@happyvertical/smrt-cli 0.53.3 → 0.53.4

package/dist/portability-DmQWSSXA.js

@@ -0,0 +1,859 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { T as assertExternalArtifactPath, j as errorCode } from "./cli-BRFsobey.js";
+import { closeSync, constants, existsSync, fstatSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, writeFileSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { createHash, randomBytes } from "node:crypto";
+//#region src/app/portability-assets.ts
+/**
+* Filesystem asset portability for logical export/import bundles.
+*
+* Ported unchanged from the template's `scripts/smrt-portability-assets.mjs`:
+* the bundle format, limits, sanitized failure codes, staging journal, and
+* crash-recovery rules are a persisted contract.
+*/
+var ASSET_MANIFEST_SCHEMA_VERSION = 1;
+var MAX_ASSET_COUNT = 1e3;
+var MAX_ASSET_BYTES = 64 * 1024 * 1024;
+var MAX_TOTAL_ASSET_BYTES = 256 * 1024 * 1024;
+var MAX_BUNDLE_BYTES = 512 * 1024 * 1024;
+var ASSET_URI_PREFIX = "smrt-bundle://asset/";
+var DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
+var BASE64_PATTERN = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+var MAX_BASE64_ASSET_LENGTH = Math.ceil(MAX_ASSET_BYTES / 3) * 4;
+/** Sanitized asset-portability failure with a stable kebab-case `code`. */
+var AssetPortabilityError = class extends Error {
+	code;
+	constructor(code) {
+		super(`Asset portability validation failed (${code}).`);
+		this.name = "AssetPortabilityError";
+		this.code = code;
+	}
+};
+function fail(code) {
+	return new AssetPortabilityError(code);
+}
+function isSanitizedFailure(error) {
+	return !!error && typeof error === "object" && typeof error.code === "string" && /^[a-z][a-z0-9-]*$/.test(error.code);
+}
+function sha256(value) {
+	return createHash("sha256").update(value).digest("hex");
+}
+/** `sha256:<hex>` digest of bytes. */
+function digestBytes(value) {
+	return `sha256:${sha256(value)}`;
+}
+function isInside(parent, child) {
+	const nested = relative(parent, child);
+	return nested !== "" && nested !== ".." && !nested.startsWith(`..${sep}`);
+}
+function assertOutsideSource(sourceRoot, candidate, code) {
+	const source = realpathSync(sourceRoot);
+	const resolved = resolve(candidate);
+	if (resolved === source || isInside(source, resolved) || isInside(resolved, source)) throw fail(code);
+	return resolved;
+}
+function assertRealDirectory(path, code) {
+	try {
+		const details = lstatSync(path);
+		if (details.isSymbolicLink() || !details.isDirectory()) throw fail(code);
+		if (realpathSync(path) !== resolve(path)) throw fail(code);
+		return resolve(path);
+	} catch (error) {
+		if (isSanitizedFailure(error)) throw error;
+		throw fail(code);
+	}
+}
+/** Validate an asset root: absolute, outside the source tree, real directory. */
+function assertAssetRoot({ sourceRoot, assetRoot, allowMissing = false }) {
+	if (typeof assetRoot !== "string" || !isAbsolute(assetRoot)) throw fail("asset-root-required");
+	const root = assertOutsideSource(sourceRoot, assetRoot, "unsafe-asset-root");
+	assertRealDirectory(dirname(root), "unsafe-asset-root");
+	if (existsSync(root)) assertRealDirectory(root, "unsafe-asset-root");
+	else if (!allowMissing) throw fail("asset-root-missing");
+	return root;
+}
+function normalizePayloadPath(value) {
+	if (typeof value !== "string" || value.length === 0 || value.length > 512 || value.includes("\\") || value.includes("\0") || value.startsWith("/") || value.split("/").some((part) => part === "" || part === "." || part === "..")) throw fail("unsafe-payload-path");
+	return value;
+}
+function normalizeDestinationPath(value) {
+	const normalized = normalizePayloadPath(value);
+	if (!/^portable\/[a-f0-9]{64}$/.test(normalized)) throw fail("unsafe-destination-path");
+	return normalized;
+}
+function portableUri(key) {
+	return `${ASSET_URI_PREFIX}${encodeURIComponent(key)}`;
+}
+function payloadPathForKey(key) {
+	return `payloads/${sha256(key)}`;
+}
+function destinationPathForKey(key) {
+	return `portable/${sha256(key)}`;
+}
+function readBoundedDescriptor(descriptor, expectedSize, changedCode) {
+	const bytes = Buffer.alloc(expectedSize);
+	let offset = 0;
+	while (offset < expectedSize) {
+		const count = readSync(descriptor, bytes, offset, expectedSize - offset, null);
+		if (count === 0) throw fail(changedCode);
+		offset += count;
+	}
