@earendil-works/chord 1.5.0 → 1.5.1

package/dist/node/app/archive.d.ts

@@ -0,0 +1,37 @@
+import type { Context } from "../../context/index.ts";
+import { type Store } from "../../store/index.ts";
+/** The kit's archive format version. */
+export declare const ARCHIVE_FORMAT = 1;
+/** What an archive says about itself. */
+export type ArchiveManifest = {
+    readonly format: number;
+    readonly app: string;
+    readonly api: string;
+    readonly address: {
+        readonly kind: string;
+        readonly key: string;
+    };
+};
+/**
+ * Packs the host directory `dir` of a host that does not run (its worker's lock held: nothing writes it) into the
+ * archive at `path`: `manifest`, its store's export and its files.
+ */
+export declare function packData(dir: string, manifest: ArchiveManifest, path: string, context: Context): Promise<void>;
+/**
+ * Packs the open `store` and the files directory `files` into the archive at `path` (mode 0600, staged beside it and
+ * renamed): `manifest`, the store's export (one consistent point, written while the host runs on) and the finished
+ * files (uploads under way left out).
+ */
+export declare function packStore(store: Store, files: string, manifest: ArchiveManifest, path: string, context: Context): Promise<void>;
+/** What an import takes at most: unpacked bytes (4 GiB by default) and entries (100,000 by default). */
+export type ImportLimits = {
+    readonly bytes?: number;
+    readonly entries?: number;
+};
+/**
+ * Unpacks the archive at `archive` into the new host directory `dir` (refused when it exists): its manifest checked by
+ * `accept` (a throw refuses it), the store made from `store.archive`, `files/` restored, within `limits`. Staged beside
+ * `dir` (mode 0700, files 0600) and renamed into place at the end, so a refused or broken archive leaves nothing.
+ */
+export declare function unpackData(archive: string, dir: string, accept: (manifest: ArchiveManifest) => void, limits: ImportLimits, context: Context): Promise<void>;
+//# sourceMappingURL=archive.d.ts.map

package/dist/node/app/archive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive.d.ts","sourceRoot":"","sources":["../../../src/node/app/archive.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAEtD,OAAO,EAAoD,KAAK,KAAK,EAAiB,MAAM,sBAAsB,CAAC;AAInH,wCAAwC;AACxC,eAAO,MAAM,cAAc,IAAI,CAAC;AAEhC,yCAAyC;AACzC,MAAM,MAAM,eAAe,GAAG;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CAClE,CAAC;AAKF;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAQpH;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAC9B,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,OAAO,GACd,OAAO,CAAC,IAAI,CAAC,CAkBf;AAuDD,wGAAwG;AACxG,MAAM,MAAM,YAAY,GAAG;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAElF;;;;GAIG;AACH,wBAAsB,UAAU,CAC/B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,IAAI,EAC3C,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,OAAO,GACd,OAAO,CAAC,IAAI,CAAC,CAgBf"}

