@hraness/sponge 0.2.6 → 0.3.0

package/dist/src/portability/backup.js

@@ -1,41 +1,95 @@
-import { constants, openSync, closeSync, fstatSync, fsyncSync, unlinkSync, rmSync } from 'node:fs';
+import { constants, openSync, closeSync, fstatSync, fsyncSync, unlinkSync, rmSync, chmodSync, fchmodSync, } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { openLibrary } from '../store/index.js';
-import { safeDirectory } from '../store/files.js';
-import { StoreError } from '../store/types.js';
+import { safeDirectory, pathExists } from '../store/files.js';
+import { loadPublishKey, publishKeyPath, maximumPublishKeyBytes } from '../publish/identity.js';
 import { inspectDatabase, neutralizeRestoredDatabase } from './database.js';
-import { bounded, exact, fileDescriptor, invalid, maximumDatabaseBytes, maximumEntries, maximumTotalBytes, openRead, readExact, transfer, writeAll, describe, newDirectory, discardOwned, syncDirectory, writePrivateExclusive } from './files.js';
+import { bounded, digestString, exact, fileDescriptor, invalid, maximumDatabaseBytes, maximumEntries, maximumTotalBytes, openRead, readExact, transfer, writeAll, describe, newDirectory, discardOwned, writePrivateExclusive, } from './files.js';
+import { syncDirectory } from '../util/fsync.js';
+import { SpongeError } from '../errors.js';
 const magic = Buffer.from('SPONGE-BACKUP-1\n');
 const maxManifestBytes = 32 * 1024 ** 2;
+function publishKeyEntry(value) {
+    if (value === null)
+        return null;
+    const r = exact(value, ['path', 'bytes', 'sha256']);
+    if (r.path !== publishKeyPath)
+        invalid();
+    return { path: publishKeyPath, bytes: bounded(r.bytes, maximumPublishKeyBytes), sha256: digestString(r.sha256) };
+}
 function manifest(value) {
-    const r = exact(value, ['format', 'version', 'schemaVersion', 'libraryId', 'revisionEpoch', 'files']);
-    if (r.format !== 'sponge-backup' || r.version !== 1 || typeof r.libraryId !== 'string' || r.libraryId.length > 256 || !Array.isArray(r.files) || r.files.length < 1 || r.files.length > maximumEntries + 1)
+    const v = value && typeof value === 'object' ? value.version : undefined;
+    const r = exact(value, [
+        'format',
+        'version',
+        'schemaVersion',
+        'libraryId',
+        'revisionEpoch',
+        'files',
+        ...(v === 2 ? ['publishKey'] : []),
+    ]);
+    if (r.format !== 'sponge-backup' ||
+        (r.version !== 1 && r.version !== 2) ||
+        typeof r.libraryId !== 'string' ||
+        r.libraryId.length > 256 ||
+        !Array.isArray(r.files) ||
+        r.files.length < 1 ||
+        r.files.length > maximumEntries + 1)
         invalid();
     const files = r.files.map(fileDescriptor);
-    if (files[0]?.path !== 'library.sqlite' || files.slice(1).some(f => f.path === 'library.sqlite') || new Set(files.map(f => f.path)).size !== files.length)
+    if (files[0]?.path !== 'library.sqlite' ||
+        files.slice(1).some((f) => f.path === 'library.sqlite') ||
+        new Set(files.map((f) => f.path)).size !== files.length)
         invalid();
-    return { format: 'sponge-backup', version: 1, schemaVersion: bounded(r.schemaVersion, Number.MAX_SAFE_INTEGER), libraryId: r.libraryId, revisionEpoch: bounded(r.revisionEpoch, Number.MAX_SAFE_INTEGER), files };
+    return {
+        format: 'sponge-backup',
+        version: r.version,
+        schemaVersion: bounded(r.schemaVersion, Number.MAX_SAFE_INTEGER),
+        libraryId: r.libraryId,
+        revisionEpoch: bounded(r.revisionEpoch, Number.MAX_SAFE_INTEGER),
+        files,
+        publishKey: r.version === 2 ? publishKeyEntry(r.publishKey) : null,
+    };
 }
 function sameSnapshot(info, m) {
-    if (info.schemaVersion !== m.schemaVersion || info.libraryId !== m.libraryId || info.revisionEpoch !== m.revisionEpoch)
+    if (info.schemaVersion !== m.schemaVersion ||
+        info.libraryId !== m.libraryId ||
