single filesystem
-    //      walk or single paginated S3 ListObjectsV2 request. No HEAD
-    //      round-trips, no markdown parsing.
-    //   2. Build the set of (type, id) pairs that belong to *this* repo via
-    //      a cheap directory scan — no frontmatter parse.
-    //   3. Filter the asset list by that set and look up display names by
-    //      reading just the matching entities' frontmatter name line.
+    // New scheme: assets are keyed `{assetId}/{filename}` (assetId = UUIDv4) and
+    // ownership/authz lives in the AssetIndexService, not in the URL. Two path
+    // segments after /api/assets/ vs three for the legacy route below — Fastify
+    // disambiguates by arity, so both coexist during the migration cutover.
     //
-    // For a repo like "analogous-experiences" with 800 assets this collapses
-    // hundreds of awaited round-trips into ~1 + a handful of small file reads.
+    // Authz: index.get(assetId) → repo → hasRepoAccess. Fail-closed on a miss.
+    // The filename in the URL MUST match the indexed filename, otherwise a valid
+    // assetId would authorize arbitrary keys under that UUID directory.
+    fastify.route({
+        method: ['GET', 'HEAD'],
+        url: '/api/assets/:assetId/:filename',
+        handler: async (req, reply) => {
+            const { assetId, filename } = req.params;
+            const isHead = req.method === 'HEAD';
+            const ifNoneMatch = req.headers['if-none-match'];
+            const row = workspaceManager.getAssetIndex().get(assetId);
+            // Fail-closed: unknown id, or a filename that doesn't match the indexed
+            // one, both 404 (never leak existence; never authorize a sibling key).
+            if (!row || row.filename !== filename) {
+                return reply.status(404).send({ error: 'Asset not found' });
+            }
+            // (No anonymous public-fonts exception here anymore: fonts resolve
+            // through the same contract as images — token allowlist below, the
+            // share-token route, or export bundling. Fail closed without one.)
+            const user = req.user;
+            if (!user && authService.hasUsers()) {
+                // No session cookie/Bearer (e.g. a sandboxed artifact iframe). Try the
+                // artifact-asset capability token before failing. The preHandler only
+                // verified the signature + 2-seg shape and stashed the payload as a
+                // CANDIDATE — the authoritative checks happen HERE against the resolved
+                // row: repo match + exact-asset allowlist + the token's user STILL has
+                // repo access (revocation enforced per-serve). Serve same-origin.
+                const tok = req.artifactAssetToken;
+                if (tok) {
+                    const tokenUser = authService.findUserById(Number(tok.userId));
+                    // Token is minted for ONE artifact (in tok.repo). It may load assets
+                    // owned by that repo, OR assets in a workspace-wide shared store
+                    // (workspace-assets) — those are cross-repo by design and readable by
+                    // every member, so an artifact in repo A may embed a shared-store
+                    // image. The exact-asset allowlist still scopes what THIS token unlocks,
+                    // and hasRepoAccess re-checks the token user against the owning repo.
+                    const repoMatch = tok.repo === row.repo || access.isWorkspaceWide(row.repo, workspaceManager);
+                    if (repoMatch &&
+                        tok.assets.includes(artifactAssetKey(assetId, filename)) &&
+                        tokenUser &&
+                        access.hasRepoAccess(tokenUser, row.repo, workspaceManager, authService)) {
+                        return serveIndexedAsset(workspaceManager, reply, {
+                            assetId, filename, repo: row.repo, isHead, size: row.size, proxyR2: true, ifNoneMatch,
+                        });
+                    }
+                }
+                return reply.status(404).send({ error: 'Asset not found' });
+            }
+            if (!hasRepoAccess(req, row.repo, workspaceManager, authService)) {
+                return reply.status(404).send({ error: 'Asset not found' });
+            }
+            // Authz decided above (folder access); shared helper does the serving.
+            //
+            // TRANSPORT exception: WebKit sends the session cookie from sandboxed
+            // (opaque-origin) artifact iframes — Chromium doesn't — so a Safari/iOS
+            // iframe image request lands HERE on session authz even though it also
+            // carries a verified `?at=` candidate. The session stays the authz
+            // authority (the token never overrides it), but the default R2 serve
+            // answers 302-to-bucket-origin, which the iframe's CSP rightly blocks
+            // ("Redirect was not allowed" — images broken in Safari, fine in
+            // Chrome). A verified token candidate is the fingerprint of that
+            // sandboxed caller, so serve it same-origin via the token proxy path
+            // (image/font-only + size caps + revalidate ETag) instead of redirecting.
