@north-light/cli 0.0.0-stage → 0.3.413

package/dist/core/spaces/open-beneath.js

@@ -0,0 +1 @@
+var ie=Object.defineProperty;var f=(t,e)=>ie(t,"name",{value:e,configurable:!0});import{chmodSync as V,chownSync as oe,closeSync as y,constants as d,fchmodSync as K,fchownSync as ce,fstatSync as $,fsyncSync as A,linkSync as fe,lstatSync as X,mkdirSync as M,openSync as w,readdirSync as C,readFileSync as se,readlinkSync as le,readSync as H,realpathSync as ue,renameSync as j,rmdirSync as G,rmSync as ae,statSync as q,symlinkSync as ye,unlinkSync as R,writeSync as he}from"node:fs";import{randomUUID as de}from"node:crypto";import{basename as p,dirname as N,join as _,relative as g,resolve as k,sep as v}from"node:path";import{loadLinuxNative as Oe,O_CLOEXEC as I,O_PATH as D,RESOLVE_BENEATH as Ee,RESOLVE_NO_SYMLINKS as pe}from"../../native/linux.js";const Ne=Ee|pe,B=D|d.O_DIRECTORY|I;let b=null;function m(){return b===null&&(b=Oe()),b}f(m,"native");function E(t){return t.code}f(E,"code");class S extends Error{static{f(this,"BeneathRefusal")}}function z(t){return t instanceof S}f(z,"isBeneathRefusal");function J(t,e){switch(E(t)){case"ELOOP":case"EXDEV":return new S(`path meets a symlink: ${e}`);case"ENXIO":return new S(`path is not a regular file: ${e}`);case"EAGAIN":return new S(`path is held by a lease: ${e}`);default:return t}}f(J,"refused");function x(t,e,r,i,n){try{return t.openat2(e,r,i,Ne)}catch(c){throw J(c,n)}}f(x,"openat2");function Q(t,e,r){let i;try{i=$(t)}catch(n){throw y(t),n}if(i.isFile()||r&&i.isDirectory())return t;throw y(t),new S(`path is not a regular file: ${e}`)}f(Q,"regular");const Y=new Set(["ENOENT","ENOTDIR","EACCES"]);function W(t){return Y.has(E(t)??"")||z(t)}f(W,"isAbsentOrRefused");function Z(t,e){const r=g(k(t),k(e));if(r===".."||r.startsWith(`..${v}`)||r.startsWith(v))throw new Error(`${e} is outside ${t}`);return r}f(Z,"inside");function ee(t){if(t===""||t===".."||t.includes("/"))throw new Error(`not one path component: ${t}`);return t}f(ee,"entry");function L(t,e,r){if(r&d.O_CREAT)throw new Error("openBeneath never creates; use writeFileBeneath or createFileBeneath");const i=Z(t,e),n=m();if(!n)return w(e,r);const c=w("/",B);let o;try{o=x(n,c,g("/",k(t))||".",B,t)}finally{y(c)}try{return r&D?x(n,o,i||".",r|I,e):Q(x(n,o,i||".",r|I|d.O_NONBLOCK,e),e,!0)}finally{y(o)}}f(L,"openBeneath");function we(t,e){const r=L(t,e,d.O_RDONLY);try{return se(r)}finally{y(r)}}f(we,"readFileBeneath");function Le(t,e){try{return we(t,e).toString("utf8")}catch(r){if(E(r)==="ENOENT"||z(r))return null;throw r}}f(Le,"readTextBeneathIfExists");function te(t,e){if(!m())return q(e);const r=L(t,e,D);try{return $(r)}finally{y(r)}}f(te,"statBeneath");function Fe(t,e){try{return te(t,e),!0}catch(r){if(Y.has(E(r)??""))return!1;throw r}}f(Fe,"existsBeneath");function O(t,e,r,i=!1){Z(t,e);const n=m();if(!n)return i&&M(e,{recursive:!0}),r(o=>o===void 0?e:_(e,ee(o)));let c=w("/",B);try{for(const s of g("/",k(e)).split(v).filter(Boolean)){let a;try{a=x(n,c,s,B,e)}catch(u){if(!i||E(u)!=="ENOENT")throw u;try{M(`/proc/self/fd/${c}/${s}`)}catch(l){if(E(l)!=="EEXIST")throw l}a=x(n,c,s,B,e)}y(c),c=a}const o=`/proc/self/fd/${c}`;return r(s=>s===void 0?o:`${o}/${ee(s)}`)}finally{y(c)}}f(O,"withDirBeneath");function P(t,e,r,i){if(!m())return w(t,e,r);let n;try{n=w(t,e|d.O_NOFOLLOW|d.O_NONBLOCK,r)}catch(c){throw J(c,i)}return Q(n,i,!1)}f(P,"openForWrite");function F(t,e){let r=0;for(;r<e.length;)r+=he(t,e,r,e.length-r)}f(F,"writeAll");function ke(t,e,r,i={}){const n=typeof r=="string"?Buffer.from(r,"utf8"):r,c=i.mode??438;let o=N(e),s=p(e),a=t;if(i.atomic&&!m()){let u=!1;try{u=X(e).isSymbolicLink()}catch(l){if(E(l)!=="ENOENT")throw l}if(u){const l=ue(e);o=N(l),s=p(l),a="/"}}O(a,o,u=>{if(!i.atomic){const T=P(u(s),d.O_WRONLY|d.O_CREAT|d.O_TRUNC,c,e);try{F(T,n)}finally{y(T)}return}const l=u(`.${s}.${de()}.tmp`);let h=w(l,"wx",c);try{F(h,n),A(h),y(h),h=void 0,j(l,u(s))}finally{h!==void 0&&y(h);try{R(l)}catch(T){if(E(T)!=="ENOENT")throw T}}},!0)}f(ke,"writeFileBeneath");function De(t,e,r,i=438){const n=typeof r=="string"?Buffer.from(r,"utf8"):r;O(t,N(e),c=>{const o=w(c(p(e)),"wx",i);try{F(o,n),A(o)}finally{y(o)}},!0)}f(De,"createFileBeneath");function Ae(t,e,r){O(t,N(e),i=>{const n=P(i(p(e)),d.O_WRONLY|d.O_CREAT|d.O_APPEND,438,e);try{F(n,Buffer.from(r,"utf8"))}finally{y(n)}},!0)}f(Ae,"appendFileBeneath");function Ce(t,e){O(t,N(e),r=>R(r(p(e))))}f(Ce,"unlinkBeneath");function Re(t,e){O(t,N(e),r=>G(r(p(e))))}f(Re,"rmdirBeneath");function ge(t,e,r){O(t,N(e),i=>O(t,N(r),n=>j(i(p(e)),n(p(r))),!0))}f(ge,"renameBeneath");function ve(t,e,r){O(t,N(e),i=>O(t,N(r),n=>fe(i(p(e)),n(p(r)))))}f(ve,"linkBeneath");function Ie(t,e){O(t,e,r=>{const i=w(r(),d.O_RDONLY);try{A(i)}finally{y(i)}})}f(Ie,"fsyncDirBeneath");function U(t,e){return O(t,e,r=>C(r(),{withFileTypes:!0}))}f(U,"readdirBeneath");function be(t,e,r){return O(t,e,i=>C(i()).sort((n,c)=>n.localeCompare(c)).slice(0,r).flatMap(n=>{try{return[{name:n,stat:m()?X(i(n)):q(i(n))}]}catch(c){if(E(c)==="ENOENT")return[];throw c}}))}f(be,"listBeneath");function Ye(t,e,r=()=>!0,i=()=>!1){const n=[],c=[e];for(;c.length;){const o=c.pop();let s;try{s=U(t,o)}catch(a){if(o===e&&!Y.has(E(a)??""))throw a;continue}for(const a of s){const u=_(o,a.name);a.isDirectory()?i(a.name)||c.push(u):a.isFile()&&r(a.name)&&n.push(u)}}return n}f(Ye,"walkFilesBeneath");function We(t,e,r,i,n=new Set){re(t,e,U(t,e),r,i,n)}f(We,"copyTreeBeneath");function re(t,e,r,i,n,c){O(i,n,()=>{},!0);for(const o of r){if(c.has(o.name))continue;const s=_(e,o.name),a=_(n,o.name);if(o.isDirectory()){let u,l;try{u=te(t,s).mode&511,l=U(t,s)}catch(h){if(W(h))continue;throw h}re(t,s,l,i,a,new Set),O(i,n,h=>V(h(o.name),u))}else if(o.isSymbolicLink()){let u;try{u=O(t,e,l=>le(l(o.name)))}catch(l){if(E(l)==="EINVAL"||W(l))continue;throw l}O(i,n,l=>ye(u,l(o.name)))}else if(o.isFile()){let u;try{u=L(t,s,d.O_RDONLY)}catch(l){if(W(l))continue;throw l}try{me(u,i,a)}finally{y(u)}}}}f(re,"copyEntries");function me(t,e,r){const i=$(t).mode&511;O(e,N(r),n=>{const c=P(n(p(r)),d.O_WRONLY|d.O_CREAT|d.O_TRUNC,i,r);try{K(c,i);const o=Buffer.allocUnsafe(1<<20);for(let s=H(t,o);s>0;s=H(t,o))F(c,o.subarray(0,s))}finally{y(c)}},!0)}f(me,"copyFileFd");function Pe(t,e,r,i){if(!m()){i&&oe(e,i.uid,i.gid),V(e,r);return}const n=L(t,e,d.O_RDONLY|d.O_NONBLOCK);try{const c=$(n);if(!c.isFile()&&!c.isDirectory())throw new S(`path is not a regular file or directory: ${e}`);i&&ce(n,i.uid,i.gid),K(n,r)}finally{y(n)}}f(Pe,"setModeBeneath");function ne(t){try{R(t)}catch(e){if(E(e)!=="ENOENT")throw e}}f(ne,"unlinkIfPresent");function Ue(t,e){const r=m();if(!r){ae(e,{recursive:!0,force:!0});return}try{O(t,N(e),i=>{const n=w(i(),B);try{Se(r,n,p(e),e)}finally{y(n)}})}catch(i){if(E(i)!=="ENOENT")throw i}}f(Ue,"removeTreeBeneath");function Se(t,e,r,i){const n=[],c=f((o,s,a)=>{let u;try{u=x(t,o,s,B,a)}catch(h){if(E(h)==="ENOENT")return;if(E(h)!=="ENOTDIR"&&!(h instanceof S))throw h;ne(`/proc/self/fd/${o}/${s}`);return}n.push({fd:u,parentFd:o,name:s,shown:a,dirs:[]});const l=n[n.length-1];for(const h of C(`/proc/self/fd/${u}`,{withFileTypes:!0}))h.isDirectory()?l.dirs.push(h.name):ne(`/proc/self/fd/${u}/${h.name}`)},"enter");try{for(c(e,r,i);n.length>0;){const o=n[n.length-1],s=o.dirs.pop();if(s!==void 0){c(o.fd,s,_(o.shown,s));continue}n.pop(),y(o.fd);try{G(`/proc/self/fd/${o.parentFd}/${o.name}`)}catch(a){if(E(a)!=="ENOENT")throw a}}}finally{for(const o of n)y(o.fd)}}f(Se,"removeTreeAt");function Ve(t,e){if(!m())return{path:e,release:f(()=>{},"release")};const r=L(t,e,D);let i;try{i=$(r)}catch(c){throw y(r),c}if(!i.isSocket())throw y(r),new S(`path is not a socket: ${e}`);let n=!0;return{path:`/proc/self/fd/${r}`,release:f(()=>{n&&(n=!1,y(r))},"release")}}f(Ve,"socketBeneath");export{Ae as appendFileBeneath,We as copyTreeBeneath,De as createFileBeneath,Fe as existsBeneath,Ie as fsyncDirBeneath,W as isAbsentOrRefused,z as isBeneathRefusal,ve as linkBeneath,be as listBeneath,L as openBeneath,we as readFileBeneath,Le as readTextBeneathIfExists,U as readdirBeneath,Ue as removeTreeBeneath,ge as renameBeneath,Re as rmdirBeneath,Pe as setModeBeneath,Ve as socketBeneath,te as statBeneath,Ce as unlinkBeneath,Ye as walkFilesBeneath,O as withDirBeneath,ke as writeFileBeneath};

