@jsm-mit/sultana-assets-rust-package 0.3.0 → 0.4.0

package/README.md

@@ -34,7 +34,7 @@ One class per part of the canister:
 | `AssetsRustUploadsActor` | chunked session, single-shot upload, `uploadBytesAsyncUnsafe` | any signed-in caller |
 | `AssetsRustSalonActor` | `upload_image`, `delete_salon_asset`, transcoding and render reservations | the salon's owner — core decides |
 | `AssetsRustWorkerActor` | system upload of a transcoded result under a reserved id | listed transcoding workers |
-| `AssetsRustAssetsActor` | `get_asset_info`, `list_assets`, `http_request`, `assetUrl` | anybody |
+| `AssetsRustAssetsActor` | `get_asset_info`, `list_assets`, `http_request`, `assetUrl` | anybody; `list_assets` only the canister's controllers and the core seat |
 | `AssetsRustAvatarActor` | `upload_my_avatar`, `delete_my_avatar` (own avatar only, profile required — core `isUser` —, no quota; 64 KB / 512 px, re-encoded as JPEG), `get_avatar`, `/avatar/<principal>`, `avatarUrl` | writes: the caller for themselves; reads: anybody |
 
 Every method is `…AsyncUnsafe` and throws one of three errors, like the other wrapper
@@ -57,14 +57,16 @@ types are exported too, and `./declarations/*` gives the generated files.
 `src/` is browser-safe — the same package serves the biz panel, the playground and the
 transcoding worker.
 
-Scripts: `build`, `typecheck`, `sync-declarations`, `test-suite`, `test-smoke`, `test-upgrade`, `redeploy`, `sandbox`
+Scripts: `build`, `typecheck`, `sync-declarations`, `test-suite`, `test-smoke`, `test-upgrade`,
+`redeploy`, `sandbox`
 (an interactive console: `npm run sandbox -- <canister-id>`, caller from `IDENTITY_PEM` in
 `.env.sandbox` or anonymous), `stamp-canister`, `publish-public`. See `CLAUDE.md` for who runs what.
 
 ## Integration tests
 
-`npm run test-suite` reinstalls the current `../sultana-assets-rust` build into the crafting
-table's `short-living` slot (lease 3 minutes) and runs `tests/test-suite.ts` there. No
+All tests run on the LOCAL replica — no cycles, no shared slot. `npm run test-suite`
+reinstalls the current `../sultana-assets-rust` build into a local canister and runs
+`tests/test-suite.ts` there. No
 `.env`, no PEMs: every identity is generated per run. A fresh canister has no core canister,
 so the suite claims that claim-once seat for a generated identity and plays core itself.
 
@@ -73,6 +75,12 @@ read per domain (worker list, a few-byte single-shot upload read back over HTTP,
 result, a salon upload refused by the stand-in core), one replication wait, ≈ 30 s.
 `publish-public` runs it too.
 
+`npm run test-upgrade` seeds the canister, upgrades it in the middle of the run and checks
+that the stored data reads back identical. `scripts/local-canister.sh`
+builds `../sultana-assets-rust` with cargo and reinstalls it into a canister of the dfx project
+in `local/` (its id stays under `local/.dfx`); the upgrade test upgrades that canister. The
+local replica must run (`dfx start --background`); the scripts never start or stop it.
+
 What the suite covers: the core seat and the worker list; chunked and single-shot uploads
 with every owner and size check; reads, HTTP 200/206/404, certification header and
 streaming; the worker's system upload with a poster; `delete_asset` taking the thumb along;
@@ -85,7 +93,8 @@ the suite never touches it.
 
