@nodetool-ai/websocket 0.7.0-rc.23 → 0.8.1

package/dist/resolve-media-urls.js

@@ -2,16 +2,35 @@
  * Resolve asset IDs in message content to browser-accessible URLs.
  *
  * Media refs store an `asset_id` in the database. Before sending to a
- * client, this module resolves each to a full URL via `buildAssetUrl`.
+ * client, this module resolves each to a URL the browser can load directly
+ * from an `<img>` / `<video>` / `<audio>` element — which is why it goes
+ * through the storage backend's own URL builder, exactly like
+ * `assets.get_url` does. A media element sends no `Authorization` header, so
+ * on a deployment with auth enforced and asset bytes in S3/Supabase the old
+ * `/api/storage/<key>` path answered 401 (and pointed at a local file backend
+ * that did not hold the bytes anyway); the signed URL those backends mint is
+ * loadable as-is.
  *
  * For LLM providers use `resolveContentForProvider` instead, which maps
  * asset_id directly to a file:// URI so no HTTP round-trip is needed.
+ *
+ * Pass the owning `userId` wherever it's known: asset bytes are written
+ * owner-prefixed (`<userId>/<assetId>.<ext>`), and a key built without the
+ * prefix resolves to a path that no longer exists.
  */
-import { buildAssetUrl, getAssetFilePath } from "@nodetool-ai/config";
+import { buildAssetUrl, getAssetFilePath, loadAssetStorageConfig } from "@nodetool-ai/config";
+import { assetObjectKey, createAssetUrlBuilder } from "@nodetool-ai/storage";
+import { existsSync } from "node:fs";
 import { pathToFileURL } from "node:url";
+import { isObjectLike, isString } from "./lib/wire-values.js";
 const MIME_TO_EXT = {
     "image/png": "png",
     "image/jpeg": "jpg",
+    // `image/jpg` and `image/bmp` are accepted by the storage-side extension map
+    // (IMAGE_MIME_TO_EXT); without them here, resolution fell through to `.bin`
+    // and produced a dangling asset URL for a file written as `.jpg` / `.bmp`.
+    "image/jpg": "jpg",
+    "image/bmp": "bmp",
     "image/gif": "gif",
     "image/webp": "webp",
     "image/svg+xml": "svg",
@@ -28,17 +47,65 @@ function extFromMime(mime) {
         return "bin";
     return MIME_TO_EXT[mime] ?? "bin";
 }
-function resolveAssetId(assetId, mimeType) {
-    return buildAssetUrl(`${assetId}.${extFromMime(mimeType)}`);
+// asset_id comes from client-supplied message content and is interpolated into
+// a filesystem path. A value with path separators or `..` segments would let
+// the resolved file:// URI escape the assets dir and expose arbitrary local
+// files to the LLM. Restrict to a plain id token.
+function isSafeAssetId(assetId) {
+    return (assetId.length > 0 &&
+        !assetId.includes("/") &&
+        !assetId.includes("\\") &&
+        !assetId.includes("..") &&
+        !assetId.includes("\0"));
+}
+/**
+ * Bytes are written owner-prefixed (`<userId>/<assetId>.<ext>`) by
+ * `storeAssetWithThumbnail`, and `/api/storage` only falls back
+ * prefixed → flat, never the other way round — so a flat URL 404s for every
+ * asset written under the current layout. Build the prefixed key whenever the
+ * owner is known; without one, the flat legacy key is all there is.
+ */
+function assetKeyFor(assetId, mimeType, userId) {
+    const fileName = `${assetId}.${extFromMime(mimeType)}`;
+    return userId ? assetObjectKey(userId, fileName) : fileName;
+}
+/**
+ * The configured backend's URL builder, rebuilt when the backend kind changes
+ * (tests switch backends in-process). The `file` backend is served by this
+ * server's own `/api/storage` route, so it keeps going through
+ * `buildAssetUrl`, which percent-encodes each key segment; the cloud backends
+ * mint a signed URL to their own origin.
+ */
+let cachedBuilderKind = null;
+let cachedBuilder = null;
+async function assetUrlForKey(key) {
+    const config = loadAssetStorageConfig();
+    if (config.kind === "file") {
+        return buildAssetUrl(key);
+    }
+    if (!cachedBuilder || cachedBuilderKind !== config.kind) {
+        cachedBuilderKind = config.kind;
+        cachedBuilder = createAssetUrlBuilder(config);
+    }
+    try {
+        return await cachedBuilder(key);
+    }
+    catch {
+        // Signing failed (network, expired credentials). The server-side route is
+        // no worse than emitting nothing, and it still works for a caller that can
+        // authenticate.
+        return buildAssetUrl(key);
+    }
 }
 /**
  * Resolve a media ref object: if it has an asset_id, derive uri from it.
