@north-light/cli 0.3.529 → 0.3.531

package/dist/core/graph/access.d.ts

@@ -1,54 +1,54 @@
-import type { DatabaseSync } from 'node:sqlite';
 import type { ObjectRow, Reader } from './types.js';
+import type { CanvasDb } from '../canvas/db.js';
 /** The object's owners, nearest first, ending at its space; empty when the object is a space.
  *  CROSS JOIN pins the chain as the outer loop: left to the planner, it scans every
  *  object and probes the chain, which made each read check cost milliseconds. */
-export declare function ownerChain(db: DatabaseSync, object: ObjectRow): ObjectRow[];
-export declare function spaceOf(db: DatabaseSync, object: ObjectRow): ObjectRow;
+export declare function ownerChain(db: CanvasDb, object: ObjectRow): Promise<ObjectRow[]>;
+export declare function spaceOf(db: CanvasDb, object: ObjectRow): Promise<ObjectRow>;
 /** A shipped document: one a package reconciler owns, read from its package file
  *  (`documents.source_path` is set). Only the reconciler writes it. */
-export declare function isShipped(db: DatabaseSync, object: ObjectRow): boolean;
+export declare function isShipped(db: CanvasDb, object: ObjectRow): Promise<boolean>;
 /** The apps whose tools a run may use, `crtr` last. On a local runtime (v0) every
  *  installed, enabled plugin's tools are usable by every run, and an installed
  *  plugin is exactly an app holding live shipped documents. Hosted grants narrow
  *  this per reader later; `mayUseTools` is the one question both ask. */
-export declare function toolApps(db: DatabaseSync, reader: Reader): ObjectRow[];
+export declare function toolApps(db: CanvasDb, reader: Reader): Promise<ObjectRow[]>;
 /** May `reader` use any of `app`'s tool groups? v0: every run may use every installed plugin's tools. */
-export declare function mayUseTools(_db: DatabaseSync, _reader: Reader, app: ObjectRow): boolean;
+export declare function mayUseTools(_db: CanvasDb, _reader: Reader, app: ObjectRow): boolean;
 /** Whether `scopes` hold a provider-group scope `<provider>:<group>` of `app`: what a run needs to call that app's provider commands
  *  (`requireGroup`). The provider id is the app's client id. */
-export declare function holdsProviderGroup(db: DatabaseSync, scopes: readonly string[], app: ObjectRow): boolean;
+export declare function holdsProviderGroup(db: CanvasDb, scopes: readonly string[], app: ObjectRow): Promise<boolean>;
 /** Whether this reader may register, publish or watch as an object owned by `owner`. */
-export declare function mayActAs(db: DatabaseSync, reader: Reader, owner: ObjectRow): boolean;
+export declare function mayActAs(db: CanvasDb, reader: Reader, owner: ObjectRow): Promise<boolean>;
 /** Run confinement for a node acting on a custom object of its app (Silas, 2026-09-30):
  *  a node reaches an object registered in its own run, or when neither run is isolated.
  *  An object the person or the app's server registered is reached by nodes outside
  *  isolation only. Any other reader is unchanged. */
-export declare function customReachable(db: DatabaseSync, reader: Reader, object: ObjectRow): boolean;
+export declare function customReachable(db: CanvasDb, reader: Reader, object: ObjectRow): Promise<boolean>;
 /** The `crtr:objects:*` targets an object belongs to, from its owner chain (rulings R5):
  *  person space → `user`; under an app's profile → `profile:<id>`; a node of an app or a custom
  *  object → `app:<x>`; any node (local, or a stub of one of the account's nodes) → `node`.
  *  App documents and the profile itself stay under the memory scopes; a repo has no target.
  *  The app's own `app:<x>` is left out: its own objects need no scope. */
-export declare function objectsTargets(db: DatabaseSync, object: ObjectRow, appGrantee: string): string[];
+export declare function objectsTargets(db: CanvasDb, object: ObjectRow, appGrantee: string): Promise<string[]>;
 /** Whether a non-person reader's scopes hold `crtr:objects:<verb>:<t>` for a target t of `object`.
  *  False for a person and for a revoked grant (`scopes === null`). `covers` is exact equality here. */
-export declare function holdsObjectsScope(db: DatabaseSync, reader: Reader, verb: 'read' | 'watch' | 'link' | 'write', object: ObjectRow): boolean;
+export declare function holdsObjectsScope(db: CanvasDb, reader: Reader, verb: 'read' | 'watch' | 'link' | 'write', object: ObjectRow): Promise<boolean>;
 /** Whether the watch `watcher` → `object` that `app` made through `link` still authorizes delivering `object`'s events to `watcher` past the
  *  watcher's read gate: `app` owns `object` (directly, or through its profile: `mayActAs`) and, when its `scopes` are known, they hold
  *  `crtr:objects:link:<t>` for the watcher. Null `scopes` (a stub of a remote object: the home already checked the link) skip the scope. It grants
  *  delivery of this one object's events only; nothing about reading it. */
-export declare function linkAuthorizes(db: DatabaseSync, app: ObjectRow, scopes: readonly string[] | null, object: ObjectRow, watcher: ObjectRow): boolean;
+export declare function linkAuthorizes(db: CanvasDb, app: ObjectRow, scopes: readonly string[] | null, object: ObjectRow, watcher: ObjectRow): Promise<boolean>;
 /** Callers turn `false` into `not_found`. A person reader reads everything. An app's
  *  shipped documents are read by any run that may use that app's tools. */
-export declare function canRead(db: DatabaseSync, reader: Reader, object: ObjectRow): boolean;
+export declare function canRead(db: CanvasDb, reader: Reader, object: ObjectRow): Promise<boolean>;
 /** `canRead` for many readers of one object: the owner chain is walked once. */
-export declare function readCheck(db: DatabaseSync, object: ObjectRow): (reader: Reader) => boolean;
+export declare function readCheck(db: CanvasDb, object: ObjectRow): Promise<(reader: Reader) => Promise<boolean>>;
 /** Always asked of the space, also for a person: a repo never owns a non-public
  *  document, whoever asks. A shipped document is changed by nobody, its own app
  *  included — only the package reconciler writes it, and it asks no reader. */
-export declare function canChange(db: DatabaseSync, reader: Reader, object: ObjectRow): boolean;
+export declare function canChange(db: CanvasDb, reader: Reader, object: ObjectRow): Promise<boolean>;
 /** The own-app memory scope a narrowed run lacks for `access` on a document, or null (see `missingOwnMemoryScope`). */
-export declare function missingMemoryScope(db: DatabaseSync, reader: Reader, object: ObjectRow, access: 'read' | 'rw'): string | null;
+export declare function missingMemoryScope(db: CanvasDb, reader: Reader, object: ObjectRow, access: 'read' | 'rw'): Promise<string | null>;
 /** The same for a document about to be created under `owner`. */
-export declare function missingMemoryScopeUnder(db: DatabaseSync, reader: Reader, owner: ObjectRow, access: 'read' | 'rw'): string | null;
+export declare function missingMemoryScopeUnder(db: CanvasDb, reader: Reader, owner: ObjectRow, access: 'read' | 'rw'): Promise<string | null>;

package/dist/core/graph/access.js

@@ -1,8 +1,8 @@