 Bump the version by hand, commit, push, then `npm run publish-public`. It refuses unless this
 repo and `../sultana-assets-rust` are on a clean, pushed `master` and the version is new on
-npm; it reinstalls the canister's master into `short-living` (lease 2), checks that its
+npm; it reinstalls the canister's master into the canister on the LOCAL replica
+(`scripts/local-canister.sh`; the replica must run), checks that its
 `candid:service` equals `declarations/sultana-assets-rust/sultana-assets-rust.did` as dfx
 rewrites it (the hand-written .did is normalized by a local `dfx build --check` first), runs
 the smoke test (`tests/test-smoke.ts`) on that same deploy, stamps

package/dist/actor-base.d.ts

@@ -25,10 +25,13 @@ export declare class ActorBase {
     protected host: string;
     protected actor: ActorSubclass<_SERVICE>;
     protected agent: HttpAgent;
+    private ready;
     /**
      * @param canisterId - The sultana-assets-rust canister to talk to.
      * @param identity - The caller; left out = anonymous (enough for the reads).
-     * @param host - The IC API host; default https://icp0.io.
+     * @param host - The IC API host; default https://icp0.io. A local replica
+     *   (`http://127.0.0.1:4943`) works too: for a local host — and only then — the agent
+     *   fetches the replica's root key before the first call.
      */
     constructor(canisterId: string, identity?: Identity | undefined, host?: string);
     private initAgentAndActor;

package/dist/actor-base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actor-base.d.ts","sourceRoot":"","sources":["../src/actor-base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,SAAS,EAAE,KAAK,QAAQ,EAAS,MAAM,qBAAqB,CAAC;AAE1F,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gEAAgE,CAAC;AAG/F,sFAAsF;AACtF,MAAM,WAAW,SAAS;IACtB,yFAAyF;IACzF,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,QAAQ,EAAE,OAAO,CAAC;CACrB;AAKD;;;;;;;;;GASG;AACH,qBAAa,SAAS;IASN,SAAS,CAAC,UAAU,EAAE,MAAM;IAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,QAAQ;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM;IAR/F,SAAS,CAAC,KAAK,EAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1C,SAAS,CAAC,KAAK,EAAG,SAAS,CAAC;IAE5B;;;;OAIG;gBACmB,UAAU,EAAE,MAAM,EAAY,QAAQ,CAAC,EAAE,QAAQ,YAAA,EAAY,IAAI,GAAE,MAAqB;IAI9G,OAAO,CAAC,iBAAiB;IAWzB;;;;OAIG;IACI,iBAAiB,IAAI,IAAI;IAIhC,iFAAiF;cACjE,0BAA0B,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAqBpF,SAAS,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO;IASpD,SAAS,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI;CAU1D"}
+{"version":3,"file":"actor-base.d.ts","sourceRoot":"","sources":["../src/actor-base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,SAAS,EAAE,KAAK,QAAQ,EAAS,MAAM,qBAAqB,CAAC;AAE1F,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gEAAgE,CAAC;AAG/F,sFAAsF;AACtF,MAAM,WAAW,SAAS;IACtB,yFAAyF;IACzF,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,QAAQ,EAAE,OAAO,CAAC;CACrB;AASD;;;;;;;;;GASG;AACH,qBAAa,SAAS;IAYN,SAAS,CAAC,UAAU,EAAE,MAAM;IAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,QAAQ;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM;IAX/F,SAAS,CAAC,KAAK,EAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1C,SAAS,CAAC,KAAK,EAAG,SAAS,CAAC;IAC5B,OAAO,CAAC,KAAK,CAAoC;IAEjD;;;;;;OAMG;gBACmB,UAAU,EAAE,MAAM,EAAY,QAAQ,CAAC,EAAE,QAAQ,YAAA,EAAY,IAAI,GAAE,MAAqB;IAI9G,OAAO,CAAC,iBAAiB;IAYzB;;;;OAIG;IACI,iBAAiB,IAAI,IAAI;IAIhC,iFAAiF;cACjE,0BAA0B,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAuBpF,SAAS,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO;IAcpD,SAAS,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI;CAU1D"}