+        info.revisionEpoch !== m.revisionEpoch)
         invalid();
-    const expected = info.blobs.map(b => ({ path: b.relativePath, bytes: b.bytes, sha256: b.sha256 }));
+    const expected = info.blobs.map((b) => ({ path: b.relativePath, bytes: b.bytes, sha256: b.sha256 }));
     if (JSON.stringify(expected) !== JSON.stringify(m.files.slice(1)))
         invalid();
 }
 export async function backupLibrary(store, output) {
     if (resolve(output) !== output)
-        throw new StoreError('invalid-input');
+        throw new SpongeError('invalid-input');
     safeDirectory(dirname(output));
-    const snapshot = await store.createBackupSnapshot();
+    const snapshot = await store.backups.snapshot();
     let fd, created = false;
     try {
         const info = inspectDatabase(snapshot.path);
-        const files = [describe(snapshot.path, 'library.sqlite', maximumDatabaseBytes), ...info.blobs.map(b => ({ path: b.relativePath, bytes: b.bytes, sha256: b.sha256 }))];
-        const m = { format: 'sponge-backup', version: 1, schemaVersion: info.schemaVersion, libraryId: info.libraryId, revisionEpoch: info.revisionEpoch, files };
+        const files = [
+            describe(snapshot.path, 'library.sqlite', maximumDatabaseBytes),
+            ...info.blobs.map((b) => ({ path: b.relativePath, bytes: b.bytes, sha256: b.sha256 })),
+        ];
+        // The publishing key is immutable once linked into place; a key that would not load is refused here, not discovered at restore.
+        const keyPath = join(store.root, publishKeyPath), publishKey = pathExists(keyPath)
+            ? (loadPublishKey(keyPath), describe(keyPath, publishKeyPath, maximumPublishKeyBytes))
+            : null;
+        const m = {
+            format: 'sponge-backup',
+            version: 2,
+            schemaVersion: info.schemaVersion,
+            libraryId: info.libraryId,
+            revisionEpoch: info.revisionEpoch,
+            files,
+            publishKey,
+        };
         const json = Buffer.from(JSON.stringify(m));
-        if (json.length > maxManifestBytes || files.reduce((n, f) => n + f.bytes, json.length + magic.length + 4) > maximumTotalBytes)
-            throw new StoreError('limit-exceeded');
+        if (json.length > maxManifestBytes ||
+            [...files, ...(publishKey ? [publishKey] : [])].reduce((n, f) => n + f.bytes, json.length + magic.length + 4) >
+                maximumTotalBytes)
+            throw new SpongeError('limit-exceeded');
         fd = openSync(output, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
         created = true;
         writeAll(fd, magic);
@@ -43,7 +97,7 @@ export async function backupLibrary(store, output) {
         length.writeUInt32BE(json.length);
         writeAll(fd, length);
         writeAll(fd, json);
-        for (const file of files) {
+        for (const file of publishKey ? [...files, publishKey] : files) {
             const input = openRead(file.path === 'library.sqlite' ? snapshot.path : join(store.root, file.path));
             try {
                 if (fstatSync(input).size !== file.bytes || transfer(input, file.bytes, fd) !== file.sha256)
@@ -58,7 +112,13 @@ export async function backupLibrary(store, output) {
         fd = undefined;
         syncDirectory(dirname(output));
         const result = describe(output, 'archive', maximumTotalBytes);
-        return { output, sha256: result.sha256, bytes: result.bytes, itemsSnapshotEpoch: info.revisionEpoch };
+        return {
+            output,
+            sha256: result.sha256,
+            bytes: result.bytes,
+            itemsSnapshotEpoch: info.revisionEpoch,
+            publishKey: publishKey !== null,
+        };
     }
     catch (error) {
         if (fd !== undefined) {
@@ -78,7 +138,7 @@ export async function backupLibrary(store, output) {
                 rmSync(snapshot.path + side, { force: true });
         }
         finally {
