@augurworks/augur 0.15.5 → 0.15.7

package/agents/README.md

@@ -32,9 +32,11 @@ signed in to and types the code; the token lands in `~/.config/augur/tokens.json
 `augur ship` / `augur publish` use it from then on. `publish` runs the pairing itself when
 it finds no token, so inside a workspace tree nothing has to be done first. On a workspace
 that serves drafts (`/.well-known/augur.json` says `drafts.enabled`), the everyday verbs
-are `augur open` and `augur land` instead — see [drafts.md](./drafts.md). To get the
-tree from a hostname, pair first, then `npx @augurworks/augur clone --space <id>` — it reads the
-origin from the pairing.
+are `augur open` and `augur land` instead — see [drafts.md](./drafts.md). Where drafts
+are served you need no tree at all: `augur open <opportunity>/<prototype>` fetches that one
+prototype into a folder of its own (a cold agent that cloned a large workspace first spent
+most of its first turn waiting). Elsewhere, `npx @augurworks/augur clone --space <id>` fetches
+the tree — it reads the origin from the pairing.
 
 The instance says all of this itself at `GET /llms.txt` (and as data at
 `/.well-known/augur.json`); a signed-out request for an engine path answers `401` with

package/agents/drafts.md

@@ -55,7 +55,8 @@ saves on every burst of changes; `augur save` saves once.
 ## Landing
 
 `augur land` replaces the prototype's real URL with your draft, records who landed it and
-when, and closes the draft. It is refused in exactly one case: somebody landed on this
+when — and whose draft it was, when a member lands somebody else's from the site — and
+closes the draft. It is refused in exactly one case: somebody landed on this
 prototype since you opened yours. Then:
 
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@augurworks/augur",
-  "version": "0.15.5",
+  "version": "0.15.7",
   "files": [
     "scripts/",
     "build.js",

package/scripts/lib/store.mjs

@@ -39,10 +39,30 @@ export function resolveOrigin(root = ENGINE_ROOT) {
     cwdSpaceOrigin = JSON.parse(readFileSync(path.join(process.cwd(), "space.json"), "utf8")).siteOrigin || "";
   } catch (e) {}
   return (process.env.AUGUR_ORIGIN || env.AUGUR_ORIGIN ||
-    deployConfig(root, originHost(cwdSpaceOrigin)).siteOrigin || cwdSpaceOrigin || "")
+    deployConfig(root, originHost(cwdSpaceOrigin)).siteOrigin || cwdSpaceOrigin || pairedOrigin() || "")
     .replace(/\/+$/, "");
 }
 
+/**
+ * The origin this machine last paired with, when nothing else names one. A cold agent
+ * in an empty folder has just run `augur connect --origin X` and holds a token for X and
+ * nothing else — and `clone`/`open` then refused with "no target origin" until it typed
+ * AUGUR_ORIGIN, which the front door had told it the pairing would carry. One saved
+ * pairing is the answer; several is the most recent, said on stderr so a wrong guess is
+ * visible before anything is written.
+ */
+export function pairedOrigin() {
+  try {
+    const saved = JSON.parse(readFileSync(path.join(os.homedir(), ".config", "augur", "tokens.json"), "utf8"));
+    const hosts = Object.entries(saved).filter(([h, v]) => h && v && v.token);
+    if (!hosts.length) return "";
+    hosts.sort((a, b) => String(b[1].at || "").localeCompare(String(a[1].at || "")));
+    const [host] = hosts[0];
+    if (hosts.length > 1) console.error(`[augur] no origin named — using the last pairing, https://${host} (set AUGUR_ORIGIN to pick another)`);
+    return `https://${host}`;
+  } catch (e) { return ""; }
+}
+
 export function resolveToken(origin, root = ENGINE_ROOT) {
   const env = readEnvFile(path.join(root, ".env.deploy"));
   let token = process.env.AUGUR_TOKEN || env.AUGUR_TOKEN || "";