+            // Grants nothing new: this session could fetch the same bytes through
+            // the redirect; only the transport changes. Scoped to the R2 backend —
+            // local storage streams directly (no redirect to block), and routing it
+            // through the proxy would impose the token path's image/font-only gate
+            // on session-authorized types it previously served (e.g. video).
+            let r2Backed = false;
+            if (req.artifactAssetToken) {
+                try {
+                    r2Backed = workspaceManager.getGraph(row.repo).getAssetStorage() === 'r2';
+                }
+                catch { /* served 404 below */ }
+            }
+            return serveIndexedAsset(workspaceManager, reply, {
+                assetId, filename, repo: row.repo, isHead, size: row.size, ifNoneMatch,
+                ...(r2Backed ? { proxyR2: true } : {}),
+            });
+        },
+    });
+    // The legacy 3-segment serve route (GET/HEAD /api/assets/:type/:id/:filename)
+    // was removed once every body referenced immutable /api/assets/{assetId}/...
+    // URLs (served by the by-assetId route above) and the legacy-hit logs drained
+    // to zero. Un-indexed legacy blobs no longer exist; nothing requests this.
+    // GET /api/repos/:repo/assets — list all assets in a folder. The listing
+    // logic (ownership-index scan) lives in listRepoAssets() so the MCP
+    // `list_assets` tool returns an identical shape.
     fastify.get('/api/repos/:repo/assets', async (req, reply) => {
         const { repo } = req.params;
-        if (!hasRepoAccess(req, repo, authService)) {
+        if (!hasRepoAccess(req, repo, workspaceManager, authService)) {
+            return reply.status(404).send({ error: `Folder "${repo}" not found` });
+        }
+        // Verify the repo exists before delegating; listRepoAssets swallows
+        // missing-graph errors as [], which is right for the bulk endpoint but
+        // wrong for the single-repo one (we want a 404).
+        try {
+            workspaceManager.getGraph(repo);
+        }
+        catch (err) {
+            return reply.status(404).send({ error: err.message });
+        }
+        return { assets: await listRepoAssets(repo, workspaceManager) };
+    });
+    // GET /api/workspace/assets — bulk asset lists for ALL accessible repos in
+    // one round-trip. Replaces 15+ parallel /api/repos/:repo/assets calls so
+    // GalleryView's thumbnail effect doesn't saturate the browser HTTP/1.1
+    // 6-slot queue and block other navigation fetches.
+    // Response shape: `{ [repoName]: RepoAsset[] }`.
+    fastify.get('/api/workspace/assets', async (req, reply) => {
+        const user = req.user;
+        // Use the shared access-control helper so personal-folder restrictions
+        // and workspace-owner-on-shared-folder semantics apply consistently.
+        const accessible = access.getAccessibleRepos(user, workspaceManager, authService).map(r => r.name);
+        // One bucket walk for the whole workspace (see listWorkspaceAssets) rather
+        // than a per-repo listAll fan-out. Seed every accessible repo so folders
+        // with no assets still appear as empty arrays (shape-stable for callers).
+        const result = {};
+        for (const repo of accessible)
+            result[repo] = [];
+        const flat = await listWorkspaceAssets(accessible, workspaceManager);
+        for (const { repo, ...asset } of flat)
+            (result[repo] ??= []).push(asset);
+        return reply.send(result);
+    });
+    // GET /api/workspace/assets/manager — the dedicated asset-manager view.
+    //
+    // Distinct from /api/workspace/assets (kept shape-stable for GalleryView's
+    // thumbnail effect). This composes the SAME primitives (getAccessibleRepos +
+    // listRepoAssets + assetDeleteDenialByAssetId) into the shape the /assets UI needs:
+    //   - `folders`: every accessible folder's metadata (display name +
+    //     workspace_wide + system flags) so the client can render the folder
+    //     filter, group headers, the Workspace/folder-scoped visibility badge,
+    //     and pin the shared store first — the system store is excluded from
+    //     /api/repos so the client can't get this elsewhere.