package/dist/core/spaces/permissions.d.ts

@@ -0,0 +1,19 @@
+import { type ActiveGrant } from '../grants/mirror.js';
+export interface RunPermissions {
+    app: string;
+    ownNodes: boolean;
+    otherFiles: Array<{
+        holder: string;
+        path: string;
+        writable: boolean;
+    }>;
+    otherNodes: string[];
+}
+/** Only the active mirror and the launched scope list determine a run's mounts. */
+export declare function permissionsForRun(app: string, sub: string, grantId: string | null, launched: string[] | null): RunPermissions;
+/** The same computation over a given grant record, e.g. the mirror before a sync replaced it. */
+export declare function permissionsForGrant(app: string, sub: string, grant: ActiveGrant | null, launched: string[] | null): RunPermissions;
+/** A project is available only through an actual file mount, never a symlink or an ancestor of it. */
+export declare function readableProject(repository: string, roots: readonly string[]): boolean;
+export declare function readableProjectForScopes(repository: string, app: string, resolved: readonly string[], launched: readonly string[] | null): boolean;
+export { fileRoot, type FileCaller } from './file-root.js';

package/dist/core/spaces/permissions.js

@@ -0,0 +1 @@
+var v=Object.defineProperty;var f=(r,i)=>v(r,"name",{value:i,configurable:!0});import{covers as h,parseScope as F}from"@north-light/identity";import{activeGrant as S,grantFor as j}from"../grants/mirror.js";import{appSpace as d,userFilesRoot as A}from"../layout.js";import{contains as y}from"./file-root.js";import{join as E,resolve as u}from"node:path";import{lstatSync as z,realpathSync as $}from"node:fs";function g(r,i,o,e){return R(r,i,o?S(o):j(r,i),e)}f(g,"permissionsForRun");function R(r,i,o,e){if(!o||o.grantee!==r||o.sub!==i)throw new Error(`no active grant for ${r}`);if(e!==null&&!Array.isArray(e))throw new Error("invalid launched scopes");const t=[],s=[];let c=e===null;const a=e??o.resolved;for(const n of a){if(typeof n!="string")throw new Error("invalid launched scope");F(n);const x=n===`crtr:memory:read:${r}`||n===`crtr:memory:rw:${r}`||n.startsWith(`crtr:memory:read:${r}:`)||n.startsWith(`crtr:memory:rw:${r}:`);if(e!==null&&!x&&!o.resolved.some(m=>h(m,n)))throw new Error(`launched scope not in grant: ${n}`);const p=/^crtr:files:(read|rw):(user|app:[A-Za-z0-9_-]{1,64}):(.+)$/.exec(n);if(p){const[,m,w,b]=p;if(w===r)throw new Error(`own-app files cannot narrow a run: ${n}`);t.push({holder:w,path:b,writable:m==="rw"})}const l=/^crtr:objects:read:(app:[A-Za-z0-9_-]{1,64})$/.exec(n);l&&l[1]!==r&&s.push(l[1])}return{app:r,ownNodes:c,otherFiles:t,otherNodes:s}}f(R,"permissionsForGrant");function Z(r,i){const o=u(r);for(const e of i){const t=u(e);if(y(t,o))try{if($(o)!==o||$(t)!==t)continue;let s=o;for(;y(t,s)&&!z(s).isSymbolicLink();){if(s===t)return!0;s=u(s,"..")}}catch{}}return!1}f(Z,"readableProject");function q(r,i,o,e){const t=[d(i).files];for(const s of e??o){if(e!==null&&!o.some(a=>h(a,s)))continue;const c=/^crtr:files:(?:read|rw):(user|app:[A-Za-z0-9_-]{1,64}):(.+)$/.exec(s);c&&t.push(E(c[1]==="user"?A():d(c[1]).files,c[2]==="."?"":c[2]))}return Z(r,t)}f(q,"readableProjectForScopes");import{fileRoot as D}from"./file-root.js";export{D as fileRoot,R as permissionsForGrant,g as permissionsForRun,Z as readableProject,q as readableProjectForScopes};

package/dist/core/spaces/process.d.ts

@@ -0,0 +1,41 @@
+import { type CapturedExit } from '../../launcher/spec.js';
+export interface AppProcess {
+    pid: number;
+    completion: Promise<CapturedExit>;
+    stop(signal?: 'SIGTERM' | 'SIGKILL'): Promise<void>;
+}
+export interface AppProcessOptions {
+    nodeId?: string;
+    /** For node-backed work the persisted node setting always takes precedence. */
+    isolated?: boolean;
+    app?: string;
+    command: string[];
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    stdin?: string;
+    stdoutBytes?: number;
+    stderrBytes?: number;
+    stderrTail?: boolean;
+    pluginRoot?: string;
+    /** A file-backed job writes its own log and needs no launcher output capture. */
+    capture?: boolean;
+}
+/** The same mount compiler and launcher request used by broker launches. A node
+ * keeps its launched scope list; a process without a node uses the app's whole
+ * current grant. Linux never falls back to direct execution when configured
+ * with a launcher whose socket is missing. */
+export declare function appProcessSandboxed(): boolean;
+/** Whether app processes start through the root launcher (a sandbox with a fixed mount list). */
+export declare function appProcessesSandboxed(): boolean;
+/** Test seam: treat app processes as sandboxed (or not) without a launcher socket. */
+export declare function __setAppProcessesSandboxedForTest(value: boolean | undefined): void;
+/** Whether `cwd` lies inside a directory mount the launcher would give a process of
+ *  `app`. This is the launcher's own `cwd is not mounted` rule applied to the mounts
+ *  `compileLaunch` produces, so a caller can refuse a directory at arm time instead of
+ *  at every run. `nodeId` is the node the process runs for, when it has one. */
+export declare function cwdIsMounted(app: string, cwd: string, nodeId?: string, isolated?: boolean): boolean;
+export declare function stopAppProcess(pid: number, signal?: 'SIGTERM' | 'SIGKILL', nodeId?: string): Promise<void>;
+/** A node-backed isolated process always starts in its own agent folder.
+ * Callers validate explicitly requested cwd separately (e.g. hook execution). */
+export declare function appProcessCwd(nodeId: string, app: string, cwd: string, isolated: boolean): string;
+export declare function launchAppProcess(options: AppProcessOptions): Promise<AppProcess>;