-            store.finishBackup(snapshot.id);
+            store.backups.finish(snapshot.id);
         }
     }
 }
@@ -101,7 +161,8 @@ export async function restoreLibrary(input, into) {
             invalid();
         }
         const m = manifest(parsed);
-        if (m.files.reduce((n, f) => n + f.bytes, magic.length + 4 + length) !== size)
+        if ([...m.files, ...(m.publishKey ? [m.publishKey] : [])].reduce((n, f) => n + f.bytes, magic.length + 4 + length) !==
+            size)
             invalid();
         target = newDirectory(into);
         for (const file of m.files) {
@@ -118,16 +179,39 @@ export async function restoreLibrary(input, into) {
                 closeSync(out);
             }
         }
+        // The key goes only into the new directory created above (exclusive create), so restore never replaces an existing key.
+        if (m.publishKey) {
+            const dir = safeDirectory(join(target.root, 'keys'), true);
+            chmodSync(dir, 0o700);
+            const path = join(target.root, publishKeyPath), out = openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+            try {
+                if (transfer(fd, m.publishKey.bytes, out) !== m.publishKey.sha256)
+                    invalid();
+                fchmodSync(out, 0o600);
+                fsyncSync(out);
+            }
+            finally {
+                closeSync(out);
+            }
+            syncDirectory(dir);
+            loadPublishKey(path);
+        }
         sameSnapshot(inspectDatabase(join(into, 'library.sqlite')), m);
         const state = neutralizeRestoredDatabase(join(into, 'library.sqlite'));
         writePrivateExclusive(join(into, '.sponge-library'), 'sponge-library-v1\n');
         // Mark bindings as deliberately absent. This never installs runtime/auth/model files.
         safeDirectory(join(into, 'runtime'), true);
-        writePrivateExclusive(join(into, 'runtime', 'restore.json'), JSON.stringify({ schemaVersion: 1, libraryId: m.libraryId, ownerIncarnation: state.incarnation, connections: 'unresolved', heldJobs: state.heldJobs }) + '\n');
+        writePrivateExclusive(join(into, 'runtime', 'restore.json'), JSON.stringify({
+            schemaVersion: 1,
+            libraryId: m.libraryId,
+            ownerIncarnation: state.incarnation,
+            connections: 'unresolved',
+            heldJobs: state.heldJobs,
+        }) + '\n');
         const store = await openLibrary(into);
         store.close();
         syncDirectory(into);
-        return { root: into, libraryId: m.libraryId, ...state };
+        return { root: into, libraryId: m.libraryId, ...state, publishKey: m.publishKey !== null };
     }
     catch (error) {
         if (target)

package/dist/src/portability/database.js

@@ -1,46 +1,78 @@
 import { DatabaseSync } from 'node:sqlite';
 import { randomUUID } from 'node:crypto';
-import { libraryMigrations } from '../store/index.js';
-import { digest, regularFile } from '../store/files.js';
-import { StoreError } from '../store/types.js';
+import { migrations } from '../../migrations/index.js';
+import { regularFile } from '../store/files.js';
+import { sha256 } from '../util/hash.js';
 import { blobPath, bounded, digestString, invalid, maximumBlobBytes, maximumEntries } from './files.js';
-function schema(db) { return JSON.stringify(db.prepare("SELECT type,name,tbl_name,sql FROM sqlite_schema ORDER BY type,name").all()); }
+import { SpongeError } from '../errors.js';
+function schema(db) {
+    return JSON.stringify(db.prepare('SELECT type,name,tbl_name,sql FROM sqlite_schema ORDER BY type,name').all());
+}
 /** Compare executable schema before any restored SQL mutation, not just claimed migration hashes. */
 export function inspectDatabase(path) {
     regularFile(path);
+    // SQLite's own errors on a forged or corrupt file (not a database, malformed image) are an integrity failure, not a crash.
