@aigne/afs-did-space 1.12.0-beta.5

package/dist/share-store.d.cts

@@ -0,0 +1,65 @@
+import { ShareDeclaration } from "./share-declaration.cjs";
+
+//#region src/share-store.d.ts
+interface ShareEntry {
+  id: string;
+  ownerDid: string;
+  sourcePath: string;
+  declPath: string;
+  slug: string;
+  kind: "raw" | "web";
+  status: "active" | "revoked";
+  declCid?: string;
+  config: ShareDeclaration;
+  createdAt: number;
+  updatedAt: number;
+}
+interface ShareRow {
+  id: string;
+  owner_did: string;
+  source_path: string;
+  decl_path: string;
+  slug: string;
+  kind: "raw" | "web";
+  status: "active" | "revoked";
+  decl_cid: string | null;
+  config_json: string;
+  created_at: number;
+  updated_at: number;
+}
+/** Map a raw storage row to a public ShareEntry (malformed config_json → {}). */
+declare function rowToEntry(row: ShareRow): ShareEntry;
+interface ShareStore {
+  /** Create the `shares` table + indices if missing (idempotent). */
+  ensureTable(): Promise<void>;
+  /** Public serving hot path — slug is global, no owner scope. */
+  resolveBySlug(slug: string): Promise<ShareEntry | null>;
+  /** `.shares/` listing — active, non-unlisted, newest first. */
+  listByOwner(ownerDid: string): Promise<ShareEntry[]>;
+  /** `instances/{iid}/.shares` listing — active, non-unlisted, newest first. */
+  listByInstance(ownerDid: string, instanceDid: string): Promise<ShareEntry[]>;
+  /** `.shares/{slug}` read — owner-scoped (cross-owner read returns null). */
+  readByOwnerAndSlug(ownerDid: string, slug: string): Promise<ShareEntry | null>;
+  /** Reconcile: look up the existing row for this owner's decl path. */
+  findByOwnerAndDeclPath(ownerDid: string, declPath: string): Promise<ShareEntry | null>;
+  /**
+   * Nested-share detection — return the conflicting decl_path (a parent or
+   * child share owned by the SAME owner whose sourcePath overlaps), or null.
+   */
+  findNestedConflict(ownerDid: string, declPath: string, sourcePath: string): Promise<string | null>;
+  /**
+   * Slug uniqueness check (slug is global). Return the conflicting decl_path,
+   * or null. The row identified by `(ownerDid, declPath)` is excluded BY
+   * IDENTITY — never by decl_path alone, else a sibling owner's same-decl_path
+   * row would be wrongly excluded and let the slug collision slip past the
+   * pre-io dry-run into a post-io global-UNIQUE failure.
+   */
+  findSlugConflict(slug: string, ownerDid: string, declPath: string): Promise<string | null>;
+  /** Reconcile write — INSERT … ON CONFLICT(owner_did, decl_path) DO UPDATE. */
+  upsert(row: ShareRow): Promise<void>;
+  /** Reconcile delete — owner-scoped (never touches a sibling owner's row). */
+  deleteByOwnerAndDeclPath(ownerDid: string, declPath: string): Promise<void>;
+}
+//#endregion
+export { ShareEntry, ShareRow, ShareStore, rowToEntry };
+//# sourceMappingURL=share-store.d.cts.map

package/dist/share-store.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-store.d.cts","names":[],"sources":["../src/share-store.ts"],"mappings":";;;UAyBiB,UAAA;EACf,EAAA;EACA,QAAA;EACA,UAAA;EACA,QAAA;EACA,IAAA;EACA,IAAA;EACA,MAAA;EACA,OAAA;EACA,MAAA,EAAQ,gBAAA;EACR,SAAA;EACA,SAAA;AAAA;AAAA,UAKe,QAAA;EACf,EAAA;EACA,SAAA;EACA,WAAA;EACA,SAAA;EACA,IAAA;EACA,IAAA;EACA,MAAA;EACA,QAAA;EACA,WAAA;EACA,UAAA;EACA,UAAA;AAAA;AA4BF;AAAA,iBAxBgB,UAAA,CAAW,GAAA,EAAK,QAAA,GAAW,UAAA;AAAA,UAwB1B,UAAA;EAEA;EAAf,WAAA,IAAe,OAAA;EAGc;EAA7B,aAAA,CAAc,IAAA,WAAe,OAAA,CAAQ,UAAA;EAGN;EAA/B,WAAA,CAAY,QAAA,WAAmB,OAAA,CAAQ,UAAA;EAGgB;EAAvD,cAAA,CAAe,QAAA,UAAkB,WAAA,WAAsB,OAAA,CAAQ,UAAA;EAGX;EAApD,kBAAA,CAAmB,QAAA,UAAkB,IAAA,WAAe,OAAA,CAAQ,UAAA;EAGA;EAA5D,sBAAA,CAAuB,QAAA,UAAkB,QAAA,WAAmB,OAAA,CAAQ,UAAA;EAmBA;;;;EAbpE,kBAAA,CACE,QAAA,UACA,QAAA,UACA,UAAA,WACC,OAAA;EAekE;;;;;;;EANrE,gBAAA,CAAiB,IAAA,UAAc,QAAA,UAAkB,QAAA,WAAmB,OAAA;EA5BxD;EA+BZ,MAAA,CAAO,GAAA,EAAK,QAAA,GAAW,OAAA;EA/BgB;EAkCvC,wBAAA,CAAyB,QAAA,UAAkB,QAAA,WAAmB,OAAA;AAAA"}