package/dist/node/app/archive.js

@@ -0,0 +1,204 @@
+// Data archives (slice 13 §4, decisions "The app kit, point 5" and "App kit naming and export"): one tar of the data a
+// host created, `manifest.json` (the app, its API version, the kit's format version, the address), `store.archive` (the
+// store's export archive, slice 6a, as JSONL: one consistent point, the export holding the commit queue while it reads)
+// and `files/` (its finished files). A running worker packs its own open store; without one the server packs the
+// directory under the worker's lock. Unpacking makes a new directory for an address that has none, refusing every path
+// that would leave it.
+import { createReadStream, createWriteStream } from "node:fs";
+import { mkdir, mkdtemp, open, readdir, rename, rm, stat } from "node:fs/promises";
+import { dirname, join, relative, sep } from "node:path";
+import { pipeline } from "node:stream/promises";
+import { openNodeSqliteDatabase } from "../../sqlite/node.js";
+import { decodeJsonl, encodeJsonl, importStore, openStore, sqliteBackend } from "../../store/index.js";
+import { privateDirectory, privateStore } from "./layout.js";
+import { readTar, writeTar } from "./tar.js";
+/** The kit's archive format version. */
+export const ARCHIVE_FORMAT = 1;
+/** The store file of a host directory. */
+const STORE = "store.sqlite";
+/**
+ * Packs the host directory `dir` of a host that does not run (its worker's lock held: nothing writes it) into the
+ * archive at `path`: `manifest`, its store's export and its files.
+ */
+export async function packData(dir, manifest, path, context) {
+    if (!(await exists(dir)))
+        throw new Error(`exportData: ${manifest.address.key} has no data`);
+    const store = await openStore(sqliteBackend(await openNodeSqliteDatabase(join(dir, STORE))), context);
+    try {
+        await packStore(store, join(dir, "files"), manifest, path, context);
+    }
+    finally {
+        await store.close(context);
+    }
+}
+/**
+ * Packs the open `store` and the files directory `files` into the archive at `path` (mode 0600, staged beside it and
+ * renamed): `manifest`, the store's export (one consistent point, written while the host runs on) and the finished
+ * files (uploads under way left out).
+ */
+export async function packStore(store, files, manifest, path, context) {
+    const staging = await mkdtemp(join(dirname(path), ".chord-export-"));
+    try {
+        const exported = join(staging, "store.archive");
+        await pipeline(encodeJsonl(store.export(context)), createWriteStream(exported, { mode: 0o600 }));
+        const text = new TextEncoder().encode(JSON.stringify(manifest));
+        const size = (await stat(exported)).size;
+        async function* entries() {
+            yield { path: "manifest.json", size: text.length, data: chunksOf(text) };
+            yield { path: "store.archive", size, data: createReadStream(exported) };
+            yield* filesOf(files);
+        }
+        const written = join(staging, "archive.tar");
+        await pipeline(writeTar(entries()), createWriteStream(written, { mode: 0o600 }));
+        await rename(written, path);
+    }
+    finally {
+        await rm(staging, { recursive: true, force: true });
+    }
+}
+/** One chunk. */
+async function* chunksOf(bytes) {
+    yield bytes;
+}
+/**
+ * The files under `root` as entries `files/<relative path>` (hidden ones, uploads under way, left out), each opened only
+ * when the archive comes to it (one descriptor at a time) and its size taken from the open file: a file deleted while a
+ * running worker is exported is skipped, or read whole from its open handle (finished files never change; Opus L7).
+ */
+async function* filesOf(root) {
+    for (const path of await pathsUnder(root)) {
+        const handle = await open(path, "r").catch((error) => {
+            if (error.code === "ENOENT")
+                return undefined;
+            throw error;
+        });
+        if (handle === undefined)
+            continue;
+        const info = await handle.stat();
+        if (!info.isFile()) {
+            await handle.close();
+            continue;
+        }
+        const inside = relative(root, path).split(sep).join("/");
+        yield {
+            path: `files/${inside}`,
+            size: info.size,
+            data: handle.createReadStream({ start: 0, end: Math.max(0, info.size - 1) }),
+        };
+    }
+}
+/** The paths of the files under `root`, sorted, hidden ones left out (a directory gone meanwhile: none of it). */
+async function pathsUnder(root) {
+    const paths = [];
+    const walk = async (dir) => {
+        let entries;
+        try {
+            entries = (await readdir(dir, { withFileTypes: true })).sort((a, b) => (a.name < b.name ? -1 : 1));
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return;
+            throw error;
+        }
+        for (const entry of entries) {
+            if (entry.name.startsWith("."))
+                continue;
+            const path = join(dir, entry.name);
+            if (entry.isDirectory())
+                await walk(path);
+            else if (entry.isFile())
+                paths.push(path);
+        }
+    };
+    await walk(root);
+    return paths;
+}
+/**
+ * Unpacks the archive at `archive` into the new host directory `dir` (refused when it exists): its manifest checked by
+ * `accept` (a throw refuses it), the store made from `store.archive`, `files/` restored, within `limits`. Staged beside
+ * `dir` (mode 0700, files 0600) and renamed into place at the end, so a refused or broken archive leaves nothing.
+ */
+export async function unpackData(archive, dir, accept, limits, context) {
+    if (await exists(dir))
+        throw new Error(`importData: ${dir} exists already (an address is imported once)`);
+    await privateDirectory(dirname(dir));
+    const staging = await mkdtemp(join(dirname(dir), ".chord-import-"));
+    try {
+        const storeArchive = await unpackEntries(archive, staging, accept, limits, context);
+        await privateStore(join(staging, STORE));
+        const backend = sqliteBackend(await openNodeSqliteDatabase(join(staging, STORE)));
+        const store = await importStore(backend, decodeJsonl(createReadStream(storeArchive)), context);
+        await store.close(context);
+        await rm(storeArchive);
+        await rename(staging, dir);
+    }
+    catch (error) {
+        await rm(staging, { recursive: true, force: true });
+        throw error;
+    }
+}
+/**
+ * Writes the entries of `archive` into `staging`: the manifest first (checked by `accept` before any data is written),
+ * then `store.archive` and `files/…`, within `limits` (counted from the headers, before an entry is written). The path
+ * of the staged `store.archive`.
+ */
+async function unpackEntries(archive, staging, accept, limits, context) {
+    const maxBytes = limits.bytes ?? 4 * 1024 ** 3;
+    const maxEntries = limits.entries ?? 100_000;
+    let manifest;
+    let storeArchive;
+    let bytes = 0;
+    let entries = 0;
+    for await (const entry of readTar(createReadStream(archive))) {
+        context.abortSignal?.throwIfAborted();
+        if (++entries > maxEntries)
+            throw new Error(`importData: the archive has more than ${maxEntries} entries`);
+        if (entry.kind === "directory")
+            continue;
+        bytes += entry.size;
+        if (bytes > maxBytes)
+            throw new Error(`importData: the archive unpacks to more than ${maxBytes} bytes`);
+        if (manifest === undefined && entry.path !== "manifest.json") {
+            throw new Error("importData: the archive does not start with manifest.json");
+        }
+        if (entry.path === "manifest.json") {
+            // A trust boundary: the archive's own description, checked by `accept`.
+            manifest = JSON.parse(new TextDecoder().decode(await collect(entry.data, 64 * 1024)));
+            accept(manifest);
+        }
+        else if (entry.path === "store.archive") {
+            storeArchive = join(staging, "store.archive");
+            await pipeline(entry.data, createWriteStream(storeArchive, { mode: 0o600 }));
+        }
+        else if (entry.path.startsWith("files/")) {
+            // `readTar` refused absolute paths and `..`: `files/<path>` stays inside the staging directory.
+            const target = join(staging, ...entry.path.split("/"));
+            await mkdir(dirname(target), { recursive: true, mode: 0o700 });
+            await pipeline(entry.data, createWriteStream(target, { mode: 0o600 }));
+        }
+        else {
+            throw new Error(`importData: the archive holds ${entry.path}, which an address archive does not`);
+        }
+    }
+    if (manifest === undefined || storeArchive === undefined) {
+        throw new Error("importData: the archive has no manifest.json or store.archive");
+    }
+    return storeArchive;
+}
+/** The bytes of `data`, refused past `limit`. */
+async function collect(data, limit) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of data) {
+        size += chunk.length;
+        if (size > limit)
+            throw new Error("importData: manifest.json is too large");
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks);
+}
+/** Whether `path` exists. */
+async function exists(path) {
+    return stat(path).then(() => true, () => false);
+}
+//# sourceMappingURL=archive.js.map