package/dist/actor-base.js

@@ -1,6 +1,9 @@
 import { HttpAgent, Actor } from "@icp-sdk/core/agent";
 import { idlFactory } from "../declarations/sultana-assets-rust/sultana-assets-rust.did.js";
 import { DEFAULT_HOST } from "./constants.js";
+function isLocalHost(host) {
+    return /^https?:\/\/(127\.0\.0\.1|localhost|\[::1\])(:\d+)?\/?$/.test(host);
+}
 // IC error code of an explicit trap (ic0.trap — every ic_cdk::trap and every Rust panic).
 const TRAP_ERROR_CODE = "IC0503";
 /**
@@ -19,10 +22,13 @@ export class ActorBase {
     host;
     actor;
     agent;
+    ready = Promise.resolve();
     /**
      * @param canisterId - The sultana-assets-rust canister to talk to.
      * @param identity - The caller; left out = anonymous (enough for the reads).
-     * @param host - The IC API host; default https://icp0.io.
+     * @param host - The IC API host; default https://icp0.io. A local replica
+     *   (`http://127.0.0.1:4943`) works too: for a local host — and only then — the agent
+     *   fetches the replica's root key before the first call.
      */
     constructor(canisterId, identity, host = DEFAULT_HOST) {
         this.canisterId = canisterId;
@@ -35,6 +41,7 @@ export class ActorBase {
             host: this.host,
             identity: this.identity,
         });
+        this.ready = isLocalHost(this.host) ? this.agent.fetchRootKey().then(() => undefined) : Promise.resolve();
         this.actor = Actor.createActor(idlFactory, {
             agent: this.agent,
             canisterId: this.canisterId,
@@ -50,6 +57,7 @@ export class ActorBase {
     }
     /** Runs one canister call and translates its failure (see the class comment). */
     async executeFunctionAsyncUnsafe(fnAsync) {
+        await this.ready;
         try {
             return await fnAsync();
         }
@@ -65,12 +73,15 @@ export class ActorBase {
             throw new Error("CriticalCanisterError", { cause: { logs: null, rawError: err } });
         }
     }
-    // True if `error` is an IC reject caused by an inspect-stage refusal. sultana-assets-rust
-    // has no inspect_message today; kept so the error vocabulary stays the same as in the
-    // other wrapper packages. When the canister gets one, check the text it produces.
+    // True if `error` is an IC reject caused by an inspect-stage refusal. The canister's
+    // inspect_message (since 2026-10-25) refuses by not accepting, which the replica reports as
+    // "Canister rejected the message" (IC0406); older replicas said "... refused message".
     isInspectionRejection(error) {
         const rejectText = error?.cause?.code?.rejectMessage || error?.message || "";
-        return rejectText.includes("canister_inspect_message explicitly refused message");
+        return (rejectText.includes("Canister rejected the message") ||
+            rejectText.includes("IC0406") ||
+            rejectText.includes("canister_inspect_message explicitly refused message") ||
+            rejectText.includes("canister_inspect_message implicitly refused message"));
     }
     // The trap text when `error` is a trap of the canister, otherwise null. The replica
     // reports it as "... Canister called `ic0.trap` with message: '<text>'.\nConsider ...";

package/dist/actors/assets-actor.d.ts

@@ -1,6 +1,7 @@
 import { ActorBase } from "../actor-base.js";
 import type { AssetInfoView, HttpGetInput, HttpResponseView } from "../interfaces.js";
-/** Reads: what is stored and how it is served. All queries — anonymous callers are fine. */
+/** Reads: what is stored and how it is served. All queries — anonymous callers are fine,
+ * except `listAssetsAsyncUnsafe`: the canister's controllers and the core seat only. */
 export declare class AssetsRustAssetsActor extends ActorBase {
     /**
      * @param assetId - The asset.
@@ -13,7 +14,8 @@ export declare class AssetsRustAssetsActor extends ActorBase {
     getAssetInfoAsyncUnsafe(assetId: string): Promise<AssetInfoView | null>;
     /**
      * Every asset physically stored — the raw storage view, independent of any salon library:
-     * thumbnails, posters and orphans included.
+     * thumbnails, posters and orphans included. The canister's controllers and the core seat
+     * only; anybody else gets a CanisterError ("list_assets refused: controllers only").
      * @returns A Promise that resolves to every stored asset.
      * @throws CanisterError - The canister trapped.
      * @throws CallRefusedAtInspectionStage - The call was refused at the inspect stage.