package/dist/share-store.d.mts

@@ -0,0 +1,65 @@
+import { ShareDeclaration } from "./share-declaration.mjs";
+
+//#region src/share-store.d.ts
+interface ShareEntry {
+  id: string;
+  ownerDid: string;
+  sourcePath: string;
+  declPath: string;
+  slug: string;
+  kind: "raw" | "web";
+  status: "active" | "revoked";
+  declCid?: string;
+  config: ShareDeclaration;
+  createdAt: number;
+  updatedAt: number;
+}
+interface ShareRow {
+  id: string;
+  owner_did: string;
+  source_path: string;
+  decl_path: string;
+  slug: string;
+  kind: "raw" | "web";
+  status: "active" | "revoked";
+  decl_cid: string | null;
+  config_json: string;
+  created_at: number;
+  updated_at: number;
+}
+/** Map a raw storage row to a public ShareEntry (malformed config_json → {}). */
+declare function rowToEntry(row: ShareRow): ShareEntry;
+interface ShareStore {
+  /** Create the `shares` table + indices if missing (idempotent). */
+  ensureTable(): Promise<void>;
+  /** Public serving hot path — slug is global, no owner scope. */
+  resolveBySlug(slug: string): Promise<ShareEntry | null>;
+  /** `.shares/` listing — active, non-unlisted, newest first. */
+  listByOwner(ownerDid: string): Promise<ShareEntry[]>;
+  /** `instances/{iid}/.shares` listing — active, non-unlisted, newest first. */
+  listByInstance(ownerDid: string, instanceDid: string): Promise<ShareEntry[]>;
+  /** `.shares/{slug}` read — owner-scoped (cross-owner read returns null). */
+  readByOwnerAndSlug(ownerDid: string, slug: string): Promise<ShareEntry | null>;
+  /** Reconcile: look up the existing row for this owner's decl path. */
+  findByOwnerAndDeclPath(ownerDid: string, declPath: string): Promise<ShareEntry | null>;
+  /**
+   * Nested-share detection — return the conflicting decl_path (a parent or
+   * child share owned by the SAME owner whose sourcePath overlaps), or null.
+   */
+  findNestedConflict(ownerDid: string, declPath: string, sourcePath: string): Promise<string | null>;
+  /**
+   * Slug uniqueness check (slug is global). Return the conflicting decl_path,
+   * or null. The row identified by `(ownerDid, declPath)` is excluded BY
+   * IDENTITY — never by decl_path alone, else a sibling owner's same-decl_path
+   * row would be wrongly excluded and let the slug collision slip past the
+   * pre-io dry-run into a post-io global-UNIQUE failure.
+   */
+  findSlugConflict(slug: string, ownerDid: string, declPath: string): Promise<string | null>;
+  /** Reconcile write — INSERT … ON CONFLICT(owner_did, decl_path) DO UPDATE. */
+  upsert(row: ShareRow): Promise<void>;
+  /** Reconcile delete — owner-scoped (never touches a sibling owner's row). */
+  deleteByOwnerAndDeclPath(ownerDid: string, declPath: string): Promise<void>;
+}
+//#endregion
+export { ShareEntry, ShareRow, ShareStore, rowToEntry };
+//# sourceMappingURL=share-store.d.mts.map

package/dist/share-store.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-store.d.mts","names":[],"sources":["../src/share-store.ts"],"mappings":";;;UAyBiB,UAAA;EACf,EAAA;EACA,QAAA;EACA,UAAA;EACA,QAAA;EACA,IAAA;EACA,IAAA;EACA,MAAA;EACA,OAAA;EACA,MAAA,EAAQ,gBAAA;EACR,SAAA;EACA,SAAA;AAAA;AAAA,UAKe,QAAA;EACf,EAAA;EACA,SAAA;EACA,WAAA;EACA,SAAA;EACA,IAAA;EACA,IAAA;EACA,MAAA;EACA,QAAA;EACA,WAAA;EACA,UAAA;EACA,UAAA;AAAA;AA4BF;AAAA,iBAxBgB,UAAA,CAAW,GAAA,EAAK,QAAA,GAAW,UAAA;AAAA,UAwB1B,UAAA;EAEA;EAAf,WAAA,IAAe,OAAA;EAGc;EAA7B,aAAA,CAAc,IAAA,WAAe,OAAA,CAAQ,UAAA;EAGN;EAA/B,WAAA,CAAY,QAAA,WAAmB,OAAA,CAAQ,UAAA;EAGgB;EAAvD,cAAA,CAAe,QAAA,UAAkB,WAAA,WAAsB,OAAA,CAAQ,UAAA;EAGX;EAApD,kBAAA,CAAmB,QAAA,UAAkB,IAAA,WAAe,OAAA,CAAQ,UAAA;EAGA;EAA5D,sBAAA,CAAuB,QAAA,UAAkB,QAAA,WAAmB,OAAA,CAAQ,UAAA;EAmBA;;;;EAbpE,kBAAA,CACE,QAAA,UACA,QAAA,UACA,UAAA,WACC,OAAA;EAekE;;;;;;;EANrE,gBAAA,CAAiB,IAAA,UAAc,QAAA,UAAkB,QAAA,WAAmB,OAAA;EA5BxD;EA+BZ,MAAA,CAAO,GAAA,EAAK,QAAA,GAAW,OAAA;EA/BgB;EAkCvC,wBAAA,CAAyB,QAAA,UAAkB,QAAA,WAAmB,OAAA;AAAA"}

package/dist/share-store.mjs

@@ -0,0 +1,25 @@
+//#region src/share-store.ts
+/** Map a raw storage row to a public ShareEntry (malformed config_json → {}). */
+function rowToEntry(row) {
+	let config = {};
+	try {
+		config = JSON.parse(row.config_json);
+	} catch {}
+	return {
+		id: row.id,
+		ownerDid: row.owner_did,
+		sourcePath: row.source_path,
+		declPath: row.decl_path,
+		slug: row.slug,
+		kind: row.kind,
+		status: row.status,
+		declCid: row.decl_cid ?? void 0,
+		config,
+		createdAt: row.created_at,
+		updatedAt: row.updated_at
+	};
+}
+
+//#endregion
+export { rowToEntry };
+//# sourceMappingURL=share-store.mjs.map