package/dist/node/app/archive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive.js","sourceRoot":"","sources":["../../../src/node/app/archive.ts"],"names":[],"mappings":"AAAA,uHAAuH;AACvH,wHAAwH;AACxH,wHAAwH;AACxH,iHAAiH;AACjH,uHAAuH;AACvH,uBAAuB;AAEvB,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAe,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAc,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACnH,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAiB,QAAQ,EAAE,MAAM,UAAU,CAAC;AAE5D,wCAAwC;AACxC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAUhC,0CAA0C;AAC1C,MAAM,KAAK,GAAG,cAAc,CAAC;AAE7B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,QAAyB,EAAE,IAAY,EAAE,OAAgB;IACpG,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,QAAQ,CAAC,OAAO,CAAC,GAAG,cAAc,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,MAAM,sBAAsB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACtG,IAAI,CAAC;QACJ,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;YAAS,CAAC;QACV,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,KAAY,EACZ,KAAa,EACb,QAAyB,EACzB,IAAY,EACZ,OAAgB;IAEhB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAChD,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,iBAAiB,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACjG,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QACzC,KAAK,SAAS,CAAC,CAAC,OAAO;YACtB,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC7C,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,iBAAiB,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACjF,MAAM,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;YAAS,CAAC;QACV,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;AACF,CAAC;AAED,iBAAiB;AACjB,KAAK,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAiB;IACzC,MAAM,KAAK,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,IAAY;IACnC,KAAK,MAAM,IAAI,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAA4B,EAAE,EAAE;YAC3E,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAC9C,MAAM,KAAK,CAAC;QACb,CAAC,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,SAAS;QACV,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM;YACL,IAAI,EAAE,SAAS,MAAM,EAAE;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;SAC5E,CAAC;IACH,CAAC;AACF,CAAC;AAED,kHAAkH;AAClH,KAAK,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,KAAK,EAAE,GAAW,EAAiB,EAAE;QACjD,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACJ,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO;YAC/D,MAAM,KAAK,CAAC;QACb,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;iBACrC,IAAI,KAAK,CAAC,MAAM,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;IACF,CAAC,CAAC;IACF,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,KAAK,CAAC;AACd,CAAC;AAKD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,OAAe,EACf,GAAW,EACX,MAA2C,EAC3C,MAAoB,EACpB,OAAgB;IAEhB,IAAI,MAAM,MAAM,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,+CAA+C,CAAC,CAAC;IAC1G,MAAM,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC;QACJ,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACpF,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAClF,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC/F,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;QACvB,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAC3B,OAAe,EACf,OAAe,EACf,MAA2C,EAC3C,MAAoB,EACpB,OAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC;IAC7C,IAAI,QAAqC,CAAC;IAC1C,IAAI,YAAgC,CAAC;IACrC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,CAAC,WAAW,EAAE,cAAc,EAAE,CAAC;QACtC,IAAI,EAAE,OAAO,GAAG,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,UAAU,UAAU,CAAC,CAAC;QAC3G,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QACzC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC;QACpB,IAAI,KAAK,GAAG,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,QAAQ,QAAQ,CAAC,CAAC;QACxG,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACpC,wEAAwE;YACxE,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAoB,CAAC;YACzG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClB,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAC3C,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAC9C,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAC9E,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,gGAAgG;YAChG,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YACvD,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/D,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,IAAI,qCAAqC,CAAC,CAAC;QACnG,CAAC;IACF,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,YAAY,CAAC;AACrB,CAAC;AAED,iDAAiD;AACjD,KAAK,UAAU,OAAO,CAAC,IAA+B,EAAE,KAAa;IACpE,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QAChC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;QACrB,IAAI,IAAI,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED,6BAA6B;AAC7B,KAAK,UAAU,MAAM,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CACrB,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACX,CAAC;AACH,CAAC","sourcesContent":["// Data archives (slice 13 §4, decisions \"The app kit, point 5\" and \"App kit naming and export\"): one tar of the data a\n// host created, `manifest.json` (the app, its API version, the kit's format version, the address), `store.archive` (the\n// store's export archive, slice 6a, as JSONL: one consistent point, the export holding the commit queue while it reads)\n// and `files/` (its finished files). A running worker packs its own open store; without one the server packs the\n// directory under the worker's lock. Unpacking makes a new directory for an address that has none, refusing every path\n// that would leave it.\n\nimport { createReadStream, createWriteStream, type Dirent } from \"node:fs\";\nimport { mkdir, mkdtemp, open, readdir, rename, rm, stat } from \"node:fs/promises\";\nimport { dirname, join, relative, sep } from \"node:path\";\nimport { pipeline } from \"node:stream/promises\";\nimport type { Context } from \"../../context/index.ts\";\nimport { openNodeSqliteDatabase } from \"../../sqlite/node.ts\";\nimport { decodeJsonl, encodeJsonl, importStore, openStore, type Store, sqliteBackend } from \"../../store/index.ts\";\nimport { privateDirectory, privateStore } from \"./layout.ts\";\nimport { readTar, type TarEntry, writeTar } from \"./tar.ts\";\n\n/** The kit's archive format version. */\nexport const ARCHIVE_FORMAT = 1;\n\n/** What an archive says about itself. */\nexport type ArchiveManifest = {\n\treadonly format: number;\n\treadonly app: string;\n\treadonly api: string;\n\treadonly address: { readonly kind: string; readonly key: string };\n};\n\n/** The store file of a host directory. */\nconst STORE = \"store.sqlite\";\n\n/**\n * Packs the host directory `dir` of a host that does not run (its worker's lock held: nothing writes it) into the\n * archive at `path`: `manifest`, its store's export and its files.\n */\nexport async function packData(dir: string, manifest: ArchiveManifest, path: string, context: Context): Promise<void> {\n\tif (!(await exists(dir))) throw new Error(`exportData: ${manifest.address.key} has no data`);\n\tconst store = await openStore(sqliteBackend(await openNodeSqliteDatabase(join(dir, STORE))), context);\n\ttry {\n\t\tawait packStore(store, join(dir, \"files\"), manifest, path, context);\n\t} finally {\n\t\tawait store.close(context);\n\t}\n}\n\n/**\n * Packs the open `store` and the files directory `files` into the archive at `path` (mode 0600, staged beside it and\n * renamed): `manifest`, the store's export (one consistent point, written while the host runs on) and the finished\n * files (uploads under way left out).\n */\nexport async function packStore(\n\tstore: Store,\n\tfiles: string,\n\tmanifest: ArchiveManifest,\n\tpath: string,\n\tcontext: Context,\n): Promise<void> {\n\tconst staging = await mkdtemp(join(dirname(path), \".chord-export-\"));\n\ttry {\n\t\tconst exported = join(staging, \"store.archive\");\n\t\tawait pipeline(encodeJsonl(store.export(context)), createWriteStream(exported, { mode: 0o600 }));\n\t\tconst text = new TextEncoder().encode(JSON.stringify(manifest));\n\t\tconst size = (await stat(exported)).size;\n\t\tasync function* entries(): AsyncGenerator<TarEntry> {\n\t\t\tyield { path: \"manifest.json\", size: text.length, data: chunksOf(text) };\n\t\t\tyield { path: \"store.archive\", size, data: createReadStream(exported) };\n\t\t\tyield* filesOf(files);\n\t\t}\n\t\tconst written = join(staging, \"archive.tar\");\n\t\tawait pipeline(writeTar(entries()), createWriteStream(written, { mode: 0o600 }));\n\t\tawait rename(written, path);\n\t} finally {\n\t\tawait rm(staging, { recursive: true, force: true });\n\t}\n}\n\n/** One chunk. */\nasync function* chunksOf(bytes: Uint8Array): AsyncGenerator<Uint8Array> {\n\tyield bytes;\n}\n\n/**\n * The files under `root` as entries `files/<relative path>` (hidden ones, uploads under way, left out), each opened only\n * when the archive comes to it (one descriptor at a time) and its size taken from the open file: a file deleted while a\n * running worker is exported is skipped, or read whole from its open handle (finished files never change; Opus L7).\n */\nasync function* filesOf(root: string): AsyncGenerator<TarEntry> {\n\tfor (const path of await pathsUnder(root)) {\n\t\tconst handle = await open(path, \"r\").catch((error: NodeJS.ErrnoException) => {\n\t\t\tif (error.code === \"ENOENT\") return undefined;\n\t\t\tthrow error;\n\t\t});\n\t\tif (handle === undefined) continue;\n\t\tconst info = await handle.stat();\n\t\tif (!info.isFile()) {\n\t\t\tawait handle.close();\n\t\t\tcontinue;\n\t\t}\n\t\tconst inside = relative(root, path).split(sep).join(\"/\");\n\t\tyield {\n\t\t\tpath: `files/${inside}`,\n\t\t\tsize: info.size,\n\t\t\tdata: handle.createReadStream({ start: 0, end: Math.max(0, info.size - 1) }),\n\t\t};\n\t}\n}\n\n/** The paths of the files under `root`, sorted, hidden ones left out (a directory gone meanwhile: none of it). */\nasync function pathsUnder(root: string): Promise<string[]> {\n\tconst paths: string[] = [];\n\tconst walk = async (dir: string): Promise<void> => {\n\t\tlet entries: Dirent[];\n\t\ttry {\n\t\t\tentries = (await readdir(dir, { withFileTypes: true })).sort((a, b) => (a.name < b.name ? -1 : 1));\n\t\t} catch (error) {\n\t\t\tif ((error as NodeJS.ErrnoException).code === \"ENOENT\") return;\n\t\t\tthrow error;\n\t\t}\n\t\tfor (const entry of entries) {\n\t\t\tif (entry.name.startsWith(\".\")) continue;\n\t\t\tconst path = join(dir, entry.name);\n\t\t\tif (entry.isDirectory()) await walk(path);\n\t\t\telse if (entry.isFile()) paths.push(path);\n\t\t}\n\t};\n\tawait walk(root);\n\treturn paths;\n}\n\n/** What an import takes at most: unpacked bytes (4 GiB by default) and entries (100,000 by default). */\nexport type ImportLimits = { readonly bytes?: number; readonly entries?: number };\n\n/**\n * Unpacks the archive at `archive` into the new host directory `dir` (refused when it exists): its manifest checked by\n * `accept` (a throw refuses it), the store made from `store.archive`, `files/` restored, within `limits`. Staged beside\n * `dir` (mode 0700, files 0600) and renamed into place at the end, so a refused or broken archive leaves nothing.\n */\nexport async function unpackData(\n\tarchive: string,\n\tdir: string,\n\taccept: (manifest: ArchiveManifest) => void,\n\tlimits: ImportLimits,\n\tcontext: Context,\n): Promise<void> {\n\tif (await exists(dir)) throw new Error(`importData: ${dir} exists already (an address is imported once)`);\n\tawait privateDirectory(dirname(dir));\n\tconst staging = await mkdtemp(join(dirname(dir), \".chord-import-\"));\n\ttry {\n\t\tconst storeArchive = await unpackEntries(archive, staging, accept, limits, context);\n\t\tawait privateStore(join(staging, STORE));\n\t\tconst backend = sqliteBackend(await openNodeSqliteDatabase(join(staging, STORE)));\n\t\tconst store = await importStore(backend, decodeJsonl(createReadStream(storeArchive)), context);\n\t\tawait store.close(context);\n\t\tawait rm(storeArchive);\n\t\tawait rename(staging, dir);\n\t} catch (error) {\n\t\tawait rm(staging, { recursive: true, force: true });\n\t\tthrow error;\n\t}\n}\n\n/**\n * Writes the entries of `archive` into `staging`: the manifest first (checked by `accept` before any data is written),\n * then `store.archive` and `files/…`, within `limits` (counted from the headers, before an entry is written). The path\n * of the staged `store.archive`.\n */\nasync function unpackEntries(\n\tarchive: string,\n\tstaging: string,\n\taccept: (manifest: ArchiveManifest) => void,\n\tlimits: ImportLimits,\n\tcontext: Context,\n): Promise<string> {\n\tconst maxBytes = limits.bytes ?? 4 * 1024 ** 3;\n\tconst maxEntries = limits.entries ?? 100_000;\n\tlet manifest: ArchiveManifest | undefined;\n\tlet storeArchive: string | undefined;\n\tlet bytes = 0;\n\tlet entries = 0;\n\tfor await (const entry of readTar(createReadStream(archive))) {\n\t\tcontext.abortSignal?.throwIfAborted();\n\t\tif (++entries > maxEntries) throw new Error(`importData: the archive has more than ${maxEntries} entries`);\n\t\tif (entry.kind === \"directory\") continue;\n\t\tbytes += entry.size;\n\t\tif (bytes > maxBytes) throw new Error(`importData: the archive unpacks to more than ${maxBytes} bytes`);\n\t\tif (manifest === undefined && entry.path !== \"manifest.json\") {\n\t\t\tthrow new Error(\"importData: the archive does not start with manifest.json\");\n\t\t}\n\t\tif (entry.path === \"manifest.json\") {\n\t\t\t// A trust boundary: the archive's own description, checked by `accept`.\n\t\t\tmanifest = JSON.parse(new TextDecoder().decode(await collect(entry.data, 64 * 1024))) as ArchiveManifest;\n\t\t\taccept(manifest);\n\t\t} else if (entry.path === \"store.archive\") {\n\t\t\tstoreArchive = join(staging, \"store.archive\");\n\t\t\tawait pipeline(entry.data, createWriteStream(storeArchive, { mode: 0o600 }));\n\t\t} else if (entry.path.startsWith(\"files/\")) {\n\t\t\t// `readTar` refused absolute paths and `..`: `files/<path>` stays inside the staging directory.\n\t\t\tconst target = join(staging, ...entry.path.split(\"/\"));\n\t\t\tawait mkdir(dirname(target), { recursive: true, mode: 0o700 });\n\t\t\tawait pipeline(entry.data, createWriteStream(target, { mode: 0o600 }));\n\t\t} else {\n\t\t\tthrow new Error(`importData: the archive holds ${entry.path}, which an address archive does not`);\n\t\t}\n\t}\n\tif (manifest === undefined || storeArchive === undefined) {\n\t\tthrow new Error(\"importData: the archive has no manifest.json or store.archive\");\n\t}\n\treturn storeArchive;\n}\n\n/** The bytes of `data`, refused past `limit`. */\nasync function collect(data: AsyncIterable<Uint8Array>, limit: number): Promise<Uint8Array> {\n\tconst chunks: Uint8Array[] = [];\n\tlet size = 0;\n\tfor await (const chunk of data) {\n\t\tsize += chunk.length;\n\t\tif (size > limit) throw new Error(\"importData: manifest.json is too large\");\n\t\tchunks.push(chunk);\n\t}\n\treturn Buffer.concat(chunks);\n}\n\n/** Whether `path` exists. */\nasync function exists(path: string): Promise<boolean> {\n\treturn stat(path).then(\n\t\t() => true,\n\t\t() => false,\n\t);\n}\n"]}

