@coffer-org/server 7.2.0 → 7.3.0

package/dist/auth-api.d.ts

@@ -7,6 +7,10 @@ declare module 'fastify' {
 }
 export declare const PUBLIC_API_PATHS: string[];
 export declare function startPasswordSession(reply: FastifyReply, login: string, password: string): Promise<AuthUser | null>;
+export declare function parseBasicCredential(header: string | undefined): {
+    login: string;
+    secret: string;
+} | null;
 export declare function resolveRequestUser(req: FastifyRequest): Promise<AuthUser | null>;
 export declare function requireAdmin(req: FastifyRequest, reply: FastifyReply): boolean;
 export declare function registerAuthApi(app: FastifyInstance): Promise<void>;

package/dist/auth-api.js

@@ -2,6 +2,8 @@ import { field } from '@coffer-org/sdk/fields';
 import { materializeTree } from '@coffer-org/sdk/materialize/pipeline';
 import { countUsers, createUser, findUserByLogin, findUserById, getPasswordHash, listUsers, updateUser, deleteUser, countAdmins, createSession, resolveSession, deleteSession, createApiToken, resolveApiToken, listApiTokens, revokeApiToken, } from "./auth-store.js";
 import { resolveAccessToken } from "./oauth-store.js";
+import { listLinks, unlink, mintLinkCode } from "./identity-link.js";
+import { listLinkableConnectors, connectorLinkUrl } from "./orchestrator/index.js";
 import { mcpResource } from "./public-url.js";
 import { verifyPassword } from "./auth-crypto.js";
 import { maskSecrets, preserveSecrets } from "./field-masking.js";
@@ -11,6 +13,7 @@ import { USERS_SHELF } from '@coffer-org/sdk/users-shelf';
 const PASSWORD_FIELDS = materializeTree({ password: field.password({}) });
 const SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 const COOKIE_NAME = 'sid';
+const LINK_CODE_TTL_MS = 10 * 60 * 1000;
 export const PUBLIC_API_PATHS = ['/api/auth/status', '/api/auth/login', '/api/auth/setup'];
 function readCookie(req, name) {
     const header = req.headers.cookie;
@@ -37,12 +40,32 @@ export async function startPasswordSession(reply, login, password) {
     setCookie(reply, raw, SESSION_TTL_MS / 1000);
     return row;
 }
+export function parseBasicCredential(header) {
+    if (!header?.startsWith('Basic '))
+        return null;
+    let decoded;
+    try {
+        decoded = Buffer.from(header.slice('Basic '.length).trim(), 'base64').toString('utf8');
+    }
+    catch {
+        return null;
+    }
+    const at = decoded.indexOf(':');
+    if (at <= 0)
+        return null;
+    return { login: decoded.slice(0, at), secret: decoded.slice(at + 1) };
+}
 export async function resolveRequestUser(req) {
     const auth = req.headers.authorization;
     if (auth?.startsWith('Bearer ')) {
         const raw = auth.slice('Bearer '.length);
         return (await resolveApiToken(raw)) ?? (await resolveAccessToken(raw, await mcpResource(req)));
     }
+    const basic = parseBasicCredential(auth);
+    if (basic) {
+        const user = await resolveApiToken(basic.secret);
+        return user && user.login === basic.login ? user : null;
+    }
     const sid = readCookie(req, COOKIE_NAME);
     if (!sid)
         return null;
@@ -208,4 +231,34 @@ export async function registerAuthApi(app) {
             return reply.code(404).send({ error: 'not_found' });
         return { ok: true };
     });
+    app.get('/api/auth/links', async (req, reply) => {
+        if (!req.user)
+            return reply.code(401).send({ error: 'unauthorized' });
+        return { links: await listLinks(req.user.id), linkable: listLinkableConnectors() };
+    });
+    app.post('/api/auth/links', async (req, reply) => {
+        if (!req.user)
+            return reply.code(401).send({ error: 'unauthorized' });
+        const minted = await mintLinkCode(req.user.id, LINK_CODE_TTL_MS);
+        const links = {};
+        for (const connectorId of listLinkableConnectors()) {
+            const url = connectorLinkUrl(connectorId, minted.raw);
+            if (url)
+                links[connectorId] = url;
+        }
+        return { ...minted, links };
+    });
+    app.delete('/api/auth/links/:connector/:externalId', async (req, reply) => {
+        if (!req.user)
+            return reply.code(401).send({ error: 'unauthorized' });
+        const { connector, externalId } = req.params;
+        const own = await listLinks(req.user.id);
+        const owns = own.some((l) => l.connector === connector && l.externalId === externalId);
+        if (!owns)
+            return reply.code(404).send({ error: 'not_found' });
+        const ok = await unlink(connector, externalId);
+        if (!ok)
+            return reply.code(404).send({ error: 'not_found' });
+        return { ok: true };
+    });
 }