package/dist/share-store.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-store.mjs","names":[],"sources":["../src/share-store.ts"],"sourcesContent":["/**\n * Phase 0.2 — ShareStore: storage-agnostic contract for the `shares` table.\n *\n * The `ShareResolver` (share-resolve.ts) is a storage-agnostic orchestrator\n * that holds the reconcile business logic (parse / derive / slug + nesting\n * conflict detection / kind auto-detect) and delegates ALL table access to a\n * `ShareStore`. This mirrors the repo's existing `DIDSpaceResolver +\n * KeyValueStore` precedent: one interface, hand-written siblings per backend\n * (`D1ShareStore` for Cloudflare D1, `SqliteShareStore` for the Node daemon),\n * no adapter shim.\n *\n * Owner-scoped identity: every mutating / point-lookup method takes `ownerDid`\n * because the identity key is the composite `(owner_did, decl_path)` — two\n * owners legitimately share the same relative `decl_path`. `slug` is global, so\n * `resolveBySlug` (public serving hot path) is the only caller-less method.\n *\n * `reconcileAll` (offline full rebuild) is intentionally NOT here — it scans the\n * `entries` table (TreeIndex domain) and needs an ObjectStore, so it stays a\n * D1-only concern in `D1ShareReconciler`.\n */\n\nimport type { ShareDeclaration } from \"./share-declaration.js\";\n\n// ─── Public entry (camelCase, what callers consume) ─────────────────────────────\n\nexport interface ShareEntry {\n  id: string;\n  ownerDid: string;\n  sourcePath: string;\n  declPath: string;\n  slug: string;\n  kind: \"raw\" | \"web\";\n  status: \"active\" | \"revoked\";\n  declCid?: string;\n  config: ShareDeclaration;\n  createdAt: number;\n  updatedAt: number;\n}\n\n// ─── Storage row (snake_case D1/sqlite column names) ────────────────────────────\n\nexport interface ShareRow {\n  id: string;\n  owner_did: string;\n  source_path: string;\n  decl_path: string;\n  slug: string;\n  kind: \"raw\" | \"web\";\n  status: \"active\" | \"revoked\";\n  decl_cid: string | null;\n  config_json: string;\n  created_at: number;\n  updated_at: number;\n}\n\n/** Map a raw storage row to a public ShareEntry (malformed config_json → {}). */\nexport function rowToEntry(row: ShareRow): ShareEntry {\n  let config: ShareDeclaration = {};\n  try {\n    config = JSON.parse(row.config_json) as ShareDeclaration;\n  } catch {\n    // malformed config_json — treat as empty declaration\n  }\n  return {\n    id: row.id,\n    ownerDid: row.owner_did,\n    sourcePath: row.source_path,\n    declPath: row.decl_path,\n    slug: row.slug,\n    kind: row.kind,\n    status: row.status,\n    declCid: row.decl_cid ?? undefined,\n    config,\n    createdAt: row.created_at,\n    updatedAt: row.updated_at,\n  };\n}\n\n// ─── ShareStore contract ────────────────────────────────────────────────────────\n\nexport interface ShareStore {\n  /** Create the `shares` table + indices if missing (idempotent). */\n  ensureTable(): Promise<void>;\n\n  /** Public serving hot path — slug is global, no owner scope. */\n  resolveBySlug(slug: string): Promise<ShareEntry | null>;\n\n  /** `.shares/` listing — active, non-unlisted, newest first. */\n  listByOwner(ownerDid: string): Promise<ShareEntry[]>;\n\n  /** `instances/{iid}/.shares` listing — active, non-unlisted, newest first. */\n  listByInstance(ownerDid: string, instanceDid: string): Promise<ShareEntry[]>;\n\n  /** `.shares/{slug}` read — owner-scoped (cross-owner read returns null). */\n  readByOwnerAndSlug(ownerDid: string, slug: string): Promise<ShareEntry | null>;\n\n  /** Reconcile: look up the existing row for this owner's decl path. */\n  findByOwnerAndDeclPath(ownerDid: string, declPath: string): Promise<ShareEntry | null>;\n\n  /**\n   * Nested-share detection — return the conflicting decl_path (a parent or\n   * child share owned by the SAME owner whose sourcePath overlaps), or null.\n   */\n  findNestedConflict(\n    ownerDid: string,\n    declPath: string,\n    sourcePath: string,\n  ): Promise<string | null>;\n\n  /**\n   * Slug uniqueness check (slug is global). Return the conflicting decl_path,\n   * or null. The row identified by `(ownerDid, declPath)` is excluded BY\n   * IDENTITY — never by decl_path alone, else a sibling owner's same-decl_path\n   * row would be wrongly excluded and let the slug collision slip past the\n   * pre-io dry-run into a post-io global-UNIQUE failure.\n   */\n  findSlugConflict(slug: string, ownerDid: string, declPath: string): Promise<string | null>;\n\n  /** Reconcile write — INSERT … ON CONFLICT(owner_did, decl_path) DO UPDATE. */\n  upsert(row: ShareRow): Promise<void>;\n\n  /** Reconcile delete — owner-scoped (never touches a sibling owner's row). */\n  deleteByOwnerAndDeclPath(ownerDid: string, declPath: string): Promise<void>;\n}\n"],"mappings":";;AAwDA,SAAgB,WAAW,KAA2B;CACpD,IAAI,SAA2B,EAAE;AACjC,KAAI;AACF,WAAS,KAAK,MAAM,IAAI,YAAY;SAC9B;AAGR,QAAO;EACL,IAAI,IAAI;EACR,UAAU,IAAI;EACd,YAAY,IAAI;EAChB,UAAU,IAAI;EACd,MAAM,IAAI;EACV,MAAM,IAAI;EACV,QAAQ,IAAI;EACZ,SAAS,IAAI,YAAY;EACzB;EACA,WAAW,IAAI;EACf,WAAW,IAAI;EAChB"}

package/dist/share-virtual-path.cjs

@@ -0,0 +1,102 @@
+const require_rolldown_runtime = require('./_virtual/rolldown_runtime.cjs');
+let ufo = require("ufo");
+
+//#region src/share-virtual-path.ts
+/** Strip leading and trailing slashes — returns bare path (e.g. "instances/z1abc/.shares"). */
+function normalisePath(path) {
+	return (0, ufo.withoutLeadingSlash)((0, ufo.withoutTrailingSlash)(path));
+}
+/**
+* Match an AFS path to a SharesVirtualMatch variant.
+*
+* Matching rules (after leading/trailing slash stripping):
+*   ".shares"                      → { kind: "owner-list" }
+*   ".shares/{slug}"               → { kind: "owner-read", slug }
+*   "instances/{iid}/.shares"      → { kind: "instance-list", instanceDid: iid }
+*   "instances/{iid}/.shares/{s}"  → { kind: "instance-read", instanceDid: iid, slug: s }
+*   anything else                  → null
+*/
+function matchSharesVirtualPath(path) {
+	const norm = normalisePath(path);
+	if (norm === ".shares") return { kind: "owner-list" };
+	if (norm.startsWith(".shares/")) {
+		const slug = norm.slice(8);
+		if (slug && !slug.includes("/")) return {
+			kind: "owner-read",
+			slug
+		};
+		return null;
+	}
+	const instanceMatch = /^instances\/([^/]+)\/.shares(\/(.*))?$/.exec(norm);
+	if (instanceMatch) {
+		const instanceDid = instanceMatch[1];
+		const afterShares = instanceMatch[3] ?? "";
+		if (!afterShares) return {
+			kind: "instance-list",
+			instanceDid
+		};
+		if (!afterShares.includes("/")) return {
+			kind: "instance-read",
+			instanceDid,
+			slug: afterShares
+		};
+		return null;
+	}
+	return null;
+}
+var ShareVirtualHandler = class {
+	constructor(resolver, ownerDid) {
+		this.resolver = resolver;
+		this.ownerDid = ownerDid;
+	}
+	/**
+	* Serve a list request for a matched virtual path.
+	* Returns an empty list for null matches.
+	*
+	* Filter rules:
+	*   - visibility: "unlisted" → excluded from list (but accessible via read)
+	*   - status: "revoked" → excluded from list
+	*/
+	async list(match) {
+		if (!match) return { list: [] };
+		if (match.kind === "owner-list") return { list: (await this.resolver.listByOwner(this.ownerDid)).map((e) => buildShareEntry(`/.shares/${e.slug}`, e)) };
+		if (match.kind === "instance-list") return { list: (await this.resolver.listByInstance(this.ownerDid, match.instanceDid)).map((e) => buildShareEntry(`/instances/${match.instanceDid}/.shares/${e.slug}`, e)) };
+		return { list: [] };
+	}
+	/**
+	* Serve a read request for a matched virtual path.
+	* Returns null when the match is null or the slug is not found.
+	* Note: read does NOT filter by visibility — unlisted shares are accessible by slug.
+	*/
+	async read(match) {
+		if (!match) return null;
+		if (match.kind === "owner-read") {
+			const entry = await this.resolver.readShare(this.ownerDid, match.slug);
+			if (!entry) return null;
+			return { data: buildShareEntry(`/.shares/${entry.slug}`, entry) };
+		}
+		if (match.kind === "instance-read") {
+			const entry = await this.resolver.readShare(this.ownerDid, match.slug);
+			if (!entry) return null;
+			const expectedPrefix = `instances/${match.instanceDid}/`;
+			if (!entry.sourcePath.startsWith(expectedPrefix)) return null;
+			return { data: buildShareEntry(`/instances/${match.instanceDid}/.shares/${entry.slug}`, entry) };
+		}
+		return null;
+	}
+};
+/** Serialize a ShareEntry to an AFSEntry with JSON content and kind "did-space:share". */
+function buildShareEntry(path, shareEntry) {
+	return {
+		id: path,
+		path,
+		content: JSON.stringify(shareEntry),
+		meta: { kind: "did-space:share" },
+		createdAt: new Date(shareEntry.createdAt),
+		updatedAt: new Date(shareEntry.updatedAt)
+	};
+}
+
+//#endregion
+exports.ShareVirtualHandler = ShareVirtualHandler;
+exports.matchSharesVirtualPath = matchSharesVirtualPath;