package/dist/node/app/blobs.d.ts

@@ -0,0 +1,23 @@
+/** The blob files of one host, in `dir` (`<files>/blobs`). */
+export declare class Blobs {
+    readonly dir: string;
+    constructor(dir: string);
+    /** Where blob `id` lives. */
+    path(id: string): string;
+    /** Makes the directory (mode 0700) before a blob moves in. */
+    prepare(): Promise<void>;
+    /** Writes `bytes` as blob `id`: into `staging` (mode 0600), then moved into place. */
+    write(id: string, bytes: Uint8Array, staging: string): Promise<void>;
+    /** Up to `length` bytes of blob `id` (of `size` bytes) from `offset`: fewer at its end. */
+    read(id: string, size: number, offset: number, length: number): Promise<Uint8Array>;
+    /** Removes the blobs `ids` (a missing one: nothing). */
+    remove(ids: readonly string[]): Promise<void>;
+    /** Removes every blob file `known` does not know: what writes left that never committed. */
+    sweep(known: (id: string) => Promise<boolean>): Promise<void>;
+    /**
+     * Puts blob `id` into `target` (another host's blob directory): a hard link (blobs never change, so two hosts may
+     * share the file), a copy where the file system refuses links.
+     */
+    linkInto(id: string, target: string): Promise<void>;
+}
+//# sourceMappingURL=blobs.d.ts.map

