@alisio/server 0.1.0-alpha.5 → 0.1.0-alpha.6

package/dist/routes/artifacts.js

@@ -0,0 +1,261 @@
+/**
+ * Published artifacts (spec §14.1): the list of a root session, one artifact with its files and
+ * provenance, its download (the file, or a ZIP of a multi-file artifact streamed with
+ * `node:zlib`) and, from phase 2, single files for the panel, signed links for the isolated
+ * viewer, the copy into the workspace (a tool call of the session), the analysis sources and
+ * deletion. Every route is behind the session cookie like the rest of `/api`.
+ */
+import { randomUUID } from "node:crypto";
+import { createReadStream, existsSync } from "node:fs";
+import { join } from "node:path";
+import { pipeline } from "node:stream/promises";
+import { artifactFileType, artifactSlug, readArtifactHead, toRef, writeZip, } from "@alisio/core";
+import { signViewToken, VIEW_TOKEN_TTL_MS } from "../auth/view-token.js";
+import { readJson } from "../http/body.js";
+import { HttpError } from "../http/errors.js";
+import { is, queryInt, validate } from "../schemas.js";
+const KINDS = [
+    "dashboard",
+    "document",
+    "spreadsheet",
+    "image",
+    "data",
+    "code",
+    "archive",
+    "file",
+];
+/** Provenance keys that only serve the store (never sent to clients). */
+const PRIVATE = new Set(["sourcePath", "previewable", "sha256"]);
+/** `attachment; filename="…"; filename*=UTF-8''…` with an ASCII fallback (RFC 6266/5987). */
+export function attachmentDisposition(fileName) {
+    const ascii = fileName.replace(/[^\x20-\x7e]/g, "_").replace(/["\\]/g, "_");
+    const encoded = encodeURIComponent(fileName).replace(/['()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+    return `attachment; filename="${ascii}"; filename*=UTF-8''${encoded}`;
+}
+/** The same header with `inline` (files the panel previews). */
+const inlineDisposition = (fileName) => attachmentDisposition(fileName).replace(/^attachment/, "inline");
+/**
+ * CSP of files served to the panel on the app origin: inert when opened as a document (opaque
+ * origin, no scripts), harmless for `<img>` and `fetch()` which ignore it.
+ */
+export const FILE_CSP = "default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'; sandbox";
+/** `/artifact-view/<token>/<path>` with every path segment encoded. */
+export const viewUrl = (token, path) => `/artifact-view/${token}/${path.split("/").map(encodeURIComponent).join("/")}`;
+/** Whether the isolated viewer serves an artifact (HTML dashboards and PDFs). */
+export const viewable = (record) => record.kind === "dashboard" || record.mimeType === "application/pdf";
+export function registerArtifactRoutes(router, ctx) {
+    const { artifacts, sessions } = ctx;
+    const now = ctx.now ?? Date.now;
+    const ready = (id) => {
+        const record = find(id);
+        if (record.status !== "ready")
+            throw new HttpError("artifact_not_found", `Artifact ${record.status}`);
+        return record;
+    };
+    function find(id) {
+        const record = artifacts.get(id);
+        if (!record)
+            throw new HttpError("artifact_not_found", "Artifact not found");
+        return record;
+    }
+    router.get("/api/sessions/:sid/artifacts", ({ params, url }) => {
+        const session = sessions.get(params.sid ?? "");
+        const kind = url.searchParams.get("kind");
+        if (kind && !KINDS.includes(kind))
+            throw new HttpError("validation_failed", "Invalid query parameter", { fields: ["kind"] });
+        const limit = queryInt(url, "limit", 50, 200) ?? 50;
+        const before = queryInt(url, "cursor", 0);
+        const records = artifacts.list(sessions.rootOf(session.id), {
+            ...(kind ? { kind: kind } : {}),
+            limit,
+            ...(before ? { before } : {}),
+            includeDeleted: true,
+        });
+        const last = records.at(-1);
+        return {
+            body: {
+                items: records.map(toRef),
+                ...(records.length === limit && last ? { next: String(last.createdAt) } : {}),
+            },
+        };
+    });
+    router.get("/api/artifacts/:aid", async ({ params }) => {
+        const record = find(params.aid ?? "");
+        const files = record.status === "ready"
+            ? (await artifacts.files(record).catch(() => [])).map(({ path, bytes }) => ({
+                path,
+                bytes,
+            }))