package/dist/share-virtual-path.mjs

@@ -0,0 +1,101 @@
+import { withoutLeadingSlash, withoutTrailingSlash } from "ufo";
+
+//#region src/share-virtual-path.ts
+/** Strip leading and trailing slashes — returns bare path (e.g. "instances/z1abc/.shares"). */
+function normalisePath(path) {
+	return withoutLeadingSlash(withoutTrailingSlash(path));
+}
+/**
+* Match an AFS path to a SharesVirtualMatch variant.
+*
+* Matching rules (after leading/trailing slash stripping):
+*   ".shares"                      → { kind: "owner-list" }
+*   ".shares/{slug}"               → { kind: "owner-read", slug }
+*   "instances/{iid}/.shares"      → { kind: "instance-list", instanceDid: iid }
+*   "instances/{iid}/.shares/{s}"  → { kind: "instance-read", instanceDid: iid, slug: s }
+*   anything else                  → null
+*/
+function matchSharesVirtualPath(path) {
+	const norm = normalisePath(path);
+	if (norm === ".shares") return { kind: "owner-list" };
+	if (norm.startsWith(".shares/")) {
+		const slug = norm.slice(8);
+		if (slug && !slug.includes("/")) return {
+			kind: "owner-read",
+			slug
+		};
+		return null;
+	}
+	const instanceMatch = /^instances\/([^/]+)\/.shares(\/(.*))?$/.exec(norm);
+	if (instanceMatch) {
+		const instanceDid = instanceMatch[1];
+		const afterShares = instanceMatch[3] ?? "";
+		if (!afterShares) return {
+			kind: "instance-list",
+			instanceDid
+		};
+		if (!afterShares.includes("/")) return {
+			kind: "instance-read",
+			instanceDid,
+			slug: afterShares
+		};
+		return null;
+	}
+	return null;
+}
+var ShareVirtualHandler = class {
+	constructor(resolver, ownerDid) {
+		this.resolver = resolver;
+		this.ownerDid = ownerDid;
+	}
+	/**
+	* Serve a list request for a matched virtual path.
+	* Returns an empty list for null matches.
+	*
+	* Filter rules:
+	*   - visibility: "unlisted" → excluded from list (but accessible via read)
+	*   - status: "revoked" → excluded from list
+	*/
+	async list(match) {
+		if (!match) return { list: [] };
+		if (match.kind === "owner-list") return { list: (await this.resolver.listByOwner(this.ownerDid)).map((e) => buildShareEntry(`/.shares/${e.slug}`, e)) };
+		if (match.kind === "instance-list") return { list: (await this.resolver.listByInstance(this.ownerDid, match.instanceDid)).map((e) => buildShareEntry(`/instances/${match.instanceDid}/.shares/${e.slug}`, e)) };
+		return { list: [] };
+	}
+	/**
+	* Serve a read request for a matched virtual path.
+	* Returns null when the match is null or the slug is not found.
+	* Note: read does NOT filter by visibility — unlisted shares are accessible by slug.
+	*/
+	async read(match) {
+		if (!match) return null;
+		if (match.kind === "owner-read") {
+			const entry = await this.resolver.readShare(this.ownerDid, match.slug);
+			if (!entry) return null;
+			return { data: buildShareEntry(`/.shares/${entry.slug}`, entry) };
+		}
+		if (match.kind === "instance-read") {
+			const entry = await this.resolver.readShare(this.ownerDid, match.slug);
+			if (!entry) return null;
+			const expectedPrefix = `instances/${match.instanceDid}/`;
+			if (!entry.sourcePath.startsWith(expectedPrefix)) return null;
+			return { data: buildShareEntry(`/instances/${match.instanceDid}/.shares/${entry.slug}`, entry) };
+		}
+		return null;
+	}
+};
+/** Serialize a ShareEntry to an AFSEntry with JSON content and kind "did-space:share". */
+function buildShareEntry(path, shareEntry) {
+	return {
+		id: path,
+		path,
+		content: JSON.stringify(shareEntry),
+		meta: { kind: "did-space:share" },
+		createdAt: new Date(shareEntry.createdAt),
+		updatedAt: new Date(shareEntry.updatedAt)
+	};
+}
+
+//#endregion
+export { ShareVirtualHandler, matchSharesVirtualPath };
+//# sourceMappingURL=share-virtual-path.mjs.map