+	if (readSync(descriptor, Buffer.allocUnsafe(1), 0, 1, null) !== 0) throw fail(changedCode);
+	return bytes;
+}
+function readRegularFileUnchecked(path, approvedRoot, onOpened) {
+	const lexicalPath = resolve(path);
+	if (!isInside(approvedRoot, lexicalPath)) throw fail("asset-outside-root");
+	const before = lstatSync(lexicalPath);
+	if (before.isSymbolicLink() || !before.isFile()) throw fail("asset-not-regular");
+	if (before.size > 67108864) throw fail("asset-too-large");
+	if (!isInside(approvedRoot, realpathSync(lexicalPath))) throw fail("asset-outside-root");
+	const noFollow = constants.O_NOFOLLOW ?? 0;
+	const descriptor = openSync(lexicalPath, constants.O_RDONLY | noFollow);
+	try {
+		const opened = fstatSync(descriptor);
+		if (!opened.isFile() || opened.size !== before.size) throw fail("asset-changed-during-read");
+		onOpened?.();
+		const openedPath = statSync(lexicalPath);
+		if (!isInside(approvedRoot, realpathSync(lexicalPath)) || openedPath.dev !== opened.dev || openedPath.ino !== opened.ino) throw fail("asset-changed-during-read");
+		const bytes = readBoundedDescriptor(descriptor, opened.size, "asset-changed-during-read");
+		const after = fstatSync(descriptor);
+		const afterPath = statSync(lexicalPath);
+		if (after.dev !== opened.dev || after.ino !== opened.ino || after.size !== opened.size || bytes.byteLength !== opened.size || !isInside(approvedRoot, realpathSync(lexicalPath)) || afterPath.dev !== opened.dev || afterPath.ino !== opened.ino) throw fail("asset-changed-during-read");
+		return bytes;
+	} finally {
+		closeSync(descriptor);
+	}
+}
+function readRegularFile(path, approvedRoot, onOpened) {
+	try {
+		return readRegularFileUnchecked(path, approvedRoot, onOpened);
+	} catch (error) {
+		if (isSanitizedFailure(error)) throw error;
+		throw fail("asset-changed-during-read");
+	}
+}
+function pathFromSourceUri(sourceUri) {
+	if (typeof sourceUri !== "string" || !sourceUri.startsWith("file://")) throw fail("unsupported-asset-source");
+	try {
+		return fileURLToPath(sourceUri);
+	} catch {
+		throw fail("unsupported-asset-source");
+	}
+}
+function assetRows(tables) {
+	const table = tables.find((candidate) => candidate?.name === "assets");
+	if (!table) return [];
+	if (!Array.isArray(table.rows) || !table.columns?.includes("id") || !table.columns?.includes("source_uri")) throw fail("invalid-asset-table");
+	return table.rows;
+}
+/** Replace provider paths with logical keys while collecting verified payloads. */
+function collectFilesystemAssets({ tables, sourceRoot, assetRoot, onSourceOpened }) {
+	const rows = assetRows(tables);
+	if (rows.length === 0) return {
+		schemaVersion: 1,
+		adapter: "filesystem",
+		entries: [],
+		payloads: []
+	};
+	if (rows.length > 1e3) throw fail("too-many-assets");
+	const root = assertAssetRoot({
+		sourceRoot,
+		assetRoot
+	});
+	const keys = /* @__PURE__ */ new Set();
+	const payloadPaths = /* @__PURE__ */ new Set();
+	const entries = [];
+	const payloads = [];
+	let totalBytes = 0;
+	for (const row of rows) {
+		if (!row?.source_uri) continue;
+		const key = String(row.id || "");
+		if (!key || key.length > 512 || keys.has(key)) throw fail("duplicate-asset-key");
+		keys.add(key);
+		const payloadPath = payloadPathForKey(key);
+		if (payloadPaths.has(payloadPath)) throw fail("duplicate-payload-path");
+		payloadPaths.add(payloadPath);
+		const bytes = readRegularFile(pathFromSourceUri(row.source_uri), root, onSourceOpened);
+		totalBytes += bytes.byteLength;
+		if (totalBytes > 268435456) throw fail("asset-total-too-large");
+		const contentDigest = digestBytes(bytes);
+		entries.push({
+			key,
+			byteLength: bytes.byteLength,
+			contentDigest,
+			payloadPath
+		});
+		payloads.push({
+			path: payloadPath,
+			encoding: "base64",
+			data: bytes.toString("base64")
+		});
+		row.source_uri = portableUri(key);
+	}
+	return {
+		schemaVersion: 1,
+		adapter: "filesystem",
+		entries,
+		payloads
+	};
+}
+function decodePayload(payload, expectedByteLength) {
+	const candidate = payload;
+	if (candidate?.encoding !== "base64" || typeof candidate.data !== "string" || candidate.data.length > MAX_BASE64_ASSET_LENGTH || !BASE64_PATTERN.test(candidate.data)) throw fail("invalid-asset-payload");
+	const data = candidate.data;
+	const padding = data.endsWith("==") ? 2 : data.endsWith("=") ? 1 : 0;