+    //   - `assets`: a FLAT list annotated with the owning `repo` and a per-asset
+    //     `canDelete` decision (uploader/owner gate, via the same authz primitive
+    //     the DELETE route enforces) so the UI can disable delete with a reason
+    //     instead of letting the user hit a 403.
+    fastify.get('/api/workspace/assets/manager', async (req, reply) => {
+        const user = req.user;
+        workspaceManager.reloadConfig();
+        const accessible = access.getAccessibleRepos(user, workspaceManager, authService);
+        const index = workspaceManager.getAssetIndex?.();
+        const folders = accessible.map(r => ({
+            repo: r.name,
+            displayName: r.display_name ?? null,
+            workspaceWide: r.workspace_wide === true,
+            system: r.system === true,
+        }));
+        const configByRepo = new Map(accessible.map(r => [r.name, r]));
+        // listWorkspaceAssets reads the ownership index per accessible repo. Here we
+        // layer on the per-asset delete decision (gated on the immutable assetId
+        // every asset now carries) so the UI can disable delete with a reason
+        // instead of letting the user hit a 403.
+        const flat = await listWorkspaceAssets(accessible.map(r => r.name), workspaceManager);
+        const assets = flat.map((a) => {
+            const r = configByRepo.get(a.repo);
+            const denial = assetDeleteDenialByAssetId(index, r, user, a.assetId);
+            return { ...a, canDelete: denial === null, denialReason: denial };
+        });
+        return reply.send({ folders, assets });
+    });
+    // GET /api/workspace/assets/reference-index — the Library "loose /
+    // unreferenced" filter's data (assets-referenced-not-owned P3). One
+    // live-reconciled, budgeted workspace walk → { assetId: referencing-entry
+    // count }. The client fetches this LAZILY (only on the first loose-filter
+    // toggle) so the scan never taxes users who don't filter, and marks an asset
+    // loose only when its count is 0 AND the scan completed (partial=false).
+    //
+    // Counts are computed from a workspace-wide scan (an asset referenced only by
+    // an entry in a folder the caller can't read is still NOT loose), but the
+    // RESPONSE is scoped to the assets the caller can actually see — the same
+    // least-disclosure posture as /manager and /references, so it never reveals
+    // even a UUID→count for a folder the caller has no access to. The scoped ids
+    // are exactly the manager listing's keys; a referenced-but-unindexed asset is
+    // never shown there, so dropping it costs the client nothing.
+    fastify.get('/api/workspace/assets/reference-index', async (req, reply) => {
+        try {
+            const user = req.user;
+            const index = workspaceManager.getAssetIndex?.();
+            if (!index) {
+                // No index → can't scope without leaking, and looseness is unknowable.
+                // Fail safe (like a partial scan): the client marks nothing loose.
+                return reply.send({ index: {}, partial: true });
+            }
+            const visibleIds = new Set();
+            for (const r of access.getAccessibleRepos(user, workspaceManager, authService)) {
+                for (const row of index.listByRepo(r.name))
+                    visibleIds.add(row.assetId);
+            }
+            const { index: counts, partial } = await computeAssetReferenceIndex({ workspaceManager });
+            const scoped = {};
+            for (const id of visibleIds) {
+                const c = counts[id];
+                if (c != null)
+                    scoped[id] = c;
+            }
+            return reply.send({ index: scoped, partial });
+        }
+        catch (err) {
+            req.log?.error?.({ err }, '[reference-index] scan failed');
+            return reply.status(500).send({ error: 'Could not compute the reference index' });
+        }
+    });
+    // GET /api/workspace/assets/:assetId/references — entries whose markdown
+    // body (or frontmatter) references this asset's URL. Scans accessible
+    // repos via graph.search, which already includes body-content scanning,
+    // so no schema change is needed. Filters self-reference: a STANDALONE
+    // asset's own wrapper entity has the URL in its `asset_url` frontmatter
+    // and would self-match — drop it. Embedded assets keep their parent
+    // entity in results (the parent IS the only "use", and clicking it is
+    // the user's path to managing the image's context).