package/dist/share-virtual-path.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-virtual-path.mjs","names":[],"sources":["../src/share-virtual-path.ts"],"sourcesContent":["/**\n * Phase 0.5 — ShareVirtualHandler + `.shares/` virtual path routing.\n *\n * matchSharesVirtualPath: maps an AFS path to one of 4 match variants\n *   (owner-list, owner-read, instance-list, instance-read) or null.\n *\n * ShareVirtualHandler: uses ShareResolver to serve list/read for virtual views.\n */\n\nimport type { AFSEntry, AFSEntryMetadata } from \"@aigne/afs\";\nimport { withoutLeadingSlash, withoutTrailingSlash } from \"ufo\";\nimport type { ShareEntry, ShareResolver } from \"./share-resolve.js\";\n\n// ─── Types ────────────────────────────────────────────────────────────────────\n\nexport type SharesVirtualMatch =\n  | { kind: \"owner-list\" }\n  | { kind: \"owner-read\"; slug: string }\n  | { kind: \"instance-list\"; instanceDid: string }\n  | { kind: \"instance-read\"; instanceDid: string; slug: string }\n  | null;\n\n// ─── matchSharesVirtualPath ───────────────────────────────────────────────────\n\n/** Strip leading and trailing slashes — returns bare path (e.g. \"instances/z1abc/.shares\"). */\nfunction normalisePath(path: string): string {\n  return withoutLeadingSlash(withoutTrailingSlash(path));\n}\n\n/**\n * Match an AFS path to a SharesVirtualMatch variant.\n *\n * Matching rules (after leading/trailing slash stripping):\n *   \".shares\"                      → { kind: \"owner-list\" }\n *   \".shares/{slug}\"               → { kind: \"owner-read\", slug }\n *   \"instances/{iid}/.shares\"      → { kind: \"instance-list\", instanceDid: iid }\n *   \"instances/{iid}/.shares/{s}\"  → { kind: \"instance-read\", instanceDid: iid, slug: s }\n *   anything else                  → null\n */\nexport function matchSharesVirtualPath(path: string): SharesVirtualMatch {\n  const norm = normalisePath(path);\n\n  // Owner-scope: \".shares\" or \".shares/{slug}\"\n  if (norm === \".shares\") {\n    return { kind: \"owner-list\" };\n  }\n  if (norm.startsWith(\".shares/\")) {\n    const slug = norm.slice(\".shares/\".length);\n    // slug must be non-empty and must not contain any \"/\" (no nested paths)\n    if (slug && !slug.includes(\"/\")) {\n      return { kind: \"owner-read\", slug };\n    }\n    return null;\n  }\n\n  // Instance-scope: \"instances/{iid}/.shares\" or \"instances/{iid}/.shares/{slug}\"\n  const instanceMatch = /^instances\\/([^/]+)\\/.shares(\\/(.*))?$/.exec(norm);\n  if (instanceMatch) {\n    const instanceDid = instanceMatch[1]!;\n    const afterShares = instanceMatch[3] ?? \"\";\n    if (!afterShares) {\n      return { kind: \"instance-list\", instanceDid };\n    }\n    // afterShares must not contain \"/\"\n    if (!afterShares.includes(\"/\")) {\n      return { kind: \"instance-read\", instanceDid, slug: afterShares };\n    }\n    return null;\n  }\n\n  return null;\n}\n\n// ─── ShareVirtualHandler ──────────────────────────────────────────────────────\n\nexport class ShareVirtualHandler {\n  constructor(\n    private readonly resolver: ShareResolver,\n    private readonly ownerDid: string,\n  ) {}\n\n  /**\n   * Serve a list request for a matched virtual path.\n   * Returns an empty list for null matches.\n   *\n   * Filter rules:\n   *   - visibility: \"unlisted\" → excluded from list (but accessible via read)\n   *   - status: \"revoked\" → excluded from list\n   */\n  async list(match: SharesVirtualMatch): Promise<{ list: AFSEntry[] }> {\n    if (!match) return { list: [] };\n\n    if (match.kind === \"owner-list\") {\n      const entries = await this.resolver.listByOwner(this.ownerDid);\n      return {\n        list: entries.map((e) => buildShareEntry(`/.shares/${e.slug}`, e)),\n      };\n    }\n\n    if (match.kind === \"instance-list\") {\n      const entries = await this.resolver.listByInstance(this.ownerDid, match.instanceDid);\n      return {\n        list: entries.map((e) =>\n          buildShareEntry(`/instances/${match.instanceDid}/.shares/${e.slug}`, e),\n        ),\n      };\n    }\n\n    // owner-read and instance-read are not list operations\n    return { list: [] };\n  }\n\n  /**\n   * Serve a read request for a matched virtual path.\n   * Returns null when the match is null or the slug is not found.\n   * Note: read does NOT filter by visibility — unlisted shares are accessible by slug.\n   */\n  async read(match: SharesVirtualMatch): Promise<{ data: AFSEntry } | null> {\n    if (!match) return null;\n\n    if (match.kind === \"owner-read\") {\n      const entry = await this.resolver.readShare(this.ownerDid, match.slug);\n      if (!entry) return null;\n      return { data: buildShareEntry(`/.shares/${entry.slug}`, entry) };\n    }\n\n    if (match.kind === \"instance-read\") {\n      // Verify slug belongs to this instance: source_path must be under instances/{iid}/\n      const entry = await this.resolver.readShare(this.ownerDid, match.slug);\n      if (!entry) return null;\n      const expectedPrefix = `instances/${match.instanceDid}/`;\n      if (!entry.sourcePath.startsWith(expectedPrefix)) return null;\n      return {\n        data: buildShareEntry(`/instances/${match.instanceDid}/.shares/${entry.slug}`, entry),\n      };\n    }\n\n    // owner-list and instance-list are not read operations\n    return null;\n  }\n}\n\n// ─── Helpers ──────────────────────────────────────────────────────────────────\n\n/** Serialize a ShareEntry to an AFSEntry with JSON content and kind \"did-space:share\". */\nfunction buildShareEntry(path: string, shareEntry: ShareEntry): AFSEntry {\n  return {\n    id: path,\n    path,\n    content: JSON.stringify(shareEntry),\n    meta: { kind: \"did-space:share\" } as AFSEntryMetadata,\n    createdAt: new Date(shareEntry.createdAt),\n    updatedAt: new Date(shareEntry.updatedAt),\n  };\n}\n"],"mappings":";;;;AAyBA,SAAS,cAAc,MAAsB;AAC3C,QAAO,oBAAoB,qBAAqB,KAAK,CAAC;;;;;;;;;;;;AAaxD,SAAgB,uBAAuB,MAAkC;CACvE,MAAM,OAAO,cAAc,KAAK;AAGhC,KAAI,SAAS,UACX,QAAO,EAAE,MAAM,cAAc;AAE/B,KAAI,KAAK,WAAW,WAAW,EAAE;EAC/B,MAAM,OAAO,KAAK,MAAM,EAAkB;AAE1C,MAAI,QAAQ,CAAC,KAAK,SAAS,IAAI,CAC7B,QAAO;GAAE,MAAM;GAAc;GAAM;AAErC,SAAO;;CAIT,MAAM,gBAAgB,yCAAyC,KAAK,KAAK;AACzE,KAAI,eAAe;EACjB,MAAM,cAAc,cAAc;EAClC,MAAM,cAAc,cAAc,MAAM;AACxC,MAAI,CAAC,YACH,QAAO;GAAE,MAAM;GAAiB;GAAa;AAG/C,MAAI,CAAC,YAAY,SAAS,IAAI,CAC5B,QAAO;GAAE,MAAM;GAAiB;GAAa,MAAM;GAAa;AAElE,SAAO;;AAGT,QAAO;;AAKT,IAAa,sBAAb,MAAiC;CAC/B,YACE,AAAiB,UACjB,AAAiB,UACjB;EAFiB;EACA;;;;;;;;;;CAWnB,MAAM,KAAK,OAA0D;AACnE,MAAI,CAAC,MAAO,QAAO,EAAE,MAAM,EAAE,EAAE;AAE/B,MAAI,MAAM,SAAS,aAEjB,QAAO,EACL,OAFc,MAAM,KAAK,SAAS,YAAY,KAAK,SAAS,EAE9C,KAAK,MAAM,gBAAgB,YAAY,EAAE,QAAQ,EAAE,CAAC,EACnE;AAGH,MAAI,MAAM,SAAS,gBAEjB,QAAO,EACL,OAFc,MAAM,KAAK,SAAS,eAAe,KAAK,UAAU,MAAM,YAAY,EAEpE,KAAK,MACjB,gBAAgB,cAAc,MAAM,YAAY,WAAW,EAAE,QAAQ,EAAE,CACxE,EACF;AAIH,SAAO,EAAE,MAAM,EAAE,EAAE;;;;;;;CAQrB,MAAM,KAAK,OAA+D;AACxE,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI,MAAM,SAAS,cAAc;GAC/B,MAAM,QAAQ,MAAM,KAAK,SAAS,UAAU,KAAK,UAAU,MAAM,KAAK;AACtE,OAAI,CAAC,MAAO,QAAO;AACnB,UAAO,EAAE,MAAM,gBAAgB,YAAY,MAAM,QAAQ,MAAM,EAAE;;AAGnE,MAAI,MAAM,SAAS,iBAAiB;GAElC,MAAM,QAAQ,MAAM,KAAK,SAAS,UAAU,KAAK,UAAU,MAAM,KAAK;AACtE,OAAI,CAAC,MAAO,QAAO;GACnB,MAAM,iBAAiB,aAAa,MAAM,YAAY;AACtD,OAAI,CAAC,MAAM,WAAW,WAAW,eAAe,CAAE,QAAO;AACzD,UAAO,EACL,MAAM,gBAAgB,cAAc,MAAM,YAAY,WAAW,MAAM,QAAQ,MAAM,EACtF;;AAIH,SAAO;;;;AAOX,SAAS,gBAAgB,MAAc,YAAkC;AACvE,QAAO;EACL,IAAI;EACJ;EACA,SAAS,KAAK,UAAU,WAAW;EACnC,MAAM,EAAE,MAAM,mBAAmB;EACjC,WAAW,IAAI,KAAK,WAAW,UAAU;EACzC,WAAW,IAAI,KAAK,WAAW,UAAU;EAC1C"}