-var R=Object.defineProperty;var s=(n,t)=>R(n,"name",{value:t,configurable:!0});import{prepared as f}from"../sqlite-statements.js";import{covers as O}from"@north-light/identity";import{objectPlace as x,runPlace as N,runsSeeEachOther as g}from"../runs/confinement.js";import{missingOwnMemoryScope as E}from"./spaces/own-memory.js";import{SPACES as L,identityOf as u}from"./spaces/index.js";import{insideRepo as C}from"./spaces/repo.js";function T(n,t){return f(n,`WITH RECURSIVE chain(rowid, depth) AS (
+var R=Object.defineProperty;var s=(n,t)=>R(n,"name",{value:t,configurable:!0});import{covers as S}from"@north-light/identity";import{objectPlace as O,runPlace as x,runsSeeEachOther as N}from"../runs/confinement.js";import{missingOwnMemoryScope as h}from"./spaces/own-memory.js";import{SPACES as g,identityOf as l}from"./spaces/index.js";import{insideRepo as L}from"./spaces/repo.js";async function C(n,t){return await n.prepare(`WITH RECURSIVE chain(rowid, depth) AS (
       SELECT owner, 1 FROM objects WHERE rowid = ? AND owner IS NOT NULL
       UNION ALL
       SELECT o.owner, c.depth + 1 FROM objects o JOIN chain c ON o.rowid = c.rowid WHERE o.owner IS NOT NULL
-    ) SELECT o.* FROM chain c CROSS JOIN objects o WHERE o.rowid = c.rowid ORDER BY c.depth`).all(t.rowid)}s(T,"ownerChain");function J(n,t){return c(n,t).space}s(J,"spaceOf");function c(n,t){const e=T(n,t),p=e.length?e[e.length-1]:t,o=L[p.type];if(!o)throw new Error(`${t.type} ${t.id} has no space: its owner chain ends at ${p.type} ${p.id}`);const r=e.length?[...e.slice(0,-1).reverse(),t]:[];return{space:p,path:r,impl:o}}s(c,"locate");function m(n,t){return t.type!=="document"?!1:f(n,"SELECT source_path FROM documents WHERE object = ?").get(t.rowid)?.source_path!=null}s(m,"isShipped");function B(n,t){return f(n,`SELECT a.* FROM objects a WHERE a.type = 'app' AND a.deleted_at IS NULL AND EXISTS (
+    ) SELECT o.* FROM chain c CROSS JOIN objects o WHERE o.rowid = c.rowid ORDER BY c.depth`).all(t.rowid)}s(C,"ownerChain");async function P(n,t){return(await r(n,t)).space}s(P,"spaceOf");async function r(n,t){const a=await C(n,t),i=a.length?a[a.length-1]:t,e=g[i.type];if(!e)throw new Error(`${t.type} ${t.id} has no space: its owner chain ends at ${i.type} ${i.id}`);const o=a.length?[...a.slice(0,-1).reverse(),t]:[];return{space:i,path:o,impl:e}}s(r,"locate");async function y(n,t){return t.type!=="document"?!1:(await n.prepare("SELECT source_path FROM documents WHERE object = ?").get(t.rowid))?.source_path!=null}s(y,"isShipped");async function k(n,t){return(await n.prepare(`SELECT a.* FROM objects a WHERE a.type = 'app' AND a.deleted_at IS NULL AND EXISTS (
       SELECT 1 FROM objects o JOIN documents d ON d.object = o.rowid
       WHERE o.owner = a.rowid AND o.type = 'document' AND o.deleted_at IS NULL AND d.source_path IS NOT NULL)
-    ORDER BY a.name = 'crtr', a.name`).all().filter(p=>h(n,t,p))}s(B,"toolApps");function h(n,t,e){return e.type==="app"}s(h,"mayUseTools");const A=s(n=>n.class!=="app"||n.place!==void 0,"isRun");function I(n,t,e){const p=`${u(n,e).external_id.replace(/^app:/,"")}:`;return t.some(o=>o.startsWith(p)&&!o.slice(p.length).includes(":"))}s(I,"holdsProviderGroup");function _(n,t,e){return t.class==="person"?!0:t.class==="object"?t.owner.rowid===e.rowid:t.class==="app"?t.app.rowid===e.rowid||e.type==="profile"&&e.owner===t.app.rowid:t.app.rowid===e.rowid||e.type==="profile"&&t.profile?.rowid===e.rowid||e.type==="repo"&&C(n,t,e,"rw")}s(_,"mayActAs");function M(n,t,e){if(t.class!=="node"&&!(t.class==="app"&&t.place!==void 0))return!0;const p=t.class==="app"?t.place:N(t.node.id,n);if(p===null)return!0;const o=x(e.rowid,n);return o===null?!p.isolated:g(p,o)}s(M,"customReachable");const w=s(n=>n.type.includes("."),"isCustom");function Y(n,t,e){return d(n,c(n,t),t,e)}s(Y,"objectsTargets");function d(n,{space:t,path:e},p,o){const r=[];if(t.type==="person")r.push("user");else if(t.type==="app"&&e.length>0){const i=e[0];if(i.type==="profile")e.length>1&&r.push(`profile:${u(n,i).external_id}`);else if(i.type==="node"||w(i)){const l=u(n,t).external_id;l!==o&&r.push(l)}}return p.type==="node"&&r.push("node"),r}s(d,"targetsOf");function a(n,t,e,p,o){if(t.class==="person"||t.scopes===null)return!1;const r=t.scopes;if(r.length===0||p.space.type==="app"&&t.app.rowid===p.space.rowid)return!1;const i=u(n,t.app).external_id;return d(n,p,o,i).some(l=>{const y=`crtr:objects:${e}:${l}`;return r.some(S=>O(S,y))})}s(a,"holdsInLocated");function U(n,t,e,p){return t.class==="person"||t.scopes===null?!1:a(n,t,e,c(n,p),p)}s(U,"holdsObjectsScope");function z(n,t,e,p,o){const r=p.owner===null?null:n.prepare("SELECT * FROM objects WHERE rowid = ?").get(p.owner)??null;if(r===null)return!1;const i={class:"app",app:t,scopes:e??[]};return _(n,i,r)?e===null||U(n,i,"link",o):!1}s(z,"linkAuthorizes");function G(n,t,e){return W(n,e)(t)}s(G,"canRead");function W(n,t){let e=null,p=null;return o=>{if(o.class==="person")return!0;if(e??=c(n,t),e.space.type==="app"&&e.path.length>0){if(p??=m(n,t),p&&h(n,o,e.space))return!0;if(w(t)){if(o.app.rowid===e.space.rowid&&!M(n,o,t))return!1;if(o.app.rowid!==e.space.rowid&&o.scopes!==null&&h(n,o,e.space)&&(t.privacy==="public"||A(o)&&I(n,o.scopes,e.space)))return!0}}return a(n,o,"read",e,t)||o.class==="object"&&w(o.object)&&a(n,o,"watch",e,t)?!0:e.impl.canRead(n,o,e.space,e.path,t)}}s(W,"readCheck");function V(n,t,e){if(m(n,e))return!1;const p=c(n,e);if(a(n,t,"write",p,e))return!0;const{space:o,path:r,impl:i}=p;return i.canChange(n,t,o,r,e)}s(V,"canChange");function X(n,t,e,p){if(t.class==="person")return null;const{space:o,path:r}=c(n,e);return o.type==="app"&&t.app.rowid===o.rowid?E(n,t,o,r,e,p):null}s(X,"missingMemoryScope");function q(n,t,e,p){if(t.class==="person")return null;const o=c(n,e),{space:r}=o;return r.type!=="app"||t.app.rowid!==r.rowid?null:E(n,t,r,o.path.length===0?[e]:[...o.path],null,p)}s(q,"missingMemoryScopeUnder");export{V as canChange,G as canRead,M as customReachable,U as holdsObjectsScope,I as holdsProviderGroup,m as isShipped,z as linkAuthorizes,_ as mayActAs,h as mayUseTools,X as missingMemoryScope,q as missingMemoryScopeUnder,Y as objectsTargets,T as ownerChain,W as readCheck,J as spaceOf,B as toolApps};
