@foldrun/core 8.0.0 → 9.0.0

package/dist/src/history.d.ts

@@ -35,6 +35,11 @@ export interface RevisionSummary {
     commit: string | null;
     paths: string[];
 }
+/** Refuse (400) a deploy's `commit` that cannot be a revision id. A writer
+ *  calls this BEFORE it writes: checked only in recordRevision, after the
+ *  files were replaced, a bad commit left the new source live with no
+ *  revision, no snapshot and no audit entry (30 Oct 2026). */
+export declare function assertCommitId(commit: string): void;
 /** A local revision id: sortable by time, unique enough, visibly not a sha. */
 export declare function newRevisionId(now?: Date): string;
 /**

package/dist/src/history.js

@@ -55,6 +55,15 @@ const historyDir = (tenant, scope) => {
         assertSafeName(scope, "workspace");
     return path.join(dataRoot(), tenant, ".history", scope);
 };
+/** Refuse (400) a deploy's `commit` that cannot be a revision id. A writer
+ *  calls this BEFORE it writes: checked only in recordRevision, after the
+ *  files were replaced, a bad commit left the new source live with no
+ *  revision, no snapshot and no audit entry (30 Oct 2026). */
+export function assertCommitId(commit) {
+    if (typeof commit !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._@-]{0,120}$/.test(commit)) {
+        throw Object.assign(new Error(`commit "${String(commit).slice(0, 130)}" is not a commit id — letters, digits and . _ @ -, at most 121 characters`), { status: 400 });
+    }
+}
 /** A local revision id: sortable by time, unique enough, visibly not a sha. */
 export function newRevisionId(now = new Date()) {
     return `r-${now.getTime().toString(36)}-${crypto.randomBytes(3).toString("hex")}`;
@@ -72,8 +81,17 @@ export function recordRevision(tenant, scope, files, meta = {}) {
         return null;
     const dir = historyDir(tenant, scope);
     fs.mkdirSync(dir, { recursive: true });
+    // A commit is the revision's id only the first time it is recorded. A
+    // second deploy of one commit (a CI re-run after a dashboard edit), or a
+    // `commit` that names a revision already here, overwrote that revision's
+    // record and its snapshot (30 Oct 2026) — History could no longer restore
+    // to it. It gets its own id now; `commit` still says which one it was,
+    // and a restore by commit (resolveRevision) still finds it.
+    if (meta.commit)
+        assertCommitId(meta.commit);
+    const commitId = meta.commit && !fs.existsSync(path.join(dir, `${meta.commit}.json`)) ? meta.commit : null;
     const rev = {
-        id: meta.id ?? meta.commit ?? newRevisionId(),
+        id: meta.id ?? commitId ?? newRevisionId(),
         at: new Date().toISOString(),
         by: meta.by ?? "system",
         message: meta.message ?? describe(changed),
@@ -252,7 +270,11 @@ export function resolveRevision(tenant, scope, to, now = Date.now()) {
     else {
         if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,120}$/.test(t))
             throw Object.assign(new Error(`not a revision or a time: ${to}`), { status: 400 });
-        hit = all.find((r) => r.id === t || r.commit === t || (t.length >= 7 && r.commit?.startsWith(t)));
+        // An exact id first, then a commit: a commit deployed twice is recorded
+        // once under its own id and again under a fresh one naming it (30 Oct
+        // 2026, recordRevision), and newest-first with one predicate answered
+        // the first revision's id with the second's snapshot.
+        hit = all.find((r) => r.id === t) ?? all.find((r) => r.commit === t || (t.length >= 7 && r.commit?.startsWith(t)));
     }
     return hit ? { id: hit.id, at: hit.at, by: hit.by, message: hit.message } : null;
 }
@@ -353,8 +375,13 @@ export function changedPathsBetween(tenant, scope, from, to) {
     if (from === to)
         return [];
     const revs = listRevisions(tenant, scope, { limit: 500 }); // newest first
-    const ti = revs.findIndex((r) => r.id === to || r.commit === to);
-    const fi = revs.findIndex((r) => r.id === from || r.commit === from);
+    // An exact id before a commit, as resolveRevision.
+    const at = (x) => {
+        const byId = revs.findIndex((r) => r.id === x);
+        return byId >= 0 ? byId : revs.findIndex((r) => r.commit === x);
+    };
+    const ti = at(to);
+    const fi = at(from);
     if (ti < 0 || fi < 0 || ti > fi)
         return null;
     return [...new Set(revs.slice(ti, fi).flatMap((r) => r.paths))].sort();