package/dist/auth-store.d.ts

@@ -1,3 +1,5 @@
+import { generateToken, hashToken } from './auth-crypto.ts';
+export { generateToken, hashToken };
 export interface AuthUser {
     id: number;
     login: string;

package/dist/auth-store.js

@@ -1,5 +1,6 @@
 import { getEm } from "./db.js";
 import { hashPassword, generateToken, hashToken } from "./auth-crypto.js";
+export { generateToken, hashToken };
 function toAuthUser(row) {
     return {
         id: row.id,

package/dist/entity-schema.d.ts

@@ -25,6 +25,8 @@ export declare const MsgLogSchema: EntitySchema<any, never, import("@mikro-orm/c
 export declare const UserSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
 export declare const SessionSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
 export declare const ApiTokenSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
+export declare const IdentityLinkSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
+export declare const LinkCodeSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
 export declare const OAuthClientSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
 export declare const OAuthCodeSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
 export declare const OAuthTokenSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;

package/dist/entity-schema.js

@@ -209,6 +209,9 @@ export const ThreadStateSchema = new EntitySchema({
         chat_id: { type: 'text', primary: true },
         agent_id: { type: 'text', nullable: true },
         preset_id: { type: 'text', nullable: true },
+        title: { type: 'text', nullable: true },
+        owner: { type: 'text', nullable: true },
+        visibility: { type: 'text', nullable: true },
         updated_at: { type: 'text' },
     },
 });
@@ -274,6 +277,27 @@ export const ApiTokenSchema = new EntitySchema({
         revoked: { type: 'integer' },
     },
 });
+export const IdentityLinkSchema = new EntitySchema({
+    name: '_IdentityLink',
+    tableName: '_identity_links',
+    properties: {
+        id: { type: 'integer', primary: true, autoincrement: true },
+        connector: { type: 'text' },
+        external_id: { type: 'text' },
+        user_id: { type: 'integer' },
+        linked_at: { type: 'text' },
+    },
+});
+export const LinkCodeSchema = new EntitySchema({
+    name: '_LinkCode',
+    tableName: '_link_codes',
+    properties: {
+        code_hash: { type: 'text', primary: true },
+        user_id: { type: 'integer' },
+        expires_at: { type: 'text' },
+        created_at: { type: 'text' },
+    },
+});
 export const OAuthClientSchema = new EntitySchema({
     name: '_OAuthClient',
     tableName: '_oauth_clients',
@@ -331,5 +355,7 @@ export const systemEntities = [
     OAuthTokenSchema,
     ThreadMessageSchema,
     ThreadStateSchema,
+    IdentityLinkSchema,
+    LinkCodeSchema,
     buildSettingsEntitySchema(SYSTEM_SETTINGS_ID, SYSTEM_SETTINGS),
 ];

package/dist/identity-link.d.ts

@@ -0,0 +1,15 @@
+export interface IdentityLink {
+    connector: string;
+    externalId: string;
+    userId: number;
+    linkedAt: string;
+}
+export declare function findLinkedUser(connector: string, externalId: string): Promise<number | null>;
+export declare function listLinks(userId: number): Promise<IdentityLink[]>;
+export declare function unlink(connector: string, externalId: string): Promise<boolean>;
+export declare function mintLinkCode(userId: number, ttlMs: number): Promise<{
+    raw: string;
+    expiresAt: string;
+}>;
+export declare function redeemLinkCode(raw: string, connector: string, externalId: string): Promise<number | null>;
+export declare function pruneLinkCodes(): Promise<void>;