+    ORDER BY a.name = 'crtr', a.name`).all()).filter(i=>f(n,t,i))}s(k,"toolApps");function f(n,t,a){return a.type==="app"}s(f,"mayUseTools");const T=s(n=>n.class!=="app"||n.place!==void 0,"isRun");async function A(n,t,a){const i=`${(await l(n,a)).external_id.replace(/^app:/,"")}:`;return t.some(e=>e.startsWith(i)&&!e.slice(i.length).includes(":"))}s(A,"holdsProviderGroup");async function I(n,t,a){return t.class==="person"?!0:t.class==="object"?t.owner.rowid===a.rowid:t.class==="app"?t.app.rowid===a.rowid||a.type==="profile"&&a.owner===t.app.rowid:t.app.rowid===a.rowid||a.type==="profile"&&t.profile?.rowid===a.rowid||a.type==="repo"&&await L(n,t,a,"rw")}s(I,"mayActAs");async function _(n,t,a){if(t.class!=="node"&&!(t.class==="app"&&t.place!==void 0))return!0;const i=t.class==="app"?t.place:await x(t.node.id,n);if(i===null)return!0;const e=await O(a.rowid,n);return e===null?!i.isolated:N(i,e)}s(_,"customReachable");const w=s(n=>n.type.includes("."),"isCustom");async function J(n,t,a){return await E(n,await r(n,t),t,a)}s(J,"objectsTargets");async function E(n,{space:t,path:a},i,e){const o=[];if(t.type==="person")o.push("user");else if(t.type==="app"&&a.length>0){const p=a[0];if(p.type==="profile")a.length>1&&o.push(`profile:${(await l(n,p)).external_id}`);else if(p.type==="node"||w(p)){const c=(await l(n,t)).external_id;c!==e&&o.push(c)}}return i.type==="node"&&o.push("node"),o}s(E,"targetsOf");async function u(n,t,a,i,e){if(t.class==="person"||t.scopes===null)return!1;const o=t.scopes;if(o.length===0||i.space.type==="app"&&t.app.rowid===i.space.rowid)return!1;const p=(await l(n,t.app)).external_id;return(await E(n,i,e,p)).some(c=>{const m=`crtr:objects:${a}:${c}`;return o.some(d=>S(d,m))})}s(u,"holdsInLocated");async function M(n,t,a,i){return t.class==="person"||t.scopes===null?!1:await u(n,t,a,await r(n,i),i)}s(M,"holdsObjectsScope");async function B(n,t,a,i,e){const o=i.owner===null?null:await n.prepareUncached("SELECT * FROM objects WHERE rowid = ?").get(i.owner)??null;if(o===null)return!1;const p={class:"app",app:t,scopes:a??[]};return await I(n,p,o)?a===null||await M(n,p,"link",e):!1}s(B,"linkAuthorizes");async function Y(n,t,a){return(await U(n,a))(t)}s(Y,"canRead");async function U(n,t){let a=null,i=null;return async e=>{if(e.class==="person")return!0;if(a??=await r(n,t),a.space.type==="app"&&a.path.length>0){if(i??=await y(n,t),i&&f(n,e,a.space))return!0;if(w(t)){if(e.app.rowid===a.space.rowid&&!await _(n,e,t))return!1;if(e.app.rowid!==a.space.rowid&&e.scopes!==null&&f(n,e,a.space)&&(t.privacy==="public"||T(e)&&await A(n,e.scopes,a.space)))return!0}}return await u(n,e,"read",a,t)||e.class==="object"&&w(e.object)&&await u(n,e,"watch",a,t)?!0:await a.impl.canRead(n,e,a.space,a.path,t)}}s(U,"readCheck");async function z(n,t,a){if(await y(n,a))return!1;const i=await r(n,a);if(await u(n,t,"write",i,a))return!0;const{space:e,path:o,impl:p}=i;return await p.canChange(n,t,e,o,a)}s(z,"canChange");async function G(n,t,a,i){if(t.class==="person")return null;const{space:e,path:o}=await r(n,a);return e.type==="app"&&t.app.rowid===e.rowid?await h(n,t,e,o,a,i):null}s(G,"missingMemoryScope");async function V(n,t,a,i){if(t.class==="person")return null;const e=await r(n,a),{space:o}=e;return o.type!=="app"||t.app.rowid!==o.rowid?null:await h(n,t,o,e.path.length===0?[a]:[...e.path],null,i)}s(V,"missingMemoryScopeUnder");export{z as canChange,Y as canRead,_ as customReachable,M as holdsObjectsScope,A as holdsProviderGroup,y as isShipped,B as linkAuthorizes,I as mayActAs,f as mayUseTools,G as missingMemoryScope,V as missingMemoryScopeUnder,J as objectsTargets,C as ownerChain,U as readCheck,P as spaceOf,k as toolApps};

package/dist/core/graph/custom.d.ts

@@ -1,7 +1,7 @@
-import type { DatabaseSync } from 'node:sqlite';
 import type { Level, ObjectRow, Privacy, Reader } from './types.js';
 import { customReachable, mayActAs } from './access.js';
 import { onQueueSignal } from './receivers.js';
+import type { CanvasDb } from '../canvas/db.js';
 export { customReachable, mayActAs, onQueueSignal };
 export type CustomReceiver = 'queue' | {
     url: string;
@@ -35,7 +35,7 @@ export interface QueueLine {
     created_at: string;
 }
 /** Register a kind and a named instance in the caller's write transaction. */
-export declare function registerCustomObject(db: DatabaseSync, reader: Reader, input: {
+export declare function registerCustomObject(db: CanvasDb, reader: Reader, input: {
     kind: string;
     name: string;
     owner: ObjectRow;
@@ -45,12 +45,12 @@ export declare function registerCustomObject(db: DatabaseSync, reader: Reader, i
     receiver?: CustomReceiver | null;
     rotateToken?: boolean;
     privacy?: Privacy;
-}): {
+}): Promise<{
     object: ObjectRow;
     token?: string;
     created: boolean;
     changed: string[];
-};
+}>;
 export type KindSource = 'register' | 'manifest' | 'peer';
 export type KindChange = 'events' | 'description' | 'read';
 /**
@@ -61,7 +61,7 @@ export type KindChange = 'events' | 'description' | 'read';
  * `manifest` or `register` row is `kind_owned`. `read_json` is written only by `manifest`. A catalog is replaced,
  * never merged. Runs in the caller's write transaction.
  */
-export declare function upsertKind(db: DatabaseSync, input: {
+export declare function upsertKind(db: CanvasDb, input: {
     name: string;
     owner: ObjectRow;
     description: string;
@@ -70,26 +70,26 @@ export declare function upsertKind(db: DatabaseSync, input: {
         command: string[];
     } | null;
     source: KindSource;
-}): {
+}): Promise<{
     outcome: 'inserted' | 'updated' | 'unchanged' | 'skipped';
     changed: KindChange[];
-};
-export declare function publishCustom(db: DatabaseSync, object: ObjectRow, actor: ObjectRow | null, input: {
+}>;
+export declare function publishCustom(db: CanvasDb, object: ObjectRow, actor: ObjectRow | null, input: {
     event: string;
     summary: string;
     state?: unknown;
     cause?: string;
-}): {
+}): Promise<{
     message_id: string | null;
     delivered: number;
     depth: number;
-};
-export declare function unregisterCustomObject(db: DatabaseSync, object: ObjectRow, actor: ObjectRow | null): void;
-export declare function pendingFor(db: DatabaseSync, object: ObjectRow, afterSeq?: number): QueueLine[];
+}>;
+export declare function unregisterCustomObject(db: CanvasDb, object: ObjectRow, actor: ObjectRow | null): Promise<void>;
+export declare function pendingFor(db: CanvasDb, object: ObjectRow, afterSeq?: number): Promise<QueueLine[]>;
 /** A claimed push delivery has the identical document as a pending queue delivery. */
-export declare function pushLineFor(db: DatabaseSync, deliveryId: string): QueueLine | null;
-export declare function acknowledge(db: DatabaseSync, object: ObjectRow, deliveryIds: string[]): {
+export declare function pushLineFor(db: CanvasDb, deliveryId: string): Promise<QueueLine | null>;
+export declare function acknowledge(db: CanvasDb, object: ObjectRow, deliveryIds: string[]): Promise<{
     acknowledged: number;
     unknown?: string[];
-};
-export declare function verifyPublishToken(db: DatabaseSync, object: ObjectRow, token: string): boolean;
+}>;
+export declare function verifyPublishToken(db: CanvasDb, object: ObjectRow, token: string): Promise<boolean>;

package/dist/core/graph/custom.js

@@ -1,12 +1,12 @@