package/dist/space-resolver.cjs

@@ -0,0 +1,54 @@
+const require_did_utils = require('./did-utils.cjs');
+const require_local = require('./local.cjs');
+
+//#region src/space-resolver.ts
+var LocalSpaceResolver = class {
+	/**
+	* Per-user DID Spaces this resolver constructed, keyed by normalized userDid.
+	* The installer/owner space is intentionally NOT tracked here — its lifecycle
+	* belongs to whoever constructed and passed it in. Closed via `close()`.
+	*/
+	ownedSpaces = /* @__PURE__ */ new Map();
+	/**
+	* @param installerSpace the installer/owner DIDSpace (its share-resolver
+	*   factory is late-injected by the daemon via setShareResolverFactory).
+	* @param shareResolverFactory share-out Phase 3: threaded into every sibling
+	*   `new DIDSpace(...)` so a caller space's `.share` writes reach the SAME
+	*   daemon-global store (same factory closure) as the installer space.
+	* @param scopeHmacSecret scope de-id (README §5.3): threaded into every sibling
+	*   `new DIDSpace(...)` so each caller space derives the same storage scope the
+	*   installer space does. The installer space is constructed with the SAME
+	*   secret by the daemon. Undefined → de-id off (plaintext dirs, back-compat).
+	*/
+	constructor(installerSpace, shareResolverFactory, scopeHmacSecret) {
+		this.installerSpace = installerSpace;
+		this.shareResolverFactory = shareResolverFactory;
+		this.scopeHmacSecret = scopeHmacSecret;
+	}
+	async resolveInstallerSpace() {
+		return this.installerSpace;
+	}
+	async resolveUserSpace(userDid) {
+		require_did_utils.validateId(userDid);
+		const key = require_did_utils.normalizeId(userDid);
+		if (key === this.installerSpace.config.userDid) return this.installerSpace;
+		const cached = this.ownedSpaces.get(key);
+		if (cached) return cached;
+		const space = new require_local.DIDSpace({
+			rootPath: this.installerSpace.config.rootPath,
+			userDid,
+			shareResolverFactory: this.shareResolverFactory,
+			scopeHmacSecret: this.scopeHmacSecret
+		});
+		this.ownedSpaces.set(key, space);
+		return space;
+	}
+	/** Close every per-user space this resolver created (call on daemon shutdown). */
+	close() {
+		for (const space of this.ownedSpaces.values()) space.close();
+		this.ownedSpaces.clear();
+	}
+};
+
+//#endregion
+exports.LocalSpaceResolver = LocalSpaceResolver;

package/dist/space-resolver.d.cts

@@ -0,0 +1,34 @@
+import { DIDSpace, ShareResolverFactory } from "./local.cjs";
+import { DIDSpaceLike, SpaceResolver } from "@aigne/afs";
+
+//#region src/space-resolver.d.ts
+declare class LocalSpaceResolver implements SpaceResolver {
+  private readonly installerSpace;
+  private readonly shareResolverFactory?;
+  private readonly scopeHmacSecret?;
+  /**
+   * Per-user DID Spaces this resolver constructed, keyed by normalized userDid.
+   * The installer/owner space is intentionally NOT tracked here — its lifecycle
+   * belongs to whoever constructed and passed it in. Closed via `close()`.
+   */
+  private readonly ownedSpaces;
+  /**
+   * @param installerSpace the installer/owner DIDSpace (its share-resolver
+   *   factory is late-injected by the daemon via setShareResolverFactory).
+   * @param shareResolverFactory share-out Phase 3: threaded into every sibling
+   *   `new DIDSpace(...)` so a caller space's `.share` writes reach the SAME
+   *   daemon-global store (same factory closure) as the installer space.
+   * @param scopeHmacSecret scope de-id (README §5.3): threaded into every sibling
+   *   `new DIDSpace(...)` so each caller space derives the same storage scope the
+   *   installer space does. The installer space is constructed with the SAME
+   *   secret by the daemon. Undefined → de-id off (plaintext dirs, back-compat).
+   */
+  constructor(installerSpace: DIDSpace, shareResolverFactory?: ShareResolverFactory | undefined, scopeHmacSecret?: Uint8Array | undefined);
+  resolveInstallerSpace(): Promise<DIDSpaceLike>;
+  resolveUserSpace(userDid: string): Promise<DIDSpaceLike>;
+  /** Close every per-user space this resolver created (call on daemon shutdown). */
+  close(): void;
+}
+//#endregion
+export { LocalSpaceResolver };
+//# sourceMappingURL=space-resolver.d.cts.map