package/scripts/restore.mjs

@@ -292,6 +292,14 @@ if (STATE) {
     })).json();
     if (!res.ok) die(`the instance refused the state: ${res.reason}${res.failed ? ` (${res.failed.join(", ")})` : ""}`);
     if (res.skipped && res.skipped.length) log(`\x1b[33mskipped (not in the instance's inventory): ${res.skipped.join(", ")}\x1b[0m`);
+    // A restore says "at least this": a member the copy does not name stays, and the
+    // instance names them so a keep is never mistaken for a replace.
+    if (res.members && res.members.kept && res.members.kept.length) {
+      log(`\x1b[33mkept ${res.members.kept.length} member(s) this copy does not name (a restore removes nobody): ${res.members.kept.join(", ")} — remove them in the people panel if they should go\x1b[0m`);
+    }
+    if (res.members && res.members.removed && res.members.removed.length) {
+      log(`removed ${res.members.removed.length} member(s) this copy does not name: ${res.members.removed.join(", ")}`);
+    }
     stateReport = res;
   }
 }

package/src/_worker.js

@@ -5219,7 +5219,11 @@ function personFace(users, id) {
     : { name: null, initials: null, color: null };
 }
 const decorateDrafts = (drafts, users) => (drafts || []).map((d) => ({ ...d, ...personFace(users, d.owner) }));
-const decorateLandings = (landings, users) => (landings || []).map((l) => ({ ...l, ...personFace(users, l.by) }));
+const decorateLandings = (landings, users) => (landings || []).map((l) => ({
+  ...l, ...personFace(users, l.by),
+  // The draft's owner, with a face, when the landing was made from somebody else's draft.
+  draft: l.draftOwner && l.draftOwner !== l.by ? { owner: l.draftOwner, session: l.draftSession || "", ...personFace(users, l.draftOwner) } : null,
+}));
 