package/dist/node/app/blobs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blobs.d.ts","sourceRoot":"","sources":["../../../src/node/app/blobs.ts"],"names":[],"mappings":"AAQA,8DAA8D;AAC9D,qBAAa,KAAK;IACjB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB,YAAY,GAAG,EAAE,MAAM,EAEtB;IAED,6BAA6B;IAC7B,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEvB;IAED,8DAA8D;IACxD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAE7B;IAED,sFAAsF;IAChF,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKzE;IAED,2FAA2F;IACrF,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CASxF;IAED,wDAAwD;IAClD,MAAM,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAElD;IAED,4FAA4F;IACtF,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAIlE;IAED;;;OAGG;IACG,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKxD;CACD"}

package/dist/node/app/blobs.js

@@ -0,0 +1,64 @@
+// The blobs of one host's files (Files v2): immutable byte files under `<files>/blobs/`, named by id. A blob is
+// written whole beside its place and moved there (a reader never sees part of one), never changed, and removed once no
+// version references it. Blobs a write left without its index commit (a crash between the two) are swept.
+import { constants } from "node:fs";
+import { copyFile, link, mkdir, open, readdir, rename, rm, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+/** The blob files of one host, in `dir` (`<files>/blobs`). */
+export class Blobs {
+    dir;
+    constructor(dir) {
+        this.dir = dir;
+    }
+    /** Where blob `id` lives. */
+    path(id) {
+        return join(this.dir, id);
+    }
+    /** Makes the directory (mode 0700) before a blob moves in. */
+    async prepare() {
+        await mkdir(this.dir, { recursive: true, mode: 0o700 });
+    }
+    /** Writes `bytes` as blob `id`: into `staging` (mode 0600), then moved into place. */
+    async write(id, bytes, staging) {
+        await this.prepare();
+        await mkdir(dirname(staging), { recursive: true, mode: 0o700 });
+        await writeFile(staging, bytes, { mode: 0o600, flag: "wx" });
+        await rename(staging, this.path(id));
+    }
+    /** Up to `length` bytes of blob `id` (of `size` bytes) from `offset`: fewer at its end. */
+    async read(id, size, offset, length) {
+        const handle = await open(this.path(id), "r");
+        try {
+            const buffer = new Uint8Array(Math.max(0, Math.min(length, size - offset)));
+            const { bytesRead } = await handle.read(buffer, 0, buffer.length, offset);
+            return buffer.subarray(0, bytesRead);
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    /** Removes the blobs `ids` (a missing one: nothing). */
+    async remove(ids) {
+        for (const id of ids)
+            await rm(this.path(id), { force: true });
+    }
+    /** Removes every blob file `known` does not know: what writes left that never committed. */
+    async sweep(known) {
+        for (const id of await readdir(this.dir).catch(() => [])) {
+            if (!(await known(id)))
+                await rm(this.path(id), { force: true });
+        }
+    }
+    /**
+     * Puts blob `id` into `target` (another host's blob directory): a hard link (blobs never change, so two hosts may
+     * share the file), a copy where the file system refuses links.
+     */
+    async linkInto(id, target) {
+        await link(this.path(id), join(target, id)).catch(async (error) => {
+            if (error.code === "EEXIST")
+                throw error;
+            await copyFile(this.path(id), join(target, id), constants.COPYFILE_EXCL);
+        });
+    }
+}
+//# sourceMappingURL=blobs.js.map

package/dist/node/app/blobs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blobs.js","sourceRoot":"","sources":["../../../src/node/app/blobs.ts"],"names":[],"mappings":"AAAA,gHAAgH;AAChH,uHAAuH;AACvH,0GAA0G;AAE1G,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,OAAO,KAAK;IACR,GAAG,CAAS;IAErB,YAAY,GAAW;QACtB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IAChB,CAAC;IAED,6BAA6B;IAC7B,IAAI,CAAC,EAAU;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,8DAA8D;IAC9D,KAAK,CAAC,OAAO;QACZ,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,sFAAsF;IACtF,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,KAAiB,EAAE,OAAe;QACzD,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,MAAM,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACtC,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,IAAI,CAAC,EAAU,EAAE,IAAY,EAAE,MAAc,EAAE,MAAc;QAClE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YAC5E,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1E,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;gBAAS,CAAC;YACV,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;IACF,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,MAAM,CAAC,GAAsB;QAClC,KAAK,MAAM,EAAE,IAAI,GAAG;YAAE,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,KAAK,CAAC,KAAuC;QAClD,KAAK,MAAM,EAAE,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;gBAAE,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;IACF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,EAAU,EAAE,MAAc;QACxC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAA4B,EAAE,EAAE;YACxF,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACzC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;IACJ,CAAC;CACD","sourcesContent":["// The blobs of one host's files (Files v2): immutable byte files under `<files>/blobs/`, named by id. A blob is\n// written whole beside its place and moved there (a reader never sees part of one), never changed, and removed once no\n// version references it. Blobs a write left without its index commit (a crash between the two) are swept.\n\nimport { constants } from \"node:fs\";\nimport { copyFile, link, mkdir, open, readdir, rename, rm, writeFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\n\n/** The blob files of one host, in `dir` (`<files>/blobs`). */\nexport class Blobs {\n\treadonly dir: string;\n\n\tconstructor(dir: string) {\n\t\tthis.dir = dir;\n\t}\n\n\t/** Where blob `id` lives. */\n\tpath(id: string): string {\n\t\treturn join(this.dir, id);\n\t}\n\n\t/** Makes the directory (mode 0700) before a blob moves in. */\n\tasync prepare(): Promise<void> {\n\t\tawait mkdir(this.dir, { recursive: true, mode: 0o700 });\n\t}\n\n\t/** Writes `bytes` as blob `id`: into `staging` (mode 0600), then moved into place. */\n\tasync write(id: string, bytes: Uint8Array, staging: string): Promise<void> {\n\t\tawait this.prepare();\n\t\tawait mkdir(dirname(staging), { recursive: true, mode: 0o700 });\n\t\tawait writeFile(staging, bytes, { mode: 0o600, flag: \"wx\" });\n\t\tawait rename(staging, this.path(id));\n\t}\n\n\t/** Up to `length` bytes of blob `id` (of `size` bytes) from `offset`: fewer at its end. */\n\tasync read(id: string, size: number, offset: number, length: number): Promise<Uint8Array> {\n\t\tconst handle = await open(this.path(id), \"r\");\n\t\ttry {\n\t\t\tconst buffer = new Uint8Array(Math.max(0, Math.min(length, size - offset)));\n\t\t\tconst { bytesRead } = await handle.read(buffer, 0, buffer.length, offset);\n\t\t\treturn buffer.subarray(0, bytesRead);\n\t\t} finally {\n\t\t\tawait handle.close();\n\t\t}\n\t}\n\n\t/** Removes the blobs `ids` (a missing one: nothing). */\n\tasync remove(ids: readonly string[]): Promise<void> {\n\t\tfor (const id of ids) await rm(this.path(id), { force: true });\n\t}\n\n\t/** Removes every blob file `known` does not know: what writes left that never committed. */\n\tasync sweep(known: (id: string) => Promise<boolean>): Promise<void> {\n\t\tfor (const id of await readdir(this.dir).catch(() => [])) {\n\t\t\tif (!(await known(id))) await rm(this.path(id), { force: true });\n\t\t}\n\t}\n\n\t/**\n\t * Puts blob `id` into `target` (another host's blob directory): a hard link (blobs never change, so two hosts may\n\t * share the file), a copy where the file system refuses links.\n\t */\n\tasync linkInto(id: string, target: string): Promise<void> {\n\t\tawait link(this.path(id), join(target, id)).catch(async (error: NodeJS.ErrnoException) => {\n\t\t\tif (error.code === \"EEXIST\") throw error;\n\t\t\tawait copyFile(this.path(id), join(target, id), constants.COPYFILE_EXCL);\n\t\t});\n\t}\n}\n"]}