-var x=Object.defineProperty;var m=(e,t)=>x(e,"name",{value:t,configurable:!0});import{prepared as a}from"../sqlite-statements.js";import{createHash as J,randomBytes as P,timingSafeEqual as q}from"node:crypto";import{CrtrError as j,usage as p}from"../errors.js";import{ExitCode as O}from"../../types.js";import{createObject as F,liveDocumentNamed as M}from"./objects.js";import{invalidateCustomKind as D}from"./kinds/registry.js";import{customReachable as k,mayActAs as L}from"./access.js";import{publish as N,HOP_LIMIT as B,HopLimitError as K}from"./events.js";import{checkoutsForCwd as T}from"./repo-sync/repos.js";import{onQueueSignal as V,signalQueue as R}from"./receivers.js";import{receiverEndpoint as G,isPublicReceiverAddress as Q}from"./receiver-url.js";import{isIP as Y}from"node:net";import{KIND as H,LOCAL as I,MAX_KIND_EVENTS as z,RESERVED_KIND_ROOTS as X,eventCatalogReasons as Z}from"../plugin-objects-manifest.js";const ee=["public","friends","private"];function w(e,t){throw new j(e,t,O.GENERAL)}m(w,"conflict");function A(e){return J("sha256").update(e).digest("hex")}m(A,"hash");function W(){return`crtr_pub_${P(32).toString("base64url")}`}m(W,"issueToken");function te(e){if(e==null)return null;if(e==="queue")return JSON.stringify(e);if(typeof e!="object"||Array.isArray(e))throw p("invalid custom receiver; expected queue, an https url, or argv and absolute cwd");if("url"in e&&typeof e.url=="string")try{const s=G(e.url).hostname.replace(/^\[|\]$/g,"");if(Y(s)&&!Q(s))throw new Error("non-public IP address");return JSON.stringify({url:e.url})}catch(t){throw p(`invalid custom receiver: ${String(t)}`)}if("argv"in e&&Array.isArray(e.argv)&&e.argv.length>0&&e.argv.every(t=>typeof t=="string")&&typeof e.cwd=="string"&&e.cwd.startsWith("/"))return JSON.stringify(e);throw p("invalid custom receiver; url must be https and argv requires a command and absolute cwd")}m(te,"receiverJson");function ge(e,t,s){const{kind:n,name:i,owner:o,description:d,events:l,receiver:c,rotateToken:h,privacy:f}=s;if(f!==void 0&&!ee.includes(f))throw p(`invalid privacy ${JSON.stringify(f)}`);if(L(e,t,o)||w("forbidden",`cannot act as ${o.id}`),!H.test(n)||X.includes(n.split(".")[0]))throw p(`invalid or reserved kind ${n}`);if(!i.trim()||i!==i.trim()||i.includes("\0"))throw p(`invalid object name ${JSON.stringify(i)}`);const E=te(c);if(c!=="queue"&&c!==null&&c!==void 0&&"argv"in c&&t.class!=="person"&&t.class!=="node"&&w("argv_forbidden","argv receiver requires a person or node principal"),l===void 0){const u=a(e,"SELECT source FROM object_kinds WHERE name = ?").get(n);if(u?.source!=="manifest"&&u?.source!=="peer")throw p("events is required unless the kind is declared by an installed plugin")}else if(Object.keys(l).length>z||Object.entries(l).some(([u,g])=>!I.test(u)||!Number.isInteger(g?.level)||g.level<1||g.level>10||g.supersedes!==void 0&&typeof g.supersedes!="boolean"||g.ends_wait!==void 0&&typeof g.ends_wait!="boolean"))throw p("invalid custom event catalog");const r=M(e,o.rowid,i);if(r&&!k(e,t,r)&&w("forbidden",`cannot act as ${o.id}`),r&&t.class!=="person"&&t.class!=="node"){const u=a(e,"SELECT receiver_json FROM custom_objects WHERE object = ?").get(r.rowid)?.receiver_json;u&&typeof JSON.parse(u)=="object"&&"argv"in JSON.parse(u)&&w("argv_forbidden","argv receiver requires a person or node principal")}r&&r.type!==n&&w("name_taken",`${o.name}/${i} is already held by ${r.id}`);const v=l===void 0?null:ne(e,{name:n,owner:o,description:d,events:l,read:null,source:"register"});if(!r){const u=F(e,{type:n,kind:null,owner:o.rowid,privacy:f??"public",name:i,preview:""}),g=W();return a(e,`INSERT INTO custom_objects (object, description, receiver_json, token_hash)
-      VALUES (?, ?, ?, ?)`).run(u.rowid,d,E,A(g)),t.class==="node"&&a(e,"UPDATE custom_objects SET registered_by = ? WHERE object = ?").run(t.node.id,u.rowid),E!==null&&a(e,"UPDATE objects SET reception = 2 WHERE rowid = ?").run(u.rowid),N(e,{event:"created",object:u,actor:t.class==="object"?t.object:t.class==="person"?t.person:t.class==="app"?t.app:t.node,attrs:{}},$=>T(e,$)),{object:u,token:g,created:!0,changed:[]}}const y=a(e,"SELECT description, receiver_json FROM custom_objects WHERE object = ?").get(r.rowid);y||w("name_taken",`${o.name}/${i} is not a custom object`);const _=[];if(y.description!==d&&_.push("description"),y.receiver_json!==E&&_.push("receiver"),v?.changed.includes("events")&&_.push("events"),v?.changed.includes("description")&&!_.includes("description")&&_.push("description"),f!==void 0&&r.privacy!==f&&_.push("privacy"),h&&_.push("token"),_.length===0)return{object:r,created:!1,changed:_};const S=h?W():void 0,b=_.includes("privacy")?{...r,privacy:f}:r;if(b!==r&&a(e,"UPDATE objects SET privacy = ? WHERE rowid = ?").run(f,r.rowid),a(e,"UPDATE custom_objects SET description = ?, receiver_json = ?, token_hash = COALESCE(?, token_hash) WHERE object = ?").run(d,E,S===void 0?null:A(S),r.rowid),a(e,"UPDATE objects SET reception = ? WHERE rowid = ?").run(E===null?0:2,r.rowid),y.receiver_json!==E){const u=Date.now();if(E===null){const g=a(e,`UPDATE deliveries SET canceled_at = ?, updated_at = ?
-        WHERE destination_id = ? AND state = 'pending' AND canceled_at IS NULL`).run(u,u,r.id);a(e,"UPDATE custom_objects SET dropped = dropped + ? WHERE object = ?").run(g.changes,r.rowid)}else a(e,`UPDATE deliveries SET next_attempt_at = ?, updated_at = ?
-        WHERE destination_id = ? AND state = 'pending' AND canceled_at IS NULL`).run(E==='"queue"'?null:u,u,r.id);R(r.id)}return h&&R(r.id),N(e,{event:"configured",object:b,actor:t.class==="object"?t.object:t.class==="person"?t.person:t.class==="app"?t.app:t.node,attrs:{changed:_.join(",")}},u=>T(e,u)),{object:b,...S===void 0?{}:{token:S},created:!1,changed:_}}m(ge,"registerCustomObject");function ne(e,t){const{name:s,owner:n,description:i,events:o,read:d,source:l}=t;if(!H.test(s))throw p(`invalid kind ${s}`);if(Z(o,s).length>0)throw p("invalid custom event catalog");const c=a(e,"SELECT owner, description, events_json, read_json, source, declared FROM object_kinds WHERE name = ?").get(s),h=U(o),f=l==="manifest"&&d!==null?JSON.stringify({command:d.command}):null,E=new Date().toISOString();if(!c)return a(e,`INSERT INTO object_kinds (name, owner, description, events_json, created_at, updated_at, read_json, source, declared)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, 1)`).run(s,n.rowid,i,h,E,E,f,l),D(e,s),{outcome:"inserted",changed:[]};const r=c.owner===n.rowid;if(l==="peer"){if(c.source!=="peer")return{outcome:"skipped",changed:[]}}else if(c.source!=="peer"&&(r||w("kind_owned",`${s} belongs to another owner`),l==="register"&&c.source==="manifest"))return{outcome:"skipped",changed:[]};const v=[];return U(JSON.parse(c.events_json))!==h&&v.push("events"),c.description!==i&&v.push("description"),(c.read_json??null)!==f&&v.push("read"),v.length===0&&r&&c.source===l&&c.declared===1?{outcome:"unchanged",changed:v}:(a(e,"UPDATE object_kinds SET owner = ?, description = ?, events_json = ?, read_json = ?, source = ?, declared = 1, updated_at = ? WHERE name = ?").run(n.rowid,i,h,f,l,E,s),D(e,s),{outcome:"updated",changed:v})}m(ne,"upsertKind");function he(e,t,s,n){const i=a(e,"SELECT events_json FROM object_kinds WHERE name = ?").get(t.type);if(!i||t.deleted_at!==null)throw p(`${t.id} is not a live custom object`);const o=JSON.parse(i.events_json);if(!I.test(n.event)||!Object.hasOwn(o,n.event))throw new j("unknown_event",`${t.type} declares ${Object.keys(o).join(", ")}, not ${n.event}`,O.USAGE,{declared:Object.keys(o),event:n.event});if(typeof n.summary!="string")throw p("summary must be text");const d=n.state===void 0?null:JSON.stringify(n.state);if(n.state!==void 0&&d===void 0)throw p("state must be JSON-serializable");if(Buffer.byteLength(JSON.stringify({summary:n.summary,...n.state===void 0?{}:{state:n.state}}))>64*1024)throw new j("body_too_large","custom event summary and state exceed 64 KiB",O.USAGE);if(d!==null&&Buffer.byteLength(d)>64*1024)throw p("state exceeds 64 KiB");const l=n.cause??null,c=l===null?null:a(e,`SELECT depth FROM messages WHERE message_id = ?