 /** How many units the gallery's index will ask about in one answer. */
 const DRAFTS_INDEX_MAX = 50;
@@ -6916,6 +6920,7 @@ function loginPage(tctx, redirect, error, requestUrl, opts = {}) {
 <head>
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <meta name="description" content="A sign-in gate. Assistants and scripts: GET /llms.txt says how to get in." />
   <meta name="robots" content="noindex, nofollow" />
   ${previewHead(tctx, requestUrl)}
   <link rel="preload" href="/fonts/inter-latin-wght-normal.woff2" as="font" type="font/woff2" crossorigin />
@@ -7022,6 +7027,7 @@ function loginPage(tctx, redirect, error, requestUrl, opts = {}) {
     </div>
     ${formBody}
     ${tctx.LOGIN_HINT && !passwordless ? `<p class="hint">${escapeHtml(tctx.LOGIN_HINT)}</p>` : ""}
+    <p class="hint door">Connecting an assistant or a script? It reads <a href="/llms.txt">/llms.txt</a>.</p>
   </main>
 </body>
 </html>`;
@@ -7359,8 +7365,78 @@ async function withDraftUi(tctx, res, url, me, env) {
   return new Response(html, { status: res.status, statusText: res.statusText, headers });
 }
 /** A content response, dressed: the live-reload poll, the current chrome, the draft bar, the cache policy. */
-async function serveContent(tctx, asset, url, me, env) {
-  return withAssetCache(await withDraftUi(tctx, await composeChrome(tctx, withLiveReload(tctx, asset, url), url), url, me, env), url);
+async function serveContent(tctx, asset, url, me, env, request = null) {
+  return withAgentPreface(withDoorLink(withAssetCache(await withDraftUi(tctx, await composeChrome(tctx, withLiveReload(tctx, asset, url), url), url, me, env), url)), request, url, me);
+}
+
+/**
+ * Is this fetch a BROWSER's? Every browser sends `Sec-Fetch-Dest` (and `-Mode`) on every
+ * request it makes — a navigation, an iframe, an image, a prefetch — and no scripted
+ * fetcher does: curl, node, Python, the fetch behind a summarising tool. The headers are
+ * forbidden to page script, so a page cannot fake them off; a fetcher can only fake them
+ * ON, which is the harmless direction. A `Mozilla/` user agent counts as a browser too,
+ * for the browser old enough to send no Sec-Fetch at all and for the fetcher that dresses
+ * as one — both get the page a person gets, which is the conservative side of the line.
+ */
+function browserFetch(request) {
+  if (!request || !request.headers) return true;
+  if (request.headers.has("Sec-Fetch-Dest") || request.headers.has("Sec-Fetch-Mode")) return true;
+  return /^Mozilla\//.test(request.headers.get("User-Agent") || "");
+}
+
+/** The one paragraph a non-browser fetch of a prototype is given, first in the body. */
+function agentPreface(url) {
+  const origin = escapeHtml(url.origin);
+  return `<p data-augur-door>This prototype is served by an Augur workspace at ${origin}. `
+    + `Assistants and scripts: <a href="${DOOR_DOCS}">${origin}${DOOR_DOCS}</a> says how to change it — `
+    + `a terminal is paired with the person's approval, and nobody is ever asked for a password.</p>`;
+}
+
+/**
+ * A prototype fetched by something that is not a browser opens with the door.
+ *
+ * An agent handed a prototype's URL fetches the page and finds a finished site with
+ * nothing on it about how it is edited — the customer's own HTML, and on a public
+ * prototype never the gate. The `Link` header (below) reaches a scripted agent; a
+ * summarising fetch keeps only the text. So a fetch that carries no browser headers gets
+ * ONE paragraph prepended to the body, naming the origin and `/llms.txt`, and a browser
+ * gets the page byte for byte as published — a person never sees it, an embed never
+ * carries it, and the design is not touched. Decided 6 Sep 2026 after two of four cold
+ * agents fetched the prototype rather than the workspace and told the person to ask a
+ * developer.
+ *
+ * `no-store`, so the agent's variant is never what a cache hands a browser; the wrap is
+ * the outermost on the serving path for the same reason — nothing below it stores what
+ * this adds. Only a 200 HTML page: an error page, a redirect and a stylesheet are left alone.
+ * Only a SIGNED-OUT fetch: a request carrying a member's session is already inside, and
+ * what it is served — the gallery, a gated prototype — stays byte for byte what it was.
+ */
+async function withAgentPreface(res, request, url, me = null) {
+  if (!res || res.status !== 200 || !/text\/html/.test(res.headers.get("Content-Type") || "")) return res;
+  if (me || browserFetch(request)) return res;
+  const html = await res.text();
+  const m = /<body[^>]*>/i.exec(html);
+  const out = m ? html.slice(0, m.index + m[0].length) + agentPreface(url) + html.slice(m.index + m[0].length) : agentPreface(url) + html;
+  const headers = new Headers(res.headers);
+  headers.delete("Content-Length");
+  headers.delete("ETag");
+  headers.set("Cache-Control", "no-store");
+  headers.set("Vary", "Sec-Fetch-Dest, User-Agent");
+  return new Response(out, { status: res.status, statusText: res.statusText, headers });
+}
+/**
+ * A served page carries the same `Link: </llms.txt>; rel="help"` the gate carries. An agent
+ * handed the URL of a PUBLIC prototype never meets the gate — it fetches the page, finds a
+ * finished site with nothing on it about how it is edited, and gives up. The header is the
+ * one pointer that costs the page no bytes and no pixels; a scripted agent reads it, and a
+ * summarising one at least reaches the gate's own words at the workspace root.
+ */
+function withDoorLink(res) {
+  if (!res || !/text\/html/.test(res.headers.get("Content-Type") || "")) return res;
+  if (res.headers.get("Link")) return res;
+  const headers = new Headers(res.headers);
+  headers.set("Link", `<${DOOR_DOCS}>; rel="help"`);
+  return new Response(res.body, { status: res.status, statusText: res.statusText, headers });
 }
 