package/dist/identity-link.js

@@ -0,0 +1,76 @@
+import { getEm } from "./db.js";
+import { generateToken, hashToken, findUserById } from "./auth-store.js";
+export async function findLinkedUser(connector, externalId) {
+    const em = getEm().fork();
+    const row = (await em.findOne('_IdentityLink', {
+        connector,
+        external_id: externalId,
+    }));
+    if (!row)
+        return null;
+    const user = await findUserById(row.user_id);
+    return user && !user.disabled ? row.user_id : null;
+}
+export async function listLinks(userId) {
+    const em = getEm().fork();
+    const rows = (await em.find('_IdentityLink', { user_id: userId }));
+    return rows.map((r) => ({
+        connector: r.connector,
+        externalId: r.external_id,
+        userId: r.user_id,
+        linkedAt: r.linked_at,
+    }));
+}
+export async function unlink(connector, externalId) {
+    const em = getEm().fork();
+    const deleted = await em.nativeDelete('_IdentityLink', { connector, external_id: externalId });
+    return deleted > 0;
+}
+export async function mintLinkCode(userId, ttlMs) {
+    const em = getEm().fork();
+    const raw = generateToken();
+    const expiresAt = new Date(Date.now() + ttlMs).toISOString();
+    em.create('_LinkCode', {
+        code_hash: hashToken(raw),
+        user_id: userId,
+        expires_at: expiresAt,
+        created_at: new Date().toISOString(),
+    });
+    await em.flush();
+    return { raw, expiresAt };
+}
+async function setLink(em, connector, externalId, userId) {
+    const existing = (await em.findOne('_IdentityLink', {
+        connector,
+        external_id: externalId,
+    }));
+    const linkedAt = new Date().toISOString();
+    if (existing) {
+        em.assign(existing, { user_id: userId, linked_at: linkedAt });
+    }
+    else {
+        em.create('_IdentityLink', { connector, external_id: externalId, user_id: userId, linked_at: linkedAt });
+    }
+    await em.flush();
+}
+export async function redeemLinkCode(raw, connector, externalId) {
+    const em = getEm().fork();
+    const hash = hashToken(raw);
+    const row = (await em.findOne('_LinkCode', { code_hash: hash }));
+    if (!row)
+        return null;
+    const deleted = await em.nativeDelete('_LinkCode', { code_hash: hash });
+    if (deleted === 0)
+        return null;
+    if (row.expires_at < new Date().toISOString())
+        return null;
+    const owner = await findUserById(row.user_id);
+    if (!owner || owner.disabled)
+        return null;
+    await setLink(em, connector, externalId, row.user_id);
+    return row.user_id;
+}
+export async function pruneLinkCodes() {
+    const em = getEm().fork();
+    await em.nativeDelete('_LinkCode', { expires_at: { $lt: new Date().toISOString() } });
+}

package/dist/index.js

@@ -15,10 +15,12 @@ import { NotFoundError } from "./mutate.js";
 import { httpErrorFor, registerErrorHandler } from "./http-errors.js";
 import { resolveEmbed } from "./embed.js";
 import { resolveWithinHome, filterSort, listDir } from "./fs-list.js";
-import { initPlugins, teardownPlugins, readDisabled, purgePluginData, getPluginSettings, getPlugins, } from "./plugin-runtime.js";
+import { initPlugins, teardownPlugins, readDisabled, getDisabled, purgePluginData, getPluginSettings, getPlugins, } from "./plugin-runtime.js";
 import { registerPluginsApi } from "./plugins-api.js";
 import { orchestratorDiagnostics } from "./orchestrator/index.js";
+import { pluginHooks } from "./plugin-hooks.js";
 import { registerPluginUserApi, registerPluginAdminApi } from "./plugin-user-api.js";
+import { collectHttpMounts, registerPluginHttpMounts, registerTextBodyParsers } from "./plugin-http-mounts.js";
 import { registerAuthApi, resolveRequestUser, requireAdmin, PUBLIC_API_PATHS } from "./auth-api.js";
 import { registerMcpHttp } from "./mcp-http.js";
 import { registerOAuthApi } from "./oauth-api.js";
@@ -71,6 +73,7 @@ app.addHook('onResponse', async (req, reply) => {
 });
 await app.register(cors, { origin: true });
 await app.register(multipart, { limits: { fileSize: 25 * 1024 * 1024 } });
+registerTextBodyParsers(app);
 await app.register(fastifyStatic, { root: UPLOADS, prefix: '/uploads/' });
 app.addHook('onSend', async (req, reply, payload) => {
     if (req.url.startsWith('/uploads/')) {
@@ -327,6 +330,10 @@ app.put('/api/settings/:id', (req, reply) => {
 });
 registerPluginAdminApi(app, requireAdmin);
 registerPluginUserApi(app);
+const httpMounts = collectHttpMounts(pluginHooks);
+registerPluginHttpMounts(app, httpMounts, { disabledSet: getDisabled, resolveUser: resolveRequestUser });
+if (httpMounts.length)
+    app.log.info(`plugin http mounts: ${httpMounts.map((m) => `${m.pluginId}${m.mount.prefix}`).join(', ')}`);
 app.get('/api/fs/list', async (req, reply) => {
     const home = homedir();
     const q = req.query;