  */
-function resolveRef(ref, fallbackMime) {
+async function resolveRef(ref, fallbackMime, userId) {
     const resolved = { ...ref };
     const mime = (resolved.mimeType ?? resolved.mime_type ?? resolved.content_type ?? fallbackMime);
-    if (typeof resolved.asset_id === "string" && resolved.asset_id) {
-        resolved.uri = resolveAssetId(resolved.asset_id, mime);
+    if (isString(resolved.asset_id) &&
+        isSafeAssetId(resolved.asset_id)) {
+        resolved.uri = await assetUrlForKey(assetKeyFor(resolved.asset_id, mime, userId));
     }
     return resolved;
 }
@@ -47,12 +114,21 @@ function resolveRef(ref, fallbackMime) {
  * Maps asset_id directly to a file:// URI so providers read from disk,
  * not via an HTTP round-trip to the local server.
  */
-function resolveRefForProvider(ref, fallbackMime) {
+function resolveRefForProvider(ref, fallbackMime, userId) {
     const resolved = { ...ref };
     const mime = (resolved.mimeType ?? resolved.mime_type ?? resolved.content_type ?? fallbackMime);
-    if (typeof resolved.asset_id === "string" && resolved.asset_id && !resolved.uri) {
-        const ext = extFromMime(mime);
-        const filePath = getAssetFilePath(`${resolved.asset_id}.${ext}`);
+    if (isString(resolved.asset_id) &&
+        isSafeAssetId(resolved.asset_id) &&
+        !resolved.uri) {
+        const flat = `${resolved.asset_id}.${extFromMime(mime)}`;
+        // Prefer the owner-prefixed path the bytes are actually written to, but
+        // fall back to the flat legacy path for objects predating that layout.
+        let filePath = getAssetFilePath(assetKeyFor(resolved.asset_id, mime, userId));
+        if (userId && !existsSync(filePath)) {
+            const legacy = getAssetFilePath(flat);
+            if (existsSync(legacy))
+                filePath = legacy;
+        }
         resolved.uri = pathToFileURL(filePath).href;
     }
     return resolved;
@@ -61,49 +137,59 @@ function resolveRefForProvider(ref, fallbackMime) {
  * Walk a message content array and resolve asset_id refs to file:// URIs
  * suitable for LLM provider calls (reads directly from disk).
  */
-export function resolveContentForProvider(content) {
+export function resolveContentForProvider(content, userId) {
     if (!Array.isArray(content))
         return content;
     return content.map((block) => {
-        if (!block || typeof block !== "object")
+        if (!isObjectLike(block))
             return block;
         const b = block;
         if ((b.type === "image_url" || b.type === "image") &&
-            b.image &&
-            typeof b.image === "object") {
-            return { ...b, image: resolveRefForProvider(b.image, "image/png") };
+            isObjectLike(b.image)) {
+            return { ...b, image: resolveRefForProvider(b.image, "image/png", userId) };
         }
-        if (b.type === "video" && b.video && typeof b.video === "object") {
-            return { ...b, video: resolveRefForProvider(b.video, "video/mp4") };
+        if (b.type === "video" && isObjectLike(b.video)) {
+            return { ...b, video: resolveRefForProvider(b.video, "video/mp4", userId) };
         }
-        if (b.type === "audio" && b.audio && typeof b.audio === "object") {
-            return { ...b, audio: resolveRefForProvider(b.audio, "audio/wav") };
+        if (b.type === "audio" && isObjectLike(b.audio)) {
+            return { ...b, audio: resolveRefForProvider(b.audio, "audio/wav", userId) };
         }
         return block;
     });
 }
 /**
  * Walk a message content array and resolve asset_id refs to URLs.
+ *
+ * Async because a cloud storage backend signs each URL; the `file` backend
+ * resolves without I/O.
