studiograph 1.3.48-next.76 → 1.3.48-next.78

package/dist/server/routes/graph-api.js

@@ -203,11 +203,19 @@ export async function registerGraphApiRoutes(fastify, workspaceManager, authServ
             const memberCount = authService.getFolderMembers(r.name).length;
             const callerRole = user ? authService.getFolderRole(user.id, r.name) : null;
             let entityTypes = [];
+            // `folders` carries the per-folder display_name override (when one
+            // exists in the folder's .studiograph-folder.json sidecar); the client
+            // falls back to toDisplayName(slug) when display_name is absent.
             let folders = [];
             try {
                 const graph = workspaceManager.getGraph(r.name);
                 entityTypes = graph.listEntityTypes();
-                folders = graph.listFolders().map(f => f.path);
+                folders = graph.listFolders().map(f => {
+                    const entry = { path: f.path };
+                    if (f.display_name)
+                        entry.display_name = f.display_name;
+                    return entry;
+                });
             }
             catch { /* repo not mounted */ }
             return {
@@ -902,6 +910,48 @@ export async function registerGraphApiRoutes(fastify, workspaceManager, authServ
             return reply.status(400).send({ error: err.message });
         }
     });
+    // POST /api/repos/:repo/entities/bulk-delete — delete many entities in
+    // one git transaction + one WS broadcast. Replaces N parallel
+    // DELETE /entities/:type/:id calls, which on a 500-entry bulk delete
+    // produced 500 git commits + 500 entity_change broadcasts and froze
+    // the UI for minutes.
+    fastify.post('/api/repos/:repo/entities/bulk-delete', async (req, reply) => {
+        const { repo } = req.params;
+        if (!hasRepoAccess(req, repo, workspaceManager, authService)) {
+            return reply.status(404).send({ error: `Folder “${repo}” not found` });
+        }
+        const body = req.body;
+        if (!body?.entities || !Array.isArray(body.entities)) {
+            return reply.status(400).send({ error: 'Expected { entities: [{ entityType, entityId }] }' });
+        }
+        let graph;
+        try {
+            graph = workspaceManager.getGraph(repo);
+        }
+        catch (err) {
+            return reply.status(404).send({ error: err.message });
+        }
+        try {
+            const result = await graph.bulkDelete(body.entities.map(e => ({ entityType: e.entityType, entityId: e.entityId })), {
+                user: reqGitUser(req),
+                commitMessage: `Bulk delete ${body.entities.length} ${body.entities.length === 1 ? 'entry' : 'entries'} from web UI`,
+            });
+            if (result.deleted.length > 0) {
+                wsHub?.broadcast({
+                    type: 'repo_sync', repo,
+                    actor: req.user?.displayName ?? 'API',
+                    source: 'api', timestamp: new Date().toISOString(),
+                });
+            }
+            return reply.send({
+                deleted: result.deleted.length,
+                errors: result.errors,
+            });
+        }
+        catch (err) {
+            return reply.status(400).send({ error: err.message });
+        }
+    });
     // POST /api/repos/:repo/entities — create a new entity
     fastify.post('/api/repos/:repo/entities', async (req, reply) => {
         const { repo } = req.params;
@@ -982,9 +1032,11 @@ export async function registerGraphApiRoutes(fastify, workspaceManager, authServ
         }
     });
     // POST /api/repos/:repo/folders — create a folder (with .gitkeep). Auto-creates parents.
+    // Optional display_name is written to the folder's .studiograph-folder.json
+    // sidecar when set; otherwise the client falls back to toDisplayName(slug).
     fastify.post('/api/repos/:repo/folders', async (req, reply) => {
         const { repo } = req.params;
-        const { path } = req.body ?? {};
+        const { path, display_name } = req.body ?? {};
         if (!path || typeof path !== 'string') {
             return reply.status(400).send({ error: 'path is required' });
         }
@@ -999,17 +1051,25 @@ export async function registerGraphApiRoutes(fastify, workspaceManager, authServ
             return reply.status(404).send({ error: err.message });
         }
         try {
-            await graph.createFolder(path, undefined, reqGitUser(req));
+            await graph.createFolder(path, undefined, reqGitUser(req), {
+                displayName: display_name,
+            });
             return reply.status(201).send({ success: true, path });
         }
         catch (err) {
             return reply.status(400).send({ error: err.message });
         }
     });
-    // PATCH /api/repos/:repo/folders — rename / move a folder within the repo.