package/dist/mcp-http.js

@@ -1,14 +1,18 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { collectMcpTools, resolveRagDeps, buildDomainSections, buildMcpInstructions, siteSection, } from "./mcp-tools.js";
+import { collectMcpTools, resolveRagDeps, buildDomainAreas, buildMcpInstructions, siteSection } from "./mcp-tools.js";
+import { assembleSystem, ALL_PRESENT } from "./orchestrator/system-areas.js";
 import { configuredPublicUrl } from "./public-url.js";
 import { getLogger } from "./log.js";
 const log = getLogger('mcp-http');
 export async function buildMcpServer(role, actor) {
     const rag = await resolveRagDeps();
-    const tools = (await collectMcpTools({ rag, includeAdmin: role === 'admin', actor })).filter((t) => role === 'admin' || t.role === 'member');
+    const tools = await collectMcpTools({ rag, role, actor });
     const site = await siteSection(await configuredPublicUrl());
-    const sections = [...(await buildDomainSections()), ...(site ? [site] : [])];
+    const areas = await buildDomainAreas();
+    if (site)
+        areas['channel'] = [site];
+    const sections = assembleSystem(areas, ALL_PRESENT);
     const server = new McpServer({ name: 'coffer', version: '1.0.0' }, { instructions: buildMcpInstructions(sections) });
     const registerTool = server.registerTool.bind(server);
     for (const t of tools) {

package/dist/mcp-tools.d.ts

@@ -6,6 +6,7 @@ import { type AuthRole, type PluginHooks } from './plugin-hooks.ts';
 import { type Condition } from '@coffer-org/sdk/condition';
 import { type AgentMeta } from '@coffer-org/sdk/library';
 import { type RagHit } from './rag-search.ts';
+import type { SystemAreas } from './orchestrator/system-areas.ts';
 export interface McpToolDef {
     server: string;
     bareName: string;
@@ -21,9 +22,9 @@ export interface RagDeps {
 }
 export declare function formatHits(hits: RagHit[]): string;
 export declare function resolveRagDeps(): Promise<RagDeps | null>;
-export declare function collectMcpTools(opts?: {
+export declare function collectMcpTools(opts: {
+    role: AuthRole;
     rag?: RagDeps | null;
-    includeAdmin?: boolean;
     actor?: string;
 }): Promise<McpToolDef[]>;
 export declare function collectPluginInstructions(hooks?: Record<string, PluginHooks>, emFactory?: () => EntityManager): Promise<{
@@ -73,7 +74,7 @@ export declare function collectLibraryPurposes(reg?: {
     }[];
 }, locales?: LocaleResolver): LibraryPurpose[];
 export declare function siteSection(siteUrl: string): Promise<string | null>;
-export declare function buildDomainSections(locales?: LocaleResolver): Promise<string[]>;
+export declare function buildDomainAreas(locales?: LocaleResolver): Promise<SystemAreas>;
 export interface StarterHint {
     id: string;
     text: string;