+            : [];
+        const provenance = Object.fromEntries(Object.entries(record.provenance).filter(([key]) => !PRIVATE.has(key)));
+        return {
+            body: {
+                ...toRef(record),
+                ...(record.entry ? { entry: record.entry } : {}),
+                files,
+                provenance,
+            },
+        };
+    });
+    router.get("/api/artifacts/:aid/download", async ({ params, url, res }) => {
+        const record = find(params.aid ?? "");
+        if (record.status !== "ready")
+            throw new HttpError("artifact_not_found", `Artifact ${record.status}`);
+        const files = await artifacts.files(record);
+        const manifest = url.searchParams.get("manifest") === "1";
+        if (files.length === 1 && !manifest) {
+            const [file] = files;
+            res.writeHead(200, {
+                // Always from the type registry, never from the script; downloads never render inline.
+                "Content-Type": record.mimeType,
+                "Content-Length": file.bytes,
+                "Content-Disposition": attachmentDisposition(record.fileName),
+                "Cache-Control": "private, no-store",
+            });
+            await pipeline(createReadStream(file.abs), res);
+            return undefined;
+        }
+        const name = record.fileName.toLowerCase().endsWith(".zip")
+            ? record.fileName
+            : `${record.fileName.replace(/\.[^.]+$/, "")}.zip`;
+        res.writeHead(200, {
+            "Content-Type": "application/zip",
+            "Content-Disposition": attachmentDisposition(name),
+            "Cache-Control": "private, no-store",
+        });
+        await writeZip([
+            ...files.map((file) => ({ name: file.path, source: file.abs })),
+            ...(manifest
+                ? [{ name: "manifest.json", source: join(artifacts.folder(record), "manifest.json") }]
+                : []),
+        ], res);
+        res.end();
+        return undefined;
+    });
+    router.get("/api/artifacts/:aid/files/*", async ({ params, res }) => {
+        const record = ready(params.aid ?? "");
+        const file = await artifacts.resolveFile(record, params["*"] ?? "");
+        if (!file)
+            throw new HttpError("artifact_not_found", "File not found in this artifact");
+        // The registry type (extension and bytes); HTML and download-only types never render inline.
+        const type = artifactFileType(file.path, await readArtifactHead(file.abs));
+        const name = file.path.split("/").pop() ?? file.path;
+        res.writeHead(200, {
+            "Content-Type": type.mimeType,
+            "Content-Length": file.bytes,
+            "Content-Disposition": type.inline ? inlineDisposition(name) : attachmentDisposition(name),
+            "Content-Security-Policy": FILE_CSP,
+            "Cache-Control": "private, no-store",
+        });
+        await pipeline(createReadStream(file.abs), res);
+        return undefined;
+    });
+    router.post("/api/artifacts/:aid/view", ({ params }) => {
+        const record = ready(params.aid ?? "");
+        if (!viewable(record))
+            throw new HttpError("validation_failed", "Only dashboards and PDFs open in the viewer");
+        if (!record.previewable)
+            throw new HttpError("artifact_too_large", "This artifact is too large to preview");
+        if (!ctx.viewSecret)
+            throw new HttpError("not_found", "The viewer is not available");
+        const expiresAt = now() + VIEW_TOKEN_TTL_MS;
+        const token = signViewToken(ctx.viewSecret, record.id, expiresAt);
+        return { body: { url: viewUrl(token, record.entry ?? record.fileName), expiresAt } };
+    });
+    /**
+     * Queues a tool call of the artifact's session (no model): the same gates apply (write and
+     * capability approvals arrive over SSE like any other). `409 runs_active` while it runs.
+     */
+    async function queueToolCall(record, tool, display, unavailable, correlationId) {
+        const scheduler = ctx.scheduler;
+        if (!scheduler)
+            throw new HttpError("not_found", "This action is not available");
+        const session = sessions.get(record.sessionId);
+        if (sessions.lockedBy(session.id))
+            throw new HttpError("session_locked", "Another Alisio process (for example the TUI) is using this session");