package/dist/src/hooks.d.ts

@@ -6,6 +6,8 @@ export declare const HOOK_TIMEOUT_DEFAULT: {
 };
 export declare const HOOK_TIMEOUT_MAX = 120;
 export declare const HOOK_CODE_MAX: number;
+/** A hook's name: its folder's name, never a path. */
+export declare function isHookName(name: unknown): name is string;
 export interface HookDef {
     name: string;
     /** The folder holding hook.md and run.mjs. */

package/dist/src/hooks.js

@@ -38,6 +38,10 @@ export const HOOK_TIMEOUT_DEFAULT = { gate: 30, watch: 60 };
 export const HOOK_TIMEOUT_MAX = 120;
 export const HOOK_CODE_MAX = 100 * 1024;
 const NAME = /^[a-z0-9][a-z0-9-]{0,63}$/;
+/** A hook's name: its folder's name, never a path. */
+export function isHookName(name) {
+    return typeof name === "string" && NAME.test(name);
+}
 /** Read hook.md, or say in one sentence why it is not a hook. */
 export function readHookDef(dir, scope) {
     const name = path.basename(dir);
@@ -117,6 +121,15 @@ export function resolveHooks(args) {
         if (seen.has(name))
             continue;
         seen.add(name);
+        // Checked before the name is joined to anything (30 Oct 2026): readHookDef
+        // tested only basename(dir), so `../../<tenant>/workspaces/<ws>/hooks/<h>`
+        // passed, and the hook test route answered which folders exist anywhere
+        // on the server — on a laptop it would have run that run.mjs. An error,
+        // not missing: a step refuses either way, and the name is the problem.
+        if (!isHookName(name)) {
+            errors.push(`"${name}" is not a hook name — lowercase letters, digits and dashes (the hook's folder name)`);
+            continue;
+        }
         const own = path.join(args.workspaceRoot, "hooks", name);
         const shared = path.join(args.libraryRoot, "hooks", name);
         const dir = fs.existsSync(own) ? own : fs.existsSync(shared) ? shared : null;

package/dist/src/library.js

@@ -234,6 +234,10 @@ export function deleteLibraryPath(tenant, kind, rel, meta = {}) {
     const norm = path.normalize(rel);
     if (norm.startsWith("..") || path.isAbsolute(norm))
         throw new Error(`illegal path: ${rel}`);
+    // "." (or "./", "a/..") is the shelf itself: one call took every shared
+    // tool or skill from every workspace (30 Oct 2026). Name what goes.
+    if (norm === "." || norm === "./")
+        throw new Error(`illegal path: ${rel} — name the file or folder to delete, not the whole ${kind} shelf`);
     const target = path.join(libraryDir(tenant, kind), norm);
     const gone = [];
     if (fs.existsSync(target)) {

package/dist/src/notify.d.ts

@@ -78,10 +78,24 @@ export declare function nextAttemptAt(n: number, at: number): number | null;
  *  delivery, redeliveries included, so a receiver dedupes on it. */
 export declare function newDeliveryId(): string;
 /** The URL with ${SECRET}s resolved, and how it may be shown: a Slack hook
- *  URL is itself a credential, so it is never echoed resolved. */
+ *  URL is itself a credential, so it is never echoed resolved.
+ *
+ *  A secret bound to sites (`foldrun secrets sites`) is filled only when the
+ *  resolved URL's host is one of them — the rule the egress proxy and the
+ *  tool tester keep (30 Oct 2026). Before, notify.url filled any secret into
+ *  any host, so an editor could write `https://their.server/?k=${STRIPE_KEY}`
+ *  and press Test. The host is read AFTER filling, because the usual shape is
+ *  the whole URL as one secret (`${SLACK_WEBHOOK_URL}`, bound to
+ *  hooks.slack.com). An unbound secret fills as it does for an agent's
+ *  `secrets:` and a tool test — workspace first, then the account — since
+ *  binding is how an account says where a value may go. `refused` says why
+ *  `url` is null when a binding stopped it; `filled` maps each value put
+ *  into the URL to its name, so an error that echoes the URL can be scrubbed. */
 export declare function webhookTarget(tenant: string, workspace: string, config?: NotifyConfig | null): {
     url: string | null;
     shown: string;
+    refused?: string;
+    filled: Record<string, string>;
 };
 export interface WebhookAttempt {
     /** 1-based. */