package/dist/core/spaces/process.js

@@ -0,0 +1 @@
+var L=Object.defineProperty;var d=(e,n)=>L(e,"name",{value:n,configurable:!0});import{existsSync as I}from"node:fs";import{randomUUID as T}from"node:crypto";import{join as E}from"node:path";import{getNode as b}from"../canvas/canvas.js";import{nodeAgentDir as C,nodeHome as N,nodeRunDir as D}from"../canvas/paths.js";import{appSpace as O}from"../layout.js";import{activeGrant as $,activeGrantForApp as x,grantFor as k,grantsGeneration as v}from"../grants/mirror.js";import{emitEvent as _}from"../events/emit.js";import{ensureAppSpace as K}from"./space.js";import{compileLaunch as R,launchStillGranted as B}from"./mounts.js";import{pinSandboxRuntimeHome as F}from"./runtime-home.js";import{sandboxCacheEnv as H}from"./cache-env.js";import{launcherRequest as f}from"../../launcher/client.js";import{LAUNCHER_SOCKET as S}from"../../launcher/spec.js";function oe(){if(process.platform!=="linux")return!1;if(I(S))return!0;throw new Error("root launcher socket is unavailable; refusing an unsandboxed app process")}d(oe,"appProcessSandboxed");function de(){return y??(process.platform==="linux"&&I(S))}d(de,"appProcessesSandboxed");let y;function ie(e){y=e}d(ie,"__setAppProcessesSandboxedForTest");function ae(e,n,r,i=!1){const t=r===void 0?null:b(r),a=t?null:x(e);if(!t&&!a)throw new Error(`no active grant for ${e}`);return R({nodeId:r??"proc-cwd-check",app:e,sub:t?t.sub??"user:local":a.sub,grantId:t?t.grant_id??null:a.id,scopes:t?.scopes??null,command:["true"],env:{},...r===void 0?{withoutNode:!0}:{},isolated:t?.isolated===!0||i,auditMissing:d(()=>{},"auditMissing")}).mounts.some(({source:s})=>n===s||n.startsWith(s==="/"?"/":`${s}/`))}d(ae,"cwdIsMounted");async function A(e,n="SIGKILL",r){if(!("ok"in await f({operation:"stop",pid:e,signal:n,...r===void 0?{}:{nodeId:r}})))throw new Error("launcher did not stop process")}d(A,"stopAppProcess");function M(e,n,r,i){return i?C(e,n):r}d(M,"appProcessCwd");async function se(e){const n=e.nodeId===void 0?null:b(e.nodeId);if(e.nodeId!==void 0&&!n)throw new Error(`missing node ${e.nodeId}`);const r=n?.grantee??e.app??"app:terminal";if(e.app!==void 0&&e.app!==r)throw new Error("app does not match node");const i=n?null:x(r);if(!n&&!i)throw new Error(`no active grant for ${r}`);if(n&&r!=="app:terminal"&&!(n.grant_id?$(n.grant_id):k(r,n.sub??"user:local")))throw new Error(`no active grant for ${r}`);await K(r);const t=e.nodeId??`proc-${T()}`,a=n?.isolated===!0||e.isolated===!0;if(a&&!n)throw new Error("isolated process requires a live node");const m=O(r),s=M(t,r,e.cwd,a),w=n?N(t,r,a):m.home,G=F(Object.fromEntries(Object.entries({...e.env,...process.platform==="linux"?H(r):{},HOME:w,PI_CODING_AGENT_DIR:E(w,".pi","agent"),PWD:s,...e.nodeId===void 0?{}:{CRTR_API_SOCKET:E(D(t),"cli.sock")}}).filter(o=>o[1]!==void 0))),h={nodeId:t,app:r,sub:n?n.sub??"user:local":i.sub,grantId:n?n.grant_id??null:i.id,scopes:n?.scopes??null},P=d(()=>{const o=R({...h,command:e.command,env:G,...e.nodeId===void 0?{withoutNode:!0}:{},isolated:a,cwd:s,...e.pluginRoot===void 0?{}:{pluginRoot:e.pluginRoot},auditMissing:d(p=>_({level:"warn",event:"process.mount.missing",...e.nodeId===void 0?{}:{node_id:e.nodeId},fields:{source:p}}),"auditMissing")});if(e.pluginRoot!==void 0&&(o.pluginRoot=e.pluginRoot),e.capture===!1){if(e.nodeId===void 0||e.stdin!==void 0)throw new Error("uncaptured process requires a node and no stdin")}else o.capture={stdoutBytes:e.stdoutBytes??256*1024,stderrBytes:e.stderrBytes??256*1024,...e.stderrTail?{stderrTail:!0}:{},...e.stdin===void 0?{}:{stdin:e.stdin}};return o},"compile");let u;for(let o=0;o<2&&u===void 0;o++){const p=v(),g=P(),c=await f({operation:"launch",spec:g});if(!("pid"in c))throw new Error("launcher did not return a process id");if(v()===p||B(h,g)){u=c.pid;break}_({level:"info",event:"process.launch.regranted",...e.nodeId===void 0?{}:{node_id:e.nodeId},fields:{pid:c.pid}}),await A(c.pid,"SIGKILL").catch(()=>{})}if(u===void 0)throw new Error("grant changed during every launch attempt");const l=u;return{pid:l,get completion(){return f({operation:"wait",pid:l}).then(o=>{if(!("result"in o))throw new Error("launcher did not return process completion");return o.result})},stop:d((o="SIGKILL")=>A(l,o,e.nodeId),"stop")}}d(se,"launchAppProcess");export{ie as __setAppProcessesSandboxedForTest,M as appProcessCwd,oe as appProcessSandboxed,de as appProcessesSandboxed,ae as cwdIsMounted,se as launchAppProcess,A as stopAppProcess};

package/dist/core/spaces/runtime-home.d.ts

@@ -0,0 +1,5 @@
+export declare const SANDBOX_RUNTIME_HOME = "/opt/crouter/runtime";
+/** Pin the generation selector even if an app/profile supplied its own value. */
+export declare function pinSandboxRuntimeHome<T extends NodeJS.ProcessEnv>(env: T): T & {
+    CRTR_RUNTIME_HOME: string;
+};

package/dist/core/spaces/runtime-home.js

@@ -0,0 +1 @@
+var e=Object.defineProperty;var n=(t,o)=>e(t,"name",{value:o,configurable:!0});const r="/opt/crouter/runtime";function R(t){return{...t,CRTR_RUNTIME_HOME:r}}n(R,"pinSandboxRuntimeHome");export{r as SANDBOX_RUNTIME_HOME,R as pinSandboxRuntimeHome};

package/dist/core/spaces/space.d.ts

@@ -0,0 +1,8 @@
+/** App sandboxes bind the person's files through crtr-data group access. */
+export declare function ensureUserFiles(): void;
+/** On macOS no launcher or crtr-data group exists; directories stay owned by the Mac user. */
+export declare function ensureAppSpace(app: string): Promise<{
+    uid: number;
+    gid: number;
+    root: string;
+}>;

package/dist/core/spaces/space.js

@@ -0,0 +1,2 @@
+var f=Object.defineProperty;var n=(o,r)=>f(o,"name",{value:r,configurable:!0});import{chownSync as a,chmodSync as d,existsSync as m,mkdirSync as c,readFileSync as h,statSync as l}from"node:fs";import{appSpace as g,appsRoot as w,userFilesRoot as y}from"../layout.js";import{launcherRequest as S}from"../../launcher/client.js";import{LAUNCHER_SOCKET as x}from"../../launcher/spec.js";import{allocateAppUser as E,uidForApp as v}from"./users.js";function p(){const o=h("/etc/group","utf8").split(`
+`).find(e=>e.startsWith("crtr-data:"));if(!o)throw new Error("crtr-data group is required on sandboxed Linux");const r=Number(o.split(":")[2]);if(!Number.isInteger(r))throw new Error("invalid crtr-data group id");return r}n(p,"dataGroup");function L(){const o=y(),r=p();c(o,{recursive:!0,mode:1528});const e=l(o),t=e.mode&4095;if(!e.isDirectory()||e.gid!==r||t!==1528){if(!e.isDirectory()||e.uid!==process.getuid())throw new Error(`${o} has owner ${e.uid}, group ${e.gid}, mode ${t.toString(8).padStart(4,"0")}; requires an crtr-data (${r}) directory with mode 2770; only its owner can repair it`);e.gid!==r&&a(o,e.uid,r),t!==1528&&d(o,1528)}}n(L,"ensureUserFiles");async function N(o){const r=g(o);if(!(process.platform==="linux"&&m(x))){if(process.platform==="linux")throw new Error("app space requires the root launcher on Linux");for(const i of[r.root,r.memory,r.conversations,r.nodes,r.files,r.home,r.cache])c(i,{recursive:!0});return{uid:v(o),gid:process.getgid(),root:r.root}}const t=p(),s=E(o),u=await S({operation:"user.create",app:r.root.slice(w().length+1),uid:s.uid});if(!("uid"in u)||u.uid!==s.uid)throw new Error(`launcher did not create OS user for ${o}`);for(const i of[r.root,r.memory,r.conversations,r.nodes,r.files,r.home,r.cache])c(i,{recursive:!0,mode:1528}),a(i,process.getuid(),t),d(i,1528);return{uid:s.uid,gid:t,root:r.root}}n(N,"ensureAppSpace");export{N as ensureAppSpace,L as ensureUserFiles};

package/dist/core/spaces/stop.d.ts

@@ -0,0 +1,21 @@
+import type { DatabaseSync } from 'node:sqlite';
+import type { ObjectRow } from '../graph/types.js';
+import { type TeardownResult } from '../runtime/host.js';
+/** End the job object of a backgrounded command as killed. A command that was never backgrounded
+ *  has no job object; that answers false. Daemon-only: opens canvas.db. */
+export declare function killBashJobObject(jobId: string, killedBy: (db: DatabaseSync) => ObjectRow | null, reason?: string): boolean;
+/** Record a backgrounded command as its node's job object (id = job id); an existing job
+ *  object is returned as is. The one path for both the broker's record call and the
+ *  daemon adopting a job the broker backgrounded while exiting. Daemon-only. */
+export declare function recordBashJobObject(nodeId: string, jobId: string, spec: {
+    command: string;
+    jobDir: string;
+    logPath: string;
+}): ObjectRow;
+/** Stop the broker first so it cannot start another job during the job scan. */
+export declare function stopNodeSandboxes(nodeId: string, reason: string, options?: {
+    excludePid?: number;
+    after?: () => Promise<void>;
+    deleting?: boolean;
+    holdRecovery?: boolean;
+}): Promise<TeardownResult>;