+    fastify.get('/api/workspace/assets/:assetId/references', async (req, reply) => {
+        const { assetId } = req.params;
+        const user = req.user;
+        const index = workspaceManager.getAssetIndex?.();
+        const owner = index?.get(assetId) ?? null;
+        const accessible = access.getAccessibleRepos(user, workspaceManager, authService);
+        // The immutable-asset URL pattern. assetId is a UUID so this string
+        // is unique enough that a substring match across markdown bodies is
+        // a reliable "this entry references the asset" signal.
+        const pattern = `/api/assets/${assetId}/`;
+        const references = [];
+        for (const repo of accessible) {
+            let graph;
+            try {
+                graph = workspaceManager.getGraph(repo.name);
+            }
+            catch {
+                continue;
+            }
+            const matches = graph.search({ query: pattern });
+            for (const e of matches) {
+                // Skip self: a standalone asset's own entity holds the URL in
+                // its `asset_url` frontmatter so it always matches its own
+                // search. Embedded assets fall through (their owner is the
+                // parent entry, which IS a legitimate reference to show).
+                if (owner &&
+                    owner.ownerType === 'asset' &&
+                    owner.repo === repo.name &&
+                    e.id === owner.ownerId)
+                    continue;
+                const data = e.data;
+                const title = typeof data.name === 'string' && data.name.trim() !== ''
+                    ? data.name
+                    : e.id;
+                references.push({
+                    repo: repo.name,
+                    entityType: e.entityType,
+                    entityId: e.id,
+                    title,
+                });
+            }
+        }
+        return reply.send({ references });
+    });
+    // GET /api/repos/:repo/entities/:type/:id/delete-impact — the delete-time
+    // asset prompt's data (assets-referenced-not-owned P2). Read-only: which
+    // assets does this entry embed, which are referenced SOLELY by it
+    // (live-reconciled workspace scan), and which the caller may delete. The
+    // client offers exactly the solely-referenced + deletable ones; deletion
+    // itself runs through the existing by-id route per asset.
+    fastify.get('/api/repos/:repo/entities/:type/:id/delete-impact', async (req, reply) => {
+        const { repo, type, id } = req.params;
+        const user = req.user;
+        // Deleting requires write access to the entry's folder; the impact
+        // report shares that gate (no-leak 404, mirroring the delete route).
+        if (!access.canWriteRepo(user, repo, workspaceManager, authService)) {
             return reply.status(404).send({ error: `Folder "${repo}" not found` });
         }
         let graph;
         try {
             graph = workspaceManager.getGraph(repo);
         }
+        catch {
+            return reply.status(404).send({ error: 'Entry not found' });
+        }
+        try {
+            graph.get(type, id);
+        }
+        catch {
+            return reply.status(404).send({ error: 'Entry not found' });
+        }
+        try {
+            const impact = await computeAssetDeleteImpact({
+                workspaceManager, authService, user,
+                repo, entityType: type, entityId: id,
+            });
+            return reply.send(impact);
+        }
         catch (err) {
-            return reply.status(404).send({ error: err.message });
+            // The entry exists — an exception here is a scan bug, not a miss.
+            // Log it (ops signal) and fail kept-everything on the client side.
+            req.log?.error?.({ err, repo, type, id }, '[delete-impact] scan failed');
+            return reply.status(500).send({ error: 'Could not compute the asset impact' });
         }
-        // 1. Cheap repo membership set: `${type}/${id}` → md path. The
-        //    listEntityIds() call above already walked the actual on-disk
-        //    directories, so we can reconstruct the path via SINGULAR_TO_PLURAL
-        //    without any extra filesystem checks.
-        const workspacePath = workspaceManager.workspacePath ?? process.cwd();
-        const repoPath = join(workspacePath, repo);
-        const entityIds = graph.listEntityIds();
-        const idToMdPath = new Map();
-        const nameCache = new Map();
-        for (const { entityType, id } of entityIds) {
-            const plural = SINGULAR_TO_PLURAL[entityType] ?? entityType;
-            idToMdPath.set(`${entityType}/${id}`, join(repoPath, plural, `${id}.md`));
+    });
+    // GET /api/repos/:repo/entities/:type/:id/move-impact?target=<repo> — the
+    // cross-folder move heads-up (assets-referenced-not-owned P4 Option A).