+	if (data.length / 4 * 3 - padding !== expectedByteLength) throw fail("asset-size-mismatch");
+	const bytes = Buffer.from(data, "base64");
+	if (bytes.toString("base64") !== data) throw fail("invalid-asset-payload");
+	return bytes;
+}
+/** Validate every manifest/payload relationship and hydrate destination URIs. */
+function verifyFilesystemAssets({ assetBundle, tables, sourceRoot, assetRoot }) {
+	const bundle = assetBundle;
+	if (bundle?.schemaVersion !== 1 || bundle?.adapter !== "filesystem" || !Array.isArray(bundle.entries) || !Array.isArray(bundle.payloads)) throw fail("unsupported-asset-manifest");
+	if (bundle.entries.length > 1e3) throw fail("too-many-assets");
+	if (bundle.entries.length !== bundle.payloads.length) throw fail("asset-payload-count-mismatch");
+	const rows = assetRows(tables);
+	const rowByKey = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		if (!row?.source_uri) continue;
+		const key = String(row.id || "");
+		if (!key || rowByKey.has(key) || row.source_uri !== portableUri(key)) throw fail("invalid-asset-reference");
+		rowByKey.set(key, row);
+	}
+	const payloadByPath = /* @__PURE__ */ new Map();
+	for (const payload of bundle.payloads) {
+		const path = normalizePayloadPath(payload?.path);
+		if (payloadByPath.has(path)) throw fail("duplicate-payload-path");
+		payloadByPath.set(path, payload);
+	}
+	const keys = /* @__PURE__ */ new Set();
+	const paths = /* @__PURE__ */ new Set();
+	const verified = [];
+	let totalBytes = 0;
+	for (const rawEntry of bundle.entries) {
+		const entry = rawEntry;
+		const key = typeof entry?.key === "string" ? entry.key : "";
+		const payloadPath = normalizePayloadPath(entry?.payloadPath);
+		if (!key || key.length > 512 || keys.has(key)) throw fail("duplicate-asset-key");
+		if (paths.has(payloadPath)) throw fail("duplicate-payload-path");
+		keys.add(key);
+		paths.add(payloadPath);
+		const byteLength = entry?.byteLength;
+		if (!Number.isSafeInteger(byteLength) || byteLength < 0 || byteLength > 67108864) throw fail("invalid-asset-size");
+		if (!DIGEST_PATTERN.test(entry?.contentDigest || "")) throw fail("invalid-asset-digest");
+		totalBytes += byteLength;
+		if (totalBytes > 268435456) throw fail("asset-total-too-large");
+		const payload = payloadByPath.get(payloadPath);
+		if (!payload) throw fail("missing-asset-payload");
+		const bytes = decodePayload(payload, byteLength);
+		if (bytes.byteLength !== byteLength) throw fail("asset-size-mismatch");
+		if (digestBytes(bytes) !== entry?.contentDigest) throw fail("asset-digest-mismatch");
+		if (!rowByKey.has(key)) throw fail("unreferenced-asset-payload");
+		verified.push({
+			key,
+			bytes,
+			contentDigest: entry.contentDigest,
+			relativePath: destinationPathForKey(key)
+		});
+	}
+	if (keys.size !== rowByKey.size) throw fail("missing-asset-entry");
+	if (payloadByPath.size !== paths.size) throw fail("unreferenced-asset-payload");
+	if (verified.length === 0) return {
+		root: null,
+		entries: []
+	};
+	const root = assertAssetRoot({
+		sourceRoot,
+		assetRoot,
+		allowMissing: true
+	});
+	for (const entry of verified) rowByKey.get(entry.key).source_uri = pathToFileURL(join(root, entry.relativePath)).href;
+	return {
+		root,
+		entries: verified
+	};
+}
+function journalPath(stateRoot, appId) {
+	return join(stateRoot, `.smrt-asset-import-${sha256(appId).slice(0, 16)}.json`);
+}
+function writeJournal(path, journal) {
+	const temporary = `${path}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+	try {
+		writeFileSync(temporary, `${JSON.stringify(journal)}\n`, {
+			flag: "wx",
+			mode: 384
+		});
+		renameSync(temporary, path);
+	} finally {
+		rmSync(temporary, { force: true });
+	}
+}
+function assertEmptyAssetRoot(root) {
+	if (!existsSync(root)) return;
+	assertRealDirectory(root, "unsafe-asset-root");
+	if (readdirSync(root).length !== 0) throw fail("non-empty-asset-target");
+}
+/** Stage verified bytes without publishing anything into the destination root. */
+function stageFilesystemAssets({ verified, stateRoot, appId, bundleDigest }) {
+	if (verified.entries.length === 0 || !verified.root) return null;
+	assertEmptyAssetRoot(verified.root);
+	const stageRoot = join(dirname(verified.root), `.smrt-asset-stage-${process.pid}-${randomBytes(8).toString("hex")}`);
+	const path = journalPath(stateRoot, appId);
+	if (existsSync(path)) throw fail("asset-recovery-required");
+	const journal = {