package/dist/core/spaces/stop.js

@@ -0,0 +1,2 @@
+var _=Object.defineProperty;var a=(e,t)=>_(e,"name",{value:t,configurable:!0});import{prepared as x}from"../sqlite-statements.js";import{randomUUID as y}from"node:crypto";import{activeBackgroundBashJobs as R,stopBackgroundBashJob as S}from"../bash-jobs.js";import{getNode as T}from"../canvas/index.js";import{openDb as D,withCanvasWrite as h}from"../canvas/db.js";import{finishJob as J,startJob as O}from"../graph/jobs.js";import{getById as w,nodeObject as M}from"../graph/objects.js";import{readLiveSession as N}from"../canvas/sessions.js";import{contextDir as W}from"../canvas/node-agent-paths.js";import{conversationStore as $}from"../conversation-store/index.js";import{requestBrokerTeardown as C}from"../runtime/host.js";import{holdRecovery as L}from"../runtime/recovery-hold.js";function P(e,t,o){return h(n=>{const r=w(n,e);return r===null||r.type!=="job"?!1:(J(n,r,{killedBy:t(n),...o===void 0?{}:{reason:o}}),!0)})}a(P,"killBashJobObject");function I(e,t,o){return h(n=>{const r=w(n,t);if(r!==null){if(r.type!=="job")throw new Error(`${t} names a ${r.type}`);return r}return O(n,M(n,e),{id:t,...o})})}a(I,"recordBashJobObject");const d=new Map;function ee(e,t,o={}){const n=d.get(e);if(n)return n;const r=T(e);if(!r)return Promise.resolve({confirmed:!1,error:new Error(`missing node ${e}`)});const m=N(e)?.sessionId,l=a(()=>x(D(),`SELECT type, body_json FROM run_events WHERE node_id = ?
+    AND type IN ('node.turn.started', 'node.turn.completed') ORDER BY sequence_number DESC LIMIT 1`).get(e),"latestTurn"),v=r.run_id!==null&&r.pi_pid!==null&&l()?.type==="node.turn.started",E=o.holdRecovery?L(e):()=>{},j=C(e,{excludePid:o.excludePid}),c=(async()=>{const p=await j;if(!p.confirmed)return p;try{const s=W(e);for(const u of R(s,!0)){const i=await S(s,u.jobId,!0,e,t);if(i.kind==="not-stoppable")throw new Error(`background bash job ${u.jobId} could not be stopped`);i.kind!=="stopped"||o.deleting||P(u.jobId,()=>null,t)}if(v&&m&&!o.deleting){if(l()?.type!=="node.turn.started")return await o.after?.(),p;const i=$(),{entries:k}=i.read(m),B=k.at(-1),f=new Date().toISOString(),g=t==="permission_revoked",b={type:"message",id:y(),parentId:B?.id??null,timestamp:f,message:{role:"assistant",content:[],api:"openai-completions",provider:"crouter",model:"",usage:{input:0,output:0,cacheRead:0,cacheWrite:0,totalTokens:0,cost:{input:0,output:0,cacheRead:0,cacheWrite:0,total:0}},stopReason:g?"error":"aborted",errorMessage:t,timestamp:Date.now()}};i.append(m,[b,{type:"custom",id:y(),parentId:b.id,timestamp:f,customType:"crtr-turn-end",data:g?{stop_reason:"error",error:{code:"model_error",message:t}}:{stop_reason:"aborted"}}])}return await o.after?.(),p}catch(s){return{confirmed:!1,error:s instanceof Error?s:new Error(String(s))}}})();return d.set(e,c),c.finally(()=>{E(),d.get(e)===c&&d.delete(e)}),c}a(ee,"stopNodeSandboxes");export{P as killBashJobObject,I as recordBashJobObject,ee as stopNodeSandboxes};

package/dist/core/spaces/users.d.ts

@@ -0,0 +1,19 @@
+export interface AppUser {
+    app: string;
+    uid: number;
+    created: string;
+    status: 'active' | 'removed';
+}
+/** The launcher is absent on macOS; there is no app uid on that host. */
+export declare function uidForApp(app: string): number;
+/** An app has at most one active row. A removed app that reconnects gets a new
+ *  row above every uid ever allocated, so a uid is never reused. */
+export declare function allocateAppUser(app: string): AppUser;
+export declare function activeAppUsers(): Array<{
+    app: string;
+    uid: number;
+}>;
+/** The app's OS-user row not yet marked removed, if any. */
+export declare function activeAppUser(app: string): AppUser | null;
+/** The removal cascade's last write (runtime spec, "On removal"). */
+export declare function markAppUserRemoved(uid: number): void;

package/dist/core/spaces/users.js

@@ -0,0 +1 @@
+var E=Object.defineProperty;var r=(t,e)=>E(t,"name",{value:e,configurable:!0});import{prepared as p}from"../sqlite-statements.js";import{existsSync as d}from"node:fs";import{openDb as i,withCanvasWrite as n}from"../canvas/db.js";import{APP_UID_MAX as m,APP_UID_MIN as o,LAUNCHER_SOCKET as S}from"../../launcher/spec.js";function R(t){return process.platform!=="linux"||!d(S)?process.getuid?.()??0:A(t).uid}r(R,"uidForApp");function A(t){if(process.platform!=="linux")throw new Error("app OS users exist only on Linux");return n(e=>{const a=p(e,"SELECT app, uid, created, status FROM app_users WHERE app = ? AND status = 'active'").get(t);if(a)return a;const c=p(e,"SELECT MAX(uid) AS uid FROM app_users").get().uid,s=Math.max(o,(c??o-1)+1);if(s>m)throw new Error("app OS user range exhausted");const u=new Date().toISOString();return p(e,"INSERT INTO app_users (app, uid, created, status) VALUES (?, ?, ?, ?)").run(t,s,u,"active"),{app:t,uid:s,created:u,status:"active"}})}r(A,"allocateAppUser");function O(){return p(i(),"SELECT app, uid FROM app_users WHERE status = 'active'").all().map(e=>({app:e.app.startsWith("app:")?e.app.slice(4):e.app,uid:e.uid}))}r(O,"activeAppUsers");function D(t){return p(i(),"SELECT app, uid, created, status FROM app_users WHERE app = ? AND status = 'active'").get(t)??null}r(D,"activeAppUser");function T(t){n(e=>{p(e,"UPDATE app_users SET status = 'removed', removed_at = ? WHERE uid = ? AND status = 'active'").run(new Date().toISOString(),t)})}r(T,"markAppUserRemoved");export{D as activeAppUser,O as activeAppUsers,A as allocateAppUser,T as markAppUserRemoved,R as uidForApp};

package/dist/core/spawn.d.ts

@@ -0,0 +1,15 @@
+/** Does THIS process sit inside a tmux client (its own $TMUX is set)? NOT the
+ *  gate for the human surface — see tmuxServerReachable. A headless-broker child
+ *  strips TMUX/TMUX_PANE (broker.ts, anti-stophook-hijack) yet can still drive
+ *  the canvas tmux server, so gating the surface on this wrongly starves broker
+ *  nodes of human-in-the-loop. */
+export declare function isInTmux(): boolean;
+/** Is the canvas tmux SERVER reachable? The canvas runs on the DEFAULT tmux
+ *  socket (no -L/-S in core/runtime/tmux-driver.ts), so any `crtr` child — including a
+ *  headless-broker child that has deleted its own $TMUX — can split panes into
+ *  it. The human surface gates on THIS (can I reach the server to open a pane
+ *  the user is watching?), not on the caller's $TMUX. `list-clients` exits 0
+ *  whenever a server is up (even with zero attached clients) and non-zero when
+ *  no server is running — the true "no tmux to surface into" case that should
+ *  degrade to the inbox-drain follow-up. */
+export declare function tmuxServerReachable(): boolean;

package/dist/core/spawn.js

@@ -0,0 +1 @@
+var t=Object.defineProperty;var e=(r,n)=>t(r,"name",{value:n,configurable:!0});import{tmuxClientsReachable as o}from"./runtime/tmux-driver.js";function c(){return!!process.env.TMUX}e(c,"isInTmux");function i(){return o()}e(i,"tmuxServerReachable");export{c as isInTmux,i as tmuxServerReachable};

package/dist/core/sqlite-statements.d.ts

@@ -0,0 +1,4 @@
+import type { DatabaseSync, StatementSync } from 'node:sqlite';
+export declare function prepared(db: DatabaseSync, sql: string): StatementSync;
+/** Explicitly release compiled statements before closing or migrating a connection. */
+export declare function forgetPrepared(db: DatabaseSync): void;

package/dist/core/sqlite-statements.js

@@ -0,0 +1 @@
+var o=Object.defineProperty;var p=(e,t)=>o(e,"name",{value:t,configurable:!0});const a=new WeakMap;function i(e,t){let r=a.get(e);r||a.set(e,r=new Map);let n=r.get(t);return n||r.set(t,n=e.prepare(t)),n}p(i,"prepared");function s(e){a.delete(e)}p(s,"forgetPrepared");export{s as forgetPrepared,i as prepared};

package/dist/core/stdout-errors.d.ts

@@ -0,0 +1,3 @@
+import type { Writable } from 'node:stream';
+/** Install the CLI's single stdout failure policy before dispatch begins. */
+export declare function installStdoutErrorPolicy(stdout?: Writable, exit?: (code: number) => never): void;

package/dist/core/stdout-errors.js

@@ -0,0 +1 @@
+var s=Object.defineProperty;var i=(e,t)=>s(e,"name",{value:t,configurable:!0});function c(e=process.stdout,t=process.exit){let o=!1;e.on("error",r=>{if(r.code!=="EPIPE")throw r;o||(o=!0,setImmediate(()=>t(0)))})}i(c,"installStdoutErrorPolicy");export{c as installStdoutErrorPolicy};

package/dist/core/storage/attachments.d.ts

@@ -0,0 +1,33 @@
+import type { DatabaseSync } from 'node:sqlite';
+import { type StorageClient, type StorageConfig } from './client.js';
+/** The fetch step of one `run.start` or `run.message` is bounded to 110 s in
+ *  total (the hosting router waits 120 s for its headers). */
+export declare const ATTACHMENT_FETCH_BUDGET_MS = 110000;
+/** One fetched upload; `url` is the storage URL the text named (for refusals). */
+export interface AttachmentUse {
+    upload_id: string;
+    path: string;
+    url: string;
+}
+export interface ResolvedAttachments {
+    /** The text with each storage URL replaced by its runtime path. */
+    text: string;
+    uses: AttachmentUse[];
+    /** Remove every file (and directory) this call created. Idempotent. */
+    cleanup: () => void;
+}
+export interface ResolveOptions {
+    config?: () => StorageConfig | null;
+    client?: () => StorageClient;
+    budgetMs?: number;
+}
+/** Re-check, inside the accepting write, that every used upload is still this
+ *  grantee's and not pending delete (the due-work tick or an app removal may
+ *  have released it while its bytes were fetched). */
+export declare function assertUploadsUsable(grantee: string, uses: readonly AttachmentUse[], db: DatabaseSync): void;
+/** Fetch every upload a storage URL in `text` names into
+ *  `appSpace(grantee).nodes/<rootId>/attachments/` and replace exactly each
+ *  URL's span with the file's absolute runtime path. Without configured
+ *  storage the text passes through unchanged. On any failure every file this
+ *  call wrote is removed before the error propagates. */
+export declare function resolveStorageUrls(grantee: string, rootId: string, text: string, options?: ResolveOptions): Promise<ResolvedAttachments>;