package/dist/src/notify.js

@@ -33,7 +33,8 @@
 import crypto from "node:crypto";
 import { readAgentsMd } from "./runner.js";
 import { accountDir, workspaceDir, runCost, readFlow, runVerdict } from "./store.js";
-import { getSecret } from "./secrets.js";
+import { getSecret, secretSites } from "./secrets.js";
+import { siteCovers } from "./network.js";
 import { publicUrl } from "./webhook.js";
 import { approveLinkPath, approveLinkTtlMs } from "./approvals.js";
 import { noteSecretUse, healthKey } from "./secret-health.js";
@@ -180,15 +181,80 @@ export function newDeliveryId() {
     return `dlv_${crypto.randomUUID().replace(/-/g, "")}`;
 }
 /** The URL with ${SECRET}s resolved, and how it may be shown: a Slack hook
- *  URL is itself a credential, so it is never echoed resolved. */
+ *  URL is itself a credential, so it is never echoed resolved.
+ *
+ *  A secret bound to sites (`foldrun secrets sites`) is filled only when the
+ *  resolved URL's host is one of them — the rule the egress proxy and the
+ *  tool tester keep (30 Oct 2026). Before, notify.url filled any secret into
+ *  any host, so an editor could write `https://their.server/?k=${STRIPE_KEY}`
+ *  and press Test. The host is read AFTER filling, because the usual shape is
+ *  the whole URL as one secret (`${SLACK_WEBHOOK_URL}`, bound to
+ *  hooks.slack.com). An unbound secret fills as it does for an agent's
+ *  `secrets:` and a tool test — workspace first, then the account — since
+ *  binding is how an account says where a value may go. `refused` says why
+ *  `url` is null when a binding stopped it; `filled` maps each value put
+ *  into the URL to its name, so an error that echoes the URL can be scrubbed. */
 export function webhookTarget(tenant, workspace, config = notifyConfig(tenant, workspace)) {
     const raw = config?.url ?? "";
+    const filled = {};
+    // Every name put in, kept apart from `filled` (value → name, for
+    // scrubbing): two secrets with the same value would otherwise leave only
+    // the last name there, and the first one's binding would go unchecked.
+    const used = new Set();
     const url = raw.replace(/\$\{([A-Z][A-Z0-9_]*)\}/g, (whole, name) => {
         const hit = getSecret(tenant, name, workspace);
+        if (hit) {
+            filled[hit.value] = name;
+            used.add(name);
+        }
         return hit ? hit.value : whole;
     });
     const shown = raw.includes("${") ? raw : raw ? `${raw.slice(0, 40)}${raw.length > 40 ? "…" : ""}` : "none";
-    return { url: !url || url.includes("${") ? null : url, shown };
+    if (!url || url.includes("${"))
+        return { url: null, shown, filled: {} };
+    const bound = secretSites(tenant, [...used], workspace);
+    if (Object.keys(bound).length) {
+        let host = "";
+        try {
+            host = new URL(url).hostname;
+        }
+        catch {
+            // Not a URL: no host can be one of its sites.
+        }
+        const offSite = Object.entries(bound).filter(([, sites]) => !host || !sites.some((site) => siteCovers(site, host))).map(([n]) => n);
+        if (offSite.length) {
+            return {
+                url: null,
+                shown,
+                filled: {},
+                // The host is not echoed: it is read from the FILLED url, so
+                // `https://${KEY}.their.server/` would print the key back.
+                refused: `${offSite.join(", ")} ${offSite.length === 1 ? "is" : "are"} bound to other sites than notify.url's host — not sent`,
+            };
+        }
+    }
+    return { url, shown, filled };
+}
+/** An error about a request to a resolved notify.url, with every secret value
+ *  put back as its ${NAME} — a redirect refusal quotes the URL it was sent to,
+ *  and the delivery log that keeps it is read by every viewer. */
+function scrubTarget(text, filled) {
+    let out = text;
+    // Longest first, so a value inside another is not half-replaced.
+    for (const value of Object.keys(filled).sort((a, b) => b.length - a.length)) {
+        if (!value)