package/dist/mcp-tools.js

@@ -47,7 +47,7 @@ export async function resolveRagDeps() {
         return null;
     return { embeddingApiKey };
 }
-export async function collectMcpTools(opts = {}) {
+export async function collectMcpTools(opts) {
     const out = [];
     const client = new LocalClient();
     const locales = await loadComposedLocales();
@@ -202,54 +202,52 @@ export async function collectMcpTools(opts = {}) {
             },
         });
     }
-    if (opts.includeAdmin) {
-        const actor = opts.actor ?? 'mcp';
-        out.push({
-            server: 'coffer',
-            bareName: 'list_settings',
-            httpName: 'list_settings',
-            description: "List every settings group (the instance's own `system` group and each plugin's): each field's key/kind/required and the current values (secrets masked). Call before update_settings.",
-            inputSchema: {},
-            scope: 'settings',
-            role: 'admin',
-            handler: async () => {
-                try {
-                    return ok(await listSettings());
-                }
-                catch (e) {
-                    return fail(`Error: ${e.message}`);
-                }
-            },
-        });
-        out.push({
-            server: 'coffer',
-            bareName: 'update_settings',
-            httpName: 'update_settings',
-            description: 'Update a plugin or system settings group. group — the settings group id (e.g. "system", "claude-agent"); fields — only the settings to change (see list_settings). Send real secret values; the masked placeholder (********) is treated as unchanged.',
-            inputSchema: { group: z.string(), fields: z.record(z.string(), z.unknown()) },
-            scope: 'settings',
-            role: 'admin',
-            handler: async (args) => {
-                try {
-                    const row = await writePluginSettings(getEm().fork(), args.group, args.fields, actor);
-                    return ok(row);
-                }
-                catch (e) {
-                    if (e instanceof ValidationError) {
-                        const lines = e.issues.map((i) => {
-                            const o = i;
-                            return `- ${o.field ?? '?'}: ${o.code ?? 'invalid'}`;
-                        });
-                        return fail(`Validation error:\n${lines.join('\n')}`);
-                    }
-                    if (e instanceof NotFoundError)
-                        return fail(`No settings group '${String(args.group)}'.`);
-                    return fail(`Error: ${e.message}`);
+    const actor = opts.actor ?? 'mcp';
+    out.push({
+        server: 'coffer',
+        bareName: 'list_settings',
+        httpName: 'list_settings',
+        description: "List every settings group (the instance's own `system` group and each plugin's): each field's key/kind/required and the current values (secrets masked). Call before update_settings.",
+        inputSchema: {},
+        scope: 'settings',
+        role: 'admin',
+        handler: async () => {
+            try {
+                return ok(await listSettings());
+            }
+            catch (e) {
+                return fail(`Error: ${e.message}`);
+            }
+        },
+    });
+    out.push({
+        server: 'coffer',
+        bareName: 'update_settings',
+        httpName: 'update_settings',
+        description: 'Update a plugin or system settings group. group — the settings group id (e.g. "system", "claude-agent"); fields — only the settings to change (see list_settings). Send real secret values; the masked placeholder (********) is treated as unchanged.',
+        inputSchema: { group: z.string(), fields: z.record(z.string(), z.unknown()) },
+        scope: 'settings',
+        role: 'admin',
+        handler: async (args) => {
+            try {
+                const row = await writePluginSettings(getEm().fork(), args.group, args.fields, actor);
+                return ok(row);
+            }
+            catch (e) {
+                if (e instanceof ValidationError) {
+                    const lines = e.issues.map((i) => {
+                        const o = i;
+                        return `- ${o.field ?? '?'}: ${o.code ?? 'invalid'}`;
+                    });
+                    return fail(`Validation error:\n${lines.join('\n')}`);
                 }
-            },
-        });
-    }
-    return out;
+                if (e instanceof NotFoundError)
+                    return fail(`No settings group '${String(args.group)}'.`);
+                return fail(`Error: ${e.message}`);
+            }
+        },
+    });
+    return opts.role === 'admin' ? out : out.filter((t) => t.role === 'member');
 }
 export async function collectPluginInstructions(hooks = pluginHooks, emFactory = () => getEm().fork()) {
     const out = [];
@@ -316,44 +314,46 @@ export async function siteSection(siteUrl) {
     const site = await frontendInstructions(siteUrl);
     return site ? `## web\n${site}` : null;
 }
-export async function buildDomainSections(locales) {
+const DATA_MODEL = '## Data model\n' +
+    'Library (top-level area) → shelf (a kind of record, e.g. things/item) → record (addressed library/shelf/id) → fields. ' +
+    'Some field values are JSON (e.g. quantity {"value":2000,"unit":"ml"}); some are relations (hold another record\'s id); ' +
+    "some are collections (nested rows — an array). Extends add extra field-sets to a shelf's records, shown only when a " +
+    'condition holds (the "when …" notes below); in a fetched record they sit under `_extends`. ' +