+		schemaVersion: 1,
+		application: appId,
+		bundleDigest,
+		assetRoot: verified.root,
+		stageRoot,
+		phase: "staging",
+		rootExisted: existsSync(verified.root),
+		entries: verified.entries.map(({ relativePath, contentDigest }) => ({
+			relativePath,
+			contentDigest
+		}))
+	};
+	writeJournal(path, journal);
+	try {
+		mkdirSync(stageRoot, { mode: 448 });
+		for (const entry of verified.entries) {
+			const destination = join(stageRoot, entry.relativePath);
+			mkdirSync(dirname(destination), {
+				recursive: true,
+				mode: 448
+			});
+			writeFileSync(destination, entry.bytes, {
+				flag: "wx",
+				mode: 384
+			});
+			if (digestBytes(readFileSync(destination)) !== entry.contentDigest) throw fail("staged-asset-digest-mismatch");
+		}
+		return {
+			path,
+			journal
+		};
+	} catch (error) {
+		rmSync(stageRoot, {
+			recursive: true,
+			force: true
+		});
+		rmSync(path, { force: true });
+		throw error;
+	}
+}
+/** Publish the complete verified tree with one rename that never follows the target. */
+function publishFilesystemAssets(staged, options = {}) {
+	if (!staged) return;
+	const { journal, path } = staged;
+	assertEmptyAssetRoot(journal.assetRoot);
+	journal.phase = "publishing";
+	writeJournal(path, journal);
+	if (existsSync(journal.assetRoot)) rmdirSync(journal.assetRoot);
+	try {
+		options.beforeRename?.();
+		renameSync(journal.stageRoot, journal.assetRoot);
+	} catch (error) {
+		if (journal.rootExisted && !existsSync(journal.assetRoot)) mkdirSync(journal.assetRoot, { mode: 448 });
+		throw error;
+	}
+	journal.phase = "published";
+	writeJournal(path, journal);
+	verifyPublishedTree(journal);
+}
+function verifyPublishedEntry(journal, entry, approvedRoot, { allowMissing = false, verifyDigest = true } = {}) {
+	const destination = join(journal.assetRoot, normalizeDestinationPath(entry.relativePath));
+	if (!existsSync(destination)) {
+		if (allowMissing) return false;
+		throw fail("missing-published-asset");
+	}
+	const bytes = readRegularFile(destination, approvedRoot);
+	if (verifyDigest && digestBytes(bytes) !== entry.contentDigest) throw fail("published-asset-digest-mismatch");
+	return true;
+}
+function verifyPublishedTree(journal, { verifyDigest = true } = {}) {
+	try {
+		const approvedRoot = assertRealDirectory(journal.assetRoot, "unsafe-published-asset");
+		const rootEntries = readdirSync(approvedRoot);
+		if (rootEntries.length !== 1 || rootEntries[0] !== "portable") throw fail("unexpected-published-asset");
+		const portableDirectory = join(approvedRoot, "portable");
+		assertRealDirectory(portableDirectory, "unsafe-published-asset");
+		const expected = new Set(journal.entries.map((entry) => normalizeDestinationPath(entry.relativePath).slice(9)));
+		const actual = readdirSync(portableDirectory);
+		if (actual.length !== expected.size || actual.some((name) => !expected.has(name))) throw fail("unexpected-published-asset");
+		for (const entry of journal.entries) verifyPublishedEntry(journal, entry, approvedRoot, { verifyDigest });
+	} catch (error) {
+		if (isSanitizedFailure(error)) throw error;
+		throw fail("unsafe-published-asset");
+	}
+}
+/** Re-verify the published tree against the staged journal. */
+function verifyPublishedFilesystemAssets(staged) {
+	if (staged) verifyPublishedTree(staged.journal);
+}
+function removePublishedTree(journal) {
+	const quarantine = `${journal.stageRoot}.rollback-${randomBytes(6).toString("hex")}`;
+	renameSync(journal.assetRoot, quarantine);
+	const quarantinedJournal = {
+		...journal,
+		assetRoot: quarantine
+	};
+	try {
+		verifyPublishedTree(quarantinedJournal, { verifyDigest: false });
+	} catch {
+		if (journal.rootExisted) mkdirSync(journal.assetRoot, { mode: 448 });
+		return {
+			quarantined: true,
+			path: quarantine
+		};
+	}
+	rmSync(quarantine, { recursive: true });
+	if (journal.rootExisted) mkdirSync(journal.assetRoot, { mode: 448 });
+	return { quarantined: false };
+}
+/** Record in the journal that this bundle's database transaction committed. */
+function markFilesystemAssetsCommitted(staged) {
+	if (!staged) return;
+	staged.journal.committedAt = (/* @__PURE__ */ new Date()).toISOString();
+	writeJournal(staged.path, staged.journal);
+}
+/**
+* True when an import journal for `appId` exists, belongs to `bundleDigest`,
+* and records a committed database transaction.
