@jsm-mit/sultana-assets-rust-package 0.3.1 → 0.4.0

package/README.md

@@ -58,14 +58,15 @@ types are exported too, and `./declarations/*` gives the generated files.
 transcoding worker.
 
 Scripts: `build`, `typecheck`, `sync-declarations`, `test-suite`, `test-smoke`, `test-upgrade`,
-`test-suite-local`, `test-smoke-local`, `test-upgrade-local`, `redeploy`, `sandbox`
+`redeploy`, `sandbox`
 (an interactive console: `npm run sandbox -- <canister-id>`, caller from `IDENTITY_PEM` in
 `.env.sandbox` or anonymous), `stamp-canister`, `publish-public`. See `CLAUDE.md` for who runs what.
 
 ## Integration tests
 
-`npm run test-suite` reinstalls the current `../sultana-assets-rust` build into the crafting
-table's `short-living` slot (lease 3 minutes) and runs `tests/test-suite.ts` there. No
+All tests run on the LOCAL replica — no cycles, no shared slot. `npm run test-suite`
+reinstalls the current `../sultana-assets-rust` build into a local canister and runs
+`tests/test-suite.ts` there. No
 `.env`, no PEMs: every identity is generated per run. A fresh canister has no core canister,
 so the suite claims that claim-once seat for a generated identity and plays core itself.
 
@@ -74,8 +75,8 @@ read per domain (worker list, a few-byte single-shot upload read back over HTTP,
 result, a salon upload refused by the stand-in core), one replication wait, ≈ 30 s.
 `publish-public` runs it too.
 
-The `-local` variants (`npm run test-suite-local`, `test-smoke-local`, `test-upgrade-local`) run
-the same entry points on the LOCAL replica — no cycles, no lease. `scripts/local-canister.sh`
+`npm run test-upgrade` seeds the canister, upgrades it in the middle of the run and checks
+that the stored data reads back identical. `scripts/local-canister.sh`
 builds `../sultana-assets-rust` with cargo and reinstalls it into a canister of the dfx project
 in `local/` (its id stays under `local/.dfx`); the upgrade test upgrades that canister. The
 local replica must run (`dfx start --background`); the scripts never start or stop it.

package/dist/actor-base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actor-base.d.ts","sourceRoot":"","sources":["../src/actor-base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,SAAS,EAAE,KAAK,QAAQ,EAAS,MAAM,qBAAqB,CAAC;AAE1F,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gEAAgE,CAAC;AAG/F,sFAAsF;AACtF,MAAM,WAAW,SAAS;IACtB,yFAAyF;IACzF,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,QAAQ,EAAE,OAAO,CAAC;CACrB;AASD;;;;;;;;;GASG;AACH,qBAAa,SAAS;IAYN,SAAS,CAAC,UAAU,EAAE,MAAM;IAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,QAAQ;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM;IAX/F,SAAS,CAAC,KAAK,EAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1C,SAAS,CAAC,KAAK,EAAG,SAAS,CAAC;IAC5B,OAAO,CAAC,KAAK,CAAoC;IAEjD;;;;;;OAMG;gBACmB,UAAU,EAAE,MAAM,EAAY,QAAQ,CAAC,EAAE,QAAQ,YAAA,EAAY,IAAI,GAAE,MAAqB;IAI9G,OAAO,CAAC,iBAAiB;IAYzB;;;;OAIG;IACI,iBAAiB,IAAI,IAAI;IAIhC,iFAAiF;cACjE,0BAA0B,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAuBpF,SAAS,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO;IASpD,SAAS,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI;CAU1D"}
+{"version":3,"file":"actor-base.d.ts","sourceRoot":"","sources":["../src/actor-base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,SAAS,EAAE,KAAK,QAAQ,EAAS,MAAM,qBAAqB,CAAC;AAE1F,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gEAAgE,CAAC;AAG/F,sFAAsF;AACtF,MAAM,WAAW,SAAS;IACtB,yFAAyF;IACzF,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,QAAQ,EAAE,OAAO,CAAC;CACrB;AASD;;;;;;;;;GASG;AACH,qBAAa,SAAS;IAYN,SAAS,CAAC,UAAU,EAAE,MAAM;IAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,QAAQ;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM;IAX/F,SAAS,CAAC,KAAK,EAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1C,SAAS,CAAC,KAAK,EAAG,SAAS,CAAC;IAC5B,OAAO,CAAC,KAAK,CAAoC;IAEjD;;;;;;OAMG;gBACmB,UAAU,EAAE,MAAM,EAAY,QAAQ,CAAC,EAAE,QAAQ,YAAA,EAAY,IAAI,GAAE,MAAqB;IAI9G,OAAO,CAAC,iBAAiB;IAYzB;;;;OAIG;IACI,iBAAiB,IAAI,IAAI;IAIhC,iFAAiF;cACjE,0BAA0B,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAuBpF,SAAS,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO;IAcpD,SAAS,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI;CAU1D"}