package/dist/node/app/data.d.ts

@@ -0,0 +1,35 @@
+import { type Address } from "../../contracts/index.ts";
+import { type Principal } from "../../data/index.ts";
+import { type Facet } from "../../host/index.ts";
+import type { Store } from "../../store/index.ts";
+/** The data of the worker at `address` (its JSON, as `addressParam` writes it): `exportTo` packs it at `path`. */
+export declare const HostData: import("../../contracts/contract.ts").Contract<{
+    kind: "remote";
+    name: "chord.app.data";
+    params: {
+        readonly address: import("../../contracts/schema.ts").StringSchema;
+    };
+    history: [{
+        version: "1";
+        variants: {
+            readonly main: {
+                state: Record<never, never>;
+                methods: {
+                    readonly exportTo: import("../../contracts/schema.ts").Method<import("../../contracts/index.ts").Schema<{
+                        path: string;
+                        manifest: string;
+                    }>, import("../../contracts/schema.ts").NullSchema>;
+                };
+            };
+        };
+        changes: never;
+    }];
+}>;
+/** `address` as `HostData`'s param. */
+export declare function addressParam(address: Address): string;
+/**
+ * The kit's worker facet serving `HostData` for the worker's open `store` and its files directory `files`, to `server`
+ * (the server's principal) only.
+ */
+export declare function hostDataFacet<P extends Principal>(store: Store, files: string, server: P): Facet<P>;
+//# sourceMappingURL=data.d.ts.map

package/dist/node/app/data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data.d.ts","sourceRoot":"","sources":["../../../src/node/app/data.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,OAAO,EAA4B,MAAM,0BAA0B,CAAC;AAClF,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhE,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAGlD,kHAAkH;AAClH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;EAMnB,CAAC;AAEH,uCAAuC;AACvC,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAErD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAkBnG"}

package/dist/node/app/data.js

@@ -0,0 +1,44 @@
+// A host's data on its worker (decision "App kit naming and export"): the kit's object a running worker serves, through
+// which the server exports the worker's data without stopping it. The worker packs its own open store (its export holds
+// the commit queue while it reads: one consistent point) and its finished files into the archive at the path the server
+// names. Only the server may ask (its principal); the worker's plugins never see it.
+import { BACKGROUND_CONTEXT } from "../../context/index.js";
+import { method, obj, remote, str } from "../../contracts/index.js";
+import { forbidden } from "../../data/index.js";
+import { samePrincipal } from "../../data/principal.js";
+import { defineFacet } from "../../host/index.js";
+import { packStore } from "./archive.js";
+/** The data of the worker at `address` (its JSON, as `addressParam` writes it): `exportTo` packs it at `path`. */
+export const HostData = remote("chord.app.data", {
+    version: 1,
+    params: { address: str() },
+    // The address a worker has: the server names it (`addressParam`); only its kind and params place the object.
+    hostAddress: ({ address }) => JSON.parse(address),
+    variants: { main: { methods: { exportTo: method(obj({ path: str(), manifest: str() })) } } },
+});
+/** `address` as `HostData`'s param. */
+export function addressParam(address) {
+    return JSON.stringify({ kind: address.kind, params: address.params, key: address.key });
+}
+/**
+ * The kit's worker facet serving `HostData` for the worker's open `store` and its files directory `files`, to `server`
+ * (the server's principal) only.
+ */
+export function hostDataFacet(store, files, server) {
+    return defineFacet((host) => host.serve(HostData, (_params, principal) => {
+        if (!samePrincipal(principal, server, BACKGROUND_CONTEXT)) {
+            throw forbidden("chord.app.data: the server's only");
+        }
+        return {
+            variant: "main",
+            members: {
+                exportTo: async ({ path, manifest }, ctx) => {
+                    // The server's own manifest for this address.
+                    await packStore(store, files, JSON.parse(manifest), path, ctx);
+                    return null;
+                },
+            },
+        };
+    }));
+}
+//# sourceMappingURL=data.js.map