package/dist/core/storage/attachments.js

@@ -0,0 +1 @@
+var N=Object.defineProperty;var i=(e,n)=>N(e,"name",{value:n,configurable:!0});import{constants as Z,createWriteStream as j}from"node:fs";import{extname as q,join as E}from"node:path";import{Transform as G}from"node:stream";import{pipeline as X}from"node:stream/promises";import{appSpace as Y}from"../layout.js";import{RunError as v}from"../runs/operations.js";import{createFileBeneath as J,existsBeneath as z,openBeneath as K,removeTreeBeneath as O,setModeBeneath as P,unlinkBeneath as Q,withDirBeneath as V}from"../spaces/open-beneath.js";import{ensureAppSpace as ee}from"../spaces/space.js";import{storageClient as te,storageConfig as oe,StorageRefused as ne}from"./client.js";import{getUpload as k}from"./tables.js";const re=11e4,p=i((e,n)=>new v(400,"invalid_request",n,void 0,{url:e}),"refused"),R=i(e=>new v(503,"storage_unavailable",e,void 0,void 0,void 0,!0),"unavailable");function x(e,n){return/^[^\s<>"'`)\]]*/.exec(e.slice(n))[0].replace(/[.,;:!?]+$/,"")}i(x,"shownUrl");function ae(e,n,r,c,d){const l=`${n}/`,_=[];let h=0;for(let u=e.indexOf(l,h);u!==-1;u=e.indexOf(l,h)){const t=x(e,u),f=/^([A-Za-z0-9_-]+)\/([A-Za-z0-9_-]+)\//.exec(e.slice(u+l.length));if(!f)throw p(t,`storage URL ${t} does not name an upload`);if(f[1]!==r)throw p(t,`storage URL ${t} names another runtime`);const s=k(f[2],d);if(!s||s.grantee!==c)throw p(t,`storage URL ${t} names an unknown upload`);if(s.delete_pending_since)throw p(t,`storage URL ${t} names a deleted upload`);const $=u+l.length+f[0].length,m=encodeURIComponent(s.name);if(!e.startsWith(m,$))throw p(t,`storage URL ${t} does not match the upload's name`);_.push({start:u,end:$+m.length,upload:s}),h=$+m.length}return _}i(ae,"matchStorageUrls");function _e(e,n,r){for(const c of n){const d=k(c.upload_id,r);if(!d||d.grantee!==e||d.delete_pending_since)throw p(c.url,`storage URL ${c.url} names an upload deleted while it was fetched`)}}i(_e,"assertUploadsUsable");function se(e,n){if(n===1)return e;const r=q(e);return r&&r!==e?`${e.slice(0,-r.length)}-${n}${r}`:`${e}-${n}`}i(se,"candidate");async function $e(e,n,r,c={}){const d={text:r,uses:[],cleanup:i(()=>{},"cleanup")},l=(c.config??oe)();if(!l||!r.includes(`${l.base_url}/`))return d;const _=(c.client??te)(),h=ae(r,l.base_url,_.runtimeId,e);if(!h.length)return d;const u=await ee(e),t=Y(e).nodes,f=E(t,n),s=E(f,"attachments"),$={uid:process.getuid?.()??0,gid:u.gid},m=!z(t,f),I=!m&&!z(t,s),C=[];let D=!1;const M=i(()=>{if(!D){D=!0;for(const o of C)try{Q(t,o)}catch{}try{m?O(t,f):I&&O(t,s)}catch{}}},"cleanup"),U=AbortSignal.timeout(c.budgetMs??re),b=new Map;try{V(t,s,()=>{},!0);for(const{upload:o,start:B}of h){if(b.has(o.upload_id))continue;const g=x(r,B);let L;try{L=await _.fetchUpload(o.upload_id,U)}catch(a){throw a instanceof ne?p(g,a.status===409?`storage URL ${g} names an upload that was never finished`:`storage URL ${g} names an unknown upload`):U.aborted?R("attachments could not be fetched within 110 s"):a}let w="";for(let a=1;;a++){w=E(s,se(o.name,a));try{J(t,w,Buffer.alloc(0),432);break}catch(A){if(A.code!=="EEXIST")throw L.body.destroy(),A}}C.push(w);let T=0;const W=new G({transform(a,A,H){T+=a.length,H(null,a)}}),F=K(t,w,Z.O_WRONLY);try{await X(L.body,W,j("",{fd:F,autoClose:!0}),{signal:U})}catch(a){throw U.aborted?R("attachments could not be fetched within 110 s"):a instanceof v?a:R(`storage stopped sending ${o.name}: ${a instanceof Error?a.message:String(a)}`)}if(T!==o.size)throw R(`storage sent ${T} of ${o.size} bytes of ${o.name}`);P(t,w,432,$),b.set(o.upload_id,{path:w,url:g})}}catch(o){throw M(),o}let y="",S=0;for(const o of h)y+=r.slice(S,o.start)+b.get(o.upload.upload_id).path,S=o.end;return y+=r.slice(S),{text:y,uses:[...b].map(([o,{path:B,url:g}])=>({upload_id:o,path:B,url:g})),cleanup:M}}i($e,"resolveStorageUrls");export{re as ATTACHMENT_FETCH_BUDGET_MS,_e as assertUploadsUsable,$e as resolveStorageUrls};

package/dist/core/storage/client.d.ts

@@ -0,0 +1,109 @@
+import { Readable } from 'node:stream';
+import { type DirectoryToken } from '../grants/sync.js';
+/** The size limit of one uploaded or shared file: 100 MiB. */
+export declare const UPLOAD_MAX_BYTES = 104857600;
+/** Storage answered 404 (unknown, or another runtime's object) or 409 (not uploaded). */
+export declare class StorageRefused extends Error {
+    readonly status: 404 | 409;
+    readonly code: string;
+    constructor(status: 404 | 409, code: string, message: string);
+}
+export interface StorageConfig {
+    service_url: string;
+    base_url: string;
+}
+export interface CreatedUpload {
+    upload_id: string;
+    url: string;
+    upload_link: string;
+    expires_at: string;
+}
+export interface CreatedShare {
+    share_id: string;
+    url: string;
+    upload_link: string;
+    expires_at: string | null;
+}
+export interface SignedLink {
+    url: string;
+    expires_at: string;
+}
+/** An `outbound` object (a provider file argument's copy): `upload_link` is the
+ *  signed PUT, `url` a signed GET valid 15 minutes from creation; storage
+ *  deletes the object 24 hours after creation (`expires_at`). */
+export interface CreatedOutbound {
+    object_id: string;
+    upload_link: string;
+    url: string;
+    link_expires_at: string;
+    expires_at: string;
+}
+export interface SignedOutbound {
+    url: string;
+    link_expires_at: string;
+    expires_at: string;
+}
+export interface SignedUploadLink {
+    upload_link: string;
+    expires_at: string;
+}
+export interface StorageClient {
+    readonly config: StorageConfig;
+    /** This runtime's id, the second segment of every storage URL it owns. */
+    readonly runtimeId: string;
+    createUpload(input: {
+        name: string;
+        media_type: string;
+        size: number;
+    }): Promise<CreatedUpload>;
+    /** The upload's bytes; `size` is storage's `Content-Length`. */
+    fetchUpload(uploadId: string, signal?: AbortSignal): Promise<{
+        body: Readable;
+        size: number | null;
+        media_type: string | null;
+    }>;
+    signDownload(uploadId: string): Promise<SignedLink>;
+    deleteUpload(uploadId: string): Promise<void>;
+    createShare(input: {
+        name: string;
+        media_type: string;
+        size: number;
+        expires_at?: string;
+    }): Promise<CreatedShare>;
+    putShareBytes(uploadLink: string, file: string, size: number, mediaType: string): Promise<void>;
+    deleteShare(shareId: string): Promise<void>;
+    /** A provider file result's upload: the PUT accepts any length up to
+     *  `max_size` and storage records the size stored (the one call to change if
+     *  storage's field differs). */
+    createResultUpload(input: {
+        name: string;
+        media_type: string;
+        max_size: number;
+    }): Promise<CreatedUpload>;
+    /** A fresh signed PUT link for an upload with nothing stored yet (409 once
+     *  bytes are stored, 404 once it is gone). */
+    signUploadLink(uploadId: string): Promise<SignedUploadLink>;
+    createOutbound(input: {
+        name: string;
+        size: number;
+        media_type?: string;
+    }): Promise<CreatedOutbound>;
+    /** A fresh signed GET URL for an uploaded outbound object (409 before its
+     *  PUT, 404 once gone). */
+    signOutbound(objectId: string): Promise<SignedOutbound>;
+    /** PUT exactly `size` bytes of the open descriptor `fd` from offset 0 to a
+     *  signed link. Reads the descriptor, never the pathname, so a file swapped
+     *  after it was checked cannot be copied; the caller closes `fd`. */
+    putFileBytes(uploadLink: string, fd: number, size: number, mediaType: string): Promise<void>;
+}
+/** The configured storage, or null when this runtime has none. */
+export declare function storageConfig(): StorageConfig | null;
+/** The storage client for the configured runtime. Refuses with
+ *  `storage_unavailable` when no storage is configured. */
+export declare function storageClient(): StorageClient;
+/** Test seam: reset the cached client (and its token). */
+export declare function resetStorageClient(): void;
+export declare function createStorageClient(config: StorageConfig, mint: () => Promise<DirectoryToken>, runtime: string): StorageClient;
+/** Storage's name rule (plan Overview): 1–255 bytes UTF-8, no `/`, `\`, NUL or
+ *  control characters, not `.` or `..`. Returns a reason, or null when valid. */
+export declare function invalidStorageName(name: string): string | null;