  */
-export function resolveContentUrls(content) {
+export async function resolveContentUrls(content, userId) {
     if (!Array.isArray(content))
         return content;
-    return content.map((block) => {
-        if (!block || typeof block !== "object")
+    return Promise.all(content.map(async (block) => {
+        if (!isObjectLike(block))
             return block;
         const b = block;
         if ((b.type === "image_url" || b.type === "image") &&
-            b.image &&
-            typeof b.image === "object") {
-            return { ...b, image: resolveRef(b.image, "image/png") };
+            isObjectLike(b.image)) {
+            return {
+                ...b,
+                image: await resolveRef(b.image, "image/png", userId)
+            };
         }
-        if (b.type === "video" && b.video && typeof b.video === "object") {
-            return { ...b, video: resolveRef(b.video, "video/mp4") };
+        if (b.type === "video" && isObjectLike(b.video)) {
+            return {
+                ...b,
+                video: await resolveRef(b.video, "video/mp4", userId)
+            };
         }
-        if (b.type === "audio" && b.audio && typeof b.audio === "object") {
-            return { ...b, audio: resolveRef(b.audio, "audio/wav") };
+        if (b.type === "audio" && isObjectLike(b.audio)) {
+            return {
+                ...b,
+                audio: await resolveRef(b.audio, "audio/wav", userId)
+            };
         }
         return block;
-    });
+    }));
 }
 //# sourceMappingURL=resolve-media-urls.js.map

package/dist/resolve-media-urls.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-media-urls.js","sourceRoot":"","sources":["../src/resolve-media-urls.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,WAAW,GAA2B;IAC1C,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,KAAK;IACnB,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,MAAM;IACpB,eAAe,EAAE,KAAK;IACtB,YAAY,EAAE,KAAK;IACnB,WAAW,EAAE,KAAK;IAClB,WAAW,EAAE,KAAK;IAClB,WAAW,EAAE,KAAK;IAClB,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,MAAM;IACpB,iBAAiB,EAAE,KAAK;CACzB,CAAC;AAEF,SAAS,WAAW,CAAC,IAA+B;IAClD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC;AACpC,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,QAAwB;IAC/D,OAAO,aAAa,CAAC,GAAG,OAAO,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CACjB,GAA4B,EAC5B,YAAqB;IAErB,MAAM,QAAQ,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,YAAY,IAAI,YAAY,CAAuB,CAAC;IAEtH,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC/D,QAAQ,CAAC,GAAG,GAAG,cAAc,CAAC,QAAQ,CAAC,QAAkB,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,GAA4B,EAC5B,YAAqB;IAErB,MAAM,QAAQ,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,YAAY,IAAI,YAAY,CAAuB,CAAC;IAEtH,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QAChF,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,QAAQ,CAAC,QAAkB,IAAI,GAAG,EAAE,CAAC,CAAC;QAC3E,QAAQ,CAAC,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAA4D;IAE5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAE5C,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACtD,MAAM,CAAC,GAAG,KAAgC,CAAC;QAE3C,IACE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC;YAC9C,CAAC,CAAC,KAAK;YACP,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAC3B,CAAC;YACD,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC,CAAC,KAAgC,EAAE,WAAW,CAAC,EAAE,CAAC;QACjG,CAAC;QAED,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACjE,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC,CAAC,KAAgC,EAAE,WAAW,CAAC,EAAE,CAAC;QACjG,CAAC;QAED,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACjE,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC,CAAC,KAAgC,EAAE,WAAW,CAAC,EAAE,CAAC;QACjG,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAA4D;IAE5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAE5C,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACtD,MAAM,CAAC,GAAG,KAAgC,CAAC;QAE3C,IACE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC;YAC9C,CAAC,CAAC,KAAK;YACP,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAC3B,CAAC;YACD,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAgC,EAAE,WAAW,CAAC,EAAE,CAAC;QACtF,CAAC;QAED,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACjE,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAgC,EAAE,WAAW,CAAC,EAAE,CAAC;QACtF,CAAC;QAED,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACjE,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAgC,EAAE,WAAW,CAAC,EAAE,CAAC;QACtF,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"resolve-media-urls.js","sourceRoot":"","sources":["../src/resolve-media-urls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,YAAY,EACZ,QAAQ,EACT,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,GAA2B;IAC1C,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,KAAK;IACnB,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,WAAW,EAAE,KAAK;IAClB,WAAW,EAAE,KAAK;IAClB,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,MAAM;IACpB,eAAe,EAAE,KAAK;IACtB,YAAY,EAAE,KAAK;IACnB,WAAW,EAAE,KAAK;IAClB,WAAW,EAAE,KAAK;IAClB,WAAW,EAAE,KAAK;IAClB,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,MAAM;IACpB,iBAAiB,EAAE,KAAK;CACzB,CAAC;AAEF,SAAS,WAAW,CAAC,IAA+B;IAClD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC;AACpC,CAAC;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,kDAAkD;AAClD,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,CACL,OAAO,CAAC,MAAM,GAAG,CAAC;QAClB,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACtB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACvB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACvB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CACxB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAClB,OAAe,EACf,QAAmC,EACnC,MAAe;IAEf,MAAM,QAAQ,GAAG,GAAG,OAAO,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvD,OAAO,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,IAAI,iBAAiB,GAAkB,IAAI,CAAC;AAC5C,IAAI,aAAa,GAA8C,IAAI,CAAC;AAEpE,KAAK,UAAU,cAAc,CAAC,GAAW;IACvC,MAAM,MAAM,GAAG,sBAAsB,EAAE,CAAC;IACxC,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,aAAa,IAAI,iBAAiB,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;QACxD,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC;QAChC,aAAa,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,2EAA2E;QAC3E,gBAAgB;QAChB,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,UAAU,CACvB,GAA4B,EAC5B,YAAqB,EACrB,MAAe;IAEf,MAAM,QAAQ,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,YAAY,IAAI,YAAY,CAAuB,CAAC;IAEtH,IACE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3B,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAChC,CAAC;QACD,QAAQ,CAAC,GAAG,GAAG,MAAM,cAAc,CACjC,WAAW,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAC7C,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,GAA4B,EAC5B,YAAqB,EACrB,MAAe;IAEf,MAAM,QAAQ,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,YAAY,IAAI,YAAY,CAAuB,CAAC;IAEtH,IACE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3B,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAChC,CAAC,QAAQ,CAAC,GAAG,EACb,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,QAAQ,CAAC,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,wEAAwE;QACxE,uEAAuE;QACvE,IAAI,QAAQ,GAAG,gBAAgB,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9E,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,UAAU,CAAC,MAAM,CAAC;gBAAE,QAAQ,GAAG,MAAM,CAAC;QAC5C,CAAC;QACD,QAAQ,CAAC,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAA4D,EAC5D,MAAe;IAEf,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAE5C,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,CAAC,GAAG,KAAgC,CAAC;QAE3C,IACE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC;YAC9C,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,EACrB,CAAC;YACD,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC,CAAC,KAAgC,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC;QACzG,CAAC;QAED,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC,CAAC,KAAgC,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC;QACzG,CAAC;QAED,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC,CAAC,KAAgC,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC;QACzG,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA4D,EAC5D,MAAe;IAEf,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAE5C,OAAO,OAAO,CAAC,GAAG,CAChB,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC1B,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,CAAC,GAAG,KAAgC,CAAC;QAE3C,IACE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC;YAC9C,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,EACrB,CAAC;YACD,OAAO;gBACL,GAAG,CAAC;gBACJ,KAAK,EAAE,MAAM,UAAU,CACrB,CAAC,CAAC,KAAgC,EAClC,WAAW,EACX,MAAM,CACP;aACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,OAAO;gBACL,GAAG,CAAC;gBACJ,KAAK,EAAE,MAAM,UAAU,CACrB,CAAC,CAAC,KAAgC,EAClC,WAAW,EACX,MAAM,CACP;aACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,OAAO;gBACL,GAAG,CAAC;gBACJ,KAAK,EAAE,MAAM,UAAU,CACrB,CAAC,CAAC,KAAgC,EAClC,WAAW,EACX,MAAM,CACP;aACF,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/resource-events.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Process-wide resource change emitter for non-DBModel resources
+ * (collections, model installs, etc.) that need to broadcast cache
+ * invalidations to connected clients.
+ *
+ * DBModel mutations already broadcast via `ModelObserver` from
+ * `@nodetool-ai/models`. Use this emitter for resources that don't go
+ * through a DBModel.
+ */
+import { EventEmitter } from "node:events";
+export type ResourceChangeEvent = "created" | "updated" | "deleted";
+export interface ResourceChangePayload {
+    event: ResourceChangeEvent;
+    resource_type: string;
+    resource: Record<string, unknown> & {
+        id: string;
+        etag?: string;
+    };
+    /** When set, only sessions for this user receive the event. */
+    userId?: string | null;
+}
+declare class ResourceEventEmitter extends EventEmitter {
+    emitChange(payload: ResourceChangePayload): void;
+}
+export declare const resourceEvents: ResourceEventEmitter;
+export declare function notifyResourceChange(payload: ResourceChangePayload): void;
+export {};
+//# sourceMappingURL=resource-events.d.ts.map

package/dist/resource-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-events.d.ts","sourceRoot":"","sources":["../src/resource-events.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAEpE,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,mBAAmB,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,cAAM,oBAAqB,SAAQ,YAAY;IAC7C,UAAU,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAE/C;CACF;AAED,eAAO,MAAM,cAAc,sBAA6B,CAAC;AAEzD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAEzE"}

package/dist/resource-events.js

@@ -0,0 +1,20 @@
+/**
+ * Process-wide resource change emitter for non-DBModel resources
+ * (collections, model installs, etc.) that need to broadcast cache
+ * invalidations to connected clients.
+ *
+ * DBModel mutations already broadcast via `ModelObserver` from
+ * `@nodetool-ai/models`. Use this emitter for resources that don't go
+ * through a DBModel.
+ */
+import { EventEmitter } from "node:events";
+class ResourceEventEmitter extends EventEmitter {
+    emitChange(payload) {
+        this.emit("change", payload);
+    }
+}
+export const resourceEvents = new ResourceEventEmitter();
+export function notifyResourceChange(payload) {
+    resourceEvents.emitChange(payload);
+}
+//# sourceMappingURL=resource-events.js.map

package/dist/resource-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-events.js","sourceRoot":"","sources":["../src/resource-events.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAY3C,MAAM,oBAAqB,SAAQ,YAAY;IAC7C,UAAU,CAAC,OAA8B;QACvC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAEzD,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IACjE,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC"}

package/dist/routes/account.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Data-subject-rights endpoints — the HTTP door onto `@nodetool-ai/models`'
+ * `exportPersonalData` / `erasePersonalData`.
+ *
+ *   GET    /api/account/export   → Art. 20 portability
+ *   DELETE /api/account          → Art. 17 erasure
+ *
+ * The published privacy policy promises both in-product; this is what it
+ * points at. Neither route decides policy: `PERSONAL_DATA_REGISTRY` says what
+ * happens to each table and the library walks it.