 // Test seam: loadConfig fills the chrome pointer, the workspace list and the runtime-
@@ -8386,6 +8462,43 @@ async function readStateFamily(tctx, env, entry, store, kv) {
     }
     return await store.read(family, "");
   }
+  // ── the identity families the workspace OBJECT holds since the cut-over ──────────
+  //
+  // `publish:tokens` is read by the publish path from the object FIRST and KV second, and a
+  // mint writes both — so a row can be in one store and not the other. Reading KV alone
+  // here (which is what this did) produced a `--full` copy that omitted tokens which were
+  // live and answering; a restore from it would have dropped them without a word. The copy
+  // is the union of both stores.
+  //
+  // ⚠️ FOR A HASH BOTH STORES HOLD, KV'S RECORD IS THE ONE COPIED, VERBATIM. The object's
+  // row is a projection into columns — it stamps a `createdAt` on a record the copy never
+  // carried and spells `label` as null where the record had none — and a copy that took
+  // the projection stopped verifying: `augur migrate` compares the target's export with the
+  // source's, and a KV→workspace migration reported `publish:tokens` as not matching on
+  // data that had landed. What the object ADDS is the rows KV lacks; what KV holds is what a
+  // restore wrote and what a verifier reads back. (The admin panel lists the same union the
+  // other way round — the object's row is what governs a publish — and that is a display
+  // question, not a copy question.)
+  //
+  // An object that CANNOT be asked throws, and the export files that under `failed` — a
+  // restore refuses such a copy. Answering from KV alone instead would be a copy that calls
+  // itself full while missing every object-held token, the exact thing this branch closes.
+  if (entry.id === PUBLISH_TOKENS_KEY) {
+    const ident = identityFor(env, tctx, "publishTokens");
+    if (ident) {
+      const listed = await ident.tokenList();
+      const held = (listed && listed.tokens && typeof listed.tokens === "object") ? listed.tokens : {};
+      let map = null;
+      if (kv) {
+        const raw = await kv.get(entry.id);
+        if (raw != null) { try { map = JSON.parse(raw); } catch (e) { map = null; } }
+      }
+      // Absent stays absent: no document in KV and no row in the object is the one answer a
+      // restore must LEAVE alone (it clears a `{}`). A seeded-but-empty object is `{}`.
+      if (map === null && !Object.keys(held).length && !(listed && listed.seeded)) return null;
+      return { ...held, ...(map || {}) };
+    }
+  }
   if (!kv) return null;
   if (STATE_KV_PREFIXED.includes(entry.id)) {
     const out = {};
@@ -8652,6 +8765,9 @@ async function importState(tctx, env, doc) {
       },
     );
 
+    // Whether the copy carried the roster overlay at all: the object counts the people
+    // the copy does not name only when the copy claims to say who belongs.
+    identity.rosterCarried = Object.prototype.hasOwnProperty.call(doc.families, "users:roster");
     const res = await stub.fetch("https://workspace/state/import", {
       method: "POST",
       headers: { "content-type": "application/json" },
@@ -8660,7 +8776,15 @@ async function importState(tctx, env, doc) {
       }),
     });
     if (!res.ok) return { ok: false, reason: "workspace-refused", status: res.status };
-    const { atomic, refused } = await res.json();
+    const { atomic, refused, members } = await res.json();
+    // The people `prune` removed from the object are removed the way the admin panel
+    // removes them: the session, the KV-side token and invite copies go too. Best-effort
+    // and after the object's transaction — the row is the fact, these are its consequences.
+    for (const email of (members && members.removed) || []) {
+      try { await revokeSecret(env, email, tctx); } catch (e) { /* no KV binding: nothing to revoke there */ }
+      await revokePublishTokens(tctx, env, email);
+      await revokeInvitesFor(tctx, env, email);
+    }
     // ⚠️ THE IDENTITY FAMILIES GO TO BOTH, AND THAT IS THE POINT OF THE SPLIT.
     // The object gets a faithful copy and KV stays exactly what the KV path reads, so a
     // restore cannot take an instance down whichever store is currently answering. With the
@@ -8681,6 +8805,9 @@ async function importState(tctx, env, doc) {
       // from a complete one, which is the failure this whole path exists to avoid.
       unmapped: identitySkipped,
       refusedRows: refused || [],
+      // Who the copy did not name and what became of them — `kept` on a plain restore,
+      // `removed` under `prune`. Absent when the copy carried no roster.
+      ...(members ? { members } : {}),
     };
   }
 
@@ -9139,9 +9266,11 @@ function doorText(f) {
       + `turn, and run the same command again once they say they approved — the token is\n`
       + `collected then, for that same code. Do not poll for the approval in one turn:\n`
       + `the code lives five minutes and nobody sees it until you stop.\n\n`
-      + `With no\n`
-      + `source tree yet, \`npx @augurworks/augur clone --space ${f.workspace}\` then fetches one (it reads\n`
-      + `the origin from the pairing).\n\n`
+      + (f.drafts && f.drafts.enabled
+        ? `You need no source tree here: \`augur open <opportunity>/<prototype>\` fetches that one\n`
+          + `prototype into a folder of its own (see below). Do not clone the workspace first.\n\n`
+        : `With no source tree yet, \`npx @augurworks/augur clone --space ${f.workspace}\` then fetches\n`
+          + `one (it reads the origin from the pairing).\n\n`)
     : `Device pairing is switched off on this workspace. Ask an admin for an invite;\n`
       + `once you have signed in, \`augur login\` (email and password, meant for CI)\n`
       + `trades that for a publish token.\n\n`;
@@ -12245,7 +12374,7 @@ async function handleRequest(request, env, ctx, url, trace) {
       }
       const asset = await assetFetch(tctx.tenantId, env, request);
       if (asset.status === 404) return notFoundResponse(tctx);
-      return serveContent(tctx, asset, url, me, env);
+      return serveContent(tctx, asset, url, me, env, request);
     }
 