+        const opened = await sessions.app(session);
+        if (scheduler.job(session.id) ||
+            scheduler.busy(session.id) ||
+            opened.app.runner.isRunning(session.id))
+            throw new HttpError("runs_active", "Wait until the session finishes running");
+        if (!opened.app.registry.list().some((candidate) => candidate.name === tool.name))
+            throw new HttpError("permission_denied", unavailable);
+        const { run } = sessions.beginRun({
+            id: randomUUID(),
+            session: session.id,
+            status: "queued",
+            correlationId,
+            model: session.model,
+        });
+        const status = scheduler.submit({
+            runId: run.id,
+            sessionId: session.id,
+            workspaceId: opened.id,
+            app: opened.app,
+            text: "",
+            correlationId,
+            display,
+            tool,
+            options: () => sessions.runOptions(session.id),
+        });
+        return { status: 202, body: { runId: run.id, status } };
+    }
+    router.post("/api/artifacts/:aid/export", async ({ req, params, correlationId }) => {
+        const input = validate(await readJson(req), {
+            target: { check: is.string(1024), required: true },
+            overwrite: { check: is.boolean() },
+        });
+        const record = ready(params.aid ?? "");
+        return queueToolCall(record, {
+            name: "artifact_export",
+            input: {
+                id: record.id,
+                target: input.target,
+                ...(input.overwrite ? { overwrite: true } : {}),
+            },
+        }, `Copy ${record.fileName} to the workspace (${input.target.trim() || "."})`, "Copying artifacts is unavailable (the server runs with --read-only or analysis is disabled)", correlationId);
+    });
+    // Rerun (spec §19): the same script and inputs as a NEW execution with new artifacts. It is a
+    // `python_run { rerunOf }` call of the session, so the `analysis.run` capability gate applies
+    // (a web approval when nothing allows it) and nothing of the original is overwritten.
+    router.post("/api/artifacts/:aid/rerun", async ({ params, correlationId }) => {
+        const record = find(params.aid ?? "");
+        if (record.status === "deleted")
+            throw new HttpError("artifact_not_found", "The artifact was deleted");
+        if (!record.executionId)
+            throw new HttpError("validation_failed", "This artifact was not produced by python_run, so there is no script to run again");
+        return queueToolCall(record, { name: "python_run", input: { rerunOf: record.id } }, `Run the analysis of ${record.fileName} again`, "Running analyses is unavailable (the server runs with --read-only or analysis is disabled)", correlationId);
+    });
+    router.get("/api/artifacts/:aid/sources", async ({ params, url, res }) => {
+        const record = find(params.aid ?? "");
+        const job = record.executionId ? ctx.jobs?.get(record.executionId) : undefined;
+        if (!job || !ctx.stateRoot)
+            throw new HttpError("artifact_not_found", "This artifact has no analysis sources");
+        const folder = join(ctx.stateRoot, ...job.relDir.split(/[\\/]/));
+        const entries = [
+            { name: "script/main.py", source: join(folder, "script", "main.py") },
+            { name: "job.json", source: join(folder, "job.json") },
+            ...(url.searchParams.get("logs") === "1"
+                ? ["stdout.log", "stderr.log"].map((name) => ({
+                    name: `logs/${name}`,
+                    source: join(folder, "logs", name),
+                }))
+                : []),
+        ].filter((entry) => existsSync(entry.source));
+        if (!entries.length)
+            throw new HttpError("artifact_not_found", "The analysis sources were removed");
+        res.writeHead(200, {
+            "Content-Type": "application/zip",
+            "Content-Disposition": attachmentDisposition(`${artifactSlug(record.title)}-sources.zip`),
+            "Cache-Control": "private, no-store",
+        });
+        await writeZip(entries, res);
+        res.end();
+        return undefined;
+    });
+    router.delete("/api/artifacts/:aid", async ({ params }) => {
+        const record = ready(params.aid ?? "");
+        await artifacts.delete(record.id);
+        return { body: { deleted: true } };
+    });
+}