package/dist/actor-base.js

@@ -73,12 +73,15 @@ export class ActorBase {
             throw new Error("CriticalCanisterError", { cause: { logs: null, rawError: err } });
         }
     }
-    // True if `error` is an IC reject caused by an inspect-stage refusal. sultana-assets-rust
-    // has no inspect_message today; kept so the error vocabulary stays the same as in the
-    // other wrapper packages. When the canister gets one, check the text it produces.
+    // True if `error` is an IC reject caused by an inspect-stage refusal. The canister's
+    // inspect_message (since 2026-10-25) refuses by not accepting, which the replica reports as
+    // "Canister rejected the message" (IC0406); older replicas said "... refused message".
     isInspectionRejection(error) {
         const rejectText = error?.cause?.code?.rejectMessage || error?.message || "";
-        return rejectText.includes("canister_inspect_message explicitly refused message");
+        return (rejectText.includes("Canister rejected the message") ||
+            rejectText.includes("IC0406") ||
+            rejectText.includes("canister_inspect_message explicitly refused message") ||
+            rejectText.includes("canister_inspect_message implicitly refused message"));
     }
     // The trap text when `error` is a trap of the canister, otherwise null. The replica
     // reports it as "... Canister called `ic0.trap` with message: '<text>'.\nConsider ...";

package/dist/actors/uploads-actor.d.ts

@@ -2,7 +2,9 @@ import { ActorBase } from "../actor-base.js";
 import type { ChunkedUploadOptions, StartUploadInput, UploadAssetInput } from "../interfaces.js";
 /**
  * Generic uploads, not tied to a salon: a chunked session (start → chunks → finish) or a
- * single-shot upload. Any signed-in caller may upload; the session belongs to its starter.
+ * single-shot upload. Only an admin of the group may upload (the canister asks core's
+ * `isAdmin`; today the cockpit's APK), at most 64 MiB per session and three open sessions per
+ * uploader (ASSETS_RUST_LIMITS); the session belongs to its starter.
  * Salon-library uploads go through {@link AssetsRustSalonActor} instead.
  */
 export declare class AssetsRustUploadsActor extends ActorBase {
@@ -11,7 +13,8 @@ export declare class AssetsRustUploadsActor extends ActorBase {
      * after 30 minutes.
      * @param input - Name, content type and the number of chunks that will follow.
      * @returns A Promise that resolves to the new asset id (the session id).
-     * @throws CanisterError - The canister trapped: anonymous caller, totalChunks 0.
+     * @throws CanisterError - The canister trapped: anonymous caller, totalChunks 0, upload
+     *         too large, not an admin of the group (`upload refused`), too many open sessions.
      * @throws CallRefusedAtInspectionStage - The call was refused at the inspect stage.
      * @throws CriticalCanisterError - Transport failure or an unreachable canister.
      */
@@ -52,7 +55,8 @@ export declare class AssetsRustUploadsActor extends ActorBase {
      * Single-shot upload of a small file.
      * @param input - Name, content type and at most ASSETS_RUST_LIMITS.chunkSizeBytes of data.
      * @returns A Promise that resolves to the new asset id.
-     * @throws CanisterError - The canister trapped: anonymous caller, file too large.
+     * @throws CanisterError - The canister trapped: anonymous caller, file too large, not an
+     *         admin of the group (`upload refused`).
      * @throws CallRefusedAtInspectionStage - The call was refused at the inspect stage.
      * @throws CriticalCanisterError - Transport failure or an unreachable canister.
      */