+            continue;
+        const variants = new Set([value]);
+        try {
+            variants.add(encodeURI(value)).add(encodeURIComponent(value));
+        }
+        catch {
+            // A lone surrogate cannot be encoded, so it cannot appear encoded.
+        }
+        for (const v of variants)
+            out = out.split(v).join(`\${${filled[value]}}`);
+    }
+    return out;
 }
 /**
  * One attempt at one delivery, against the workspace's notify: as it reads
@@ -204,10 +270,13 @@ export async function attemptWebhook(tenant, workspace, d) {
     if (!config?.url) {
         return { ...base, ok: false, statusCode: null, durationMs: 0, response: null, error: "this workspace's notify: has no url any more" };
     }
-    const { url } = webhookTarget(tenant, workspace, config);
+    const { url, refused, filled } = webhookTarget(tenant, workspace, config);
     if (!url) {
-        return { ...base, ok: false, statusCode: null, durationMs: 0, response: null, error: "the secret named in notify.url is not in this account's vault" };
+        return { ...base, ok: false, statusCode: null, durationMs: 0, response: null, error: refused ?? "the secret named in notify.url is not in this account's vault" };
     }
+    // A URL that carries a secret is a credential: a redirect is followed only
+    // within the origin it was sent to, as the tool tester does.
+    const carriesSecret = Object.keys(filled).length > 0;
     try {
         const res = await fetchUntrusted(url, {
             method: "POST",
@@ -222,7 +291,7 @@ export async function attemptWebhook(tenant, workspace, d) {
             },
             body: d.body,
             signal: AbortSignal.timeout(Number(process.env.FOLDRUN_WEBHOOK_TIMEOUT_MS) || 8000),
-        });
+        }, { sameOrigin: carriesSecret });
         const text = (await res.text().catch(() => "")).slice(0, 500);
         return {
             ...base,
@@ -235,7 +304,7 @@ export async function attemptWebhook(tenant, workspace, d) {
     }
     catch (err) {
         const why = err instanceof Error ? (err.name === "TimeoutError" ? "timed out" : err.message) : String(err);
-        return { ...base, ok: false, statusCode: null, durationMs: Date.now() - started, response: null, error: why.slice(0, 500) };
+        return { ...base, ok: false, statusCode: null, durationMs: Date.now() - started, response: null, error: scrubTarget(why, filled).slice(0, 500) };
     }
 }
 /**
@@ -411,9 +480,9 @@ export async function sendTestNotification(tenant, workspace) {
     // The destination is echoed back with the secret still unresolved: a
     // Slack webhook URL is itself a credential, and a page that prints it is
     // a page that leaks it into a screenshot.
-    const { url, shown } = webhookTarget(tenant, workspace, config);
+    const { url, shown, refused } = webhookTarget(tenant, workspace, config);
     if (!url) {
-        return { ok: false, destination: shown, detail: `the secret named in notify.url is not in this account's vault` };
+        return { ok: false, destination: shown, detail: refused ?? `the secret named in notify.url is not in this account's vault` };
     }
     const payload = JSON.stringify({ text: `${headline} — ${detail}`, workspace, status: "test", summary: detail });
     // One attempt, recorded in the delivery log like any other — and the way
@@ -554,8 +623,9 @@ export async function sendRunNotification(tenant, workspace, run) {
         }
         // ${SECRET} so the Slack URL — itself a credential — can live in the
         // vault instead of in a file that gets committed.
-        if (!webhookTarget(tenant, workspace, config).url) {
-            console.error(`[foldrun] notify: secret in URL not set for ${tenant}/${workspace}`);
+        const target = webhookTarget(tenant, workspace, config);
+        if (!target.url) {
+            console.error(`[foldrun] notify: ${target.refused ?? "secret in URL not set"} for ${tenant}/${workspace}`);
             return false;
         }
         const event = blocked ? "blocked" : run.status;