package/dist/core/storage/client.js

@@ -0,0 +1,3 @@
+var S=Object.defineProperty;var s=(r,l)=>S(r,"name",{value:l,configurable:!0});import{createReadStream as v,read as $,statSync as T}from"node:fs";import{Readable as w}from"node:stream";import{promisify as E}from"node:util";import{readConfig as m}from"../config.js";import{RunError as k}from"../runs/operations.js";import{mintDirectoryToken as C,runtimeId as O}from"../grants/sync.js";const N=104857600;class b extends Error{static{s(this,"StorageRefused")}status;code;constructor(l,u,d){super(d),this.status=l,this.code=u}}const P=E($);async function*U(r,l){let u=0;for(;u<l;){const d=Buffer.allocUnsafe(Math.min(1048576,l-u)),{bytesRead:f}=await P(r,d,0,d.length,u);if(f===0)throw new Error("file shrank while it was being copied");u+=f,yield d.subarray(0,f)}}s(U,"fdChunks");const i=s(r=>new k(503,"storage_unavailable",r,void 0,void 0,void 0,!0),"unavailable");function j(){const r=m("user").runtime?.storage;return!r?.service_url||!r.base_url?null:{service_url:r.service_url.replace(/\/$/,""),base_url:r.base_url.replace(/\/$/,"")}}s(j,"storageConfig");let _;function W(){const r=j(),l=m("user").runtime?.issuer;if(!r||!l)throw i("file storage is not configured on this runtime");const u=`${l}
+${r.service_url}
+${r.base_url}`;return _?.key!==u&&(_={key:u,client:A(r,()=>C(l,r.service_url),O())}),_.client}s(W,"storageClient");function F(){_=void 0}s(F,"resetStorageClient");function A(r,l,u){let d,f;const x=s(async()=>{if(d&&d.expires_at-6e4>Date.now())return d.access_token;f??=l().finally(()=>{f=void 0});try{d=await f}catch(t){throw i(`storage token could not be minted: ${t instanceof Error?t.message:String(t)}`)}return d.access_token},"bearer"),c=s(async(t,e,n={})=>{const p=[AbortSignal.timeout(n.timeoutMs??1e4),...n.signal?[n.signal]:[]];let a;try{a=await fetch(`${r.service_url}${e}`,{method:t,signal:AbortSignal.any(p),headers:{Authorization:`Bearer ${await x()}`,...n.body===void 0?{}:{"Content-Type":"application/json"}},...n.body===void 0?{}:{body:JSON.stringify(n.body)}})}catch(o){throw o instanceof k?o:i(`storage could not be reached: ${o instanceof Error?o.message:String(o)}`)}if(a.status===401&&(d=void 0),a.status===404||a.status===409){const o=await a.json().catch(()=>({})),g=o.error?.code??o.code??(a.status===404?"not_found":"not_uploaded");throw new b(a.status,g,o.error?.message??o.message??`storage answered ${a.status}`)}if(!a.ok)throw await a.body?.cancel().catch(()=>{}),i(`storage answered ${a.status} to ${t} ${e.split("?")[0]}`);return a},"call"),y=s(async t=>{try{return await t.json()}catch{throw i("storage answered with an invalid body")}},"json"),h=s(t=>encodeURIComponent(t),"id");return{config:r,runtimeId:u,async createUpload(t){const e=await y(await c("POST","/v1/uploads",{body:t}));if(typeof e.upload_id!="string"||typeof e.url!="string"||typeof e.upload_link!="string"||typeof e.expires_at!="string")throw i("storage answered with an invalid upload");return{upload_id:e.upload_id,url:e.url,upload_link:e.upload_link,expires_at:e.expires_at}},async fetchUpload(t,e){const n=await c("GET",`/v1/uploads/${h(t)}/content`,{...e?{signal:e}:{},timeoutMs:11e4});if(!n.body)throw i("storage answered with no body");const p=n.headers.get("content-length");return{body:w.fromWeb(n.body),size:p===null?null:Number(p),media_type:n.headers.get("content-type")}},async signDownload(t){const e=await y(await c("POST",`/v1/uploads/${h(t)}/download-link`));if(typeof e.url!="string"||typeof e.expires_at!="string")throw i("storage answered with an invalid link");return{url:e.url,expires_at:e.expires_at}},async deleteUpload(t){try{await c("DELETE",`/v1/uploads/${h(t)}`)}catch(e){if(!(e instanceof b&&e.status===404))throw e}},async createShare(t){const e=await y(await c("POST","/v1/shares",{body:t}));if(typeof e.share_id!="string"||typeof e.url!="string"||typeof e.upload_link!="string")throw i("storage answered with an invalid share");return{share_id:e.share_id,url:e.url,upload_link:e.upload_link,expires_at:e.expires_at??null}},async putShareBytes(t,e,n,p){if(T(e).size!==n)throw new Error("shared file changed size while it was being copied");let a;try{a=await fetch(t,{method:"PUT",signal:AbortSignal.timeout(11e4),headers:{"Content-Type":p,"Content-Length":String(n)},body:w.toWeb(v(e)),duplex:"half"})}catch(o){throw i(`storage could not be reached: ${o instanceof Error?o.message:String(o)}`)}if(await a.body?.cancel().catch(()=>{}),!a.ok)throw i(`storage answered ${a.status} to the share upload`)},async deleteShare(t){try{await c("DELETE",`/v1/shares/${h(t)}`)}catch(e){if(!(e instanceof b&&e.status===404))throw e}},async createResultUpload(t){const e=await y(await c("POST","/v1/uploads",{body:{name:t.name,media_type:t.media_type,max_size:t.max_size}}));if(typeof e.upload_id!="string"||typeof e.url!="string"||typeof e.upload_link!="string"||typeof e.expires_at!="string")throw i("storage answered with an invalid upload");return{upload_id:e.upload_id,url:e.url,upload_link:e.upload_link,expires_at:e.expires_at}},async signUploadLink(t){const e=await y(await c("POST",`/v1/uploads/${h(t)}/upload-link`));if(typeof e.upload_link!="string"||typeof e.expires_at!="string")throw i("storage answered with an invalid upload link");return{upload_link:e.upload_link,expires_at:e.expires_at}},async createOutbound(t){const e=await y(await c("POST","/v1/outbound",{body:t}));if(typeof e.object_id!="string"||typeof e.upload_link!="string"||typeof e.url!="string"||typeof e.expires_at!="string")throw i("storage answered with an invalid outbound object");return{object_id:e.object_id,upload_link:e.upload_link,url:e.url,link_expires_at:e.link_expires_at,expires_at:e.expires_at}},async signOutbound(t){const e=await y(await c("POST",`/v1/outbound/${h(t)}/link`));if(typeof e.url!="string"||typeof e.expires_at!="string")throw i("storage answered with an invalid link");return{url:e.url,link_expires_at:e.link_expires_at,expires_at:e.expires_at}},async putFileBytes(t,e,n,p){const a=w.from(U(e,n));let o;try{o=await fetch(t,{method:"PUT",signal:AbortSignal.timeout(11e4),headers:{"Content-Type":p,"Content-Length":String(n)},body:w.toWeb(a),duplex:"half"})}catch(g){throw i(`storage could not be reached: ${g instanceof Error?g.message:String(g)}`)}finally{a.destroy()}if(await o.body?.cancel().catch(()=>{}),!o.ok)throw i(`storage answered ${o.status} to the upload`)}}}s(A,"createStorageClient");function G(r){return!r||Buffer.byteLength(r,"utf8")>255?"name must be 1-255 bytes":r==="."||r===".."?"name must not be . or ..":/[/\\\u0000-\u001f\u007f]/.test(r)?"name must not contain /, \\, or control characters":null}s(G,"invalidStorageName");export{b as StorageRefused,N as UPLOAD_MAX_BYTES,A as createStorageClient,G as invalidStorageName,F as resetStorageClient,W as storageClient,j as storageConfig};

package/dist/core/storage/download.d.ts

@@ -0,0 +1,24 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { type FileCaller } from '../spaces/permissions.js';
+export declare function contentTypeFor(path: string): string;
+/** An open regular file the caller may read. The caller closes `fd`. */
+export interface CallerFile {
+    fd: number;
+    path: string;
+    size: number;
+}
+/** Open `raw` for `caller` (`null` = the person) beneath the root its
+ *  permission names: absent or withheld → `not_found`; unpermitted →
+ *  `scope_missing`; a symlink on the way → `invalid_request` `param: path`; not
+ *  a regular file → `not_found`. */
+export declare function openCallerFile(caller: FileCaller | null, raw: string | null | undefined): CallerFile;
+/** A single `bytes=` range of a `size`-byte file: `null` = serve all; throws a
+ *  416 for a malformed or unsatisfiable range. Several ranges are served whole. */
+export declare function parseRange(header: string | undefined, size: number): {
+    start: number;
+    end: number;
+} | null;
+/** `file.download`: the file's raw bytes. Errors before the head is sent throw
+ *  (the listener answers the JSON envelope; a 416 carries `Content-Range`); an
+ *  error once bytes flow destroys the socket so no JSON is ever appended. */
+export declare function serveDownload(req: IncomingMessage, res: ServerResponse, caller: FileCaller, raw: string | null): Promise<void>;