-    UNION ALL SELECT depth FROM message_causes WHERE message_id = ? LIMIT 1`).get(l,l);if(l!==null&&c===void 0)throw new j("unknown_cause",`no message ${l}`,O.USAGE);if(c&&c.depth>=B)throw new K(c.depth+1);const h=new Date().toISOString();return a(e,"UPDATE custom_objects SET summary = ?, state_json = ?, published_at = ? WHERE object = ?").run(n.summary,d,h,t.rowid),a(e,"UPDATE objects SET preview = ? WHERE rowid = ?").run(n.summary.split(`
-`)[0],t.rowid),N(e,{event:`${t.type}.${n.event}`,object:t,actor:s,attrs:{},messageBody:{summary:n.summary,...n.state===void 0?{}:{state:n.state}},...n.cause===void 0?{}:{cause:n.cause}},f=>T(e,f))}m(he,"publishCustom");function ve(e,t,s){if(t.deleted_at!==null)return;N(e,{event:"deleted",object:t,actor:s,attrs:{}},i=>T(e,i));const n=new Date().toISOString();a(e,"UPDATE objects SET deleted_at = ?, reception = 0 WHERE rowid = ?").run(n,t.rowid),a(e,"UPDATE deliveries SET canceled_at = ?, updated_at = ? WHERE destination_id = ? AND state = 'pending' AND canceled_at IS NULL").run(Date.now(),Date.now(),t.id),R(t.id)}m(ve,"unregisterCustomObject");function U(e){return JSON.stringify(Object.fromEntries(Object.entries(e).sort(([t],[s])=>t.localeCompare(s)).map(([t,s])=>[t,{level:s.level,...s.supersedes===void 0?{}:{supersedes:s.supersedes},...s.ends_wait===void 0?{}:{ends_wait:s.ends_wait}}])))}m(U,"canonicalEvents");function we(e,t,s=0){return C(e,t.id,s,"pending")}m(we,"pendingFor");function ye(e,t){const s=a(e,"SELECT destination_id FROM deliveries WHERE delivery_id = ?").get(t);return s?C(e,s.destination_id,-1,"handed_off").find(n=>n.delivery_id===t)??null:null}m(ye,"pushLineFor");function C(e,t,s,n){return a(e,`SELECT d.delivery_id, m.message_id, m.seq, m.event, m.level, m.object_id, m.actor_id, m.body_json, m.body_ref, m.depth, m.created_at,
+var $=Object.defineProperty;var l=(e,t)=>$(e,"name",{value:t,configurable:!0});import{createHash as x,randomBytes as J,timingSafeEqual as P}from"node:crypto";import{CrtrError as j,usage as f}from"../errors.js";import{ExitCode as S}from"../../types.js";import{createObject as q,liveDocumentNamed as F}from"./objects.js";import{invalidateCustomKind as A}from"./kinds/registry.js";import{customReachable as D,mayActAs as k}from"./access.js";import{publish as O,HOP_LIMIT as M,HopLimitError as B}from"./events.js";import{checkoutsForCwd as N}from"./repo-sync/repos.js";import{onQueueSignal as K,signalQueue as b}from"./receivers.js";import{receiverEndpoint as V,isPublicReceiverAddress as G}from"./receiver-url.js";import{isIP as Q}from"node:net";import{KIND as L,LOCAL as H,MAX_KIND_EVENTS as Y,RESERVED_KIND_ROOTS as z,eventCatalogReasons as X}from"../plugin-objects-manifest.js";const Z=["public","friends","private"];function h(e,t){throw new j(e,t,S.GENERAL)}l(h,"conflict");function R(e){return x("sha256").update(e).digest("hex")}l(R,"hash");function I(){return`crtr_pub_${J(32).toString("base64url")}`}l(I,"issueToken");function ee(e){if(e==null)return null;if(e==="queue")return JSON.stringify(e);if(typeof e!="object"||Array.isArray(e))throw f("invalid custom receiver; expected queue, an https url, or argv and absolute cwd");if("url"in e&&typeof e.url=="string")try{const i=V(e.url).hostname.replace(/^\[|\]$/g,"");if(Q(i)&&!G(i))throw new Error("non-public IP address");return JSON.stringify({url:e.url})}catch(t){throw f(`invalid custom receiver: ${String(t)}`)}if("argv"in e&&Array.isArray(e.argv)&&e.argv.length>0&&e.argv.every(t=>typeof t=="string")&&typeof e.cwd=="string"&&e.cwd.startsWith("/"))return JSON.stringify(e);throw f("invalid custom receiver; url must be https and argv requires a command and absolute cwd")}l(ee,"receiverJson");async function we(e,t,i){const{kind:n,name:r,owner:s,description:o,events:u,receiver:d,rotateToken:_,privacy:p}=i;if(p!==void 0&&!Z.includes(p))throw f(`invalid privacy ${JSON.stringify(p)}`);if(await k(e,t,s)||h("forbidden",`cannot act as ${s.id}`),!L.test(n)||z.includes(n.split(".")[0]))throw f(`invalid or reserved kind ${n}`);if(!r.trim()||r!==r.trim()||r.includes("\0"))throw f(`invalid object name ${JSON.stringify(r)}`);const m=ee(d);if(d!=="queue"&&d!==null&&d!==void 0&&"argv"in d&&t.class!=="person"&&t.class!=="node"&&h("argv_forbidden","argv receiver requires a person or node principal"),u===void 0){const c=await e.prepare("SELECT source FROM object_kinds WHERE name = ?").get(n);if(c?.source!=="manifest"&&c?.source!=="peer")throw f("events is required unless the kind is declared by an installed plugin")}else if(Object.keys(u).length>Y||Object.entries(u).some(([c,E])=>!H.test(c)||!Number.isInteger(E?.level)||E.level<1||E.level>10||E.supersedes!==void 0&&typeof E.supersedes!="boolean"||E.ends_wait!==void 0&&typeof E.ends_wait!="boolean"))throw f("invalid custom event catalog");const a=await F(e,s.rowid,r);if(a&&!await D(e,t,a)&&h("forbidden",`cannot act as ${s.id}`),a&&t.class!=="person"&&t.class!=="node"){const c=(await e.prepare("SELECT receiver_json FROM custom_objects WHERE object = ?").get(a.rowid))?.receiver_json;c&&typeof JSON.parse(c)=="object"&&"argv"in JSON.parse(c)&&h("argv_forbidden","argv receiver requires a person or node principal")}a&&a.type!==n&&h("name_taken",`${s.name}/${r} is already held by ${a.id}`);const g=u===void 0?null:await te(e,{name:n,owner:s,description:o,events:u,read:null,source:"register"});if(!a){const c=await q(e,{type:n,kind:null,owner:s.rowid,privacy:p??"public",name:r,preview:""}),E=I();return await e.prepare(`INSERT INTO custom_objects (object, description, receiver_json, token_hash)
+      VALUES (?, ?, ?, ?)`).run(c.rowid,o,m,R(E)),t.class==="node"&&await e.prepare("UPDATE custom_objects SET registered_by = ? WHERE object = ?").run(t.node.id,c.rowid),m!==null&&await e.prepare("UPDATE objects SET reception = 2 WHERE rowid = ?").run(c.rowid),await O(e,{event:"created",object:c,actor:t.class==="object"?t.object:t.class==="person"?t.person:t.class==="app"?t.app:t.node,attrs:{}},async C=>await N(e,C)),{object:c,token:E,created:!0,changed:[]}}const v=await e.prepare("SELECT description, receiver_json FROM custom_objects WHERE object = ?").get(a.rowid);v||h("name_taken",`${s.name}/${r} is not a custom object`);const w=[];if(v.description!==o&&w.push("description"),v.receiver_json!==m&&w.push("receiver"),g?.changed.includes("events")&&w.push("events"),g?.changed.includes("description")&&!w.includes("description")&&w.push("description"),p!==void 0&&a.privacy!==p&&w.push("privacy"),_&&w.push("token"),w.length===0)return{object:a,created:!1,changed:w};const y=_?I():void 0,T=w.includes("privacy")?{...a,privacy:p}:a;if(T!==a&&await e.prepare("UPDATE objects SET privacy = ? WHERE rowid = ?").run(p,a.rowid),await e.prepare("UPDATE custom_objects SET description = ?, receiver_json = ?, token_hash = COALESCE(?, token_hash) WHERE object = ?").run(o,m,y===void 0?null:R(y),a.rowid),await e.prepare("UPDATE objects SET reception = ? WHERE rowid = ?").run(m===null?0:2,a.rowid),v.receiver_json!==m){const c=Date.now();if(m===null){const E=await e.prepare(`UPDATE deliveries SET canceled_at = ?, updated_at = ?