package/dist/routes/capabilities.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Persisted capability grants of a root session (spec §14.1): list (live grants first, then
+ * recent audit rows) and revoke. A revocation broadcasts `capabilities_changed` to the session.
+ */
+import { type CapabilityGrants } from "@alisio/core";
+import type { ServerFrame } from "@alisio/sdk";
+import type { SessionService } from "../host/sessions.ts";
+import type { Router } from "../http/router.ts";
+export declare function registerCapabilityRoutes(router: Router, ctx: {
+    grants: CapabilityGrants;
+    sessions: SessionService;
+    toSession: (sessionId: string, frame: ServerFrame) => void;
+}): void;

package/dist/routes/capabilities.js

@@ -0,0 +1,20 @@
+/**
+ * Persisted capability grants of a root session (spec §14.1): list (live grants first, then
+ * recent audit rows) and revoke. A revocation broadcasts `capabilities_changed` to the session.
+ */
+import { toGrantWire } from "@alisio/core";
+import { HttpError } from "../http/errors.js";
+export function registerCapabilityRoutes(router, ctx) {
+    router.get("/api/sessions/:sid/capabilities", ({ params }) => {
+        const session = ctx.sessions.get(params.sid ?? "");
+        return { body: { items: ctx.grants.list(session.id).map(toGrantWire) } };
+    });
+    router.delete("/api/sessions/:sid/capabilities/:gid", ({ params }) => {
+        const session = ctx.sessions.get(params.sid ?? "");
+        if (!ctx.grants.revoke(session.id, params.gid ?? "", "web"))
+            throw new HttpError("not_found", "Grant not found or already revoked");
+        const root = ctx.sessions.rootOf(session.id);
+        ctx.toSession(root, { t: "capabilities_changed", sessionId: root });
+        return { body: { revoked: true } };
+    });
+}

package/dist/routes/commands.js

@@ -111,6 +111,30 @@ export function registerCommandRoutes(router, ctx) {
             }
             if (descriptor.name === "help")
                 return { output: helpText(catalog.list("web")) };
+            if (descriptor.name === "permissions") {
+                // Web clients open the permissions popover instead; API callers get the list as text.
+                const live = opened.app.capabilityGrants.live(session.id);
+                return {
+                    output: live.length
+                        ? live
+                            .map((g) => `- ${g.capability} · allowed for this session · since ${new Date(g.createdAt).toISOString()} (${g.source})`)
+                            .join("\n")
+                        : "No saved permissions in this session.",
+                    tone: "notice",
+                };
+            }
+            if (descriptor.name === "artifacts") {
+                // Web clients open the artifact panel instead; API callers get the list as text.
+                const records = opened.app.artifacts.list(sessions.rootOf(session.id), { limit: 100 });
+                const filter = args.toLowerCase();
+                const shown = records.filter((r) => `${r.fileName} ${r.title} ${r.kind}`.toLowerCase().includes(filter));
+                return {
+                    output: shown.length
+                        ? shown.map((r) => `- ${r.fileName} (${r.kind}, ${r.bytes} bytes, ${r.id})`).join("\n")
+                        : "No artifacts in this session yet.",
+                    tone: "notice",
+                };
+            }
             if (descriptor.name === "ask") {
                 if (!args)
                     throw new Error("Usage: /ask <question>");

package/dist/routes/datasets.d.ts

@@ -0,0 +1,14 @@
+import { type ArtifactStore, type SQLiteStore } from "@alisio/core";
+import type { ServerFrame } from "@alisio/sdk";
+import type { SessionService } from "../host/sessions.ts";
+import { HttpError } from "../http/errors.ts";
+import type { Router } from "../http/router.ts";
+/** The HTTP shape of a data failure. */
+export declare function dataHttpError(error: unknown): HttpError;
+export declare function registerDatasetRoutes(router: Router, ctx: {
+    sessions: SessionService;
+    catalog: SQLiteStore;
+    artifacts: ArtifactStore;
+    blobs: import("@alisio/core").BlobStore;
+    toSession: (sessionId: string, frame: ServerFrame) => void;
+}): void;