+ *
+ * ## The subject is always the caller
+ *
+ * There is no admin path here and no way to name a subject. Both handlers get
+ * their user id from `getUserId`, reading the request that `bridge` built —
+ * and `bridge` deletes any client-supplied identity header before setting it
+ * from `req.userId`, the id the server's own auth hook decided. No id is read
+ * from the path, the query or the body: the erase body's schema declares
+ * `confirm` and nothing else, and the routes carry no `:id` segment for one to
+ * hide in. A caller wanting somebody else's data would have to change this
+ * file, not the request. `req.userId == null` is refused with 401 rather than
+ * falling back to `getUserId`'s default of user "1".
+ *
+ * ## The erasure contract
+ *
+ * `DELETE /api/account` is irreversible, so it is deliberate by construction:
+ *
+ * - The body must be `{"confirm": "DELETE MY ACCOUNT"}` — the exact string,
+ *   case-sensitive. A bare `DELETE` with no body, an empty object, a typo, or
+ *   any other value is `400` and nothing is touched. A stray or replayed
+ *   `DELETE` therefore cannot erase anything.
+ * - It is idempotent. The library re-runs the same sweep; a second call finds
+ *   nothing left and reports zeros. Both calls answer `200`.
+ * - It returns the per-table report — deleted/redacted/retained counts keyed
+ *   by table — plus the `requestId` that ties the two audit rows together.
+ * - Audit: this route writes `data_erasure_requested` *before* the sweep, so
+ *   the request is on record even if the sweep then throws.
+ *   `erasePersonalData` writes `data_erasure_completed` itself once it is
+ *   given a `requestId`; this route does not write that event a second time.
+ *   Both types are in `NEVER_PRUNED_USER_EVENT_TYPES`, so the sweep it runs
+ *   leaves them behind as the evidence the request was answered.
+ *
+ * ## Bytes, not just rows
+ *
+ * `erasePersonalData` takes an {@link ErasureObjectStore} and reports
+ * `objectKeysDeleted: null` without one — deleting the asset row and leaving
+ * the object readable to anyone holding a URL. `assetErasureStore` below wires
+ * the real `StorageAdapter`, so the report names the keys it removed.
+ *
+ * Two things that adapter does on purpose. It filters the listing to keys
+ * under `<userId>/` rather than trusting the prefix scoping: `list()`
+ * normalizes `"u1/"` to `"u1"`, and on the S3 and Supabase backends — which
+ * match a prefix as a string, not as a directory — that would also match
+ * `u10/…`. And it only ever deletes what that filter passes, so the blast
+ * radius is one user's prefix whatever the backend does with the argument.
+ * Objects stored before the owner prefix existed sit at a flat
+ * `<assetId>.<ext>` and are not reachable by any per-user prefix; they are not
+ * swept here.
+ *
+ * ## Why the body is validated with Zod rather than a Fastify `schema`
+ *
+ * These are bridged routes. The server installs an app-wide
+ * `addContentTypeParser("*", { parseAs: "buffer" })`, so `req.body` reaches a
+ * route as raw bytes and a JSON-schema `schema.body` would reject every
+ * request as "not an object". Validation therefore happens where the bytes
+ * are — one `safeParse` at the boundary, before anything reads a field —
+ * which is the pattern the other bridged routes in this package use and what
+ * `packages/AGENTS.md` means by "Zod is the canonical validator".
+ */
+import type { FastifyPluginAsync } from "fastify";
+import { type ErasureObjectStore } from "@nodetool-ai/models";
+import type { StorageAdapter } from "@nodetool-ai/storage";
+import { z } from "zod";
+import { type HttpApiOptions } from "../http-api.js";
+interface RouteOptions {
+    apiOptions: HttpApiOptions;
+    /** Object store swept on erasure. Defaults to the asset adapter. */
+    storage?: StorageAdapter;
+}
+/** The exact phrase `DELETE /api/account` requires in its body. */
+export declare const ERASURE_CONFIRMATION = "DELETE MY ACCOUNT";
+/**
+ * The one field the erase body may carry.
+ *
+ * `z.literal` rather than a free string so the gate is the phrase itself, and
+ * `strict()` so an unexpected field — `user_id`, `userId`, `subject` — is a
+ * `400` rather than something a later reader might mistake for an instruction.
+ */
+export declare const erasureRequest: z.ZodObject<{
+    confirm: z.ZodLiteral<"DELETE MY ACCOUNT">;
+}, z.core.$strict>;
+/**
+ * A {@link ErasureObjectStore} over a `StorageAdapter` — the adapter shape the
+ * doc comment on `ErasureObjectStore` sketches, with the prefix guard the
+ * string-prefix backends need.