+    try {
+        return inspectOpened(path);
+    }
+    catch (error) {
+        if (error instanceof SpongeError)
+            throw error;
+        throw new SpongeError('integrity', { cause: error });
+    }
+}
+function inspectOpened(path) {
     const db = new DatabaseSync(path, { readOnly: true });
     const expected = new DatabaseSync(':memory:');
     try {
         db.exec('PRAGMA trusted_schema=OFF');
         const version = bounded(db.prepare('PRAGMA user_version').get()?.user_version, Number.MAX_SAFE_INTEGER);
-        if (version > libraryMigrations.length)
-            throw new StoreError('schema-newer');
+        if (version > migrations.length)
+            throw new SpongeError('schema-newer');
         if (version < 1)
             invalid();
         for (let i = 0; i < version; i++) {
-            expected.exec(libraryMigrations[i]);
-            if (db.prepare('SELECT checksum FROM schema_migrations WHERE version=?').get(i + 1)?.checksum !== digest(libraryMigrations[i]))
+            const { sql } = migrations[i];
+            expected.exec(sql);
+            if (db.prepare('SELECT checksum FROM schema_migrations WHERE version=?').get(i + 1)?.checksum !== sha256(sql))
                 invalid();
         }
         if (schema(db) !== schema(expected))
             invalid();
         if (db.prepare('SELECT count(*) n FROM schema_migrations').get()?.n !== version)
             invalid();
-        if (db.prepare('PRAGMA quick_check').get()?.quick_check !== 'ok' || db.prepare('PRAGMA foreign_key_check').all().length)
+        if (db.prepare('PRAGMA quick_check').get()?.quick_check !== 'ok' ||
+            db.prepare('PRAGMA foreign_key_check').all().length)
             invalid();
         const info = db.prepare('SELECT uuid,schema_version,revision_epoch FROM library_info WHERE id=1').get();
         if (!info || typeof info.uuid !== 'string' || info.uuid.length > 256 || info.schema_version !== version)
             invalid();
         const count = Number(db.prepare('SELECT count(*) n FROM assets').get()?.n);
         if (count > maximumEntries)
-            throw new StoreError('limit-exceeded');
-        const blobs = db.prepare('SELECT sha256,bytes,relative_path FROM assets ORDER BY sha256').all().map(row => { const sha256 = digestString(row.sha256); if (row.relative_path !== blobPath(sha256))
-            invalid(); return { sha256, bytes: bounded(row.bytes, maximumBlobBytes), relativePath: String(row.relative_path) }; });
-        for (const row of db.prepare('SELECT markdown,sha256,bytes FROM representations WHERE markdown IS NOT NULL').iterate()) {
-            if (typeof row.markdown !== 'string' || digest(row.markdown) !== row.sha256 || Buffer.byteLength(row.markdown) !== row.bytes)
+            throw new SpongeError('limit-exceeded');
+        const blobs = db
+            .prepare('SELECT sha256,bytes,relative_path FROM assets ORDER BY sha256')
+            .all()
+            .map((row) => {
+            const sha256 = digestString(row.sha256);
+            if (row.relative_path !== blobPath(sha256))
+                invalid();
+            return { sha256, bytes: bounded(row.bytes, maximumBlobBytes), relativePath: String(row.relative_path) };
+        });
+        for (const row of db
+            .prepare('SELECT markdown,sha256,bytes FROM representations WHERE markdown IS NOT NULL')
+            .iterate()) {
+            if (typeof row.markdown !== 'string' ||
+                sha256(row.markdown) !== row.sha256 ||
+                Buffer.byteLength(row.markdown) !== row.bytes)
                 invalid();
         }
-        return { schemaVersion: version, libraryId: info.uuid, revisionEpoch: bounded(info.revision_epoch, Number.MAX_SAFE_INTEGER), blobs };
+        return {
+            schemaVersion: version,
+            libraryId: info.uuid,
+            revisionEpoch: bounded(info.revision_epoch, Number.MAX_SAFE_INTEGER),
+            blobs,
+        };
     }
     finally {
         expected.close();
@@ -55,9 +87,11 @@ export function neutralizeRestoredDatabase(path) {
     try {
         db.exec('PRAGMA trusted_schema=OFF; PRAGMA foreign_keys=ON; BEGIN IMMEDIATE');
         // Every nonterminal intent is retained but requires an explicit retry after restore.