package/dist/src/runner.js

@@ -41,7 +41,7 @@ import { ASK_TOOL, PEER_TOOLS, applyOperatorEvent, askPromptLine, askTimeoutSec,
 import { sendPlainNotification } from "./notify.js";
 import { TOOL_MAP, BUILTIN_TOOLS, ownToolNames, toolRefs, legacyUseNames, legacyUseError, retiredToolNames, retiredToolError } from "./tool-names.js";
 import { refNames } from "./refs.js";
-import { accountDir, workspaceDir, buildMemoryIndex, workspaceMemoryIndex, knowledgeIndex, workspaceKnowledgeIndex, workspaceTools, brokenToolReport, listWorkspaces, listTenants, listRuns, liveRuns, syncBundleFor, parseToolDef, readFlow, markerPresent, whenRowsPath, parseApis, resolveModel, parseProvider, providerEnvFor, resolveEffort, isEffortWord, EFFORT_LEVELS, checkFormatVersion, readRun, writeRun, isSplicedRecord, runSummary, verdictOf, sumAttempts, tokensOf, parseSchemaText, STORAGE_DIR, adoptLegacyVersionKey, listAgents, } from "./store.js";
+import { accountDir, workspaceDir, buildMemoryIndex, workspaceMemoryIndex, knowledgeIndex, workspaceKnowledgeIndex, workspaceTools, brokenToolReport, listWorkspaces, listTenants, listRuns, liveRuns, syncBundleFor, parseToolDef, readFlow, markerPresent, whenRowsPath, parseApis, resolveModel, parseProvider, providerEnvFor, resolveEffort, isEffortWord, EFFORT_LEVELS, checkFormatVersion, readRun, writeRun, isSplicedRecord, runSummary, verdictOf, sumAttempts, tokensOf, parseSchemaText, STORAGE_DIR, adoptLegacyVersionKey, listAgents, isOneSegment, } from "./store.js";
 import { canReadBack } from "./tool-output.js";
 import { PromptLayers, promptCacheKey } from "./prompt-layers.js";
 import { loadCatalog, checkModel, clampEffort, catalogCost, findModel, tokenPriceOf } from "./catalog.js";
@@ -4694,8 +4694,12 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                     // resuming around.
                     if (step.status !== "pending")
                         continue;
-                    const aDir = path.join(pDir, "agents", step.agent);
-                    if (!fs.existsSync(path.join(aDir, "agent.md"))) {
+                    // One folder under agents/, never a path (30 Oct 2026): an ad-hoc
+                    // run's agent came from the URL, and `../../<tenant>/…` joined here
+                    // ran another account's agent. Refused as not found, before the
+                    // existence check could answer for a path outside.
+                    const aDir = isOneSegment(step.agent) ? path.join(pDir, "agents", step.agent) : null;
+                    if (!aDir || !fs.existsSync(path.join(aDir, "agent.md"))) {
                         step.status = "failed";
                         step.events.push({
                             t: new Date().toISOString(),
@@ -4918,8 +4922,9 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                 // step of the flow (isSplicedRecord). It gets no delegateJob of its
                 // own: depth one.
                 const delegateFor = (parent) => async (agent, job, cancelled) => {
-                    const dir = path.join(pDir, "agents", agent);
-                    if (!fs.existsSync(path.join(dir, "agent.md")))
+                    // One folder under agents/, never a path — as the group check above.
+                    const dir = isOneSegment(agent) ? path.join(pDir, "agents", agent) : null;
+                    if (!dir || !fs.existsSync(path.join(dir, "agent.md")))
                         return { status: "failed", result: `${agent} is not an agent in this workspace` };
                     // A stable id on both records: an index into run.steps moves when a
                     // rescue or a fan-out is spliced in before the child.
@@ -5335,8 +5340,8 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                 const rescueStep = async (step) => {
                     if (!step.onFail)
                         return;
-                    const rescuerDir = path.join(pDir, "agents", step.onFail);
-                    if (!fs.existsSync(path.join(rescuerDir, "agent.md"))) {
+                    const rescuerDir = isOneSegment(step.onFail) ? path.join(pDir, "agents", step.onFail) : null;
+                    if (!rescuerDir || !fs.existsSync(path.join(rescuerDir, "agent.md"))) {
                         step.events.push({
                             t: new Date().toISOString(),
                             type: "error",

package/dist/src/runtime.js

@@ -830,7 +830,6 @@ function prepareLanguageRuntime(tenant, spec) {
     if (stale)
         log.push(`runtime ${fp}: cached entry unusable (${stale}); rebuilding`);
     const venvPython = path.join(root, "venv", "bin", "python");
-    const nodeModules = path.join(root, "node_modules");
     const wantsPy = wantsPython(spec);
     const wantsNd = wantsNode(spec);
     const built = { built: new Date().toISOString() };