package/dist/core/storage/download.js

@@ -0,0 +1 @@
+var y=Object.defineProperty;var c=(i,t)=>y(i,"name",{value:t,configurable:!0});import{closeSync as m,constants as h,createReadStream as v,fstatSync as b,realpathSync as g}from"node:fs";import{extname as C,isAbsolute as N,join as w,relative as l,resolve as R,sep as d}from"node:path";import{pipeline as S}from"node:stream/promises";import{appsRoot as E,runtimeRoot as _,userRoot as $}from"../layout.js";import{RunError as f}from"../runs/operations.js";import{isBeneathRefusal as O,openBeneath as I}from"../spaces/open-beneath.js";import{fileRoot as T}from"../spaces/permissions.js";const j={".txt":"text/plain; charset=utf-8",".log":"text/plain; charset=utf-8",".md":"text/markdown; charset=utf-8",".csv":"text/csv; charset=utf-8",".tsv":"text/tab-separated-values; charset=utf-8",".json":"application/json",".pdf":"application/pdf",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".heic":"image/heic",".heif":"image/heif",".avif":"image/avif",".bmp":"image/bmp",".tif":"image/tiff",".tiff":"image/tiff",".mp3":"audio/mpeg",".m4a":"audio/mp4",".wav":"audio/wav",".ogg":"audio/ogg",".mp4":"video/mp4",".mov":"video/quicktime",".webm":"video/webm",".zip":"application/zip",".gz":"application/gzip",".tar":"application/x-tar",".doc":"application/msword",".docx":"application/vnd.openxmlformats-officedocument.wordprocessingml.document",".xls":"application/vnd.ms-excel",".xlsx":"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",".ppt":"application/vnd.ms-powerpoint",".pptx":"application/vnd.openxmlformats-officedocument.presentationml.presentation"},L=new Set(["text/html","image/svg+xml","application/xhtml+xml"]);function A(i){const t=j[C(i).toLowerCase()]??"application/octet-stream";return L.has(t.split(";")[0].trim().toLowerCase())?"application/octet-stream":t}c(A,"contentTypeFor");function u(i,t){const o=l(i,t);return o===""||o!==".."&&!o.startsWith(`..${d}`)&&!o.startsWith(d)}c(u,"contains");function D(i){const t=c(n=>process.platform==="darwin"?n.toLowerCase():n,"fold"),o=t(i),r=t(E());if(u(t(_()),o)||u(t(w($(),"memory")),o))return!0;if(!u(r,o))return!1;const e=l(r,o).split(d)[1];return e==="memory"||e==="conversations"}c(D,"withheld");function z(i,t){if(typeof t!="string"||!t)throw new f(400,"invalid_request","path is required","path");if(!N(t)||t.includes("\0"))throw new f(400,"invalid_request","path must be absolute","path");const o=R(t),r=c(()=>new f(404,"not_found",`no such file: ${o}`),"notFound");if(D(o))throw r();const e=T(i,o,"read");if("hidden"in e)throw r();if(!("root"in e))throw new f(403,"scope_missing",e.missing?`missing scope ${e.missing}`:`no permission names ${o}`,void 0,void 0,e.missing??void 0);const n=c(()=>new f(400,"invalid_request",`${o} meets a symlink, leaves its permitted root, or is not a regular file`,"path"),"symlink");let p;try{p=I(e.root,o,h.O_RDONLY|h.O_NONBLOCK)}catch(a){if(O(a))throw n();const s=a.code;throw s==="ENOENT"||s==="ENOTDIR"||s==="EISDIR"||s==="ENXIO"||s==="EACCES"||s==="EPERM"?r():a}try{if(process.platform!=="linux"){let s;try{s=g(o)}catch{throw r()}if(s!==w(g(e.root),l(e.root,o)))throw n()}const a=b(p);if(!a.isFile())throw r();return{fd:p,path:o,size:a.size}}catch(a){throw m(p),a}}c(z,"openCallerFile");function M(i,t){if(i===void 0)return null;const o=c(()=>new f(416,"range_not_satisfiable","range not satisfiable","range",{size:t}),"refuse"),r=/^bytes=(.+)$/i.exec(i.trim());if(!r)throw o();if(r[1].includes(","))return null;const e=/^\s*(\d*)\s*-\s*(\d*)\s*$/.exec(r[1]);if(!e||e[1]===""&&e[2]==="")throw o();let n,p;if(e[1]===""){const a=Number(e[2]);if(!Number.isSafeInteger(a)||a===0||t===0)throw o();n=Math.max(0,t-a),p=t-1}else if(n=Number(e[1]),p=e[2]===""?t-1:Math.min(Number(e[2]),t-1),!Number.isSafeInteger(n)||!Number.isSafeInteger(p)||n>=t||e[2]!==""&&Number(e[2])<n)throw o();return{start:n,end:p}}c(M,"parseRange");async function X(i,t,o,r){const e=z(o,r);let n;try{const s=i.headers.range;try{n=M(Array.isArray(s)?s[0]:s,e.size)}catch(x){throw t.setHeader("Content-Range",`bytes */${e.size}`),x}}catch(s){throw m(e.fd),s}const p={"Content-Type":A(e.path),"X-Content-Type-Options":"nosniff","Content-Security-Policy":"sandbox; default-src 'none'","Accept-Ranges":"bytes","Cache-Control":"no-store"};if(i.destroyed||t.destroyed){m(e.fd);return}if(n?t.writeHead(206,{...p,"Content-Length":String(n.end-n.start+1),"Content-Range":`bytes ${n.start}-${n.end}/${e.size}`}):t.writeHead(200,{...p,"Content-Length":String(e.size)}),e.size===0||n&&n.end<n.start){m(e.fd),t.end();return}const a=v("",{fd:e.fd,autoClose:!0,...n?{start:n.start,end:n.end}:{start:0}});try{await S(a,t)}catch{a.destroy(),t.destroy()}}c(X,"serveDownload");export{A as contentTypeFor,z as openCallerFile,M as parseRange,X as serveDownload};

package/dist/core/storage/shares.d.ts

@@ -0,0 +1,32 @@
+import type { FileCaller } from '../spaces/permissions.js';
+export declare const SHARE_SCOPE = "crtr:files:share";
+export interface ShareView {
+    share_id: string;
+    url: string;
+    source_path: string;
+    created_by: string;
+    created_at: string;
+    expires_at: string | null;
+    status: 'on' | 'off';
+}
+/** `share.create`: freeze a copy of a file the caller may read at a public URL.
+ *  Without `crtr:files:share` only the caller's own app space may be shared. The
+ *  row is inserted only once storage holds the bytes. */
+export declare function createShare(caller: FileCaller, input: {
+    path: unknown;
+    expires_at?: unknown;
+}): Promise<{
+    share_id: string;
+    url: string;
+    expires_at: string | null;
+}>;
+/** `share.list`: the shares `createdBy` created. */
+export declare function listOwnShares(createdBy: string): {
+    shares: ShareView[];
+};
+/** `share.delete`: turn the share off, then delete its stored copy. A storage
+ *  failure leaves `object_deleted_at` unset for the due-work tick to retry. */
+export declare function deleteOwnShare(createdBy: string, shareId: string): Promise<{
+    share_id: string;
+    status: 'off';
+}>;

package/dist/core/storage/shares.js

@@ -0,0 +1 @@
+var g=Object.defineProperty;var n=(e,t)=>g(e,"name",{value:t,configurable:!0});import{closeSync as x,read as v}from"node:fs";import{promisify as O}from"node:util";import{basename as $,relative as u,sep as d}from"node:path";import{Readable as _}from"node:stream";import{appsRoot as m,appSpace as A}from"../layout.js";import{RunError as s}from"../runs/operations.js";import{scopeAllowed as k}from"../scopes.js";import{invalidStorageName as q,storageClient as w,UPLOAD_MAX_BYTES as D}from"./client.js";import{contentTypeFor as E,openCallerFile as C}from"./download.js";import{getShare as R,insertShare as T,listShares as B,markShareObjectDeleted as N,turnShareOff as F}from"./tables.js";const f="crtr:files:share";function y(e,t){const r=u(e,t);return r===""||r!==".."&&!r.startsWith(`..${d}`)&&!r.startsWith(d)}n(y,"contains");function M(e){if(y(m(),e)){const t=u(m(),e).split(d)[0];if(t)return`app:${t}`}return"user"}n(M,"spaceOf");const b=n(e=>new s(503,"storage_unavailable",e,void 0,void 0,void 0,!0),"unavailable"),P=O(v);async function*U(e,t){let r=0;for(;r<t;){const a=Buffer.allocUnsafe(Math.min(1048576,t-r)),{bytesRead:i}=await P(e,a,0,a.length,r);if(i===0)throw new Error("shared file shrank while it was being copied");r+=i,yield a.subarray(0,i)}}n(U,"chunks");async function W(e,t,r,a){const i=_.from(U(t,r));let c;try{c=await fetch(e,{method:"PUT",signal:AbortSignal.timeout(11e4),headers:{"Content-Type":a,"Content-Length":String(r)},body:_.toWeb(i),duplex:"half"})}catch(p){throw b(`storage could not be reached: ${p instanceof Error?p.message:String(p)}`)}finally{i.destroy()}if(await c.body?.cancel().catch(()=>{}),!c.ok)throw b(`storage answered ${c.status} to the share upload`)}n(W,"putBytes");async function Z(e,t){if(typeof t.path!="string"||!t.path)throw new s(400,"invalid_request","path is required","path");let r;if(t.expires_at!==void 0&&t.expires_at!==null){const i=typeof t.expires_at=="string"?Date.parse(t.expires_at):NaN;if(!Number.isFinite(i))throw new s(400,"invalid_request","expires_at must be an ISO 8601 time","expires_at");if(i<=Date.now())throw new s(400,"invalid_request","expires_at must be in the future","expires_at");r=new Date(i).toISOString()}const a=C(e,t.path);try{if(!k(e.resolved,f)&&!y(A(e.app).root,a.path))throw new s(403,"scope_missing",`missing scope ${f}: without it only files in the app's own space can be shared`,void 0,void 0,f);if(a.size>D)throw new s(400,"invalid_request","file exceeds 100 MiB","path");const i=$(a.path),c=q(i);if(c)throw new s(400,"invalid_request",`file name cannot be shared: ${c}`,"path");const p=E(a.path),h=w(),o=await h.createShare({name:i,media_type:p,size:a.size,...r?{expires_at:r}:{}});try{await W(o.upload_link,a.fd,a.size,p)}catch(S){throw await h.deleteShare(o.share_id).catch(()=>{}),S}const l=o.expires_at??r??null;return T({share_id:o.share_id,source_space:M(a.path),source_path:a.path,storage_key:`${h.runtimeId}/shares/${o.share_id}/${i}`,url:o.url,created_by:e.app,created_at:new Date().toISOString(),expires_at:l}),{share_id:o.share_id,url:o.url,expires_at:l}}finally{x(a.fd)}}n(Z,"createShare");function j(e){return{share_id:e.share_id,url:e.url,source_path:e.source_path,created_by:e.created_by,created_at:e.created_at,expires_at:e.expires_at,status:e.status}}n(j,"view");function ee(e){return{shares:B(e).map(j)}}n(ee,"listOwnShares");async function te(e,t){const r=R(t);if(!r||r.created_by!==e)throw new s(404,"not_found","share not found");if(F(t),!r.object_deleted_at)try{await w().deleteShare(t),N(t)}catch(a){if(!(a instanceof s&&a.code==="storage_unavailable"))throw a}return{share_id:t,status:"off"}}n(te,"deleteOwnShare");export{f as SHARE_SCOPE,Z as createShare,te as deleteOwnShare,ee as listOwnShares};