+ */
+export declare function assetErasureStore(adapter: StorageAdapter): ErasureObjectStore;
+declare const accountRoutes: FastifyPluginAsync<RouteOptions>;
+export default accountRoutes;
+//# sourceMappingURL=account.d.ts.map

package/dist/routes/account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../src/routes/account.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAElD,OAAO,EAKL,KAAK,kBAAkB,EACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAa,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGhE,UAAU,YAAY;IACpB,UAAU,EAAE,cAAc,CAAC;IAC3B,oEAAoE;IACpE,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED,mEAAmE;AACnE,eAAO,MAAM,oBAAoB,sBAAsB,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,cAAc;;kBAEhB,CAAC;AAoBZ;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,cAAc,GACtB,kBAAkB,CAapB;AAQD,QAAA,MAAM,aAAa,EAAE,kBAAkB,CAAC,YAAY,CAoFnD,CAAC;eAEa,aAAa"}

package/dist/routes/account.js

@@ -0,0 +1,197 @@
+/**
+ * Data-subject-rights endpoints — the HTTP door onto `@nodetool-ai/models`'
+ * `exportPersonalData` / `erasePersonalData`.
+ *
+ *   GET    /api/account/export   → Art. 20 portability
+ *   DELETE /api/account          → Art. 17 erasure
+ *
+ * The published privacy policy promises both in-product; this is what it
+ * points at. Neither route decides policy: `PERSONAL_DATA_REGISTRY` says what
+ * happens to each table and the library walks it.
+ *
+ * ## The subject is always the caller
+ *
+ * There is no admin path here and no way to name a subject. Both handlers get
+ * their user id from `getUserId`, reading the request that `bridge` built —
+ * and `bridge` deletes any client-supplied identity header before setting it
+ * from `req.userId`, the id the server's own auth hook decided. No id is read
+ * from the path, the query or the body: the erase body's schema declares
+ * `confirm` and nothing else, and the routes carry no `:id` segment for one to
+ * hide in. A caller wanting somebody else's data would have to change this
+ * file, not the request. `req.userId == null` is refused with 401 rather than
+ * falling back to `getUserId`'s default of user "1".
+ *
+ * ## The erasure contract
+ *
+ * `DELETE /api/account` is irreversible, so it is deliberate by construction:
+ *
+ * - The body must be `{"confirm": "DELETE MY ACCOUNT"}` — the exact string,
+ *   case-sensitive. A bare `DELETE` with no body, an empty object, a typo, or
+ *   any other value is `400` and nothing is touched. A stray or replayed
+ *   `DELETE` therefore cannot erase anything.
+ * - It is idempotent. The library re-runs the same sweep; a second call finds
+ *   nothing left and reports zeros. Both calls answer `200`.
+ * - It returns the per-table report — deleted/redacted/retained counts keyed
+ *   by table — plus the `requestId` that ties the two audit rows together.
+ * - Audit: this route writes `data_erasure_requested` *before* the sweep, so
+ *   the request is on record even if the sweep then throws.
+ *   `erasePersonalData` writes `data_erasure_completed` itself once it is
+ *   given a `requestId`; this route does not write that event a second time.
+ *   Both types are in `NEVER_PRUNED_USER_EVENT_TYPES`, so the sweep it runs
+ *   leaves them behind as the evidence the request was answered.
+ *
+ * ## Bytes, not just rows
+ *
+ * `erasePersonalData` takes an {@link ErasureObjectStore} and reports
+ * `objectKeysDeleted: null` without one — deleting the asset row and leaving
+ * the object readable to anyone holding a URL. `assetErasureStore` below wires
+ * the real `StorageAdapter`, so the report names the keys it removed.
+ *
+ * Two things that adapter does on purpose. It filters the listing to keys
+ * under `<userId>/` rather than trusting the prefix scoping: `list()`
+ * normalizes `"u1/"` to `"u1"`, and on the S3 and Supabase backends — which
+ * match a prefix as a string, not as a directory — that would also match
+ * `u10/…`. And it only ever deletes what that filter passes, so the blast
+ * radius is one user's prefix whatever the backend does with the argument.
+ * Objects stored before the owner prefix existed sit at a flat
+ * `<assetId>.<ext>` and are not reachable by any per-user prefix; they are not
+ * swept here.
+ *
+ * ## Why the body is validated with Zod rather than a Fastify `schema`
+ *
+ * These are bridged routes. The server installs an app-wide
+ * `addContentTypeParser("*", { parseAs: "buffer" })`, so `req.body` reaches a
+ * route as raw bytes and a JSON-schema `schema.body` would reject every
+ * request as "not an object". Validation therefore happens where the bytes
+ * are — one `safeParse` at the boundary, before anything reads a field —
+ * which is the pattern the other bridged routes in this package use and what
+ * `packages/AGENTS.md` means by "Zod is the canonical validator".
+ */
+import { randomUUID } from "node:crypto";
+import { UserEventType, erasePersonalData, exportPersonalData, recordUserEvent } from "@nodetool-ai/models";
+import { z } from "zod";
+import { bridge } from "../lib/bridge.js";
+import { getUserId } from "../http-api.js";
+import { getAssetAdapter } from "../lib/storage.js";
+/** The exact phrase `DELETE /api/account` requires in its body. */
+export const ERASURE_CONFIRMATION = "DELETE MY ACCOUNT";
+/**
+ * The one field the erase body may carry.