package/dist/routes/datasets.js

@@ -0,0 +1,239 @@
+/**
+ * Datasets (spec §14.1, §17): raw upload of a CSV/TSV/JSON/JSONL/XLSX file into a session (kept in
+ * the content-addressed blob store, ingested in the background into one SQLite file), the list
+ * and schema of a session's datasets, and the keyset-paginated rows `SpreadsheetView` reads. A
+ * spreadsheet artifact is ingested lazily on its first preview. Ingestion runs in the data
+ * engine process, so the server keeps answering (health, SSE heartbeat) while a file is read.
+ */
+import { createReadStream } from "node:fs";
+import { basename } from "node:path";
+import { pipeline } from "node:stream/promises";
+import { BlobTooLarge, DataError, datasetFormat, PageParamError, toDatasetRef, } from "@alisio/core";
+import { HttpError } from "../http/errors.js";
+import { queryInt } from "../schemas.js";
+import { attachmentDisposition } from "./artifacts.js";
+/** How long `POST /api/artifacts/:aid/dataset` waits for the ingestion before answering 202. */
+const ARTIFACT_WAIT_MS = 15_000;
+/** The HTTP shape of a data failure. */
+export function dataHttpError(error) {
+    if (error instanceof HttpError)
+        return error;
+    if (error instanceof PageParamError)
+        return new HttpError("validation_failed", error.message);
+    if (error instanceof DataError) {
+        switch (error.code) {
+            case "not_found":
+                return new HttpError("not_found", error.message);
+            case "dataset_unsupported":
+                return new HttpError("dataset_unsupported", error.message);
+            case "query_rejected":
+            case "sql_error":
+                return new HttpError("query_rejected", error.message);
+            case "query_timeout":
+                return new HttpError("query_timeout", error.message);
+            case "ingest_limit":
+                return new HttpError("payload_too_large", error.message);
+            case "ingest_invalid":
+                return new HttpError("validation_failed", error.message);
+            case "cancelled":
+                return new HttpError("cancelled", error.message);
+            default:
+                return new HttpError("internal", error.message);
+        }
+    }
+    return new HttpError("internal", error instanceof Error ? error.message : String(error));
+}
+/** `X-File-Name` is percent-encoded (headers are ASCII); falls back to the raw text. */
+function uploadName(header) {
+    const raw = Array.isArray(header) ? (header[0] ?? "") : (header ?? "");
+    let name = raw;
+    try {
+        name = decodeURIComponent(raw);
+    }
+    catch {
+        /* keep the raw header */
+    }
+    return basename(name.replace(/\\/g, "/")).trim().slice(0, 255);
+}
+export function registerDatasetRoutes(router, ctx) {
+    const { sessions } = ctx;
+    /** The dataset service of the workspace that owns a root session. */
+    async function serviceOf(sessionId) {
+        const session = sessions.get(sessionId);
+        const opened = await sessions.app(session);
+        return {
+            datasets: opened.app.datasets,
+            analysis: opened.app.config.analysis.enabled,
+            workspace: session.workspace,
+            root: sessions.rootOf(session.id),
+        };
+    }
+    /** The record of a dataset id and the service of its owner. */
+    async function find(id) {
+        const row = ctx.catalog.db
+            .prepare("SELECT session, root_session FROM datasets WHERE id=?")
+            .get(id);
+        if (!row)
+            throw new HttpError("not_found", "Dataset not found");
+        const { datasets } = await serviceOf(row.root_session);
+        const record = datasets.get(id);
+        if (!record)
+            throw new HttpError("not_found", "Dataset not found");
+        return { record, datasets };
+    }
+    const ingestInBackground = (datasets, root, name, work) => {
+        work.then(({ record }) => ctx.toSession(root, { t: "dataset_ready", sessionId: root, dataset: toDatasetRef(record) }), (error) => ctx.toSession(root, {
+            t: "dataset_failed",
+            sessionId: root,
+            name,
+            error: error instanceof Error ? error.message : String(error),
+        }));
+        void datasets;
+    };
+    router.post("/api/sessions/:sid/datasets", async ({ req, params }) => {
+        const target = await serviceOf(params.sid ?? "");
+        const type = String(req.headers["content-type"] ?? "")
+            .split(";")[0]
+            ?.trim()
+            .toLowerCase();
+        if (type !== "application/octet-stream") {
+            req.resume();
+            throw new HttpError("unsupported_media_type", "Upload the file as the raw body with Content-Type: application/octet-stream");
+        }
+        const name = uploadName(req.headers["x-file-name"]);
+        if (!name || !datasetFormat(name)) {
+            req.resume();
+            throw new HttpError("dataset_unsupported", "Upload a CSV, TSV, JSON, JSONL or XLSX file (send its name in X-File-Name)");
+        }
+        if (!target.analysis) {
+            req.resume();
+            throw new HttpError("validation_failed", "Data analysis is disabled (analysis.enabled)");
+        }
+        const limit = target.datasets.limits.maxUploadBytes;
+        const declared = Number(req.headers["content-length"] ?? Number.NaN);
+        if (Number.isFinite(declared) && declared > limit) {
+            req.resume();
+            throw new HttpError("payload_too_large", `The file exceeds ${limit} bytes (analysis.data.maxUploadBytes)`);
+        }
+        let blob;
+        try {