package/dist/src/secrets.js

@@ -238,7 +238,10 @@ export function mutateVaultFile(file, change) {
 }
 export const SECRET_NAME = /^[A-Z][A-Z0-9_]{1,63}$/;
 export function setSecret(tenant, name, value, workspace, kind) {
-    if (!SECRET_NAME.test(name)) {
+    // A string, not anything that prints as one: RegExp.test and the vault's
+    // keys both coerce, so ["RESEND_API_KEY"] from a JSON body was stored as
+    // RESEND_API_KEY past a caller's check on the name (30 Oct 2026).
+    if (typeof name !== "string" || !SECRET_NAME.test(name)) {
         throw new Error(`secret name "${name}" must be UPPER_SNAKE_CASE`);
     }
     if (value.length > 8192)
@@ -261,6 +264,9 @@ export function setSecret(tenant, name, value, workspace, kind) {
  * scheme, path or port. Returns the list as stored.
  */
 export function setSecretSites(tenant, name, sites, workspace) {
+    // all[name] would find ["NAME"] as NAME: see setSecret.
+    if (typeof name !== "string")
+        throw new Error("a secret's name is a string");
     const clean = [...new Set(sites.map((x) => x.trim().toLowerCase()).filter(Boolean))];
     for (const site of clean) {
         if (!SITE.test(site))
@@ -961,7 +967,7 @@ export function setClientCertSecret(tenant, name, config, workspace) {
         ...(config.passphrase ? { passphrase: config.passphrase } : {}),
         ...(config.export ? { export: true } : {}),
     };
-    if (!SECRET_NAME.test(name))
+    if (typeof name !== "string" || !SECRET_NAME.test(name))
         throw new Error(`secret name "${name}" must be UPPER_SNAKE_CASE`);
     const plainCert = CLIENT_CERT_PREFIX + JSON.stringify(stored);
     // Written under the vault's own lock, with the binding checked in the same