+ *
+ * `z.literal` rather than a free string so the gate is the phrase itself, and
+ * `strict()` so an unexpected field — `user_id`, `userId`, `subject` — is a
+ * `400` rather than something a later reader might mistake for an instruction.
+ */
+export const erasureRequest = z
+    .object({ confirm: z.literal(ERASURE_CONFIRMATION) })
+    .strict();
+function jsonResponse(data, status = 200) {
+    return new Response(JSON.stringify(data ?? null), {
+        status,
+        headers: { "content-type": "application/json", "cache-control": "no-store" }
+    });
+}
+/** The parsed JSON body, or `null` when there is nothing parseable. */
+async function readJsonBody(request) {
+    try {
+        const text = await request.text();
+        return text.length > 0 ? JSON.parse(text) : null;
+    }
+    catch {
+        // Unparseable bytes are "no body", answered by the schema below as a 400.
+        return null;
+    }
+}
+/**
+ * A {@link ErasureObjectStore} over a `StorageAdapter` — the adapter shape the
+ * doc comment on `ErasureObjectStore` sketches, with the prefix guard the
+ * string-prefix backends need.
+ */
+export function assetErasureStore(adapter) {
+    return {
+        async deleteObjectsForUser(userId) {
+            const prefix = `${userId}/`;
+            const { entries } = await adapter.list(prefix);
+            const deleted = [];
+            for (const entry of entries) {
+                if (!entry.key.startsWith(prefix))
+                    continue;
+                if (await adapter.delete(entry.uri))
+                    deleted.push(entry.key);
+            }
+            return deleted;
+        }
+    };
+}
+/** Filename a browser saves the export as. */
+function exportFilename(generatedAt) {
+    const day = generatedAt.slice(0, 10);
+    return `nodetool-personal-data-export-${day}.json`;
+}
+const accountRoutes = async (app, opts) => {
+    const { apiOptions } = opts;
+    const userIdHeader = apiOptions.userIdHeader ?? "x-user-id";
+    app.get("/api/account/export", async (req, reply) => {
+        // No authenticated identity means no subject. `getUserId` would answer "1"
+        // here, which is a real account on a local install.
+        if (req.userId == null) {
+            reply
+                .code(401)
+                .header("cache-control", "no-store")
+                .send({ detail: "Authentication required" });
+            return;
+        }
+        await bridge(req, reply, async (request) => {
+            const userId = getUserId(request, userIdHeader);
+            const data = await exportPersonalData(userId);
+            await recordUserEvent({
+                userId,
+                eventType: UserEventType.DATA_EXPORT_REQUESTED,
+                metadata: { request_id: randomUUID(), format: data.format }
+            });
+            return new Response(JSON.stringify(data), {
+                status: 200,
+                headers: {
+                    "content-type": "application/json",
+                    "cache-control": "no-store",
+                    "content-disposition": `attachment; filename="${exportFilename(data.generatedAt)}"`
+                }
+            });
+        }, userIdHeader);
+    });
+    app.delete("/api/account", async (req, reply) => {
+        if (req.userId == null) {
+            reply
+                .code(401)
+                .header("cache-control", "no-store")
+                .send({ detail: "Authentication required" });
+            return;
+        }
+        await bridge(req, reply, async (request) => {
+            const parsed = erasureRequest.safeParse(await readJsonBody(request));
+            if (!parsed.success) {
+                return jsonResponse({
+                    detail: "Erasure is irreversible. Send " +
+                        `{"confirm": "${ERASURE_CONFIRMATION}"} to confirm.`
+                }, 400);
+            }
+            const userId = getUserId(request, userIdHeader);
+            const requestId = randomUUID();
+            // Before the sweep: this row is the record that the request arrived,
+            // and it has to survive a sweep that then fails part-way.
+            await recordUserEvent({
+                userId,
+                eventType: UserEventType.DATA_ERASURE_REQUESTED,
+                metadata: { request_id: requestId }
+            });
+            const report = await erasePersonalData(userId, {
+                objectStore: assetErasureStore(opts.storage ?? getAssetAdapter()),
+                // `erasePersonalData` writes `data_erasure_completed` from this id.