package/dist/actors/assets-actor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets-actor.d.ts","sourceRoot":"","sources":["../../src/actors/assets-actor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGtF,4FAA4F;AAC5F,qBAAa,qBAAsB,SAAQ,SAAS;IAChD;;;;;;;OAOG;IACU,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAKpF;;;;;;;OAOG;IACU,qBAAqB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAK9D;;;;;;;;;;OAUG;IACU,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,GAAE,YAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAYzG,0EAA0E;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;CAG3C"}
+{"version":3,"file":"assets-actor.d.ts","sourceRoot":"","sources":["../../src/actors/assets-actor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGtF;wFACwF;AACxF,qBAAa,qBAAsB,SAAQ,SAAS;IAChD;;;;;;;OAOG;IACU,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAKpF;;;;;;;;OAQG;IACU,qBAAqB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAK9D;;;;;;;;;;OAUG;IACU,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,GAAE,YAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAYzG,0EAA0E;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;CAG3C"}

package/dist/actors/assets-actor.js

@@ -1,7 +1,8 @@
 import { ActorBase } from "../actor-base.js";
 import { assetUrl } from "../constants.js";
 import { mapAssetInfoView, mapHttpResponseView } from "../mappers.js";
-/** Reads: what is stored and how it is served. All queries — anonymous callers are fine. */
+/** Reads: what is stored and how it is served. All queries — anonymous callers are fine,
+ * except `listAssetsAsyncUnsafe`: the canister's controllers and the core seat only. */
 export class AssetsRustAssetsActor extends ActorBase {
     /**
      * @param assetId - The asset.
@@ -17,7 +18,8 @@ export class AssetsRustAssetsActor extends ActorBase {
     }
     /**
      * Every asset physically stored — the raw storage view, independent of any salon library:
-     * thumbnails, posters and orphans included.
+     * thumbnails, posters and orphans included. The canister's controllers and the core seat
+     * only; anybody else gets a CanisterError ("list_assets refused: controllers only").
      * @returns A Promise that resolves to every stored asset.
      * @throws CanisterError - The canister trapped.
      * @throws CallRefusedAtInspectionStage - The call was refused at the inspect stage.

package/dist/actors/uploads-actor.d.ts

@@ -2,7 +2,9 @@ import { ActorBase } from "../actor-base.js";
 import type { ChunkedUploadOptions, StartUploadInput, UploadAssetInput } from "../interfaces.js";
 /**
  * Generic uploads, not tied to a salon: a chunked session (start → chunks → finish) or a
- * single-shot upload. Any signed-in caller may upload; the session belongs to its starter.
+ * single-shot upload. Only an admin of the group may upload (the canister asks core's
+ * `isAdmin`; today the cockpit's APK), at most 64 MiB per session and three open sessions per
+ * uploader (ASSETS_RUST_LIMITS); the session belongs to its starter.
  * Salon-library uploads go through {@link AssetsRustSalonActor} instead.
  */
 export declare class AssetsRustUploadsActor extends ActorBase {
@@ -11,7 +13,8 @@ export declare class AssetsRustUploadsActor extends ActorBase {
      * after 30 minutes.
      * @param input - Name, content type and the number of chunks that will follow.
      * @returns A Promise that resolves to the new asset id (the session id).
-     * @throws CanisterError - The canister trapped: anonymous caller, totalChunks 0.
+     * @throws CanisterError - The canister trapped: anonymous caller, totalChunks 0, upload
+     *         too large, not an admin of the group (`upload refused`), too many open sessions.
      * @throws CallRefusedAtInspectionStage - The call was refused at the inspect stage.
      * @throws CriticalCanisterError - Transport failure or an unreachable canister.
      */
@@ -52,7 +55,8 @@ export declare class AssetsRustUploadsActor extends ActorBase {
      * Single-shot upload of a small file.
      * @param input - Name, content type and at most ASSETS_RUST_LIMITS.chunkSizeBytes of data.
      * @returns A Promise that resolves to the new asset id.
-     * @throws CanisterError - The canister trapped: anonymous caller, file too large.
+     * @throws CanisterError - The canister trapped: anonymous caller, file too large, not an
+     *         admin of the group (`upload refused`).
      * @throws CallRefusedAtInspectionStage - The call was refused at the inspect stage.
      * @throws CriticalCanisterError - Transport failure or an unreachable canister.
      */