+        WHERE destination_id = ? AND state = 'pending' AND canceled_at IS NULL`).run(c,c,a.id);await e.prepare("UPDATE custom_objects SET dropped = dropped + ? WHERE object = ?").run(E.changes,a.rowid)}else await e.prepare(`UPDATE deliveries SET next_attempt_at = ?, updated_at = ?
+        WHERE destination_id = ? AND state = 'pending' AND canceled_at IS NULL`).run(m==='"queue"'?null:c,c,a.id);b(a.id)}return _&&b(a.id),await O(e,{event:"configured",object:T,actor:t.class==="object"?t.object:t.class==="person"?t.person:t.class==="app"?t.app:t.node,attrs:{changed:w.join(",")}},async c=>await N(e,c)),{object:T,...y===void 0?{}:{token:y},created:!1,changed:w}}l(we,"registerCustomObject");async function te(e,t){const{name:i,owner:n,description:r,events:s,read:o,source:u}=t;if(!L.test(i))throw f(`invalid kind ${i}`);if(X(s,i).length>0)throw f("invalid custom event catalog");const d=await e.prepare("SELECT owner, description, events_json, read_json, source, declared FROM object_kinds WHERE name = ?").get(i),_=W(s),p=u==="manifest"&&o!==null?JSON.stringify({command:o.command}):null,m=new Date().toISOString();if(!d)return await e.prepare(`INSERT INTO object_kinds (name, owner, description, events_json, created_at, updated_at, read_json, source, declared)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, 1)`).run(i,n.rowid,r,_,m,m,p,u),A(e,i),{outcome:"inserted",changed:[]};const a=d.owner===n.rowid;if(u==="peer"){if(d.source!=="peer")return{outcome:"skipped",changed:[]}}else if(d.source!=="peer"&&(a||h("kind_owned",`${i} belongs to another owner`),u==="register"&&d.source==="manifest"))return{outcome:"skipped",changed:[]};const g=[];return W(JSON.parse(d.events_json))!==_&&g.push("events"),d.description!==r&&g.push("description"),(d.read_json??null)!==p&&g.push("read"),g.length===0&&a&&d.source===u&&d.declared===1?{outcome:"unchanged",changed:g}:(await e.prepare("UPDATE object_kinds SET owner = ?, description = ?, events_json = ?, read_json = ?, source = ?, declared = 1, updated_at = ? WHERE name = ?").run(n.rowid,r,_,p,u,m,i),A(e,i),{outcome:"updated",changed:g})}l(te,"upsertKind");async function Ee(e,t,i,n){const r=await e.prepare("SELECT events_json FROM object_kinds WHERE name = ?").get(t.type);if(!r||t.deleted_at!==null)throw f(`${t.id} is not a live custom object`);const s=JSON.parse(r.events_json);if(!H.test(n.event)||!Object.hasOwn(s,n.event))throw new j("unknown_event",`${t.type} declares ${Object.keys(s).join(", ")}, not ${n.event}`,S.USAGE,{declared:Object.keys(s),event:n.event});if(typeof n.summary!="string")throw f("summary must be text");const o=n.state===void 0?null:JSON.stringify(n.state);if(n.state!==void 0&&o===void 0)throw f("state must be JSON-serializable");if(Buffer.byteLength(JSON.stringify({summary:n.summary,...n.state===void 0?{}:{state:n.state}}))>64*1024)throw new j("body_too_large","custom event summary and state exceed 64 KiB",S.USAGE);if(o!==null&&Buffer.byteLength(o)>64*1024)throw f("state exceeds 64 KiB");const u=n.cause??null,d=u===null?null:await e.prepare(`SELECT depth FROM messages WHERE message_id = ?
+    UNION ALL SELECT depth FROM message_causes WHERE message_id = ? LIMIT 1`).get(u,u);if(u!==null&&d===void 0)throw new j("unknown_cause",`no message ${u}`,S.USAGE);if(d&&d.depth>=M)throw new B(d.depth+1);const _=new Date().toISOString();return await e.prepare("UPDATE custom_objects SET summary = ?, state_json = ?, published_at = ? WHERE object = ?").run(n.summary,o,_,t.rowid),await e.prepare("UPDATE objects SET preview = ? WHERE rowid = ?").run(n.summary.split(`
+`)[0],t.rowid),await O(e,{event:`${t.type}.${n.event}`,object:t,actor:i,attrs:{},messageBody:{summary:n.summary,...n.state===void 0?{}:{state:n.state}},...n.cause===void 0?{}:{cause:n.cause}},async p=>await N(e,p))}l(Ee,"publishCustom");async function _e(e,t,i){if(t.deleted_at!==null)return;await O(e,{event:"deleted",object:t,actor:i,attrs:{}},async r=>await N(e,r));const n=new Date().toISOString();await e.prepare("UPDATE objects SET deleted_at = ?, reception = 0 WHERE rowid = ?").run(n,t.rowid),await e.prepare("UPDATE deliveries SET canceled_at = ?, updated_at = ? WHERE destination_id = ? AND state = 'pending' AND canceled_at IS NULL").run(Date.now(),Date.now(),t.id),b(t.id)}l(_e,"unregisterCustomObject");function W(e){return JSON.stringify(Object.fromEntries(Object.entries(e).sort(([t],[i])=>t.localeCompare(i)).map(([t,i])=>[t,{level:i.level,...i.supersedes===void 0?{}:{supersedes:i.supersedes},...i.ends_wait===void 0?{}:{ends_wait:i.ends_wait}}])))}l(W,"canonicalEvents");async function ge(e,t,i=0){return await U(e,t.id,i,"pending")}l(ge,"pendingFor");async function he(e,t){const i=await e.prepare("SELECT destination_id FROM deliveries WHERE delivery_id = ?").get(t);return i?(await U(e,i.destination_id,-1,"handed_off")).find(n=>n.delivery_id===t)??null:null}l(he,"pushLineFor");async function U(e,t,i,n){return(await e.prepare(`SELECT d.delivery_id, m.message_id, m.seq, m.event, m.level, m.object_id, m.actor_id, m.body_json, m.body_ref, m.depth, m.created_at,
     o.type, o.name, owner.id AS owner_id
     FROM deliveries d JOIN messages m ON m.message_id = d.message_id JOIN objects o ON o.id = m.object_id
     LEFT JOIN objects owner ON owner.rowid = o.owner
-    WHERE d.destination_id = ? AND d.state = ? AND d.canceled_at IS NULL AND m.seq > ? ORDER BY m.seq`).all(t,n,s).map(o=>{const d=o.body_json?JSON.parse(o.body_json):{};return{delivery_id:o.delivery_id,message_id:o.message_id,seq:o.seq,event:o.event,level:o.level,object:{id:o.object_id,type:o.type,name:o.name,owner:o.owner_id},actor:o.actor_id,attrs:d.push?.attrs??{},...d.summary===void 0?{}:{summary:d.summary},...d.state===void 0?{}:{state:d.state},...d.push?.pointer===void 0?{}:{pointer:d.push.pointer},depth:o.depth,created_at:o.created_at}})}m(C,"queueLines");function Se(e,t,s){const n=Date.now(),i=[];let o=0;for(const d of s){const l=a(e,`UPDATE deliveries SET state = 'acknowledged', acknowledged_at = ?, updated_at = ?