-        const held = db.prepare(`UPDATE jobs SET state='needs-permission',reason='restore-reconciliation-required'${inspected.schemaVersion >= 2 ? ",retryable=0" : ""} WHERE state NOT IN ('succeeded','failed','cancelled','unsupported')`).run();
+        const held = db
+            .prepare(`UPDATE jobs SET state='needs-permission',reason='restore-reconciliation-required'${inspected.schemaVersion >= 2 ? ',retryable=0' : ''} WHERE state NOT IN ('succeeded','failed','cancelled','unsupported')`)
+            .run();
         db.prepare("UPDATE attempts SET stage='restored-unexecuted',cleanup='settled',finished_at=COALESCE(finished_at,?) WHERE cleanup='pending' OR finished_at IS NULL").run(new Date().toISOString());
-        db.exec("DELETE FROM staging_pins; DELETE FROM backup_fences; UPDATE worker_owner SET incarnation=NULL,fence=fence+1; UPDATE model_artifacts SET available=0;");
+        db.exec('DELETE FROM staging_pins; DELETE FROM backup_fences; UPDATE worker_owner SET incarnation=NULL,fence=fence+1; UPDATE model_artifacts SET available=0;');
         if (inspected.schemaVersion >= 4) {
             db.exec("UPDATE index_jobs SET state='failed',reason='restore-reconciliation-required' WHERE state NOT IN ('succeeded','failed','cancelled')");
             db.prepare("UPDATE index_attempts SET stage='restored-unexecuted',cleanup='settled',finished_at=COALESCE(finished_at,?) WHERE cleanup='pending' OR finished_at IS NULL").run(new Date().toISOString());

package/dist/src/portability/export.js

@@ -1,31 +1,57 @@
 import { join } from 'node:path';
-import { StoreError } from '../store/types.js';
 import { safeDirectory } from '../store/files.js';
-import { newDirectory, discardOwned, copyVerified, syncDirectory, blobPath, writePrivateExclusive } from './files.js';
+import { newDirectory, discardOwned, copyVerified, blobPath, writePrivateExclusive } from './files.js';
+import { syncDirectory } from '../util/fsync.js';
+import { SpongeError } from '../errors.js';
 /** Export a fixed revision with hash-named local assets. No network or acquisition. */
 export function exportItem(store, itemId, output) {
     const item = store.read(itemId);
     if (!item)
-        throw new StoreError('invalid-input');
+        throw new SpongeError('invalid-input');
     const target = newDirectory(output);
     try {
         safeDirectory(join(output, 'assets'), true);
         const known = new Map();
         for (const asset of item.assets) {
             if (asset.relativePath !== blobPath(asset.sha256))
-                throw new StoreError('integrity');
+                throw new SpongeError('integrity');
             const path = `assets/${asset.sha256}`;
             if (!known.has(asset.sha256)) {
-                copyVerified(join(store.root, asset.relativePath), join(output, path), { path, bytes: asset.bytes, sha256: asset.sha256 });
+                copyVerified(join(store.root, asset.relativePath), join(output, path), {
+                    path,
+                    bytes: asset.bytes,
+                    sha256: asset.sha256,
+                });
                 known.set(asset.sha256, path);
             }
         }
-        const markdown = item.markdown.replace(/sponge-asset:([a-f0-9]{64})/gu, (_all, sha) => { const path = known.get(sha); if (!path)
-            throw new StoreError('integrity'); return path; });
+        const markdown = item.markdown.replace(/sponge-asset:([a-f0-9]{64})/gu, (_all, sha) => {
+            const path = known.get(sha);
+            if (!path)
+                throw new SpongeError('integrity');
+            return path;
+        });
         writePrivateExclusive(join(output, 'article.md'), markdown);
         // Metadata can contain private descriptive content; exports stay private and explicit.