+            blob = await ctx.blobs.putStream(req, "application/octet-stream", { maxBytes: limit });
+        }
+        catch (error) {
+            if (error instanceof BlobTooLarge) {
+                req.resume();
+                throw new HttpError("payload_too_large", `The file exceeds ${limit} bytes (analysis.data.maxUploadBytes)`);
+            }
+            throw error;
+        }
+        if (blob.bytes === 0)
+            throw new HttpError("validation_failed", "The upload is empty");
+        const session = sessions.get(params.sid ?? "");
+        const work = target.datasets.ingest({
+            rootSessionId: target.root,
+            sessionId: session.id,
+            workspace: target.workspace,
+            path: ctx.blobs.path(blob.hash),
+            name,
+            blobHash: blob.hash,
+        });
+        // A file already ingested in this session answers immediately.
+        const existing = target.datasets.list(target.root).find((d) => d.sha256 === blob.hash);
+        work.catch(() => undefined);
+        ingestInBackground(target.datasets, target.root, name, work);
+        if (existing)
+            return {
+                status: 200,
+                body: { dataset: toDatasetRef(existing), pending: false },
+            };
+        return { status: 202, body: { dataset: null, pending: true } };
+    });
+    router.get("/api/sessions/:sid/datasets", async ({ params }) => {
+        const target = await serviceOf(params.sid ?? "");
+        return { body: { items: target.datasets.list(target.root).map(toDatasetRef) } };
+    });
+    router.get("/api/datasets/:did", async ({ params }) => {
+        const { record, datasets } = await find(params.did ?? "");
+        try {
+            return { body: datasets.detail(record) };
+        }
+        catch (error) {
+            throw dataHttpError(error);
+        }
+    });
+    // The original file of a dataset uploaded from the web (the blob store keeps it untouched).
+    router.get("/api/datasets/:did/download", async ({ params, res }) => {
+        const { record } = await find(params.did ?? "");
+        if (!record.blobHash)
+            throw new HttpError("not_found", "This dataset has no uploaded original (use the artifact download)");
+        const file = ctx.blobs.path(record.blobHash);
+        res.writeHead(200, {
+            "Content-Type": "application/octet-stream",
+            "Content-Length": record.bytes,
+            "Content-Disposition": attachmentDisposition(record.name),
+            "Cache-Control": "private, no-store",
+        });
+        await pipeline(createReadStream(file), res);
+        return undefined;
+    });
+    router.get("/api/datasets/:did/rows", async ({ params, url }) => {
+        const { record, datasets } = await find(params.did ?? "");
+        const dir = url.searchParams.get("dir");
+        if (dir !== null && dir !== "asc" && dir !== "desc")
+            throw new HttpError("validation_failed", "Invalid query parameter", { fields: ["dir"] });
+        const text = (name) => url.searchParams.get(name) ?? undefined;
+        const sheet = text("sheet");
+        const after = text("after");
+        const sort = text("sort");
+        const filter = text("filter");
+        const column = text("column");
+        try {
+            const page = await datasets.page(record, {
+                ...(sheet !== undefined ? { sheet } : {}),
+                ...(after ? { after } : {}),
+                ...(queryInt(url, "offset", 0) ? { offset: queryInt(url, "offset", 0) } : {}),
+                limit: queryInt(url, "limit", 200, 500) ?? 200,
+                ...(sort ? { sort } : {}),
+                ...(dir ? { dir } : {}),
+                ...(filter ? { filter } : {}),
+                ...(column !== undefined ? { column } : {}),
+            });
+            return { body: page };
+        }
+        catch (error) {
+            throw dataHttpError(error);
+        }
+    });
+    // A spreadsheet artifact (CSV/TSV/XLSX) is ingested the first time it is previewed.
+    router.post("/api/artifacts/:aid/dataset", async ({ params }) => {
+        const record = ctx.artifacts.get(params.aid ?? "");
+        if (!record || record.status !== "ready")
+            throw new HttpError("artifact_not_found", "Artifact not found");
+        if (record.kind !== "spreadsheet")
+            throw new HttpError("validation_failed", "Only spreadsheet artifacts open as datasets");
+        const file = await ctx.artifacts.resolveFile(record, record.entry ?? record.fileName);
+        if (!file)
+            throw new HttpError("artifact_not_found", "The artifact file was not found");
+        const target = await serviceOf(record.sessionId);
+        if (!target.analysis)
+            throw new HttpError("validation_failed", "Data analysis is disabled (analysis.enabled)");
+        const work = target.datasets.ingest({
+            rootSessionId: target.root,
+            sessionId: record.sessionId,
+            workspace: target.workspace,
+            path: file.abs,
+            name: record.fileName,
+            sourcePath: file.abs,
+        });
+        work.catch(() => undefined);
+        const outcome = await Promise.race([
+            work.then((done) => ({ done })),
+            new Promise((resolve) => setTimeout(() => resolve({}), ARTIFACT_WAIT_MS)),
+        ]).catch((error) => {
+            throw dataHttpError(error);
+        });
+        if (!outcome.done)
+            return { status: 202, body: { dataset: null, pending: true } };
+        return { body: { dataset: toDatasetRef(outcome.done.record), pending: false } };
+    });
+}