+*/
+function hasCommittedImportJournal({ stateRoot, appId, bundleDigest }) {
+	const path = journalPath(stateRoot, appId);
+	try {
+		const details = lstatSync(path);
+		if (details.isSymbolicLink() || !details.isFile()) return false;
+		const journal = JSON.parse(readFileSync(path, "utf8"));
+		return journal?.application === appId && journal.bundleDigest === bundleDigest && typeof journal.committedAt === "string";
+	} catch {
+		return false;
+	}
+}
+/** Verify the published tree and drop the journal. */
+function finishFilesystemAssets(staged) {
+	if (!staged) return;
+	verifyPublishedTree(staged.journal);
+	rmSync(staged.path, { force: true });
+}
+/** Undo a staged or published import, restoring an empty target. */
+function rollbackFilesystemAssets(staged) {
+	if (!staged) return;
+	if (existsSync(staged.journal.stageRoot)) rmSync(staged.journal.stageRoot, { recursive: true });
+	else if (existsSync(staged.journal.assetRoot)) removePublishedTree(staged.journal);
+	if (staged.journal.rootExisted && !existsSync(staged.journal.assetRoot)) mkdirSync(staged.journal.assetRoot, { mode: 448 });
+	rmSync(staged.path, { force: true });
+}
+/** Recover a prior crash only when the same bundle and exact target state prove ownership. */
+function recoverFilesystemAssets({ stateRoot, appId, bundleDigest, assetRoot, targetState }) {
+	const path = journalPath(stateRoot, appId);
+	if (!existsSync(path)) return "none";
+	const details = lstatSync(path);
+	if (details.isSymbolicLink() || !details.isFile() || (details.mode & 63) !== 0) throw fail("unsafe-asset-recovery-journal");
+	let journal;
+	try {
+		journal = JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		throw fail("invalid-asset-recovery-journal");
+	}
+	if (journal?.schemaVersion !== 1 || journal.application !== appId || journal.bundleDigest !== bundleDigest || resolve(journal.assetRoot || "") !== resolve(assetRoot || "") || !Array.isArray(journal.entries) || ![
+		"staging",
+		"publishing",
+		"published"
+	].includes(journal.phase) || dirname(resolve(journal.stageRoot || "")) !== dirname(resolve(assetRoot || "")) || !String(journal.stageRoot || "").includes(".smrt-asset-stage-")) throw fail("asset-recovery-mismatch");
+	if (targetState === "complete") {
+		if (existsSync(journal.stageRoot)) throw fail("asset-recovery-target-mismatch");
+		verifyPublishedTree(journal);
+		rmSync(path, { force: true });
+		return "complete";
+	}
+	if (targetState !== "empty") throw fail("asset-recovery-target-mismatch");
+	if (existsSync(journal.stageRoot)) rmSync(journal.stageRoot, { recursive: true });
+	else if (existsSync(journal.assetRoot)) removePublishedTree(journal);
+	if (journal.rootExisted && !existsSync(journal.assetRoot)) mkdirSync(journal.assetRoot, { mode: 448 });
+	rmSync(path, { force: true });
+	return "retry";
+}
+/**
+* Read an import bundle only when it is a private (mode 0600), regular,
+* non-symlinked file that does not change while it is read.
+*/
+function readSensitiveBundle(path, options = {}) {
+	let details;
+	let initialRealPath;
+	try {
+		details = lstatSync(path);
+		initialRealPath = realpathSync(path);
+	} catch {
+		throw fail("unsafe-bundle-file");
+	}
+	if (details.isSymbolicLink() || !details.isFile() || initialRealPath !== resolve(path) || details.size > 536870912 || process.platform !== "win32" && (details.mode & 511) !== 384) throw fail("unsafe-bundle-file");
+	const noFollow = constants.O_NOFOLLOW ?? 0;
+	let descriptor;
+	try {
+		descriptor = openSync(path, constants.O_RDONLY | noFollow);
+	} catch {
+		throw fail("bundle-changed-during-read");
+	}
+	try {
+		const opened = fstatSync(descriptor);
+		if (opened.dev !== details.dev || opened.ino !== details.ino || opened.size !== details.size || !opened.isFile()) throw fail("bundle-changed-during-read");
+		options.onOpened?.();
+		const bytes = readBoundedDescriptor(descriptor, opened.size, "bundle-changed-during-read");
+		const after = fstatSync(descriptor);
+		let afterPath;
+		let finalRealPath;
+		try {
+			afterPath = statSync(path);
+			finalRealPath = realpathSync(path);
+		} catch {
+			throw fail("bundle-changed-during-read");
+		}
+		if (after.dev !== opened.dev || after.ino !== opened.ino || after.size !== opened.size || afterPath.dev !== opened.dev || afterPath.ino !== opened.ino || finalRealPath !== resolve(path)) throw fail("bundle-changed-during-read");
+		return bytes.toString("utf8");
+	} finally {
+		closeSync(descriptor);
+	}
+}
+/** Digest identifying one serialized bundle for crash recovery. */
+function bundleContentDigest(serialized) {
+	return digestBytes(Buffer.from(serialized));
+}
+//#endregion
+//#region src/app/portability.ts
+/**
+* Logical application export/import (schemaVersion 2 bundles).
+*
+* Ported unchanged from the template's `scripts/smrt-portability.mjs`: the
+* bundle shape, non-portable table/column rules, parent-first import plan,
+* empty-target rule, and asset staging/recovery are a persisted contract.