package/dist/actors/uploads-actor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"uploads-actor.d.ts","sourceRoot":"","sources":["../../src/actors/uploads-actor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEjG;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,SAAS;IACjD;;;;;;;;OAQG;IACU,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;IAI7E;;;;;;;;;;OAUG;IACU,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpG;;;;;;;;OAQG;IACU,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAItE;;;;;;;;OAQG;IACU,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAItE;;;;;;;OAOG;IACU,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;IAI7E;;;;;;;;;;;OAWG;IACU,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,MAAM,CAAC;CAgBjJ"}
+{"version":3,"file":"uploads-actor.d.ts","sourceRoot":"","sources":["../../src/actors/uploads-actor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEjG;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,SAAS;IACjD;;;;;;;;;OASG;IACU,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;IAI7E;;;;;;;;;;OAUG;IACU,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpG;;;;;;;;OAQG;IACU,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAItE;;;;;;;;OAQG;IACU,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAItE;;;;;;;;OAQG;IACU,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;IAI7E;;;;;;;;;;;OAWG;IACU,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,MAAM,CAAC;CAgBjJ"}

package/dist/actors/uploads-actor.js

@@ -2,7 +2,9 @@ import { ActorBase } from "../actor-base.js";
 import { splitIntoChunks } from "../constants.js";
 /**
  * Generic uploads, not tied to a salon: a chunked session (start → chunks → finish) or a
- * single-shot upload. Any signed-in caller may upload; the session belongs to its starter.
+ * single-shot upload. Only an admin of the group may upload (the canister asks core's
+ * `isAdmin`; today the cockpit's APK), at most 64 MiB per session and three open sessions per
+ * uploader (ASSETS_RUST_LIMITS); the session belongs to its starter.
  * Salon-library uploads go through {@link AssetsRustSalonActor} instead.
  */
 export class AssetsRustUploadsActor extends ActorBase {
@@ -11,7 +13,8 @@ export class AssetsRustUploadsActor extends ActorBase {
      * after 30 minutes.
      * @param input - Name, content type and the number of chunks that will follow.
      * @returns A Promise that resolves to the new asset id (the session id).
-     * @throws CanisterError - The canister trapped: anonymous caller, totalChunks 0.
+     * @throws CanisterError - The canister trapped: anonymous caller, totalChunks 0, upload
+     *         too large, not an admin of the group (`upload refused`), too many open sessions.
      * @throws CallRefusedAtInspectionStage - The call was refused at the inspect stage.
      * @throws CriticalCanisterError - Transport failure or an unreachable canister.
      */
@@ -60,7 +63,8 @@ export class AssetsRustUploadsActor extends ActorBase {
      * Single-shot upload of a small file.
      * @param input - Name, content type and at most ASSETS_RUST_LIMITS.chunkSizeBytes of data.
      * @returns A Promise that resolves to the new asset id.
-     * @throws CanisterError - The canister trapped: anonymous caller, file too large.
+     * @throws CanisterError - The canister trapped: anonymous caller, file too large, not an
+     *         admin of the group (`upload refused`).
      * @throws CallRefusedAtInspectionStage - The call was refused at the inspect stage.
      * @throws CriticalCanisterError - Transport failure or an unreachable canister.
      */

package/dist/constants.d.ts

@@ -12,6 +12,10 @@ export declare const ASSETS_RUST_LIMITS: {
     readonly maxRangeBytes: 1800000;
     /** Width of the thumbnail `upload_image` generates (never upscaled). */
     readonly thumbnailWidth: 128;
+    /** Generic uploads (`start_upload`, `upload_asset`; admins of the group only): the most
+     *  bytes one session may announce, and the open sessions one uploader may hold. */
+    readonly maxGenericUploadBytes: number;
+    readonly maxOpenSessionsPerOwner: 3;
     /** An unfinished upload session is purged after this long (30 min). */
     readonly sessionTtlMs: number;
     /** The only audio content type `reserve_render` takes as the music track. */