+    // Read-only: which images this entry embeds would NOT be visible to everyone in
+    // the destination repo after a cross-repo move (their home folder stays put).
+    // Cheap — scans only this entry's embeds. The move itself is never blocked; the
+    // client shows a non-blocking notice. Fail-soft: on any error return no at-risk
+    // assets (a heads-up failing should never break or block the move).
+    fastify.get('/api/repos/:repo/entities/:type/:id/move-impact', async (req, reply) => {
+        const { repo, type, id } = req.params;
+        const target = req.query.target?.trim();
+        const user = req.user;
+        // Same gate as the move/delete-impact routes: write access to the entry's
+        // folder, no-leak 404 otherwise.
+        if (!access.canWriteRepo(user, repo, workspaceManager, authService)) {
+            return reply.status(404).send({ error: `Folder "${repo}" not found` });
         }
-        // 2. One listAll() round-trip.
-        let allAssets;
+        // Validate the entry exists first (consistent with delete-impact), then
+        // handle the no-destination-yet case as an empty heads-up.
+        let graph;
         try {
-            allAssets = await graph.listAllAssets();
+            graph = workspaceManager.getGraph(repo);
         }
         catch {
-            return { assets: [] };
-        }
-        // 3. Filter to this repo, look up display names on demand.
-        const result = [];
-        for (const asset of allAssets) {
-            const key = `${asset.entityType}/${asset.entityId}`;
-            const mdPath = idToMdPath.get(key);
-            if (!mdPath)
-                continue;
-            let entityName = nameCache.get(key);
-            if (entityName === undefined) {
-                entityName = extractEntityName(mdPath) ?? asset.entityId;
-                nameCache.set(key, entityName);
-            }
-            const url = asset.url.startsWith('file://') || !asset.url.startsWith('http')
-                ? `/api/assets/${asset.entityType}/${asset.entityId}/${asset.filename}`
-                : asset.path;
-            result.push({
-                filename: asset.filename,
-                size: asset.size,
-                contentType: asset.contentType,
-                url,
-                entityType: asset.entityType,
-                entityId: asset.entityId,
-                entityName,
-                mediaType: asset.mediaType,
+            return reply.status(404).send({ error: 'Entry not found' });
+        }
+        try {
+            graph.get(type, id);
+        }
+        catch {
+            return reply.status(404).send({ error: 'Entry not found' });
+        }
+        if (!target)
+            return reply.send({ atRisk: [] });
+        try {
+            const impact = computeAssetMoveImpact({
+                workspaceManager, authService, user,
+                repo, entityType: type, entityId: id, targetRepo: target,
             });
+            return reply.send(impact);
+        }
+        catch (err) {
+            // A heads-up must never break the move flow — log + return empty.
+            req.log?.error?.({ err, repo, type, id, target }, '[move-impact] failed');
+            return reply.send({ atRisk: [] });
         }
-        return { assets: result };
     });
-    // DELETE /api/repos/:repo/entities/:type/:id/assets/:filename — delete an asset
-    fastify.delete('/api/repos/:repo/entities/:type/:id/assets/:filename', async (req, reply) => {
-        const { repo, type, id, filename } = req.params;
-        if (!hasRepoAccess(req, repo, authService)) {
+    // GET /api/workspace/assets/store — resolve (lazy-create) the reserved
+    // Workspace Assets store and return its repo name. The manager's upload
+    // affordance calls this, then POSTs the file to /api/repos/<repo>/assets.
+    // This is how an existing workspace backfills the store on first use (D3 /
+    // resolveWorkspaceAssetsRepo) — never a boot sweep. Authed users only; the
+    // store is workspace_wide so any member can upload once it exists.
+    fastify.get('/api/workspace/assets/store', async (_req, reply) => {
+        // Match the upload route's auth posture: open-mode (no user) is allowed.
+        const workspace = new Workspace(workspaceManager.getWorkspacePath());
+        const repo = await resolveWorkspaceAssetsRepo(workspace, workspaceManager);
+        return reply.send({ repo });
+    });
+    // The entity-coordinate DELETE route (DELETE
+    // /api/repos/:repo/entities/:type/:id/assets/:filename) was removed with the
+    // legacy 3-segment scheme — every asset is now deleted by its immutable id
+    // via the by-assetId route below.