package/dist/space-resolver.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"space-resolver.d.cts","names":[],"sources":["../src/space-resolver.ts"],"mappings":";;;;cAsBa,kBAAA,YAA8B,aAAA;EAAA,iBAoBtB,cAAA;EAAA,iBACA,oBAAA;EAAA,iBACA,eAAA;EAFgB;;;;;EAAA,iBAdlB,WAAA;EAmBX;;;;;;;;;;;cALa,cAAA,EAAgB,QAAA,EAChB,oBAAA,GAAuB,oBAAA,cACvB,eAAA,GAAkB,UAAA;EAG/B,qBAAA,CAAA,GAAyB,OAAA,CAAQ,YAAA;EAIjC,gBAAA,CAAiB,OAAA,WAAkB,OAAA,CAAQ,YAAA;;EA2BjD,KAAA,CAAA;AAAA"}

package/dist/space-resolver.d.mts

@@ -0,0 +1,34 @@
+import { DIDSpace, ShareResolverFactory } from "./local.mjs";
+import { DIDSpaceLike, SpaceResolver } from "@aigne/afs";
+
+//#region src/space-resolver.d.ts
+declare class LocalSpaceResolver implements SpaceResolver {
+  private readonly installerSpace;
+  private readonly shareResolverFactory?;
+  private readonly scopeHmacSecret?;
+  /**
+   * Per-user DID Spaces this resolver constructed, keyed by normalized userDid.
+   * The installer/owner space is intentionally NOT tracked here — its lifecycle
+   * belongs to whoever constructed and passed it in. Closed via `close()`.
+   */
+  private readonly ownedSpaces;
+  /**
+   * @param installerSpace the installer/owner DIDSpace (its share-resolver
+   *   factory is late-injected by the daemon via setShareResolverFactory).
+   * @param shareResolverFactory share-out Phase 3: threaded into every sibling
+   *   `new DIDSpace(...)` so a caller space's `.share` writes reach the SAME
+   *   daemon-global store (same factory closure) as the installer space.
+   * @param scopeHmacSecret scope de-id (README §5.3): threaded into every sibling
+   *   `new DIDSpace(...)` so each caller space derives the same storage scope the
+   *   installer space does. The installer space is constructed with the SAME
+   *   secret by the daemon. Undefined → de-id off (plaintext dirs, back-compat).
+   */
+  constructor(installerSpace: DIDSpace, shareResolverFactory?: ShareResolverFactory | undefined, scopeHmacSecret?: Uint8Array | undefined);
+  resolveInstallerSpace(): Promise<DIDSpaceLike>;
+  resolveUserSpace(userDid: string): Promise<DIDSpaceLike>;
+  /** Close every per-user space this resolver created (call on daemon shutdown). */
+  close(): void;
+}
+//#endregion
+export { LocalSpaceResolver };
+//# sourceMappingURL=space-resolver.d.mts.map

package/dist/space-resolver.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"space-resolver.d.mts","names":[],"sources":["../src/space-resolver.ts"],"mappings":";;;;cAsBa,kBAAA,YAA8B,aAAA;EAAA,iBAoBtB,cAAA;EAAA,iBACA,oBAAA;EAAA,iBACA,eAAA;EAFgB;;;;;EAAA,iBAdlB,WAAA;EAmBX;;;;;;;;;;;cALa,cAAA,EAAgB,QAAA,EAChB,oBAAA,GAAuB,oBAAA,cACvB,eAAA,GAAkB,UAAA;EAG/B,qBAAA,CAAA,GAAyB,OAAA,CAAQ,YAAA;EAIjC,gBAAA,CAAiB,OAAA,WAAkB,OAAA,CAAQ,YAAA;;EA2BjD,KAAA,CAAA;AAAA"}

package/dist/space-resolver.mjs

@@ -0,0 +1,55 @@
+import { normalizeId, validateId } from "./did-utils.mjs";
+import { DIDSpace } from "./local.mjs";
+
+//#region src/space-resolver.ts
+var LocalSpaceResolver = class {
+	/**
+	* Per-user DID Spaces this resolver constructed, keyed by normalized userDid.
+	* The installer/owner space is intentionally NOT tracked here — its lifecycle
+	* belongs to whoever constructed and passed it in. Closed via `close()`.
+	*/
+	ownedSpaces = /* @__PURE__ */ new Map();
+	/**
+	* @param installerSpace the installer/owner DIDSpace (its share-resolver
+	*   factory is late-injected by the daemon via setShareResolverFactory).
+	* @param shareResolverFactory share-out Phase 3: threaded into every sibling
+	*   `new DIDSpace(...)` so a caller space's `.share` writes reach the SAME
+	*   daemon-global store (same factory closure) as the installer space.
+	* @param scopeHmacSecret scope de-id (README §5.3): threaded into every sibling
+	*   `new DIDSpace(...)` so each caller space derives the same storage scope the
+	*   installer space does. The installer space is constructed with the SAME
+	*   secret by the daemon. Undefined → de-id off (plaintext dirs, back-compat).
+	*/
+	constructor(installerSpace, shareResolverFactory, scopeHmacSecret) {
+		this.installerSpace = installerSpace;
+		this.shareResolverFactory = shareResolverFactory;
+		this.scopeHmacSecret = scopeHmacSecret;
+	}
+	async resolveInstallerSpace() {
+		return this.installerSpace;
+	}
+	async resolveUserSpace(userDid) {
+		validateId(userDid);
+		const key = normalizeId(userDid);
+		if (key === this.installerSpace.config.userDid) return this.installerSpace;
+		const cached = this.ownedSpaces.get(key);
+		if (cached) return cached;
+		const space = new DIDSpace({
+			rootPath: this.installerSpace.config.rootPath,
+			userDid,
+			shareResolverFactory: this.shareResolverFactory,
+			scopeHmacSecret: this.scopeHmacSecret
+		});
+		this.ownedSpaces.set(key, space);
+		return space;
+	}
+	/** Close every per-user space this resolver created (call on daemon shutdown). */
+	close() {
+		for (const space of this.ownedSpaces.values()) space.close();
+		this.ownedSpaces.clear();
+	}
+};
+
+//#endregion
+export { LocalSpaceResolver };
+//# sourceMappingURL=space-resolver.mjs.map