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,eAAO,MAAM,YAAY,oBAAoB,CAAC;AAE9C;;;GAGG;AACH,eAAO,MAAM,kBAAkB;IAC3B;iFAC6E;;IAE7E,yDAAyD;;IAEzD,wEAAwE;;IAExE,uEAAuE;;IAEvE,6EAA6E;;IAE7E,6FAA6F;;;;;IAK7F;uDACmD;;;CAG7C,CAAC;AAEX;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED;oCACoC;AACpC,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,cAAc,GAAE,MAA0C,GAAG,UAAU,EAAE,CAY3H"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,eAAO,MAAM,YAAY,oBAAoB,CAAC;AAE9C;;;GAGG;AACH,eAAO,MAAM,kBAAkB;IAC3B;iFAC6E;;IAE7E,yDAAyD;;IAEzD,wEAAwE;;IAExE;uFACmF;;;IAGnF,uEAAuE;;IAEvE,6EAA6E;;IAE7E,6FAA6F;;;;;IAK7F;uDACmD;;;CAG7C,CAAC;AAEX;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED;oCACoC;AACpC,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,cAAc,GAAE,MAA0C,GAAG,UAAU,EAAE,CAY3H"}

package/dist/constants.js

@@ -12,6 +12,10 @@ export const ASSETS_RUST_LIMITS = {
     maxRangeBytes: 1_800_000,
     /** Width of the thumbnail `upload_image` generates (never upscaled). */
     thumbnailWidth: 128,
+    /** Generic uploads (`start_upload`, `upload_asset`; admins of the group only): the most
+     *  bytes one session may announce, and the open sessions one uploader may hold. */
+    maxGenericUploadBytes: 64 * 1024 * 1024,
+    maxOpenSessionsPerOwner: 3,
     /** An unfinished upload session is purged after this long (30 min). */
     sessionTtlMs: 30 * 60 * 1000,
     /** The only audio content type `reserve_render` takes as the music track. */

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@jsm-mit/sultana-assets-rust-package",
-    "version": "0.3.0",
+    "version": "0.4.0",
     "description": "Wrapper TypeScript package for the sultana-assets-rust canister: chunked and single-shot uploads, salon images and transcoding reservations, the worker upload path, reads and asset URLs.",
     "license": "ISC",
     "author": "",
@@ -25,9 +25,9 @@
         "publish-public": "bash scripts/publish-public.sh",
         "typecheck": "tsc --noEmit -p tsconfig.tests.json",
         "sync-declarations": "bash scripts/sync-declarations.sh",
-        "test-suite": "bash scripts/run-tests.sh tests/test-suite.ts --lease 3",
-        "test-smoke": "bash scripts/run-tests.sh tests/test-smoke.ts --lease 3",
-        "test-upgrade": "bash scripts/run-tests.sh tests/test-upgrade.ts --lease 6",
+        "test-suite": "bash scripts/run-tests-local.sh tests/test-suite.ts",
+        "test-smoke": "bash scripts/run-tests-local.sh tests/test-smoke.ts",
+        "test-upgrade": "bash scripts/run-tests-local.sh tests/test-upgrade.ts",
         "redeploy": "bash scripts/redeploy.sh",
         "sandbox": "npx tsx sandbox/main.ts",
         "stamp-canister": "bash scripts/stamp-canister-commit.sh"
@@ -55,6 +55,6 @@
     "sultanaAssets": {
         "repo": "sultana-assets-rust",
         "repoUrl": "https://github.com/JSM-Sultana/sultana-assets-rust",
-        "commit": "7a2c7e96a4253f0203d9694c9200189f61044c85"
+        "commit": "a5db6bd52dc751a7603c5c5fdc16fb73e0486882"
     }
 }