+    // PATCH /api/repos/:repo/folders — rename / move a folder within the repo,
+    // optionally updating its display_name in the same commit. Three shapes:
+    //   { from, to }                       — slug-only rename / move
+    //   { from, to, display_name }          — slug change + display update
+    //   { from, to: from, display_name }    — display-only update (no FS move)
+    // `display_name: ""` (or null) clears the override and reverts to the slug
+    // fallback.
     fastify.patch('/api/repos/:repo/folders', async (req, reply) => {
         const { repo } = req.params;
-        const { from, to } = req.body ?? {};
+        const { from, to, display_name } = req.body ?? {};
         if (!from || !to) {
             return reply.status(400).send({ error: 'from and to are required' });
         }
@@ -1026,7 +1086,9 @@ export async function registerGraphApiRoutes(fastify, workspaceManager, authServ
         try {
             if (sessionManager)
                 await sessionManager.flush(repo);
-            await graph.renameFolder(from, to, undefined, reqGitUser(req));
+            await graph.renameFolder(from, to, undefined, reqGitUser(req), {
+                displayName: display_name === undefined ? undefined : display_name,
+            });
             return reply.send({ success: true, from, to });
         }
         catch (err) {
@@ -1091,7 +1153,18 @@ export async function registerGraphApiRoutes(fastify, workspaceManager, authServ
         const committed = await sessionManager.flush(repo);
         return reply.send({ committed });
     });
-    // POST /api/repos/:repo/import — import files via agent processing
+    // POST /api/repos/:repo/import — import files into a folder.
+    //
+    // Routing by extension:
+    //   .md / .txt / .csv          → direct write via importFile() — no LLM
+    //     round-trip, preserves the source faithfully. Markdown frontmatter
+    //     (entity_type, entity_id) is honored when present; otherwise
+    //     sensible defaults.
+    //   .pdf + opaque binaries     → asset wrapper via uploadAsset() —
+    //     creates an `asset` entity, stores the binary in R2 or the local
+    //     volume, writes a PDF text sidecar for vector indexing.
+    //   .docx                      → text extraction + agent capture
+    //     pipeline (until the mammoth → markdown workstream lands).
     fastify.post('/api/repos/:repo/import', async (req, reply) => {
         const { repo } = req.params;
         if (!hasRepoAccess(req, repo, workspaceManager, authService)) {
@@ -1101,15 +1174,102 @@ export async function registerGraphApiRoutes(fastify, workspaceManager, authServ
         if (!body?.files || !Array.isArray(body.files)) {
             return reply.status(400).send({ error: 'Expected { files: [{ filename, content }] }' });
         }
+        // Reject paths with traversal segments; importFile slugifies the rest.
+        // Empty / undefined = repo root (existing behavior).
+        const targetFolderPath = (body.targetFolderPath ?? '').trim();
+        if (targetFolderPath.split('/').some(seg => seg === '..' || seg === '.')) {
+            return reply.status(400).send({ error: 'Invalid targetFolderPath: contains traversal segments' });
+        }
         const captureRepo = body.agentDecides ? undefined : repo;
+        const gitUser = reqGitUser(req);
         try {
-            const { extractText, isSupportedFile } = await import('../../services/import-service.js');
+            const { extractText, isSupportedFile, importFile } = await import('../../services/import-service.js');
+            const { isAssetUploadExtension } = await import('../../services/assets/base.js');
+            const { uploadAsset } = await import('../../services/asset-upload-service.js');
+            const { extname } = await import('path');
             const results = [];
+            // Direct-write extensions never need an LLM. Verbatim preservation —
+            // markdown stays markdown, CSV stays CSV.
+            const DIRECT_WRITE_EXTS = new Set(['.md', '.txt', '.csv']);
             const CONCURRENCY = 3;
-            async function processFile(file) {
-                if (!file.filename || !isSupportedFile(file.filename)) {
-                    return { filename: file.filename, status: 'error', error: `Unsupported file: ${file.filename}` };
+            async function processDirect(file) {
+                let graph;
+                try {
+                    graph = workspaceManager.getGraph(repo);
+                }
+                catch (err) {
+                    return { filename: file.filename, status: 'error', error: err.message ?? 'Folder not found' };
+                }
+                const result = await importFile(graph, file.filename, file.content, {
+                    user: gitUser,
+                    // Caller-chosen destination subfolder; importFile combines it
+                    // with each file's own relative directory.
+                    folderPath: targetFolderPath || undefined,
+                    // Defer commits — we batch them into one transaction at the
+                    // end of the request so a 500-file import is one git commit
+                    // instead of 500. Per-file commits dominated wall time
+                    // (~50-200ms each) before this; batching collapses that to
+                    // one commit for the whole batch.