+    'Read: list_libraries → describe_shelf → list_records/get_record. Write: create_record/update_record (call describe_shelf first); ' +
+    'delete_record moves a record to reversible trash — do not blank fields. Before editing, read the complete record and patch only requested fields. ' +
+    'For duplicates, read both records completely, compare fields/collections/extends/attachments, recommend the less complete record for trash, and offer a field-by-field merge first. ' +
+    'Use list_trash and restore_record for recovery; purge_record is irreversible and requires explicit confirmation. ' +
+    'Each library below names what it holds and when to use it — pick the right one before searching. ' +
+    'A single-record shelf holds exactly one document — read it directly, do not search the shelf.';
+function renderLibrary(v) {
+    let s = v.name === v.id ? `### ${v.id} — ${v.agent}` : `### ${v.id} ("${v.name}") — ${v.agent}`;
+    if (v.extends.length) {
+        s +=
+            '\nExtra field-sets some records carry (which one depends on the record):\n' +
+                v.extends
+                    .map((e) => {
+                    const when = describeCondition(e.showWhen, (f) => f).join(' and ');
+                    return `- ${e.id} (on ${e.shelf}${when ? `, when ${when}` : ''}): ${e.agent.replace(/\s*\n\s*/g, ' ')}`;
+                })
+                    .join('\n');
+    }
+    return s;
+}
+export async function buildDomainAreas(locales) {
     const i18n = locales ?? (await loadComposedLocales());
-    const libraries = collectLibraryPurposes(undefined, i18n);
-    let overview = null;
-    if (libraries.length) {
-        const blocks = libraries.map((v) => {
-            let s = v.name === v.id ? `### ${v.id} — ${v.agent}` : `### ${v.id} ("${v.name}") — ${v.agent}`;
-            if (v.extends.length) {
-                s +=
-                    '\nExtra field-sets some records carry (which one depends on the record):\n' +
-                        v.extends
-                            .map((e) => {
-                            const when = describeCondition(e.showWhen, (f) => f).join(' and ');
-                            return `- ${e.id} (on ${e.shelf}${when ? `, when ${when}` : ''}): ${e.agent.replace(/\s*\n\s*/g, ' ')}`;
-                        })
-                            .join('\n');
-            }
-            return s;
-        });
-        overview =
-            '## Libraries (what each holds / when to use it — pick the right one before searching)\n\n' + blocks.join('\n\n');
+    const areas = { root: [DATA_MODEL] };
+    for (const v of collectLibraryPurposes(undefined, i18n)) {
+        areas[`library:${v.id}`] = [renderLibrary(v)];
+    }
+    for (const s of collectSingleShelves()) {
+        areas[`shelf:${s.library}/${s.shelf}`] = [
+            `### ${s.library}/${s.shelf} — single record: read it directly, do not search the shelf. ${s.agent.replace(/\s*\n\s*/g, ' ')}`,
+        ];
+    }
+    for (const { id, instructions } of await collectPluginInstructions()) {
+        areas[`plugin:${id}`] = [`## ${id}\n${instructions}`];
     }
-    const singles = collectSingleShelves();
-    const singleSection = singles.length
-        ? '## Single-record shelves (one document each — read the record, do not search the shelf)\n\n' +
-            singles.map((s) => `- ${s.library}/${s.shelf}: ${s.agent.replace(/\s*\n\s*/g, ' ')}`).join('\n')
-        : null;
-    const dataModel = '## Data model\n' +
-        'Library (top-level area) → shelf (a kind of record, e.g. things/item) → record (addressed library/shelf/id) → fields. ' +
-        'Some field values are JSON (e.g. quantity {"value":2000,"unit":"ml"}); some are relations (hold another record\'s id); ' +
-        "some are collections (nested rows — an array). Extends add extra field-sets to a shelf's records, shown only when a " +
-        'condition holds (the "when …" notes below); in a fetched record they sit under `_extends`. ' +
-        'Read: list_libraries → describe_shelf → list_records/get_record. Write: create_record/update_record (call describe_shelf first); ' +
-        'delete_record moves a record to reversible trash — do not blank fields. Before editing, read the complete record and patch only requested fields. ' +
-        'For duplicates, read both records completely, compare fields/collections/extends/attachments, recommend the less complete record for trash, and offer a field-by-field merge first. ' +
-        'Use list_trash and restore_record for recovery; purge_record is irreversible and requires explicit confirmation.';
-    const rules = (await collectPluginInstructions()).map(({ id, instructions }) => `## ${id}\n${instructions}`);
-    return [dataModel, ...(overview ? [overview] : []), ...(singleSection ? [singleSection] : []), ...rules];
+    return areas;
 }
 export const CORE_STARTER_HINT = 'what this Coffer instance itself holds — which libraries are present and what kinds of ' +
     'questions the stored data can answer';

package/dist/media/image.d.ts

@@ -0,0 +1,23 @@
+export interface ImageTarget {
+    maxEdge: number;
+    maxPixels?: number;
+    maxBytes: number;
+    encode: readonly string[];
+}
+export interface ImageFacts {
+    mime: string;
+    width: number;
+    height: number;
+    bytes: number;
+}
+export interface NormalizedImage {
+    bytes: Buffer;
+    mime: string;
+    width: number;
+    height: number;
+    source: ImageFacts;
+    changed: boolean;
+}
+export declare class ImageNormalizeError extends Error {
+}
+export declare function normalizeImage(bytes: Buffer, target: ImageTarget): Promise<NormalizedImage>;