+*/
+var portability_exports = /* @__PURE__ */ __exportAll({
+	executeImportPlan: () => executeImportPlan,
+	exportApplication: () => exportApplication,
+	importApplication: () => importApplication,
+	importedRowsMatchBundle: () => importedRowsMatchBundle,
+	manifestTables: () => manifestTables,
+	planImportTables: () => planImportTables,
+	serializeExportBundle: () => serializeExportBundle,
+	validateImportBundle: () => validateImportBundle
+});
+var SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var NON_PORTABLE_TABLE_PATTERN = /(?:^|_)(?:api_keys?|audit_logs?|auth_approve_limits?|auth_requests?|bootstrap|credentials?|magic_link_tokens?|secrets?|sessions?|tokens?)(?:_|$)/;
+var NON_PORTABLE_COLUMN_PATTERN = /(?:^|_)(?:api_key|ciphertext|cookie|credential|encrypted|encryption|password|private_key|privkey|secret|token)(?:_|$)/;
+function quoteIdentifier(value) {
+	if (!SAFE_IDENTIFIER.test(value)) throw new Error("The generated manifest contains an unsafe SQL identifier.");
+	return `"${value}"`;
+}
+function containsNonPortableRows(table) {
+	return NON_PORTABLE_TABLE_PATTERN.test(table.name) || table.columns.some((column) => NON_PORTABLE_COLUMN_PATTERN.test(column));
+}
+/** Read the application tables from `<sourceRoot>/.smrt/manifest.json`. */
+function manifestTables(sourceRoot) {
+	const manifestPath = join(sourceRoot, ".smrt", "manifest.json");
+	if (!existsSync(manifestPath)) throw new Error("Build the application before exporting or importing data.");
+	const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+	const tables = /* @__PURE__ */ new Map();
+	for (const rawDefinition of Object.values(manifest.objects || {})) {
+		const definition = rawDefinition;
+		const schema = definition?.schema;
+		if (definition?.className?.endsWith("Collection")) continue;
+		if (!schema?.tableName || schema.tableName.startsWith("_smrt_")) continue;
+		const columnDefinitions = schema.columns || {};
+		const columns = Object.keys(columnDefinitions);
+		if (columns.length === 0) continue;
+		const foreignKeys = Object.entries(columnDefinitions).flatMap(([column, columnDefinition]) => columnDefinition.foreignKey?.table ? [{
+			column,
+			referencesTable: columnDefinition.foreignKey.table
+		}] : []);
+		const primaryKeys = Object.entries(columnDefinitions).filter(([, columnDefinition]) => columnDefinition.primaryKey).map(([column]) => column);
+		tables.set(schema.tableName, {
+			name: schema.tableName,
+			columns,
+			columnDefinitions,
+			foreignKeys,
+			primaryKeys
+		});
+	}
+	return [...tables.values()].sort((left, right) => left.name.localeCompare(right.name));
+}
+/** Parent-first insertion plan with nullable cycle edges deferred to updates. */
+function planImportTables(tables) {
+	const remaining = new Map(tables.map((table) => [table.name, table]));
+	const inserted = /* @__PURE__ */ new Set();
+	const plan = [];
+	while (remaining.size > 0) {
+		const table = [...remaining.values()].filter((table) => table.foreignKeys.every((foreignKey) => foreignKey.referencesTable === table.name || !remaining.has(foreignKey.referencesTable) || inserted.has(foreignKey.referencesTable))).sort((left, right) => left.name.localeCompare(right.name))[0] || [...remaining.values()].sort((left, right) => left.name.localeCompare(right.name))[0];
+		const deferredColumns = new Set(table.foreignKeys.filter((foreignKey) => foreignKey.referencesTable === table.name || remaining.has(foreignKey.referencesTable)).map((foreignKey) => foreignKey.column));
+		plan.push({
+			...table,
+			deferredColumns
+		});
+		inserted.add(table.name);
+		remaining.delete(table.name);
+	}
+	return plan;
+}
+async function withDatabase(context, callback) {
+	const options = {
+		type: context.runtime.providers.database.engine,
+		url: context.env.DATABASE_URL
+	};
+	if (context.runtime.profile === "local") options.secureFile = {
+		driver: "node:sqlite",
+		custody: "trusted-parent",
+		root: context.paths?.root
+	};
+	const db = await (context.openDatabase ?? (async (databaseOptions) => {
+		const { getDatabase } = await import("@happyvertical/sql");
+		return getDatabase(databaseOptions);
+	}))(options);
+	try {
+		return await callback(db);
+	} finally {
+		await db.close?.();
+	}
+}
+/** Reject bundles that do not exactly match the generated schema. */
+function validateImportBundle(bundle, expected) {
+	const providedNames = bundle.tables.map((table) => table?.name);
+	if (providedNames.length !== expected.size || new Set(providedNames).size !== expected.size || providedNames.some((name) => !expected.has(name))) throw new Error("The export does not contain the complete application schema.");
+	for (const rawExported of bundle.tables) {
+		const exported = rawExported;
+		const table = expected.get(exported.name);
+		if (!table || !Array.isArray(exported.rows) || !Array.isArray(exported.columns)) throw new Error("The export does not match the generated application schema.");
+		if (exported.columns.length !== table.columns.length || new Set(exported.columns).size !== table.columns.length || exported.columns.some((column) => !table.columns.includes(column))) throw new Error(`The export schema does not match ${table.name}.`);
+		for (const row of exported.rows) {
+			if (!row || typeof row !== "object" || Array.isArray(row)) throw new Error(`The export has an invalid row for ${table.name}.`);
+			const columns = Object.keys(row);
+			if (columns.length !== table.columns.length || columns.some((column) => !table.columns.includes(column))) throw new Error(`The export has incomplete columns for ${table.name}.`);