+                    skipCommit: true,
+                });
+                if (result.status === 'created' && result.path) {
+                    return {
+                        filename: file.filename,
+                        status: 'created',
+                        entities: [{ entityId: result.entityId, entityType: result.entityType }],
+                        entry: {
+                            operation: 'create',
+                            entityType: result.entityType,
+                            entityId: result.entityId,
+                            filePath: result.path,
+                        },
+                        sidecarPaths: result.sidecarPaths,
+                    };
+                }
+                return { filename: file.filename, status: result.status, error: result.error };
+            }
+            async function processAsset(file) {
+                let graph;
+                try {
+                    graph = workspaceManager.getGraph(repo);
+                }
+                catch (err) {
+                    return { filename: file.filename, status: 'error', error: err.message ?? 'Folder not found' };
                 }
+                try {
+                    const buffer = Buffer.from(file.content, 'base64');
+                    const result = await uploadAsset({
+                        graph,
+                        filename: file.filename,
+                        buffer,
+                        folderPath: targetFolderPath || undefined,
+                        user: gitUser,
+                        workspacePath: graph.getWorkspaceRoot(),
+                        // Defer commits — the dispatcher's batched commitPending
+                        // call at the bottom of the route covers every entry in
+                        // the same transaction.
+                        skipCommit: true,
+                    });
+                    return {
+                        filename: file.filename,
+                        status: 'created',
+                        entities: [{ entityId: result.entityId, entityType: result.entityType }],
+                        entry: {
+                            operation: 'create',
+                            entityType: 'asset',
+                            entityId: result.entityId,
+                            filePath: result.filePath,
+                        },
+                        // PDF text sidecars: include in extraPaths so they land in
+                        // the same commit as the entity files.
+                        sidecarPaths: result.sidecarPath ? [result.sidecarPath] : undefined,
+                    };
+                }
+                catch (err) {
+                    return { filename: file.filename, status: 'error', error: err.message ?? 'Asset upload failed' };
+                }
+            }
+            async function processViaAgent(file) {
                 try {
                     const text = await extractText(file.filename, file.content);
                     if (!text) {
@@ -1138,14 +1298,68 @@ export async function registerGraphApiRoutes(fastify, workspaceManager, authServ
                     return { filename: file.filename, status: 'error', error: err.message ?? 'Processing failed' };
                 }
             }
+            async function processFile(file) {
+                if (!file.filename) {
+                    return { filename: file.filename, status: 'error', error: 'Missing filename' };
+                }
+                const ext = extname(file.filename).toLowerCase();
+                // Direct-write text formats first — never collide with asset
+                // detection. Then asset extensions (images, PDF, design files,
+                // archives, …). Then the agent-extraction fallback for .docx
+                // until the mammoth workstream lands. Anything else: reject.
+                if (DIRECT_WRITE_EXTS.has(ext))
+                    return processDirect(file);
+                if (isAssetUploadExtension(file.filename))
+                    return processAsset(file);
+                if (isSupportedFile(file.filename))
+                    return processViaAgent(file);
+                return { filename: file.filename, status: 'error', error: `Unsupported file: ${file.filename}` };
+            }
             // Process files in batches of CONCURRENCY
             for (let i = 0; i < body.files.length; i += CONCURRENCY) {
                 const batch = body.files.slice(i, i + CONCURRENCY);
                 const batchResults = await Promise.all(batch.map(processFile));
                 results.push(...batchResults);
             }
+            // Direct-write path deferred git commits — flush them all in one
+            // transaction now. Collapses N per-file commits into one batch
+            // commit (~50ms vs N×50ms). Agent-path files committed inline via
+            // /api/capture so they're not in this set.
+            const pendingEntries = results
+                .map(r => r.entry)
+                .filter((e) => Boolean(e));
+            // Collect every sidecar path produced by the import — these stage in
+            // the same commit as the entity files, so the folder display name
+            // and the entries it labels land atomically. De-dup because two
+            // imported files inside the same Schema_OS/widgets/ would otherwise
+            // produce duplicate sidecar entries.
+            const sidecarPaths = Array.from(new Set(results.flatMap(r => r.sidecarPaths ?? [])));
+            if (pendingEntries.length > 0) {
+                try {
+                    const graph = workspaceManager.getGraph(repo);
+                    await graph.commitPending(pendingEntries, {
+                        commitMessage: `Import ${pendingEntries.length} ${pendingEntries.length === 1 ? 'entry' : 'entries'} from web UI`,
+                        user: gitUser,
+                        extraPaths: sidecarPaths.length > 0 ? sidecarPaths : undefined,
+                    });
+                }
+                catch (err) {
+                    console.warn(`[import] batch commit failed for ${repo}: ${err instanceof Error ? err.message : err}`);
+                }
+            }
             const created = results.filter(r => r.status === 'created').length;
             const entityCount = results.reduce((sum, r) => sum + (r.entities?.length ?? 0), 0);
+            // Single repo_sync broadcast for the whole import. The realtime
+            // store's repo_sync handler refreshes the repo's entity list once
+            // — vs. one entity_change per file, which would do N re-renders
+            // on every connected client and freeze the UI for large imports.