package/dist/node/app/data.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data.js","sourceRoot":"","sources":["../../../src/node/app/data.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,wHAAwH;AACxH,wHAAwH;AACxH,qFAAqF;AAErF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAgB,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAClF,OAAO,EAAE,SAAS,EAAkB,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAc,MAAM,qBAAqB,CAAC;AAE9D,OAAO,EAAwB,SAAS,EAAE,MAAM,cAAc,CAAC;AAE/D,kHAAkH;AAClH,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,EAAE;IAChD,OAAO,EAAE,CAAC;IACV,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;IAC1B,6GAA6G;IAC7G,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY;IAC5D,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE;CAC5F,CAAC,CAAC;AAEH,uCAAuC;AACvC,MAAM,UAAU,YAAY,CAAC,OAAgB;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;AACzF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAsB,KAAY,EAAE,KAAa,EAAE,MAAS;IACxF,OAAO,WAAW,CAAI,CAAC,IAAI,EAAE,EAAE,CAC9B,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE;QAC3C,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,CAAC;YAC3D,MAAM,SAAS,CAAC,mCAAmC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO;YACN,OAAO,EAAE,MAAM;YACf,OAAO,EAAE;gBACR,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE;oBAC3C,8CAA8C;oBAC9C,MAAM,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAoB,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;oBAClF,OAAO,IAAI,CAAC;gBACb,CAAC;aACD;SACD,CAAC;IACH,CAAC,CAAC,CACF,CAAC;AACH,CAAC","sourcesContent":["// A host's data on its worker (decision \"App kit naming and export\"): the kit's object a running worker serves, through\n// which the server exports the worker's data without stopping it. The worker packs its own open store (its export holds\n// the commit queue while it reads: one consistent point) and its finished files into the archive at the path the server\n// names. Only the server may ask (its principal); the worker's plugins never see it.\n\nimport { BACKGROUND_CONTEXT } from \"../../context/index.ts\";\nimport { type Address, method, obj, remote, str } from \"../../contracts/index.ts\";\nimport { forbidden, type Principal } from \"../../data/index.ts\";\nimport { samePrincipal } from \"../../data/principal.ts\";\nimport { defineFacet, type Facet } from \"../../host/index.ts\";\nimport type { Store } from \"../../store/index.ts\";\nimport { type ArchiveManifest, packStore } from \"./archive.ts\";\n\n/** The data of the worker at `address` (its JSON, as `addressParam` writes it): `exportTo` packs it at `path`. */\nexport const HostData = remote(\"chord.app.data\", {\n\tversion: 1,\n\tparams: { address: str() },\n\t// The address a worker has: the server names it (`addressParam`); only its kind and params place the object.\n\thostAddress: ({ address }) => JSON.parse(address) as Address,\n\tvariants: { main: { methods: { exportTo: method(obj({ path: str(), manifest: str() })) } } },\n});\n\n/** `address` as `HostData`'s param. */\nexport function addressParam(address: Address): string {\n\treturn JSON.stringify({ kind: address.kind, params: address.params, key: address.key });\n}\n\n/**\n * The kit's worker facet serving `HostData` for the worker's open `store` and its files directory `files`, to `server`\n * (the server's principal) only.\n */\nexport function hostDataFacet<P extends Principal>(store: Store, files: string, server: P): Facet<P> {\n\treturn defineFacet<P>((host) =>\n\t\thost.serve(HostData, (_params, principal) => {\n\t\t\tif (!samePrincipal(principal, server, BACKGROUND_CONTEXT)) {\n\t\t\t\tthrow forbidden(\"chord.app.data: the server's only\");\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tvariant: \"main\",\n\t\t\t\tmembers: {\n\t\t\t\t\texportTo: async ({ path, manifest }, ctx) => {\n\t\t\t\t\t\t// The server's own manifest for this address.\n\t\t\t\t\t\tawait packStore(store, files, JSON.parse(manifest) as ArchiveManifest, path, ctx);\n\t\t\t\t\t\treturn null;\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t};\n\t\t}),\n\t);\n}\n"]}

package/dist/node/app/ephemeral-sessions.d.ts

@@ -0,0 +1,20 @@
+import type { Principal } from "../../data/index.ts";
+/** How long an ephemeral session lives without a link: a minute, past a reload and the reconnect loop's pauses. */
+export declare const EPHEMERAL_GRACE_MS = 60000;
+/** The server's ephemeral sessions. */
+export declare class EphemeralSessions {
+    #private;
+    constructor(max: number, graceMs?: number);
+    /** A new session `id` (its secret's hash `hash`) for `principal`; the oldest ends past the cap. */
+    issue(id: string, hash: string, principal: Principal): void;
+    /** Session `id`'s hash and principal, while it lives. */
+    get(id: string): {
+        readonly hash: string;
+        readonly principal: Principal;
+    } | undefined;
+    /** Ends session `id`; whether it was one. */
+    revoke(id: string): boolean;
+    /** A link authenticated with session `id` opened: what to call when it closes; `undefined` for no such session. */
+    linkOpened(id: string): (() => void) | undefined;
+}
+//# sourceMappingURL=ephemeral-sessions.d.ts.map

package/dist/node/app/ephemeral-sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ephemeral-sessions.d.ts","sourceRoot":"","sources":["../../../src/node/app/ephemeral-sessions.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,mHAAmH;AACnH,eAAO,MAAM,kBAAkB,QAAS,CAAC;AAUzC,uCAAuC;AACvC,qBAAa,iBAAiB;;IAM7B,YAAY,GAAG,EAAE,MAAM,EAAE,OAAO,SAAqB,EAGpD;IAED,mGAAmG;IACnG,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,IAAI,CAQ1D;IAED,yDAAyD;IACzD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;KAAE,GAAG,SAAS,CAEpF;IAED,6CAA6C;IAC7C,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAM1B;IAED,mHAAmH;IACnH,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAa/C;CAUD"}

package/dist/node/app/ephemeral-sessions.js

@@ -0,0 +1,69 @@
+// Ephemeral sessions (slice 13 §3, carry-over to slice 11): a pick-a-name login's sessions, in memory only, at most
+// `max` (past it the oldest ends), and each ending with its client's connection: once the last Chord link
+// authenticated with it closed and none opened for a grace period (a page reload, a reconnect after a drop), or when
+// none opened within that period of the login.
+/** How long an ephemeral session lives without a link: a minute, past a reload and the reconnect loop's pauses. */
+export const EPHEMERAL_GRACE_MS = 60_000;
+/** The server's ephemeral sessions. */
+export class EphemeralSessions {
+    #max;
+    #graceMs;
+    /** Insertion order is age order: the first entry is the oldest. */
+    #sessions = new Map();
+    constructor(max, graceMs = EPHEMERAL_GRACE_MS) {
+        this.#max = max;
+        this.#graceMs = graceMs;
+    }
+    /** A new session `id` (its secret's hash `hash`) for `principal`; the oldest ends past the cap. */
+    issue(id, hash, principal) {
+        const session = { hash, principal, links: 0, timer: undefined };
+        this.#sessions.set(id, session);
+        this.#waitForLink(id, session);
+        for (const [oldest] of this.#sessions) {
+            if (this.#sessions.size <= this.#max)
+                break;
+            this.revoke(oldest);
+        }
+    }
+    /** Session `id`'s hash and principal, while it lives. */
+    get(id) {
+        return this.#sessions.get(id);
+    }
+    /** Ends session `id`; whether it was one. */
+    revoke(id) {
+        const session = this.#sessions.get(id);
+        if (session === undefined)
+            return false;
+        clearTimeout(session.timer);
+        this.#sessions.delete(id);
+        return true;
+    }
+    /** A link authenticated with session `id` opened: what to call when it closes; `undefined` for no such session. */
+    linkOpened(id) {
+        const session = this.#sessions.get(id);
+        if (session === undefined)
+            return undefined;
+        session.links++;
+        clearTimeout(session.timer);
+        session.timer = undefined;
+        let closed = false;
+        return () => {
+            if (closed)
+                return;
+            closed = true;
+            session.links--;
+            if (session.links === 0 && this.#sessions.get(id) === session)
+                this.#waitForLink(id, session);
+        };
+    }
+    /** Ends `session` unless a link opens within the grace period. */
+    #waitForLink(id, session) {
+        session.timer = setTimeout(() => {
+            if (session.links === 0)
+                this.revoke(id);
+        }, this.#graceMs);
+        // The server's process does not wait for it.
+        session.timer.unref?.();
+    }
+}
+//# sourceMappingURL=ephemeral-sessions.js.map