+		}
+	}
+}
+/** JSON cannot represent SQLite's lossless BigInt results; decimal strings do. */
+function serializeExportBundle(bundle) {
+	return JSON.stringify(bundle, (_key, value) => typeof value === "bigint" ? value.toString() : value, 2);
+}
+/** Write a logical export bundle without replacing an existing file. */
+async function exportApplication(context) {
+	const tables = manifestTables(context.sourceRoot);
+	let bundle;
+	await withDatabase(context, async (db) => {
+		if (typeof db.transaction !== "function") throw new Error("Logical export requires transactional database support.");
+		bundle = await db.transaction(async (tx) => {
+			if (context.runtime.providers.database.engine === "postgres") await tx.query("SET TRANSACTION ISOLATION LEVEL REPEATABLE READ READ ONLY");
+			const exported = {
+				schemaVersion: 2,
+				application: context.appId,
+				profile: context.runtime.profile,
+				exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+				tables: []
+			};
+			for (const table of tables) exported.tables.push({
+				name: table.name,
+				columns: table.columns,
+				rows: containsNonPortableRows(table) ? [] : (await tx.query(`SELECT ${table.columns.map(quoteIdentifier).join(", ")} FROM ${quoteIdentifier(table.name)}`)).rows
+			});
+			exported.assets = collectFilesystemAssets({
+				tables: exported.tables,
+				sourceRoot: context.sourceRoot,
+				assetRoot: context.assetRoot || context.paths?.assets
+			});
+			return exported;
+		});
+	});
+	const exportedBundle = bundle;
+	const outputPath = assertExternalArtifactPath({
+		sourceRoot: context.sourceRoot,
+		path: context.path || join(context.stateRoot, "exports", `${context.appId}-${Date.now()}.json`),
+		label: "Export destination"
+	});
+	mkdirSync(dirname(outputPath), {
+		recursive: true,
+		mode: 448
+	});
+	const temporaryPath = join(dirname(outputPath), `.${basename(outputPath)}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`);
+	const serialized = `${serializeExportBundle(exportedBundle)}\n`;
+	if (Buffer.byteLength(serialized) > 536870912) throw new Error("The portability bundle exceeds the supported size limit.");
+	try {
+		writeFileSync(temporaryPath, serialized, {
+			flag: "wx",
+			mode: 384
+		});
+		try {
+			linkSync(temporaryPath, outputPath);
+		} catch (error) {
+			if (errorCode(error) === "EEXIST") throw new Error(`Export destination already exists: ${outputPath}`);
+			throw error;
+		}
+	} finally {
+		rmSync(temporaryPath, { force: true });
+	}
+	return {
+		path: outputPath,
+		tableCount: exportedBundle.tables.length,
+		assetsIncluded: true,
+		assetCount: exportedBundle.assets.entries.length
+	};
+}
+/** Execute a prevalidated parent-first import against one database transaction. */
+async function executeImportPlan(tx, plan, exportedByName) {
+	const deferredUpdates = [];
+	let rowCount = 0;
+	for (const table of plan) {
+		const exported = exportedByName.get(table.name);
+		const count = await tx.query(`SELECT COUNT(*) AS count FROM ${quoteIdentifier(table.name)}`);
+		if (Number(count.rows[0]?.count || 0) !== 0) throw new Error(`Import target table ${table.name} is not empty.`);
+		for (const row of exported.rows) {
+			const columns = Object.keys(row);
+			await tx.query(`INSERT INTO ${quoteIdentifier(table.name)} (${columns.map(quoteIdentifier).join(", ")}) VALUES (${columns.map(() => "?").join(", ")})`, ...columns.map((column) => table.deferredColumns.has(column) ? null : row[column]));
+			for (const column of table.deferredColumns) if (row[column] != null) deferredUpdates.push({
+				table,
+				column,
+				value: row[column],
+				primaryKey: table.primaryKeys[0],
+				primaryValue: row[table.primaryKeys[0]]
+			});
+			rowCount += 1;
+		}
+	}
+	for (const update of deferredUpdates) await tx.query(`UPDATE ${quoteIdentifier(update.table.name)} SET ${quoteIdentifier(update.column)} = ? WHERE ${quoteIdentifier(update.primaryKey)} = ?`, update.value, update.primaryValue);
+	return rowCount;
+}
+async function inspectImportTarget(db, plan, exportedByName) {
+	let empty = true;
+	let complete = true;
+	for (const table of plan) {
+		const count = await db.query(`SELECT COUNT(*) AS count FROM ${quoteIdentifier(table.name)}`);
+		const actual = Number(count.rows[0]?.count || 0);
+		const expected = exportedByName.get(table.name).rows.length;
+		if (actual !== 0) empty = false;
+		if (actual !== expected) complete = false;
+	}
+	if (empty) return "empty";
+	if (complete) return "complete";
+	return "dirty";
+}
+function canonicalValue(value) {
+	if (value === null || value === void 0) return null;
+	if (typeof value === "boolean") return value ? "1" : "0";
+	if (typeof value === "number" || typeof value === "bigint") return String(value);
+	if (value instanceof Date) return value.toISOString();
+	if (value instanceof Uint8Array) return Buffer.from(value).toString("base64");
+	if (typeof value === "object") return JSON.stringify(value);
+	return String(value);
+}
+function canonicalRows(rows, columns) {
+	return rows.map((row) => JSON.stringify(columns.map((column) => canonicalValue(row[column])))).sort();
+}
+/**
+* True when every planned table holds exactly the bundle's rows (as a
+* multiset over the bundle's columns). This is the evidence an interrupted
+* import's recovery needs when no commit marker was recorded: matching
+* per-table counts alone do not prove the rows are this bundle's.