-        const notes = store.readAnnotations(itemId);
-        writePrivateExclusive(join(output, 'item.json'), JSON.stringify({ schemaVersion: 1, ...notes, itemId: item.itemId, revisionId: item.revisionId, title: item.title, kind: item.kind, status: item.status, metadata: item.metadata, metadataWarnings: item.metadataWarnings, assets: item.assets.map(a => ({ sha256: a.sha256, bytes: a.bytes, mediaType: a.mediaType, relationship: a.relationship, path: known.get(a.sha256) })) }) + '\n');
+        const notes = store.annotations.forExport(itemId);
+        writePrivateExclusive(join(output, 'item.json'), JSON.stringify({
+            schemaVersion: 1,
+            ...notes,
+            itemId: item.itemId,
+            revisionId: item.revisionId,
+            title: item.title,
+            kind: item.kind,
+            status: item.status,
+            metadata: item.metadata,
+            metadataWarnings: item.metadataWarnings,
+            assets: item.assets.map((a) => ({
+                sha256: a.sha256,
+                bytes: a.bytes,
+                mediaType: a.mediaType,
+                relationship: a.relationship,
+                path: known.get(a.sha256),
+            })),
+        }) + '\n');
         syncDirectory(output);
         return { output, itemId, revisionId: item.revisionId, assets: known.size };
     }

package/dist/src/portability/files.d.ts

@@ -1,4 +1,3 @@
-import { syncDirectory } from '../store/files.js';
 export declare const maximumTotalBytes: number, maximumDatabaseBytes: number, maximumBlobBytes: number, maximumEntries = 100000;
 export interface FileRecord {
     path: string;
@@ -6,7 +5,7 @@ export interface FileRecord {
     sha256: string;
 }
 export declare function invalid(): never;
-export declare function exact(value: unknown, keys: string[]): Record<string, unknown>;
+export declare const exact: (value: unknown, keys: string[]) => Record<string, unknown>;
 export declare function bounded(value: unknown, max: number): number;
 export declare function digestString(value: unknown): string;
 export declare function blobPath(sha: string): string;
@@ -28,6 +27,4 @@ export declare function discardOwned(value: {
     device: number;
     inode: number;
 }): void;
-export declare function assertEmptyDirectory(path: string): void;
-export { syncDirectory };
 export declare function writePrivateExclusive(path: string, value: string): void;

package/dist/src/portability/files.js

@@ -1,78 +1,138 @@
 import { createHash } from 'node:crypto';
-import { constants, openSync, closeSync, fstatSync, readSync, writeSync, fsyncSync, lstatSync, mkdirSync, readdirSync, rmSync } from 'node:fs';
+import { constants, openSync, closeSync, fstatSync, readSync, writeSync, fsyncSync, lstatSync, mkdirSync, rmSync, } from 'node:fs';
 import { dirname, resolve } from 'node:path';
-import { safeDirectory, regularFile, syncDirectory } from '../store/files.js';
-import { StoreError } from '../store/types.js';
+import { safeDirectory, regularFile } from '../store/files.js';
+import { syncDirectory } from '../util/fsync.js';
+import { exactKeys } from '../util/exact.js';
+import { SpongeError } from '../errors.js';
 export const maximumTotalBytes = 16 * 1024 ** 3, maximumDatabaseBytes = 512 * 1024 ** 2, maximumBlobBytes = 512 * 1024 ** 2, maximumEntries = 100_000;
-export function invalid() { throw new StoreError('integrity'); }
-export function exact(value, keys) { if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).sort().join(',') !== keys.sort().join(','))
-    invalid(); return value; }
-export function bounded(value, max) { if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0 || value > max)
-    invalid(); return value; }
-export function digestString(value) { if (typeof value !== 'string' || !/^[a-f0-9]{64}$/u.test(value))