package/dist/actors/uploads-actor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"uploads-actor.d.ts","sourceRoot":"","sources":["../../src/actors/uploads-actor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEjG;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,SAAS;IACjD;;;;;;;;OAQG;IACU,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;IAI7E;;;;;;;;;;OAUG;IACU,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpG;;;;;;;;OAQG;IACU,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAItE;;;;;;;;OAQG;IACU,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAItE;;;;;;;OAOG;IACU,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;IAI7E;;;;;;;;;;;OAWG;IACU,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,MAAM,CAAC;CAgBjJ"}
+{"version":3,"file":"uploads-actor.d.ts","sourceRoot":"","sources":["../../src/actors/uploads-actor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEjG;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,SAAS;IACjD;;;;;;;;;OASG;IACU,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;IAI7E;;;;;;;;;;OAUG;IACU,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpG;;;;;;;;OAQG;IACU,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAItE;;;;;;;;OAQG;IACU,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAItE;;;;;;;;OAQG;IACU,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;IAI7E;;;;;;;;;;;OAWG;IACU,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,MAAM,CAAC;CAgBjJ"}

package/dist/actors/uploads-actor.js

@@ -2,7 +2,9 @@ import { ActorBase } from "../actor-base.js";
 import { splitIntoChunks } from "../constants.js";
 /**
  * Generic uploads, not tied to a salon: a chunked session (start → chunks → finish) or a
- * single-shot upload. Any signed-in caller may upload; the session belongs to its starter.
+ * single-shot upload. Only an admin of the group may upload (the canister asks core's
+ * `isAdmin`; today the cockpit's APK), at most 64 MiB per session and three open sessions per
+ * uploader (ASSETS_RUST_LIMITS); the session belongs to its starter.
  * Salon-library uploads go through {@link AssetsRustSalonActor} instead.
  */
 export class AssetsRustUploadsActor extends ActorBase {
@@ -11,7 +13,8 @@ export class AssetsRustUploadsActor extends ActorBase {
      * after 30 minutes.
      * @param input - Name, content type and the number of chunks that will follow.
      * @returns A Promise that resolves to the new asset id (the session id).
-     * @throws CanisterError - The canister trapped: anonymous caller, totalChunks 0.
+     * @throws CanisterError - The canister trapped: anonymous caller, totalChunks 0, upload
+     *         too large, not an admin of the group (`upload refused`), too many open sessions.
      * @throws CallRefusedAtInspectionStage - The call was refused at the inspect stage.
      * @throws CriticalCanisterError - Transport failure or an unreachable canister.
      */
@@ -60,7 +63,8 @@ export class AssetsRustUploadsActor extends ActorBase {
      * Single-shot upload of a small file.
      * @param input - Name, content type and at most ASSETS_RUST_LIMITS.chunkSizeBytes of data.
      * @returns A Promise that resolves to the new asset id.
-     * @throws CanisterError - The canister trapped: anonymous caller, file too large.
+     * @throws CanisterError - The canister trapped: anonymous caller, file too large, not an
+     *         admin of the group (`upload refused`).
      * @throws CallRefusedAtInspectionStage - The call was refused at the inspect stage.
      * @throws CriticalCanisterError - Transport failure or an unreachable canister.
      */

package/dist/constants.d.ts

@@ -12,6 +12,10 @@ export declare const ASSETS_RUST_LIMITS: {
     readonly maxRangeBytes: 1800000;
     /** Width of the thumbnail `upload_image` generates (never upscaled). */
     readonly thumbnailWidth: 128;
+    /** Generic uploads (`start_upload`, `upload_asset`; admins of the group only): the most
+     *  bytes one session may announce, and the open sessions one uploader may hold. */
+    readonly maxGenericUploadBytes: number;
+    readonly maxOpenSessionsPerOwner: 3;
     /** An unfinished upload session is purged after this long (30 min). */
     readonly sessionTtlMs: number;
     /** The only audio content type `reserve_render` takes as the music track. */