package/dist/core/storage/tables.d.ts

@@ -0,0 +1,63 @@
+import type { DatabaseSync } from 'node:sqlite';
+/** Row helpers for the v60 file-transfer tables. Each takes an optional handle
+ *  so a caller inside `withCanvasWrite` passes its transaction. */
+export interface UploadRow {
+    upload_id: string;
+    grantee: string;
+    name: string;
+    media_type: string;
+    size: number;
+    created_at: string;
+    delete_pending_since: string | null;
+}
+export interface UploadUseRow {
+    upload_id: string;
+    run_id: string;
+    path: string;
+}
+export interface ShareRow {
+    share_id: string;
+    source_space: string;
+    source_path: string;
+    storage_key: string;
+    url: string;
+    created_by: string;
+    created_at: string;
+    expires_at: string | null;
+    status: 'on' | 'off';
+    object_deleted_at: string | null;
+}
+export declare function insertUpload(row: Omit<UploadRow, 'delete_pending_since'>, db?: DatabaseSync): void;
+export declare function getUpload(uploadId: string, db?: DatabaseSync): UploadRow | null;
+export declare function deleteUploadRow(uploadId: string, db?: DatabaseSync): void;
+/** Uploads the runtime owes storage a delete for, oldest first. */
+export declare function pendingUploadDeletes(db?: DatabaseSync): UploadRow[];
+/** Mark uploads for deletion (idempotent: keeps the first mark). */
+export declare function markUploadsDeletePending(uploadIds: readonly string[], db?: DatabaseSync, at?: string): void;
+export declare function insertUploadUses(uses: readonly UploadUseRow[], db?: DatabaseSync): void;
+/** Remove one recorded use (a file result undone after it was recorded). */
+export declare function deleteUploadUse(use: UploadUseRow, db?: DatabaseSync): void;
+/** Record the size storage actually holds for an upload created with `max_size`. */
+export declare function setUploadSize(uploadId: string, size: number, db?: DatabaseSync): void;
+/** The use recorded at `path`, if any. */
+export declare function uploadUseAt(path: string, db?: DatabaseSync): UploadUseRow | null;
+/** Delete a run's uses and mark each of its uploads that no other run uses for
+ *  deletion. Returns the upload ids newly owed a storage delete. */
+export declare function releaseRunUploads(runIds: readonly string[], db?: DatabaseSync): string[];
+/** Uploads never used 24 h after creation (the tick marks them for deletion). */
+export declare function staleUnusedUploads(before: string, db?: DatabaseSync): string[];
+export declare function insertShare(row: Omit<ShareRow, 'status' | 'object_deleted_at'>, db?: DatabaseSync): void;
+export declare function getShare(shareId: string, db?: DatabaseSync): ShareRow | null;
+/** Shares `created_by` owns; `null` (the person) lists every share. */
+export declare function listShares(createdBy: string | null, db?: DatabaseSync): ShareRow[];
+export declare function turnShareOff(shareId: string, db?: DatabaseSync): void;
+/** Turn every share `created_by` owns off; returns their ids. */
+export declare function turnSharesOffFor(createdBy: string, db?: DatabaseSync): string[];
+/** Shares `on` whose `expires_at` has passed turn `off`; returns their ids. */
+export declare function expireShares(at?: string, db?: DatabaseSync): string[];
+/** Shares `off` whose stored object storage has not confirmed deleted. */
+export declare function sharesOwingObjectDelete(db?: DatabaseSync): ShareRow[];
+export declare function markShareObjectDeleted(shareId: string, db?: DatabaseSync, at?: string): void;
+/** Mark every upload `grantee` created for deletion (app removal); returns the
+ *  ids newly marked. */
+export declare function markGranteeUploadsDeletePending(grantee: string, db?: DatabaseSync, at?: string): string[];

package/dist/core/storage/tables.js

@@ -0,0 +1,3 @@
+var l=Object.defineProperty;var a=(e,t)=>l(e,"name",{value:t,configurable:!0});import{prepared as d}from"../sqlite-statements.js";import{openDb as _}from"../canvas/db.js";const s=a(e=>e??_(),"handle"),p=a(()=>new Date().toISOString(),"now");function T(e,t){d(s(t),"INSERT INTO uploads (upload_id, grantee, name, media_type, size, created_at, delete_pending_since) VALUES (?, ?, ?, ?, ?, ?, NULL)").run(e.upload_id,e.grantee,e.name,e.media_type,e.size,e.created_at)}a(T,"insertUpload");function f(e,t){return d(s(t),"SELECT * FROM uploads WHERE upload_id = ?").get(e)??null}a(f,"getUpload");function L(e,t){d(s(t),"DELETE FROM uploads WHERE upload_id = ?").run(e)}a(L,"deleteUploadRow");function O(e){return d(s(e),"SELECT * FROM uploads WHERE delete_pending_since IS NOT NULL ORDER BY delete_pending_since, upload_id").all()}a(O,"pendingUploadDeletes");function i(e,t,n=p()){const r=d(s(t),"UPDATE uploads SET delete_pending_since = COALESCE(delete_pending_since, ?) WHERE upload_id = ?");for(const o of e)r.run(n,o)}a(i,"markUploadsDeletePending");function D(e,t){const n=d(s(t),"INSERT INTO upload_uses (upload_id, run_id, path) VALUES (?, ?, ?)");for(const r of e)n.run(r.upload_id,r.run_id,r.path)}a(D,"insertUploadUses");function x(e,t){d(s(t),"DELETE FROM upload_uses WHERE upload_id = ? AND run_id = ? AND path = ?").run(e.upload_id,e.run_id,e.path)}a(x,"deleteUploadUse");function U(e,t,n){d(s(n),"UPDATE uploads SET size = ? WHERE upload_id = ?").run(t,e)}a(U,"setUploadSize");function N(e,t){return d(s(t),"SELECT upload_id, run_id, path FROM upload_uses WHERE path = ? ORDER BY run_id LIMIT 1").get(e)??null}a(N,"uploadUseAt");function g(e,t){const n=s(t);if(!e.length)return[];const r=e.map(()=>"?").join(","),o=n.prepare(`SELECT DISTINCT upload_id FROM upload_uses WHERE run_id IN (${r})`).all(...e).map(E=>E.upload_id);n.prepare(`DELETE FROM upload_uses WHERE run_id IN (${r})`).run(...e);const u=o.filter(E=>!d(n,"SELECT 1 FROM upload_uses WHERE upload_id = ? LIMIT 1").get(E));return i(u,n),u}a(g,"releaseRunUploads");function A(e,t){return d(s(t),`SELECT upload_id FROM uploads u WHERE delete_pending_since IS NULL AND created_at <= ?
+    AND NOT EXISTS (SELECT 1 FROM upload_uses x WHERE x.upload_id = u.upload_id)`).all(e).map(n=>n.upload_id)}a(A,"staleUnusedUploads");function C(e,t){d(s(t),`INSERT INTO shares (share_id, source_space, source_path, storage_key, url, created_by, created_at, expires_at, status, object_deleted_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'on', NULL)`).run(e.share_id,e.source_space,e.source_path,e.storage_key,e.url,e.created_by,e.created_at,e.expires_at)}a(C,"insertShare");function H(e,t){return d(s(t),"SELECT * FROM shares WHERE share_id = ?").get(e)??null}a(H,"getShare");function W(e,t){return e===null?d(s(t),"SELECT * FROM shares ORDER BY created_at DESC, share_id").all():d(s(t),"SELECT * FROM shares WHERE created_by = ? ORDER BY created_at DESC, share_id").all(e)}a(W,"listShares");function c(e,t){d(s(t),"UPDATE shares SET status = 'off' WHERE share_id = ?").run(e)}a(c,"turnShareOff");function m(e,t){const n=s(t),r=d(n,"SELECT share_id FROM shares WHERE created_by = ? AND status = 'on'").all(e).map(o=>o.share_id);return d(n,"UPDATE shares SET status = 'off' WHERE created_by = ? AND status = 'on'").run(e),r}a(m,"turnSharesOffFor");function M(e=p(),t){const n=s(t),r=d(n,"SELECT share_id FROM shares WHERE status = 'on' AND expires_at IS NOT NULL AND expires_at <= ?").all(e).map(o=>o.share_id);for(const o of r)c(o,n);return r}a(M,"expireShares");function F(e){return d(s(e),"SELECT * FROM shares WHERE status = 'off' AND object_deleted_at IS NULL ORDER BY created_at, share_id").all()}a(F,"sharesOwingObjectDelete");function I(e,t,n=p()){d(s(t),"UPDATE shares SET object_deleted_at = COALESCE(object_deleted_at, ?) WHERE share_id = ?").run(n,e)}a(I,"markShareObjectDeleted");function b(e,t,n=p()){const r=s(t),o=d(r,"SELECT upload_id FROM uploads WHERE grantee = ? AND delete_pending_since IS NULL").all(e).map(u=>u.upload_id);return i(o,r,n),o}a(b,"markGranteeUploadsDeletePending");export{L as deleteUploadRow,x as deleteUploadUse,M as expireShares,H as getShare,f as getUpload,C as insertShare,T as insertUpload,D as insertUploadUses,W as listShares,b as markGranteeUploadsDeletePending,I as markShareObjectDeleted,i as markUploadsDeletePending,O as pendingUploadDeletes,g as releaseRunUploads,U as setUploadSize,F as sharesOwingObjectDelete,A as staleUnusedUploads,c as turnShareOff,m as turnSharesOffFor,N as uploadUseAt};