+*/
+async function importedRowsMatchBundle(db, plan, exportedByName) {
+	for (const table of plan) {
+		const expected = exportedByName.get(table.name).rows;
+		const left = canonicalRows((await db.query(`SELECT ${table.columns.map(quoteIdentifier).join(", ")} FROM ${quoteIdentifier(table.name)}`)).rows, table.columns);
+		const right = canonicalRows(expected, table.columns);
+		if (left.length !== right.length) return false;
+		for (let index = 0; index < left.length; index += 1) if (left[index] !== right[index]) return false;
+	}
+	return true;
+}
+/** Import a logical bundle into an empty application database. */
+async function importApplication(context) {
+	if (!context.path) throw new Error("Usage: pnpm app:import -- /absolute/path/export.json");
+	const serialized = readSensitiveBundle(context.path);
+	const bundle = JSON.parse(serialized);
+	if (bundle.schemaVersion === 1) throw new Error("Database-only logical export bundles are not importable; create a new asset-aware export.");
+	if (bundle.schemaVersion !== 2 || !Array.isArray(bundle.tables)) throw new Error("Unsupported logical export bundle.");
+	if (bundle.application !== context.appId) throw new Error("The export belongs to a different application.");
+	const tables = bundle.tables;
+	const expected = new Map(manifestTables(context.sourceRoot).map((table) => [table.name, table]));
+	validateImportBundle({ tables }, expected);
+	const exportedByName = new Map(tables.map((table) => [table.name, table]));
+	const plan = planImportTables([...expected.values()]);
+	for (const table of plan) {
+		const exported = exportedByName.get(table.name);
+		for (const column of table.deferredColumns) if (table.columnDefinitions[column]?.notNull && exported.rows.some((row) => row[column] != null)) throw new Error(`Import cannot safely defer required cyclic reference ${table.name}.${column}.`);
+		if (table.deferredColumns.size > 0 && table.primaryKeys.length !== 1) throw new Error(`Import cannot update cyclic references for ${table.name} without one primary key.`);
+	}
+	const assetRoot = context.assetRoot || context.paths?.assets || null;
+	const verifiedAssets = verifyFilesystemAssets({
+		assetBundle: bundle.assets,
+		tables,
+		sourceRoot: context.sourceRoot,
+		assetRoot
+	});
+	const bundleDigest = bundleContentDigest(serialized);
+	const totalRows = () => tables.reduce((count, table) => count + table.rows.length, 0);
+	let rowCount = 0;
+	await withDatabase(context, async (db) => {
+		if (typeof db.transaction !== "function") throw new Error("Logical import requires transactional database support.");
+		const executor = db;
+		let targetState = await inspectImportTarget(executor, plan, exportedByName);
+		if (verifiedAssets.root && targetState === "complete" && !hasCommittedImportJournal({
+			stateRoot: context.stateRoot,
+			appId: context.appId,
+			bundleDigest
+		}) && !await importedRowsMatchBundle(executor, plan, exportedByName)) targetState = "dirty";
+		if (verifiedAssets.root) {
+			const recovery = recoverFilesystemAssets({
+				stateRoot: context.stateRoot,
+				appId: context.appId,
+				bundleDigest,
+				assetRoot: verifiedAssets.root,
+				targetState
+			});
+			if (recovery === "complete") {
+				rowCount = totalRows();
+				return;
+			}
+			if (recovery === "retry") targetState = await inspectImportTarget(executor, plan, exportedByName);
+		}
+		if (targetState !== "empty") throw new Error("Import target is not empty.");
+		const staged = stageFilesystemAssets({
+			verified: verifiedAssets,
+			stateRoot: context.stateRoot,
+			appId: context.appId,
+			bundleDigest
+		});
+		let committed = false;
+		try {
+			await context.onImportPhase?.("assets-staged");
+			await db.transaction(async (tx) => {
+				publishFilesystemAssets(staged);
+				await context.onImportPhase?.("assets-published");
+				rowCount = await executeImportPlan(tx, plan, exportedByName);
+				await context.onImportPhase?.("database-staged");
+				verifyPublishedFilesystemAssets(staged);
+			});
+			committed = true;
+			markFilesystemAssetsCommitted(staged);
+			finishFilesystemAssets(staged);
+		} catch (error) {
+			const stateAfterFailure = await inspectImportTarget(executor, plan, exportedByName);
+			if (stateAfterFailure === "complete" && (committed || await importedRowsMatchBundle(executor, plan, exportedByName))) {
+				finishFilesystemAssets(staged);
+				rowCount = totalRows();
+				return;
+			}
+			if (stateAfterFailure === "empty") rollbackFilesystemAssets(staged);
+			throw error;
+		}
+	});
+	return {
+		path: context.path,
+		rowCount,
+		assetsIncluded: true,
+		assetCount: bundle.assets.entries.length
+	};
+}
+//#endregion
+export { publishFilesystemAssets as C, stageFilesystemAssets as D, rollbackFilesystemAssets as E, verifyFilesystemAssets as O, markFilesystemAssetsCommitted as S, recoverFilesystemAssets as T, bundleContentDigest as _, manifestTables as a, finishFilesystemAssets as b, serializeExportBundle as c, AssetPortabilityError as d, MAX_ASSET_BYTES as f, assertAssetRoot as g, MAX_TOTAL_ASSET_BYTES as h, importedRowsMatchBundle as i, verifyPublishedFilesystemAssets as k, validateImportBundle as l, MAX_BUNDLE_BYTES as m, exportApplication as n, planImportTables as o, MAX_ASSET_COUNT as p, importApplication as r, portability_exports as s, executeImportPlan as t, ASSET_MANIFEST_SCHEMA_VERSION as u, collectFilesystemAssets as v, readSensitiveBundle as w, hasCommittedImportJournal as x, digestBytes as y };