package/dist/src/storage.d.ts

@@ -22,6 +22,15 @@ interface Index {
     version: 1;
     files: FileRecord[];
 }
+/**
+ * Refuse a workspace that is not there, as a 404 (30 Oct 2026).
+ *
+ * The store is keyed by workspace *name* and used to be created for any safe
+ * name on first write, so an editor got a fresh quota for every name they
+ * invented — stores no workspace list shows and no delete reaches. Every
+ * write here, and the routes that read, ask this first.
+ */
+export declare function requireWorkspace(tenant: string, workspace: string): void;
 /**
  * Hosted only. On a laptop `storage/` is just a folder in the user's own
  * project — they can see it, open it, and put a PDF in it with Finder — and
@@ -57,6 +66,18 @@ export interface Driver {
     put(key: string, body: Buffer, mime: string): Promise<void>;
     get(key: string): Promise<Buffer>;
     has(key: string): Promise<boolean>;
+    /** The object's real length, or null when there is none — what the store
+     *  holds, never what a browser said it sent (30 Oct 2026). */
+    size(key: string): Promise<number | null>;
+    /** The bytes as a stream, optionally one inclusive byte range — so a route
+     *  hands a file on without holding all of it in memory. */
+    open(key: string, range?: {
+        start: number;
+        end: number;
+    }): Promise<ReadableStream<Uint8Array>>;
+    /** Server-side copy to another key (s3 only — the fs driver's blobs move
+     *  with their directory). Used when a workspace is renamed. */
+    copy?(from: string, to: string): Promise<void>;
     remove(key: string): Promise<void>;
     /** A URL a browser can GET directly, or null when the driver has no such
      *  thing (fs) and the route must stream the bytes itself. */
@@ -65,7 +86,9 @@ export interface Driver {
     presignGet(key: string, filename: string, mime: string, ttlSec?: number, inlineType?: string): Promise<string | null>;
     /** A URL a browser can PUT directly to, so upload bytes never transit the
      *  dashboard process. Null on fs, where the route takes the body. */
-    presignPut(key: string, mime: string, ttlSec?: number): Promise<string | null>;
+    /** `size`: sign the length in, so the store refuses a PUT of any other
+     *  length (30 Oct 2026) — the per-file limit then holds at the bucket. */
+    presignPut(key: string, mime: string, ttlSec?: number, size?: number): Promise<string | null>;
 }
 /** Where the fs driver keeps a blob. Exported because the run mirror
  *  hardlinks straight to it rather than reading and rewriting the bytes. */
@@ -101,9 +124,33 @@ export declare function contentDisposition(type: "inline" | "attachment", filena
 export declare function driverFor(tenant: string, workspace: string): Driver;
 export declare function putFile(tenant: string, workspace: string, rel: string, body: Buffer, by: string): Promise<FileRecord>;
 /** Register bytes a browser PUT straight to the bucket. Same bookkeeping as
- *  putFile, minus the bytes — the platform never saw them. */
-export declare function registerUpload(tenant: string, workspace: string, rel: string, sha: string, size: number, by: string): Promise<FileRecord>;
+ *  putFile, minus the bytes — the platform never saw them.
+ *
+ *  `_claimed` is the size the browser says it sent, kept for the callers that
+ *  pass it and never believed (30 Oct 2026): the record, the per-file limit
+ *  and the quota all use the length the store reports. It used to store the
+ *  claim, so an object registered as 0 bytes (or -1e12) sat outside every
+ *  limit and lowered the quota line for everything after it. */
+export declare function registerUpload(tenant: string, workspace: string, rel: string, sha: string, _claimed: number, by: string): Promise<FileRecord>;
 export declare function readFileBytes(tenant: string, workspace: string, rel: string): Promise<Buffer | null>;
+/** A stored file's real length, from the store — a stat or a HEAD, never a
+ *  read. Null when there is no such record or no object behind it. */
+export declare function storedSize(tenant: string, workspace: string, rel: string): Promise<number | null>;
+/**
+ * A stored file as a stream, with its real length — for a route that passes
+ * the bytes on (a download, a public link) rather than reading them whole
+ * into memory. Null when there is no such record or no object behind it.
+ * `range` is inclusive and must lie inside the file (storedSize first, then
+ * byteRange, when the caller honours a Range header).
+ */
+export declare function openFile(tenant: string, workspace: string, rel: string, range?: {
+    start: number;
+    end: number;
+} | null): Promise<{
+    record: FileRecord;
+    size: number;
+    body: ReadableStream<Uint8Array>;
+} | null>;
 export declare function deleteFile(tenant: string, workspace: string, rel: string): Promise<boolean>;
 /** A link the browser can follow, or null when the route must stream it. */
 export declare function downloadUrl(tenant: string, workspace: string, record: FileRecord, opts?: {
@@ -111,7 +158,32 @@ export declare function downloadUrl(tenant: string, workspace: string, record: F
 }): Promise<string | null>;
 export declare function previewType(rel: string): string | null;
 /** A link the browser can PUT to, plus the key it will land at. Null on fs. */
-export declare function uploadUrl(tenant: string, workspace: string, rel: string, sha: string): Promise<string | null>;
+export declare function uploadUrl(tenant: string, workspace: string, rel: string, sha: string, size?: number): Promise<string | null>;
+/**
+ * Drop everything a workspace stored: every object its index names, then the
+ * index (30 Oct 2026). Called when a workspace is deleted — the store is kept
+ * by name beside the folder, so it used to outlive it: the files stayed
+ * downloadable under the old name, public links kept serving them, and a new
+ * workspace given the same name inherited them. Best effort per object (a
+ * leaked object costs storage; the index going is what makes them
+ * unreachable), and a no-op when there is no store.
+ */
+export declare function purgeWorkspaceStorage(tenant: string, workspace: string): Promise<void>;
+/**
+ * Move a workspace's stored files to its new name (30 Oct 2026). A rename
+ * used to move the folder only: the renamed workspace lost its files, and
+ * the old name kept them for whoever took it next.
+ *
+ * On fs the blobs live under the store's directory, so moving the directory
+ * is the whole move. On s3 an object's key carries the workspace name, so
+ * every object is copied first; only once all copies landed does the index
+ * move and the old objects go. A copy that fails leaves the store under the
+ * old name, whole, and throws — the caller can put the folder back.
+ *
+ * Whatever a store under the new name held is dropped first: it belonged to a
+ * workspace of that name that no longer exists, never to this one.
+ */
+export declare function moveWorkspaceStorage(tenant: string, from: string, to: string): Promise<void>;
 /**
  * Put the workspace's files on disk under `<workspace>/storage/`, where a run
  * copies them into its container like any other directory.