-    invalid(); return value; }
-export function blobPath(sha) { return `blobs/sha256/${sha.slice(0, 2)}/${sha}`; }
-export function fileDescriptor(value) { const r = exact(value, ['path', 'bytes', 'sha256']); const sha256 = digestString(r.sha256); if (r.path !== 'library.sqlite' && r.path !== blobPath(sha256))
-    invalid(); return { path: String(r.path), bytes: bounded(r.bytes, r.path === 'library.sqlite' ? maximumDatabaseBytes : maximumBlobBytes), sha256 }; }
-export function openRead(path) { safeDirectory(dirname(path)); regularFile(path); const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW); const stat = fstatSync(fd); if (!stat.isFile() || stat.nlink !== 1) {
-    closeSync(fd);
-    invalid();
-} return fd; }
-export function writeAll(fd, bytes) { let n = 0; while (n < bytes.length) {
-    const written = writeSync(fd, bytes, n, bytes.length - n);
-    if (!written)
+export function invalid() {
+    throw new SpongeError('integrity');
+}
+export const exact = (value, keys) => exactKeys(value, keys, invalid);
+export function bounded(value, max) {
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0 || value > max)
         invalid();
-    n += written;
-} }
-export function readExact(fd, bytes) { const result = Buffer.alloc(bytes); let n = 0; while (n < bytes) {
-    const read = readSync(fd, result, n, bytes - n, null);
-    if (!read)
+    return value;
+}
+export function digestString(value) {
+    if (typeof value !== 'string' || !/^[a-f0-9]{64}$/u.test(value))
         invalid();
-    n += read;
-} return result; }
-/** Stream only expected bytes from one descriptor; never allocate a full PDF or archive. */
-export function transfer(input, bytes, output) { const hash = createHash('sha256'), buffer = Buffer.alloc(64 * 1024); let n = 0; while (n < bytes) {
-    const read = readSync(input, buffer, 0, Math.min(buffer.length, bytes - n), null);
-    if (!read)
+    return value;
+}
+export function blobPath(sha) {
+    return `blobs/sha256/${sha.slice(0, 2)}/${sha}`;
+}
+export function fileDescriptor(value) {
+    const r = exact(value, ['path', 'bytes', 'sha256']);
+    const sha256 = digestString(r.sha256);
+    if (r.path !== 'library.sqlite' && r.path !== blobPath(sha256))
         invalid();
-    hash.update(buffer.subarray(0, read));
-    if (output !== undefined)
-        writeAll(output, buffer.subarray(0, read));
-    n += read;
-} return hash.digest('hex'); }
-export function describe(path, relativePath, maximum) { const fd = openRead(path); try {
-    const bytes = bounded(fstatSync(fd).size, maximum);
-    return { path: relativePath, bytes, sha256: transfer(fd, bytes) };
+    return {
+        path: String(r.path),
+        bytes: bounded(r.bytes, r.path === 'library.sqlite' ? maximumDatabaseBytes : maximumBlobBytes),
+        sha256,
+    };
 }
-finally {
-    closeSync(fd);
-} }
-export function copyVerified(source, target, record) { const input = openRead(source); let output; try {
-    if (fstatSync(input).size !== record.bytes)
+export function openRead(path) {
+    safeDirectory(dirname(path));
+    regularFile(path);
+    const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const stat = fstatSync(fd);
+    if (!stat.isFile() || stat.nlink !== 1) {
+        closeSync(fd);
         invalid();
-    safeDirectory(dirname(target), true);
-    output = openSync(target, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
-    if (transfer(input, record.bytes, output) !== record.sha256)
+    }
+    return fd;
+}
+export function writeAll(fd, bytes) {
+    let n = 0;
+    while (n < bytes.length) {
+        const written = writeSync(fd, bytes, n, bytes.length - n);
+        if (!written)
+            invalid();
+        n += written;
+    }
+}
+export function readExact(fd, bytes) {