+            if (created > 0) {
+                wsHub?.broadcast({
+                    type: 'repo_sync', repo,
+                    actor: req.user?.displayName ?? 'API',
+                    source: 'api', timestamp: new Date().toISOString(),
+                });
+            }
             return {
                 success: true,
                 imported: created,
@@ -1204,41 +1418,79 @@ export async function registerGraphApiRoutes(fastify, workspaceManager, authServ
             });
         }
     });
-    // POST /api/repos/:repo/import-images — import images as reference entities
-    fastify.post('/api/repos/:repo/import-images', { bodyLimit: 50 * 1024 * 1024 }, async (req, reply) => {
+    // POST /api/repos/:repo/assets — generic asset upload.
+    //
+    // Multipart `file` field. Creates a wrapper `asset` entity whose
+    // frontmatter points at the stored binary (R2 or local volume) via
+    // `asset_url`. PDFs additionally get a text sidecar at
+    // `<workspace>/.studiograph/assets-text/asset/<id>.txt` so the vector
+    // indexer can RAG them without bloating the markdown body. See
+    // docs/asset-architecture.md.
+    fastify.post('/api/repos/:repo/assets', async (req, reply) => {
         const { repo } = req.params;
         if (!hasRepoAccess(req, repo, workspaceManager, authService)) {
-            return reply.status(403).send({ error: 'Access denied' });
+            return reply.status(404).send({ error: `Folder "${repo}" not found` });
         }
-        const body = req.body;
-        if (!body?.files || !Array.isArray(body.files)) {
-            return reply.status(400).send({ error: 'Expected { files: [{ filename, content }] }' });
+        let graph;
+        try {
+            graph = workspaceManager.getGraph(repo);
         }
+        catch (err) {
+            return reply.status(404).send({ error: err.message });
+        }
+        // Per-route fileSize override — the global multipart limit (10MB) is
+        // tuned for inline image embeds; full asset uploads accept up to the
+        // 100MB cap enforced inside AssetService.upload().
+        let file;
         try {
-            const { importImages } = await import('../../services/image-import-service.js');
-            const graph = workspaceManager.getGraph(repo);
-            const user = reqGitUser(req);
-            const result = await importImages(graph, body.files, user);
-            // Single git commit for all created entities
-            if (result.created > 0) {
-                const git = graph.getGitService();
-                if (git) {
-                    const commitUser = user ?? { id: 'import', name: 'Import', email: 'import@studiograph' };
-                    git.commitAll(`Import ${result.created} image${result.created !== 1 ? 's' : ''} as references`, commitUser);
-                }
-            }
-            return {
-                success: true,
-                created: result.created,
-                skipped: result.skipped,
-                errors: result.errors,
-            };
+            file = await req.file({ limits: { fileSize: 100 * 1024 * 1024 } });
         }
         catch (err) {
-            return reply.status(400).send({
-                success: false,
-                error: err instanceof Error ? err.message : 'Unknown error',
+            return reply.status(400).send({ error: err?.message ?? 'Invalid multipart upload' });
+        }
+        if (!file)
+            return reply.status(400).send({ error: 'No file uploaded' });
+        const buffer = await file.toBuffer();
+        const folderPath = (req.query.folder ?? '').trim();
+        if (folderPath.split('/').some(seg => seg === '..' || seg === '.')) {
+            return reply.status(400).send({ error: 'Invalid folder: contains traversal segments' });
+        }
+        try {
+            const { uploadAsset } = await import('../../services/asset-upload-service.js');
+            const result = await uploadAsset({
+                graph,
+                filename: file.filename,
+                buffer,
+                folderPath: folderPath || undefined,
+                name: req.query.name?.trim() || undefined,
+                user: reqGitUser(req),
+                workspacePath: graph.getWorkspaceRoot(),
             });
+            wsHub?.broadcast({
+                type: 'repo_sync',
+                repo,
+                actor: req.user?.displayName ?? 'API',
+                source: 'api',
+                timestamp: new Date().toISOString(),
+            });
+            return reply.send({
+                success: true,
+                entity: {
+                    entityId: result.entityId,
+                    entityType: result.entityType,
+                    asset_url: result.asset_url,
+                    asset_kind: result.asset_kind,
+                    asset_size: result.asset_size,
+                    pages: result.pages,
+                },
+            });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            const status = msg.includes('not configured') ? 501
+                : msg.includes('Unsupported asset extension') ? 415
+                    : 400;
+            return reply.status(status).send({ success: false, error: msg });
         }
     });
 }