+    // DELETE /api/repos/:repo/assets/:assetId/:filename — delete ANY indexed
+    // asset by its immutable id (the manager's delete; assets are library
+    // citizens, so this serves every owner shape including legacy entity-owned
+    // stragglers). Removes the blob + index row in one step.
+    fastify.delete('/api/repos/:repo/assets/:assetId/:filename', async (req, reply) => {
+        const { repo, assetId, filename } = req.params;
+        // WRITE gate — see the filename route above.
+        if (!access.canWriteRepo(req.user, repo, workspaceManager, authService)) {
             return reply.status(404).send({ error: `Folder "${repo}" not found` });
         }
+        // Confirm the asset exists and actually belongs to this folder — don't let
+        // access to one folder delete another folder's asset by id.
+        const index = workspaceManager.getAssetIndex?.();
+        const row = index?.get(assetId);
+        if (!row || row.repo !== repo) {
+            return reply.status(404).send({ error: 'Asset not found' });
+        }
+        // Same uploader/owner gate as the filename route, keyed on the asset row.
+        const denial = assetDeleteDenialByAssetId(index, workspaceManager.getRepoConfig(repo), req.user, assetId);
+        if (denial)
+            return reply.status(403).send({ error: denial });
+        // Filename must match the stored row — the key is `{assetId}/{filename}`.
+        if (row.filename !== filename) {
+            return reply.status(404).send({ error: 'Asset not found' });
+        }
         let graph;
         try {
             graph = workspaceManager.getGraph(repo);
@@ -184,12 +811,131 @@ export async function registerAssetApiRoutes(fastify, workspaceManager, authServ
             return reply.status(404).send({ error: err.message });
         }
         try {
-            await graph.deleteAsset(type, id, filename);
+            await graph.deleteAssetById(assetId, filename);
+            broadcastAssetChange(repo, req, 'deleted an asset');
             return { success: true };
         }
         catch (err) {
             return reply.status(404).send({ error: err.message });
         }
     });
+    // POST /api/repos/:repo/assets/:assetId/create-entry — the second import
+    // "door": create a typed entity (auto-derived type, re-extracted body) that
+    // embeds an EXISTING free-standing asset. Makes deletion reversible — a
+    // surviving asset can be re-embedded into a new entry.
+    //
+    // Destination rule (mirrors the UI's single-click vs picker split):
+    //   - A FOLDER-OWNED asset's entry is FORCED into the asset's own folder, so
+    //     the entry's audience matches the asset's auth scope and the embedded URL
+    //     can never resolve for a reader who can't see the asset. Any `targetRepo`
+    //     is ignored for these.
+    //   - A WORKSPACE-WIDE asset is readable by every member and lives in a system
+    //     store that can't hold entries, so the caller picks a real content folder
+    //     via `targetRepo` (no cross-folder embed risk — it's globally readable).
+    fastify.post('/api/repos/:repo/assets/:assetId/create-entry', async (req, reply) => {
+        const { repo, assetId } = req.params;
+        const user = req.user;
+        // Resolve the destination folder. Only a globally-readable (workspace-wide)
+        // asset may target a folder other than its own — that's the one case with
+        // no broken-embed risk and no real "own folder" to fall back to. The
+        // subfolder is honored only on that same (picked) path. (isWorkspaceWide
+        // keys on the URL `repo`, not the asset row, so it's safe to resolve before
+        // the row lookup.)
+        const picked = req.body?.targetRepo?.trim();
+        const assetGlobal = access.isWorkspaceWide(repo, workspaceManager);
+        const destRepo = (picked && assetGlobal) ? picked : repo;
+        const destFolderPath = (picked && assetGlobal) ? (req.body?.targetFolderPath?.trim() || undefined) : undefined;
+        // Never create an entry inside a system store (it's excluded from every
+        // knowledge surface — sidebar, agent inventory, lint — so the entry would
+        // be orphaned). A workspace-wide asset MUST pick a real content folder.
+        // (System stores aren't secret, so a 400 here leaks nothing.)