package/dist/space-resolver.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"space-resolver.mjs","names":[],"sources":["../src/space-resolver.ts"],"sourcesContent":["/**\n * LocalSpaceResolver — the local (filesystem) implementation of the core\n * `SpaceResolver` contract (design.md §6.6/§6.7).\n *\n * Separates \"which space backs this identity\" from \"slice within a space\"\n * (`getInstanceSpace`). The local runtime can host many users' spaces as\n * SIBLING roots under one `rootPath` (`spaces/<did>`), so `resolveUserSpace`\n * selects the caller's own root rather than nesting their data under the\n * installer's.\n *\n * Phase 2 (current): `resolveUserSpace(u)` returns the caller's OWN space — a\n * sibling root `spaces/<u>` under the same `rootPath` — so each user's bytes\n * live in their own DID Space (design.md §六: 嵌套→并列). `resolveInstallerSpace`\n * stays the installer/owner space. This is the \"single space collapse\" fix.\n *\n * NB: unrelated to this package's `DIDSpaceResolver` (share / CID resolution).\n */\n\nimport type { DIDSpaceLike, SpaceResolver } from \"@aigne/afs\";\nimport { normalizeId, validateId } from \"./did-utils.js\";\nimport { DIDSpace, type ShareResolverFactory } from \"./local.js\";\n\nexport class LocalSpaceResolver implements SpaceResolver {\n  /**\n   * Per-user DID Spaces this resolver constructed, keyed by normalized userDid.\n   * The installer/owner space is intentionally NOT tracked here — its lifecycle\n   * belongs to whoever constructed and passed it in. Closed via `close()`.\n   */\n  private readonly ownedSpaces = new Map<string, DIDSpace>();\n\n  /**\n   * @param installerSpace the installer/owner DIDSpace (its share-resolver\n   *   factory is late-injected by the daemon via setShareResolverFactory).\n   * @param shareResolverFactory share-out Phase 3: threaded into every sibling\n   *   `new DIDSpace(...)` so a caller space's `.share` writes reach the SAME\n   *   daemon-global store (same factory closure) as the installer space.\n   * @param scopeHmacSecret scope de-id (README §5.3): threaded into every sibling\n   *   `new DIDSpace(...)` so each caller space derives the same storage scope the\n   *   installer space does. The installer space is constructed with the SAME\n   *   secret by the daemon. Undefined → de-id off (plaintext dirs, back-compat).\n   */\n  constructor(\n    private readonly installerSpace: DIDSpace,\n    private readonly shareResolverFactory?: ShareResolverFactory,\n    private readonly scopeHmacSecret?: Uint8Array,\n  ) {}\n\n  async resolveInstallerSpace(): Promise<DIDSpaceLike> {\n    return this.installerSpace;\n  }\n\n  async resolveUserSpace(userDid: string): Promise<DIDSpaceLike> {\n    // Reject path-unsafe identities up front (DIDSpace's ctor also validates,\n    // but failing here gives a clearer call site + avoids a half-built space).\n    validateId(userDid);\n    const key = normalizeId(userDid);\n\n    // Degenerate special case: when the caller IS the installer/owner (local dev\n    // with a single identity, design.md §五), reuse the installer space rather\n    // than opening a SECOND DIDSpace over the same physical dir — two metadata\n    // DBs on one directory would race. Their data already coincides by design.\n    if (key === this.installerSpace.config.userDid) return this.installerSpace;\n\n    const cached = this.ownedSpaces.get(key);\n    if (cached) return cached;\n\n    // The caller's own sibling root: same rootPath, userDir = rootPath/<u>.\n    const space = new DIDSpace({\n      rootPath: this.installerSpace.config.rootPath,\n      userDid,\n      shareResolverFactory: this.shareResolverFactory,\n      scopeHmacSecret: this.scopeHmacSecret,\n    });\n    this.ownedSpaces.set(key, space);\n    return space;\n  }\n\n  /** Close every per-user space this resolver created (call on daemon shutdown). */\n  close(): void {\n    for (const space of this.ownedSpaces.values()) space.close();\n    this.ownedSpaces.clear();\n  }\n}\n"],"mappings":";;;;AAsBA,IAAa,qBAAb,MAAyD;;;;;;CAMvD,AAAiB,8BAAc,IAAI,KAAuB;;;;;;;;;;;;CAa1D,YACE,AAAiB,gBACjB,AAAiB,sBACjB,AAAiB,iBACjB;EAHiB;EACA;EACA;;CAGnB,MAAM,wBAA+C;AACnD,SAAO,KAAK;;CAGd,MAAM,iBAAiB,SAAwC;AAG7D,aAAW,QAAQ;EACnB,MAAM,MAAM,YAAY,QAAQ;AAMhC,MAAI,QAAQ,KAAK,eAAe,OAAO,QAAS,QAAO,KAAK;EAE5D,MAAM,SAAS,KAAK,YAAY,IAAI,IAAI;AACxC,MAAI,OAAQ,QAAO;EAGnB,MAAM,QAAQ,IAAI,SAAS;GACzB,UAAU,KAAK,eAAe,OAAO;GACrC;GACA,sBAAsB,KAAK;GAC3B,iBAAiB,KAAK;GACvB,CAAC;AACF,OAAK,YAAY,IAAI,KAAK,MAAM;AAChC,SAAO;;;CAIT,QAAc;AACZ,OAAK,MAAM,SAAS,KAAK,YAAY,QAAQ,CAAE,OAAM,OAAO;AAC5D,OAAK,YAAY,OAAO"}

package/dist/sqlite-gc-queue.cjs

@@ -0,0 +1,51 @@
+const require_d1_schema = require('./d1-schema.cjs');
+
+//#region src/sqlite-gc-queue.ts
+/** Default grace matches `D1GCQueue` (2h) for cross-impl parity. `runGc` always
+* overrides with the canonical 7d, so this default is never relied upon. */
+const DEFAULT_GRACE_MS = 7200 * 1e3;
+var SqliteGcQueue = class {
+	constructor(client) {
+		this.client = client;
+	}
+	async ensureTable() {
+		await this.client.execute(`CREATE TABLE IF NOT EXISTS ds_gc_queue (
+         cid       TEXT    NOT NULL,
+         queued_at INTEGER NOT NULL,
+         PRIMARY KEY (cid)
+       )`);
+		for (const sql of require_d1_schema.GC_QUEUE_INDEX_SQL) await this.client.execute(sql);
+	}
+	async enqueue(cids) {
+		if (cids.length === 0) return;
+		await this.enqueueAt(cids, Date.now());
+	}
+	/**
+	* Enqueue with an explicit `queued_at` — used by the conformance suite to
+	* exercise the grace boundary deterministically. Not part of `GcQueue`.
+	*/
+	async enqueueAt(cids, queuedAt) {
+		if (cids.length === 0) return;
+		const stmts = cids.map((cid) => ({
+			sql: "INSERT INTO ds_gc_queue (cid, queued_at) VALUES (?, ?) ON CONFLICT DO NOTHING",
+			args: [cid, queuedAt]
+		}));
+		await this.client.batch(stmts, "write");
+	}
+	async fetchCandidates(limit = 500, graceMs = DEFAULT_GRACE_MS) {
+		if (limit === 0) return [];
+		return (await this.client.execute({
+			sql: "SELECT cid FROM ds_gc_queue WHERE queued_at <= ? LIMIT ?",
+			args: [Date.now() - graceMs, limit]
+		})).rows.map((r) => ({ cid: r.cid }));
+	}
+	async remove(cid) {
+		await this.client.execute({
+			sql: "DELETE FROM ds_gc_queue WHERE cid = ?",
+			args: [cid]
+		});
+	}
+};
+
+//#endregion
+exports.SqliteGcQueue = SqliteGcQueue;