-      WHERE delivery_id = ? AND destination_id = ? AND state = 'pending' AND canceled_at IS NULL`).run(n,n,d,t.id);Number(l.changes)?o++:i.push(d)}return{acknowledged:o,...i.length?{unknown:i}:{}}}m(Se,"acknowledge");function je(e,t,s){const n=a(e,"SELECT token_hash FROM custom_objects WHERE object = ?").get(t.rowid),i=Buffer.from(n?.token_hash??"".padEnd(64,"0"),"hex"),o=Buffer.from(A(s),"hex");return s.startsWith("crtr_pub_")&&t.deleted_at===null&&i.length===o.length&&q(i,o)&&n?.token_hash!=null}m(je,"verifyPublishToken");export{Se as acknowledge,k as customReachable,L as mayActAs,V as onQueueSignal,we as pendingFor,he as publishCustom,ye as pushLineFor,ge as registerCustomObject,ve as unregisterCustomObject,ne as upsertKind,je as verifyPublishToken};
+    WHERE d.destination_id = ? AND d.state = ? AND d.canceled_at IS NULL AND m.seq > ? ORDER BY m.seq`).all(t,n,i)).map(s=>{const o=s.body_json?JSON.parse(s.body_json):{};return{delivery_id:s.delivery_id,message_id:s.message_id,seq:s.seq,event:s.event,level:s.level,object:{id:s.object_id,type:s.type,name:s.name,owner:s.owner_id},actor:s.actor_id,attrs:o.push?.attrs??{},...o.summary===void 0?{}:{summary:o.summary},...o.state===void 0?{}:{state:o.state},...o.push?.pointer===void 0?{}:{pointer:o.push.pointer},depth:s.depth,created_at:s.created_at}})}l(U,"queueLines");async function ve(e,t,i){const n=Date.now(),r=[];let s=0;for(const o of i){const u=await e.prepare(`UPDATE deliveries SET state = 'acknowledged', acknowledged_at = ?, updated_at = ?
+      WHERE delivery_id = ? AND destination_id = ? AND state = 'pending' AND canceled_at IS NULL`).run(n,n,o,t.id);Number(u.changes)?s++:r.push(o)}return{acknowledged:s,...r.length?{unknown:r}:{}}}l(ve,"acknowledge");async function ye(e,t,i){const n=await e.prepare("SELECT token_hash FROM custom_objects WHERE object = ?").get(t.rowid),r=Buffer.from(n?.token_hash??"".padEnd(64,"0"),"hex"),s=Buffer.from(R(i),"hex");return i.startsWith("crtr_pub_")&&t.deleted_at===null&&r.length===s.length&&P(r,s)&&n?.token_hash!=null}l(ye,"verifyPublishToken");export{ve as acknowledge,D as customReachable,k as mayActAs,K as onQueueSignal,ge as pendingFor,Ee as publishCustom,he as pushLineFor,we as registerCustomObject,_e as unregisterCustomObject,te as upsertKind,ye as verifyPublishToken};

package/dist/core/graph/deletion.d.ts

@@ -1,17 +1,13 @@
-/** Deleting a node with what it owns (spec §6 "Deletion follows the owner", A9). Rows are kept
- *  with `deleted_at` so every pointer resolves to "deleted" with the last preview. A document a
- *  live document outside the deletion links to is kept: it stays owned by the deleted node, under
- *  its name and rules, and is collected when its last link goes (`collectUnlinked`). */
-import type { DatabaseSync } from 'node:sqlite';
 import type { ObjectRow } from './types.js';
+import { type CanvasDb } from '../canvas/db.js';
 /** Mark the node and everything it owns deleted except kept documents, which stay owned by the
  *  deleted node; drop the node's watches (both ends) and its `nodes` row. One savepoint, so it runs as one
  *  transaction or inside the caller's. Refuses a node whose managed worktree is unreconciled. */
-export declare function deleteNodeWithOwned(db: DatabaseSync, node: ObjectRow): void;
+export declare function deleteNodeWithOwned(db: CanvasDb, node: ObjectRow): Promise<void>;
 /** Delete a profile object with what it owns, in the same flow as the profile's own deletion
  *  (`crtr profile delete`): its documents follow the node rule — deleted, except one a live document
  *  outside the deletion links to, which stays owned by the deleted profile until its last link goes.
  *  The object row stays with `deleted_at` (kept documents still name it); its handle is released so
  *  a new profile can take the name, and its identity row stays so a kept document's permission
  *  string still names the profile id. Returns whether a profile object existed for `profileId`. */
-export declare function deleteProfileWithOwned(db: DatabaseSync, profileId: string): boolean;
+export declare function deleteProfileWithOwned(db: CanvasDb, profileId: string): Promise<boolean>;

package/dist/core/graph/deletion.js

@@ -1,6 +1,6 @@
-var R=Object.defineProperty;var E=(e,t)=>R(e,"name",{value:t,configurable:!0});import{prepared as n}from"../sqlite-statements.js";import{hasUnreconciledWorktree as f}from"../canvas/worktrees.js";import{deleteDocument as p}from"./documents.js";import{publish as s}from"./events.js";import{getByRowid as w}from"./objects.js";import{rememberDeletedIsolated as S}from"../runs/confinement.js";let a=0;function I(e,t){if(t.type!=="node")throw new Error(`deleteNodeWithOwned: ${t.id} is a ${t.type}, not a node`);if(f(t.id))throw new Error(`refusing to delete node ${t.id}: its managed worktree is not reconciled`);const o=`graph_delete_${++a}`;e.exec(`SAVEPOINT ${o}`);try{h(e,t),e.exec(`RELEASE ${o}`)}catch(i){throw e.exec(`ROLLBACK TO ${o}`),e.exec(`RELEASE ${o}`),i}}E(I,"deleteNodeWithOwned");function j(e,t){const o=n(e,`SELECT o.* FROM identities i JOIN objects o ON o.rowid = i.object
-    WHERE i.scheme = 'profile' AND i.external_id = ? AND o.type = 'profile' AND o.deleted_at IS NULL`).get(t);if(!o)return!1;const i=`graph_delete_${++a}`;e.exec(`SAVEPOINT ${i}`);try{u(e,o),n(e,"UPDATE objects SET deleted_at = ?, name = ? WHERE rowid = ?").run(new Date().toISOString(),`${o.name}.deleted-${o.rowid}`,o.rowid),s(e,{event:"deleted",object:w(e,o.rowid),actor:null,attrs:{}}),n(e,"DELETE FROM watches WHERE object = ? OR watcher = ?").run(o.rowid,o.rowid),e.exec(`RELEASE ${i}`)}catch(d){throw e.exec(`ROLLBACK TO ${i}`),e.exec(`RELEASE ${i}`),d}return!0}E(j,"deleteProfileWithOwned");function h(e,t){const o=u(e,t);n(e,"UPDATE objects SET deleted_at = ? WHERE rowid = ?").run(o,t.rowid),s(e,{event:"deleted",object:w(e,t.rowid),actor:null,attrs:{}}),n(e,"DELETE FROM watches WHERE object = ? OR watcher = ?").run(t.rowid,t.rowid),S(t.id,e),n(e,"UPDATE nodes SET run_id = NULL WHERE run_id = ? AND node_id != ? AND isolated = 0").run(t.id,t.id),n(e,"DELETE FROM nodes WHERE node_id = ?").run(t.id)}E(h,"deleteInside");function u(e,t){const o=n(e,`WITH RECURSIVE sub(rowid) AS (