package/dist/routes/files.js

@@ -6,7 +6,7 @@
  */
 import { lstat, open, readdir, realpath, stat } from "node:fs/promises";
 import { basename, extname, relative, resolve, sep } from "node:path";
-import { clipLines, inside, safePath, unifiedPatch } from "@alisio/core";
+import { clipLines, exportedPaths, inside, safePath, unifiedPatch, } from "@alisio/core";
 import { gitIgnored, gitRoot, gitStatus, runGit } from "../host/git.js";
 import { HttpError } from "../http/errors.js";
 import { sniffImage } from "./images.js";
@@ -224,23 +224,31 @@ export function registerFileRoutes(router, ctx) {
                         const meta = wanted.get(call.id);
                         if (!meta)
                             continue;
-                        let path;
-                        try {
-                            path = JSON.parse(call.arguments).path;
+                        const paths = [];
+                        if (call.name === "artifact_export")
+                            // A copied artifact can write several files: its result lists them.
+                            paths.push(...exportedPaths(catalog.callResult(id, call.id)));
+                        else {
+                            let path;
+                            try {
+                                path = JSON.parse(call.arguments).path;
+                            }
+                            catch {
+                                continue;
+                            }
+                            if (typeof path === "string" && path)
+                                paths.push(path);
                         }
-                        catch {
-                            continue;
+                        for (const path of paths) {
+                            const absolute = resolve(workspace, path);
+                            if (!inside(workspace, absolute))
+                                continue;
+                            const rel = toPosix(relative(workspace, absolute));
+                            const at = meta.startedAt ?? 0;
+                            const prev = latest.get(rel);
+                            if (!prev || at >= prev.at)
+                                latest.set(rel, { ...(meta.runId ? { runId: meta.runId } : {}), at });
                         }
-                        if (typeof path !== "string" || !path)
-                            continue;
-                        const absolute = resolve(workspace, path);
-                        if (!inside(workspace, absolute))
-                            continue;
-                        const rel = toPosix(relative(workspace, absolute));
-                        const at = meta.startedAt ?? 0;
-                        const prev = latest.get(rel);
-                        if (!prev || at >= prev.at)
-                            latest.set(rel, { ...(meta.runId ? { runId: meta.runId } : {}), at });
                     }
                 }
                 const last = page.items.at(-1);