+        if (workspaceManager.getRepoConfig(destRepo)?.system) {
+            return reply.status(400).send({ error: 'Choose a folder to create the entry in.' });
+        }
+        // Access gate FIRST — before any asset existence / owner-type response —
+        // so a non-member can't distinguish an existing private asset from a
+        // missing one (mirrors the move route's gate-before-lookup order). The
+        // asset's own folder uses the no-leak 404; an explicitly-chosen target
+        // folder uses 403 (the user picked it from a list they can already see).
+        if (destRepo === repo) {
+            if (!access.canWriteRepo(user, repo, workspaceManager, authService)) {
+                return reply.status(404).send({ error: `Folder "${repo}" not found` });
+            }
+        }
+        else if (!access.canWriteRepo(user, destRepo, workspaceManager, authService)) {
+            return reply.status(403).send({ error: `Editor access required to create an entry in "${destRepo}".` });
+        }
+        const index = workspaceManager.getAssetIndex?.();
+        const row = index?.get(assetId);
+        if (!row || row.repo !== repo) {
+            return reply.status(404).send({ error: 'Asset not found' });
+        }
+        // Any indexed asset can become an entry — assets are library citizens
+        // and entry deletion never cascades, so re-embedding is always safe.
+        // (The old free-standing-only guard existed to dodge cleanupOwnedAssets,
+        // which is gone.) Legacy entity-owned rows simply work here.
+        let graph;
+        try {
+            graph = workspaceManager.getGraph(destRepo);
+        }
+        catch (err) {
+            return reply.status(404).send({ error: err.message });
+        }
+        try {
+            const result = await createEntityFromAsset({
+                graph,
+                assetId,
+                folderPath: destFolderPath,
+                name: req.body?.name,
+                user: reqGitUser(req),
+            });
+            broadcastAssetChange(destRepo, req, 'created an entry from an asset');
+            return { entities: result.entities, assetId: result.assetId, asset_url: result.asset_url, repo: destRepo };
+        }
+        catch (err) {
+            return reply.status(400).send({ error: err.message ?? 'Could not create entry from asset' });
+        }
+    });
+    // POST /api/repos/:repo/assets/:assetId/move — relocate an asset to another
+    // folder. Index-only (the blob key is repo-independent). Requires write
+    // access to BOTH the source and target folders. Any indexed row is movable;
+    // moveByAssetId normalizes the row to folder ownership of the target, so a
+    // legacy entity-owned straggler is repaired by the very move that touches it.
+    fastify.post('/api/repos/:repo/assets/:assetId/move', async (req, reply) => {
+        const { repo, assetId } = req.params;
+        const targetRepo = req.body?.targetRepo;
+        const user = req.user;
+        if (!targetRepo)
+            return reply.status(400).send({ error: 'targetRepo is required' });
+        if (!access.canWriteRepo(user, repo, workspaceManager, authService)) {
+            return reply.status(404).send({ error: `Folder "${repo}" not found` });
+        }
+        if (!access.canWriteRepo(user, targetRepo, workspaceManager, authService)) {
+            return reply.status(403).send({ error: `Editor access required to move into "${targetRepo}".` });
+        }
+        const index = workspaceManager.getAssetIndex?.();
+        const row = index?.get(assetId);
+        if (!index || !row || row.repo !== repo) {
+            return reply.status(404).send({ error: 'Asset not found' });
+        }
+        // Moving OUT of a workspace_wide store reassigns the asset's repo, after
+        // which the tighter uploader/owner delete rule no longer applies — so the
+        // move itself must honor that rule (mirrors the entity-move guard in
+        // graph-api). A no-op for non-workspace_wide sources, so normal
+        // folder→folder moves are unaffected.
+        const denial = assetDeleteDenialByAssetId(index, workspaceManager.getRepoConfig(repo), user, assetId);
+        if (denial)
+            return reply.status(403).send({ error: denial });
+        if (targetRepo === repo)
+            return { success: true }; // no-op
+        // Honor the result — a concurrent delete/move could have removed the row
+        // between the get() above and here; reporting success then would make the
+        // asset appear moved when it wasn't.
+        if (!index.moveByAssetId(assetId, targetRepo)) {
+            return reply.status(404).send({ error: 'Asset not found' });
+        }
+        broadcastAssetChange(repo, req, 'moved an asset');
+        return { success: true };
+    });
 }
 //# sourceMappingURL=asset-api.js.map