+    const result = Buffer.alloc(bytes);
+    let n = 0;
+    while (n < bytes) {
+        const read = readSync(fd, result, n, bytes - n, null);
+        if (!read)
+            invalid();
+        n += read;
+    }
+    return result;
+}
+/** Stream only expected bytes from one descriptor; never allocate a full PDF or archive. */
+export function transfer(input, bytes, output) {
+    const hash = createHash('sha256'), buffer = Buffer.alloc(64 * 1024);
+    let n = 0;
+    while (n < bytes) {
+        const read = readSync(input, buffer, 0, Math.min(buffer.length, bytes - n), null);
+        if (!read)
+            invalid();
+        hash.update(buffer.subarray(0, read));
+        if (output !== undefined)
+            writeAll(output, buffer.subarray(0, read));
+        n += read;
+    }
+    return hash.digest('hex');
+}
+export function describe(path, relativePath, maximum) {
+    const fd = openRead(path);
+    try {
+        const bytes = bounded(fstatSync(fd).size, maximum);
+        return { path: relativePath, bytes, sha256: transfer(fd, bytes) };
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+export function copyVerified(source, target, record) {
+    const input = openRead(source);
+    let output;
+    try {
+        if (fstatSync(input).size !== record.bytes)
+            invalid();
+        safeDirectory(dirname(target), true);
+        output = openSync(target, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+        if (transfer(input, record.bytes, output) !== record.sha256)
+            invalid();
+        fsyncSync(output);
+        syncDirectory(dirname(target));
+    }
+    finally {
+        closeSync(input);
+        if (output !== undefined)
+            closeSync(output);
+    }
+}
+export function newDirectory(path) {
+    if (resolve(path) !== path)
+        throw new SpongeError('invalid-input');
+    safeDirectory(dirname(path));
+    mkdirSync(path, { mode: 0o700 });
+    const stat = lstatSync(path);
+    return { root: path, device: stat.dev, inode: stat.ino };
+}
+export function discardOwned(value) {
+    const stat = lstatSync(value.root);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || stat.dev !== value.device || stat.ino !== value.inode)
         invalid();
-    fsyncSync(output);
-    syncDirectory(dirname(target));
+    rmSync(value.root, { recursive: true });
+    syncDirectory(dirname(value.root));
 }
-finally {
-    closeSync(input);
-    if (output !== undefined)
-        closeSync(output);
-} }
-export function newDirectory(path) { if (resolve(path) !== path)
-    throw new StoreError('invalid-input'); safeDirectory(dirname(path)); mkdirSync(path, { mode: 0o700 }); const stat = lstatSync(path); return { root: path, device: stat.dev, inode: stat.ino }; }
-export function discardOwned(value) { const stat = lstatSync(value.root); if (!stat.isDirectory() || stat.isSymbolicLink() || stat.dev !== value.device || stat.ino !== value.inode)
-    invalid(); rmSync(value.root, { recursive: true }); syncDirectory(dirname(value.root)); }
-export function assertEmptyDirectory(path) { safeDirectory(path); if (readdirSync(path).length)
-    invalid(); }
-export { syncDirectory };
-export function writePrivateExclusive(path, value) { safeDirectory(dirname(path)); const fd = openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600); try {
-    writeAll(fd, Buffer.from(value));
-    fsyncSync(fd);
+export function writePrivateExclusive(path, value) {
+    safeDirectory(dirname(path));
+    const fd = openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+    try {
+        writeAll(fd, Buffer.from(value));
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+    syncDirectory(dirname(path));
 }
-finally {
-    closeSync(fd);
-} syncDirectory(dirname(path)); }