+                requestId
+            });
+            return jsonResponse({ requestId, report });
+        }, userIdHeader);
+    });
+};
+export default accountRoutes;
+//# sourceMappingURL=account.js.map

package/dist/routes/account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../../src/routes/account.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EAEhB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAuB,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAQpD,mEAAmE;AACnE,MAAM,CAAC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC;KACpD,MAAM,EAAE,CAAC;AAEZ,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IAC/C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE;QAChD,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;KAC7E,CAAC,CAAC;AACL,CAAC;AAED,uEAAuE;AACvE,KAAK,UAAU,YAAY,CAAC,OAAgB;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAuB;IAEvB,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,MAAc;YACvC,MAAM,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;YAC5B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;oBAAE,SAAS;gBAC5C,IAAI,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,SAAS,cAAc,CAAC,WAAmB;IACzC,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrC,OAAO,iCAAiC,GAAG,OAAO,CAAC;AACrD,CAAC;AAED,MAAM,aAAa,GAAqC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAC1E,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAC5B,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,WAAW,CAAC;IAE5D,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAClD,2EAA2E;QAC3E,oDAAoD;QACpD,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YACvB,KAAK;iBACF,IAAI,CAAC,GAAG,CAAC;iBACT,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;iBACnC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,MAAM,MAAM,CACV,GAAG,EACH,KAAK,EACL,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,eAAe,CAAC;gBACpB,MAAM;gBACN,SAAS,EAAE,aAAa,CAAC,qBAAqB;gBAC9C,QAAQ,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;aAC5D,CAAC,CAAC;YACH,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;gBACxC,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,eAAe,EAAE,UAAU;oBAC3B,qBAAqB,EAAE,yBAAyB,cAAc,CAC5D,IAAI,CAAC,WAAW,CACjB,GAAG;iBACL;aACF,CAAC,CAAC;QACL,CAAC,EACD,YAAY,CACb,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC9C,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YACvB,KAAK;iBACF,IAAI,CAAC,GAAG,CAAC;iBACT,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;iBACnC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,MAAM,MAAM,CACV,GAAG,EACH,KAAK,EACL,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;YACrE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,YAAY,CACjB;oBACE,MAAM,EACJ,gCAAgC;wBAChC,gBAAgB,oBAAoB,gBAAgB;iBACvD,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YAChD,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;YAC/B,qEAAqE;YACrE,0DAA0D;YAC1D,MAAM,eAAe,CAAC;gBACpB,MAAM;gBACN,SAAS,EAAE,aAAa,CAAC,sBAAsB;gBAC/C,QAAQ,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;aACpC,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE;gBAC7C,WAAW,EAAE,iBAAiB,CAAC,IAAI,CAAC,OAAO,IAAI,eAAe,EAAE,CAAC;gBACjE,oEAAoE;gBACpE,SAAS;aACV,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7C,CAAC,EACD,YAAY,CACb,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,eAAe,aAAa,CAAC"}

package/dist/routes/applications.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Applications REST routes — the non-tRPC door onto the same service.
+ *
+ * The web app uses `/trpc/applications.*`; mobile, the CLI, and third-party
+ * clients use these. Both call `lib/applications-service.ts`, so a given app
+ * serializes identically on either transport.
+ *
+ *   GET    /api/applications                        → ApplicationListItem[]
+ *   POST   /api/applications                        → ApplicationResponse
+ *   GET    /api/applications/:id                    → ApplicationResponse
+ *   PUT    /api/applications/:id                    → ApplicationResponse
+ *   PATCH  /api/applications/:id                    → ApplicationResponse
+ *   DELETE /api/applications/:id                    → { ok: true }
+ *   GET    /api/applications/:id/released-document  → ApplicationReleaseResponse | null
+ *   GET    /api/applications/:id/export-bundle      → ApplicationBundle (download)
+ *   POST   /api/applications/import-bundle          → ApplicationResponse
+ *   POST   /api/applications/build                  → BuildReport | {session_id}
+ *   POST   /api/applications/debug                  → AppDebugSummary | {session_id}
+ *   GET    /api/applications/examples               → ExampleAppSummary[]
+ *   GET    /api/applications/examples/:slug         → ApplicationBundle
+ *   POST   /api/applications/examples/:slug/install → ApplicationResponse
+ */
+import type { FastifyPluginAsync } from "fastify";
+import { type HttpApiOptions } from "../http-api.js";
+import { type AppBuildDeps } from "../lib/app-build-service.js";
+import { type AppDebugDeps } from "../lib/app-debug-service.js";
+interface RouteOptions {
+    apiOptions: HttpApiOptions;
+    /** Build dependencies — overridden only by tests. */
+    appBuild?: AppBuildDeps;
+    /** Debug dependencies — overridden only by tests. */
+    appDebug?: AppDebugDeps;
+}
+declare const applicationsRoutes: FastifyPluginAsync<RouteOptions>;
+export default applicationsRoutes;
+//# sourceMappingURL=applications.d.ts.map

package/dist/routes/applications.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"applications.d.ts","sourceRoot":"","sources":["../../src/routes/applications.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAgBlD,OAAO,EAAa,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAYhE,OAAO,EAEL,KAAK,YAAY,EAElB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEL,KAAK,YAAY,EAElB,MAAM,6BAA6B,CAAC;AAErC,UAAU,YAAY;IACpB,UAAU,EAAE,cAAc,CAAC;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB;AAqDD,QAAA,MAAM,kBAAkB,EAAE,kBAAkB,CAAC,YAAY,CAmKxD,CAAC;eAEa,kBAAkB"}