     // Published prototypes are public — never gated, regardless of the cookie.
@@ -12254,7 +12383,7 @@ async function handleRequest(request, env, ctx, url, trace) {
     if (isPublicPath(tctx, url.pathname)) {
       const asset = await assetFetch(tctx.tenantId, env, request);
       if (asset.status === 404) return notFoundResponse(tctx);
-      const res = await serveContent(tctx, asset, url, me, env);
+      const res = await serveContent(tctx, asset, url, me, env, request);
       const out = new Response(res.body, res);
       out.headers.set("X-Robots-Tag", "noindex, nofollow, noarchive");
       return out;
@@ -12285,14 +12414,14 @@ async function handleRequest(request, env, ctx, url, trace) {
       // Where drafts are served, the gallery and its indexes are derived from the live
       // store rather than read from it — a landing is on them at once.
       const derived = await derivedPage(tctx, env, url);
-      if (derived) return stamp(derived.status === 308 ? derived : await serveContent(tctx, derived, url, me, env));
+      if (derived) return stamp(derived.status === 308 ? derived : await serveContent(tctx, derived, url, me, env, request));
       const asset = await assetFetch(tctx.tenantId, env, request, { dsDraft: ds.draft });
       if (asset.status === 404) {
         const virt = await virtualCanvas(tctx, request, env, url);
         if (virt) return stamp(virt);
         return stamp(notFoundResponse(tctx));
       }
-      return stamp(await serveContent(tctx, asset, url, me, env));
+      return stamp(await serveContent(tctx, asset, url, me, env, request));
     }
 
     // Created canvas boards are public like published prototypes — same obscure
@@ -12374,7 +12503,7 @@ export const __testables = Object.freeze({
   doorFacts, doorText, wantsMachineDoor, gateResponse, DOOR_DOCS, DOOR_WELL_KNOWN,
   resumeAfterDormancy,
   PITI_VIEW_KEY, PITI_REMARKS_KEY,
-  publishAuthDetailed, unitApi, unitCaller, personFace, withDraftUi, draftUiBoot, derivedPage, dsOverlay, isEngineChrome, publishRefusalBody, splitDraftPath,
+  publishAuthDetailed, unitApi, unitCaller, personFace, withDoorLink, withAgentPreface, browserFetch, withDraftUi, draftUiBoot, derivedPage, dsOverlay, isEngineChrome, publishRefusalBody, splitDraftPath,
   adminStorageApi,
   adminCustomDomainApi,
   isPrefixBacked, backedPublicPrefixes,

package/src/drafts/drafts.js

@@ -223,6 +223,7 @@
         row.appendChild(face(l));
         var text = el("div");
         var who = l.by === "live" ? "Adopted from the live site" : label(l);
+        if (l.draft && l.draft.owner) who += " · draft by " + label(l.draft);
         text.appendChild(el("div", null, "#" + l.revision + " · " + who));
         var meta = (l.note ? l.note + " · " : "") + ago(l.at, "landed")
           + (l.restoredFrom ? " · restored from #" + l.restoredFrom : "")

package/src/tenant-do.js

@@ -739,7 +739,7 @@ function seedCount(seed) {
  * `users:roster`'s `remove` list, and dropping the person here instead would let a
  * re-invite inherit the role the last holder of that address had.
  */
-function writeIdentity(sql, identity, at, written = [], refused = []) {
+function writeIdentity(sql, identity, at, written = [], refused = [], { prune = false } = {}) {
   if (!identity || typeof identity !== "object") return { written, refused };
   const list = (k) => (Array.isArray(identity[k]) ? identity[k] : []);
   const touched = (family, n) => { if (n) written.push(family); };
@@ -775,6 +775,39 @@ function writeIdentity(sql, identity, at, written = [], refused = []) {
   touched("members", n);
   if (n) markSeeded(sql, "roster", at);
 