package/dist/node/app/ephemeral-sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ephemeral-sessions.js","sourceRoot":"","sources":["../../../src/node/app/ephemeral-sessions.ts"],"names":[],"mappings":"AAAA,oHAAoH;AACpH,0GAA0G;AAC1G,qHAAqH;AACrH,+CAA+C;AAI/C,mHAAmH;AACnH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAUzC,uCAAuC;AACvC,MAAM,OAAO,iBAAiB;IACpB,IAAI,CAAS;IACb,QAAQ,CAAS;IAC1B,mEAAmE;IAC1D,SAAS,GAAG,IAAI,GAAG,EAAmB,CAAC;IAEhD,YAAY,GAAW,EAAE,OAAO,GAAG,kBAAkB;QACpD,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,mGAAmG;IACnG,KAAK,CAAC,EAAU,EAAE,IAAY,EAAE,SAAoB;QACnD,MAAM,OAAO,GAAY,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QACzE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/B,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI;gBAAE,MAAM;YAC5C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;IACF,CAAC;IAED,yDAAyD;IACzD,GAAG,CAAC,EAAU;QACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,6CAA6C;IAC7C,MAAM,CAAC,EAAU;QAChB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACxC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,mHAAmH;IACnH,UAAU,CAAC,EAAU;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5C,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;QAC1B,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,OAAO,GAAG,EAAE;YACX,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,OAAO,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,OAAO;gBAAE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/F,CAAC,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,YAAY,CAAC,EAAU,EAAE,OAAgB;QACxC,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC/B,IAAI,OAAO,CAAC,KAAK,KAAK,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1C,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClB,6CAA6C;QAC7C,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACzB,CAAC;CACD","sourcesContent":["// Ephemeral sessions (slice 13 §3, carry-over to slice 11): a pick-a-name login's sessions, in memory only, at most\n// `max` (past it the oldest ends), and each ending with its client's connection: once the last Chord link\n// authenticated with it closed and none opened for a grace period (a page reload, a reconnect after a drop), or when\n// none opened within that period of the login.\n\nimport type { Principal } from \"../../data/index.ts\";\n\n/** How long an ephemeral session lives without a link: a minute, past a reload and the reconnect loop's pauses. */\nexport const EPHEMERAL_GRACE_MS = 60_000;\n\n/** One ephemeral session: its secret's hash, its principal, its open links, its end's timer while it has none. */\ntype Session = {\n\treadonly hash: string;\n\treadonly principal: Principal;\n\tlinks: number;\n\ttimer: ReturnType<typeof setTimeout> | undefined;\n};\n\n/** The server's ephemeral sessions. */\nexport class EphemeralSessions {\n\treadonly #max: number;\n\treadonly #graceMs: number;\n\t/** Insertion order is age order: the first entry is the oldest. */\n\treadonly #sessions = new Map<string, Session>();\n\n\tconstructor(max: number, graceMs = EPHEMERAL_GRACE_MS) {\n\t\tthis.#max = max;\n\t\tthis.#graceMs = graceMs;\n\t}\n\n\t/** A new session `id` (its secret's hash `hash`) for `principal`; the oldest ends past the cap. */\n\tissue(id: string, hash: string, principal: Principal): void {\n\t\tconst session: Session = { hash, principal, links: 0, timer: undefined };\n\t\tthis.#sessions.set(id, session);\n\t\tthis.#waitForLink(id, session);\n\t\tfor (const [oldest] of this.#sessions) {\n\t\t\tif (this.#sessions.size <= this.#max) break;\n\t\t\tthis.revoke(oldest);\n\t\t}\n\t}\n\n\t/** Session `id`'s hash and principal, while it lives. */\n\tget(id: string): { readonly hash: string; readonly principal: Principal } | undefined {\n\t\treturn this.#sessions.get(id);\n\t}\n\n\t/** Ends session `id`; whether it was one. */\n\trevoke(id: string): boolean {\n\t\tconst session = this.#sessions.get(id);\n\t\tif (session === undefined) return false;\n\t\tclearTimeout(session.timer);\n\t\tthis.#sessions.delete(id);\n\t\treturn true;\n\t}\n\n\t/** A link authenticated with session `id` opened: what to call when it closes; `undefined` for no such session. */\n\tlinkOpened(id: string): (() => void) | undefined {\n\t\tconst session = this.#sessions.get(id);\n\t\tif (session === undefined) return undefined;\n\t\tsession.links++;\n\t\tclearTimeout(session.timer);\n\t\tsession.timer = undefined;\n\t\tlet closed = false;\n\t\treturn () => {\n\t\t\tif (closed) return;\n\t\t\tclosed = true;\n\t\t\tsession.links--;\n\t\t\tif (session.links === 0 && this.#sessions.get(id) === session) this.#waitForLink(id, session);\n\t\t};\n\t}\n\n\t/** Ends `session` unless a link opens within the grace period. */\n\t#waitForLink(id: string, session: Session): void {\n\t\tsession.timer = setTimeout(() => {\n\t\t\tif (session.links === 0) this.revoke(id);\n\t\t}, this.#graceMs);\n\t\t// The server's process does not wait for it.\n\t\tsession.timer.unref?.();\n\t}\n}\n"]}

package/dist/node/app/ephemeral.d.ts

@@ -0,0 +1,11 @@
+import type { Principal } from "../../data/index.ts";
+import { type Facet } from "../../host/index.ts";
+/** The principal an ephemeral login gives. */
+export type EphemeralUser = {
+    readonly kind: "user";
+    readonly id: string;
+    readonly name: string;
+};
+/** The ephemeral login plugin's server facet; a type error unless the app's principal type holds `EphemeralUser`. */
+export declare function ephemeralLoginFacet<P extends Principal>(..._fits: EphemeralUser extends P ? [] : ["the app's principal type must hold { kind: 'user', id, name }"]): Facet<P>;
+//# sourceMappingURL=ephemeral.d.ts.map

package/dist/node/app/ephemeral.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ephemeral.d.ts","sourceRoot":"","sources":["../../../src/node/app/ephemeral.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAK9D,8CAA8C;AAC9C,MAAM,MAAM,aAAa,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAKlG,qHAAqH;AACrH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,SAAS,EACtD,GAAG,KAAK,EAAE,aAAa,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,+DAA+D,CAAC,GACxG,KAAK,CAAC,CAAC,CAAC,CAqBV"}