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,eAAO,MAAM,YAAY,oBAAoB,CAAC;AAE9C;;;GAGG;AACH,eAAO,MAAM,kBAAkB;IAC3B;iFAC6E;;IAE7E,yDAAyD;;IAEzD,wEAAwE;;IAExE,uEAAuE;;IAEvE,6EAA6E;;IAE7E,6FAA6F;;;;;IAK7F;uDACmD;;;CAG7C,CAAC;AAEX;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED;oCACoC;AACpC,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,cAAc,GAAE,MAA0C,GAAG,UAAU,EAAE,CAY3H"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,eAAO,MAAM,YAAY,oBAAoB,CAAC;AAE9C;;;GAGG;AACH,eAAO,MAAM,kBAAkB;IAC3B;iFAC6E;;IAE7E,yDAAyD;;IAEzD,wEAAwE;;IAExE;uFACmF;;;IAGnF,uEAAuE;;IAEvE,6EAA6E;;IAE7E,6FAA6F;;;;;IAK7F;uDACmD;;;CAG7C,CAAC;AAEX;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED;oCACoC;AACpC,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,cAAc,GAAE,MAA0C,GAAG,UAAU,EAAE,CAY3H"}

package/dist/constants.js

@@ -12,6 +12,10 @@ export const ASSETS_RUST_LIMITS = {
     maxRangeBytes: 1_800_000,
     /** Width of the thumbnail `upload_image` generates (never upscaled). */
     thumbnailWidth: 128,
+    /** Generic uploads (`start_upload`, `upload_asset`; admins of the group only): the most
+     *  bytes one session may announce, and the open sessions one uploader may hold. */
+    maxGenericUploadBytes: 64 * 1024 * 1024,
+    maxOpenSessionsPerOwner: 3,
     /** An unfinished upload session is purged after this long (30 min). */
     sessionTtlMs: 30 * 60 * 1000,
     /** The only audio content type `reserve_render` takes as the music track. */

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@jsm-mit/sultana-assets-rust-package",
-    "version": "0.3.1",
+    "version": "0.4.0",
     "description": "Wrapper TypeScript package for the sultana-assets-rust canister: chunked and single-shot uploads, salon images and transcoding reservations, the worker upload path, reads and asset URLs.",
     "license": "ISC",
     "author": "",
@@ -25,12 +25,9 @@
         "publish-public": "bash scripts/publish-public.sh",
         "typecheck": "tsc --noEmit -p tsconfig.tests.json",
         "sync-declarations": "bash scripts/sync-declarations.sh",
-        "test-suite": "bash scripts/run-tests.sh tests/test-suite.ts --lease 3",
-        "test-smoke": "bash scripts/run-tests.sh tests/test-smoke.ts --lease 3",
-        "test-upgrade": "bash scripts/run-tests.sh tests/test-upgrade.ts --lease 6",
-        "test-suite-local": "bash scripts/run-tests-local.sh tests/test-suite.ts",
-        "test-smoke-local": "bash scripts/run-tests-local.sh tests/test-smoke.ts",
-        "test-upgrade-local": "bash scripts/run-tests-local.sh tests/test-upgrade.ts",
+        "test-suite": "bash scripts/run-tests-local.sh tests/test-suite.ts",
+        "test-smoke": "bash scripts/run-tests-local.sh tests/test-smoke.ts",
+        "test-upgrade": "bash scripts/run-tests-local.sh tests/test-upgrade.ts",
         "redeploy": "bash scripts/redeploy.sh",
         "sandbox": "npx tsx sandbox/main.ts",
         "stamp-canister": "bash scripts/stamp-canister-commit.sh"
@@ -58,6 +55,6 @@
     "sultanaAssets": {
         "repo": "sultana-assets-rust",
         "repoUrl": "https://github.com/JSM-Sultana/sultana-assets-rust",
-        "commit": "d63f0d1ebcfa98c953ae7f68b5331e81966cec8b"
+        "commit": "a5db6bd52dc751a7603c5c5fdc16fb73e0486882"
     }
 }