+  // ── the people the copy does NOT name ──────────────────────────────────────────
+  //
+  // On KV the roster overlay is one document and an import replaces it, so anybody the
+  // copy does not name is gone. Here the rows above were upserted and every other row was
+  // left as it was — a member the copy does not name STAYS, with their session and their
+  // tokens, and for a while this reported `users:roster` as written and said nothing else,
+  // which read as a replace. So the ones left are counted and named:
+  //
+  //   · a plain restore says "at least this" and KEEPS them — `kept` says who, so a person
+  //     reading the result cannot mistake a keep for a replace;
+  //   · `prune` says "exactly this" and REMOVES them the way the admin panel's remove
+  //     does — a tombstone (a re-invite must not inherit the old role), no publish token,
+  //     no outstanding invite. The worker revokes the session and the KV-side copies.
+  //
+  // Only overlay rows: a config member is the durable roster, not the copy's to remove.
+  // Only when the copy CARRIED the roster family — a copy of nothing but statuses says
+  // nothing about who belongs. `rosterCarried` is the worker's word for that.
+  let members;
+  if (identity.rosterCarried) {
+    const named = new Set(list("members").map((m) => lcAddr(m && m.email)).filter(Boolean));
+    const left = [...sql.exec(
+      `SELECT email FROM members WHERE source = 'overlay' AND removed_at IS NULL ORDER BY email`,
+    )].map((r) => String(r.email)).filter((e) => !named.has(e));
+    members = { kept: [], removed: [] };
+    for (const e of left) {
+      if (!prune) { members.kept.push(e); continue; }
+      sql.exec(`UPDATE members SET removed_at = ? WHERE email = ?`, at, e);
+      sql.exec(`DELETE FROM publish_tokens WHERE LOWER(label) = ?`, e);
+      sql.exec(`DELETE FROM invites WHERE email = ?`, e);
+      members.removed.push(e);
+    }
+  }
+
   n = 0;
   for (const i of list("invites")) {
     if (!i || !i.tokenHash) continue;
@@ -838,7 +871,7 @@ function writeIdentity(sql, identity, at, written = [], refused = []) {
   }
   touched("blobs", n);
 
-  return { written, refused };
+  return { written, refused, members };
 }
 
 /**
@@ -2550,11 +2583,12 @@ export class TenantStore {
           written.push(scope ? `${family}/${scope}` : family);
         }
       }
-      writeIdentity(this.sql, identity, stamp, written, refused);
+      members = writeIdentity(this.sql, identity, stamp, written, refused, { prune }).members;
     };
+    let members;
     const atomic = typeof this.ctx.storage.transactionSync === "function";
     if (atomic) this.ctx.storage.transactionSync(body); else body();
-    return { written, refused, atomic };
+    return members ? { written, refused, atomic, members } : { written, refused, atomic };
   }
 
   /**

package/src/unit-object.mjs

@@ -265,11 +265,17 @@ export class UnitObject {
     const rows = [...this.sql.exec(`SELECT * FROM landings ORDER BY revision DESC`)];
     return {
       revision: this.mainRevision(),
-      landings: rows.map((r) => ({
-        revision: Number(r.revision), by: r.by || null, session: r.session || "", at: r.at, note: r.note || "",
-        draftId: r.draft_id || null, restoredFrom: r.restored_from == null ? null : Number(r.restored_from),
-        files: Object.keys(JSON.parse(r.tbl)).length,
-      })),
+      landings: rows.map((r) => {
+        // Any member may land any draft from the bar, so a landing has two people on it:
+        // who pressed Land (`by`) and whose draft it was. The draft row keeps the second.
+        const d = r.draft_id ? this.draft(r.draft_id) : null;
+        return {
+          revision: Number(r.revision), by: r.by || null, session: r.session || "", at: r.at, note: r.note || "",
+          draftId: r.draft_id || null, restoredFrom: r.restored_from == null ? null : Number(r.restored_from),
+          draftOwner: d ? d.owner : null, draftSession: d ? d.session : "",
+          files: Object.keys(JSON.parse(r.tbl)).length,
+        };
+      }),
     };
   }