+var u=Object.defineProperty;var i=(e,t)=>u(e,"name",{value:t,configurable:!0});import{hasUnreconciledWorktree as f}from"../canvas/worktrees.js";import{deleteDocument as O}from"./documents.js";import{publish as w}from"./events.js";import{getByRowid as d}from"./objects.js";import{rememberDeletedIsolated as R}from"../runs/confinement.js";import{withCanvasWrite as E}from"../canvas/db.js";async function j(e,t){if(t.type!=="node")throw new Error(`deleteNodeWithOwned: ${t.id} is a ${t.type}, not a node`);if(await f(t.id))throw new Error(`refusing to delete node ${t.id}: its managed worktree is not reconciled`);await E(async()=>await m(e,t),{savepoint:!0})}i(j,"deleteNodeWithOwned");async function I(e,t){const r=await e.prepare(`SELECT o.* FROM identities i JOIN objects o ON o.rowid = i.object
+    WHERE i.scheme = 'profile' AND i.external_id = ? AND o.type = 'profile' AND o.deleted_at IS NULL`).get(t);return r?(await E(async()=>{await c(e,r),await e.prepare("UPDATE objects SET deleted_at = ?, name = ? WHERE rowid = ?").run(new Date().toISOString(),`${r.name}.deleted-${r.rowid}`,r.rowid),await w(e,{event:"deleted",object:await d(e,r.rowid),actor:null,attrs:{}}),await e.prepare("DELETE FROM watches WHERE object = ? OR watcher = ?").run(r.rowid,r.rowid)},{savepoint:!0}),!0):!1}i(I,"deleteProfileWithOwned");async function m(e,t){const r=await c(e,t);await e.prepare("UPDATE objects SET deleted_at = ? WHERE rowid = ?").run(r,t.rowid),await w(e,{event:"deleted",object:await d(e,t.rowid),actor:null,attrs:{}}),await e.prepare("DELETE FROM watches WHERE object = ? OR watcher = ?").run(t.rowid,t.rowid),await R(t.id,e),await e.prepare("UPDATE nodes SET run_id = NULL WHERE run_id = ? AND node_id != ? AND isolated = 0").run(t.id,t.id),await e.prepare("DELETE FROM nodes WHERE node_id = ?").run(t.id)}i(m,"deleteInside");async function c(e,t){const r=await e.prepare(`WITH RECURSIVE sub(rowid) AS (
       SELECT rowid FROM objects WHERE owner = ?
       UNION SELECT o.rowid FROM objects o JOIN sub ON o.owner = sub.rowid)
-    SELECT o.* FROM objects o JOIN sub ON sub.rowid = o.rowid WHERE o.deleted_at IS NULL`).all(t.rowid),i=new Set(o.map(r=>r.rowid)),d=n(e,`SELECT e.src FROM edges e JOIN objects s ON s.rowid = e.src
-    WHERE e.type = 'links-to' AND e.dst = ? AND s.deleted_at IS NULL`);for(let r=!0;r;){r=!1;for(const c of o)c.type!=="document"||!i.has(c.rowid)||d.all(c.rowid).some(({src:O})=>!i.has(O))&&(i.delete(c.rowid),r=!0)}const l=new Date().toISOString();for(const r of o)if(i.has(r.rowid)){if(r.type==="document"){p(e,null,r);continue}n(e,"UPDATE objects SET deleted_at = ? WHERE rowid = ?").run(l,r.rowid),s(e,{event:"deleted",object:w(e,r.rowid),actor:null,attrs:{}}),n(e,"DELETE FROM watches WHERE object = ? OR watcher = ?").run(r.rowid,r.rowid)}return l}E(u,"deleteOwned");export{I as deleteNodeWithOwned,j as deleteProfileWithOwned};
+    SELECT o.* FROM objects o JOIN sub ON sub.rowid = o.rowid WHERE o.deleted_at IS NULL`).all(t.rowid),a=new Set(r.map(o=>o.rowid)),l=e.prepare(`SELECT e.src FROM edges e JOIN objects s ON s.rowid = e.src
+    WHERE e.type = 'links-to' AND e.dst = ? AND s.deleted_at IS NULL`);for(let o=!0;o;){o=!1;for(const n of r)n.type!=="document"||!a.has(n.rowid)||(await l.all(n.rowid)).some(({src:p})=>!a.has(p))&&(a.delete(n.rowid),o=!0)}const s=new Date().toISOString();for(const o of r)if(a.has(o.rowid)){if(o.type==="document"){await O(e,null,o);continue}await e.prepare("UPDATE objects SET deleted_at = ? WHERE rowid = ?").run(s,o.rowid),await w(e,{event:"deleted",object:await d(e,o.rowid),actor:null,attrs:{}}),await e.prepare("DELETE FROM watches WHERE object = ? OR watcher = ?").run(o.rowid,o.rowid)}return s}i(c,"deleteOwned");export{j as deleteNodeWithOwned,I as deleteProfileWithOwned};

package/dist/core/graph/documents.d.ts

@@ -1,9 +1,6 @@
-/** Documents: write, CAS edit, revisions and heads, links per revision, record fields, move,
- *  delete, history, read, and the two import paths (migration, repo sync). Every act records
- *  its actor's `acted-on` edge and watch and publishes its event in the caller's transaction. */
-import type { DatabaseSync } from 'node:sqlite';
 import { type ReposFn } from './reader.js';
 import type { ObjectRow, Privacy, Reader, Revision, RuleSpec } from './types.js';
+import { type CanvasDb } from '../canvas/db.js';
 export interface DocumentFields {
     preview?: string;
     summary?: string | null;
@@ -59,31 +56,31 @@ export interface DocumentRead {
 /** The object a reader acts as: its node, its app, or the person. */
 export declare function actorOf(reader: Reader): ObjectRow;
 /** Head revisions (no child), highest number first. More than one means the document needs a merge. */
-export declare function heads(db: DatabaseSync, doc: ObjectRow): Revision[];
-export declare function documentRecord(db: DatabaseSync, doc: ObjectRow): DocumentRecord;
+export declare function heads(db: CanvasDb, doc: ObjectRow): Promise<Revision[]>;
+export declare function documentRecord(db: CanvasDb, doc: ObjectRow): Promise<DocumentRecord>;
 /** The `[[name]]` links a body names, in order, each once. */
 export declare function linksIn(body: string): string[];
 /** Derive the document's `links-to` edges from `body`, resolving each name in the writer's
  *  view. A name that resolves to nothing or to several objects stays text and is returned,
  *  and remembered so {@link linkNewlyNamed} can link it when a document by that name appears;
  *  one that may live on another runtime is neither linked nor reported. */
-export declare function setRevisionLinks(db: DatabaseSync, reader: Reader, doc: ObjectRow, body: string): string[];
+export declare function setRevisionLinks(db: CanvasDb, reader: Reader, doc: ObjectRow, body: string): Promise<string[]>;
 /** `body` with each `[[link]]` the document's `links-to` edges resolved shown under its target's
  *  current name, so a rename rewrites no stored body yet every read shows the new name (spec §4).
  *  A link written as the target's id, or to a deleted target, stays as written. */
-export declare function withCurrentNames(db: DatabaseSync, doc: ObjectRow, body: string): string;
+export declare function withCurrentNames(db: CanvasDb, doc: ObjectRow, body: string): Promise<string>;
 /** Write the record fields that are present; `null` clears a nullable one. Rules are
  *  replaced when given. Does not publish; callers publish the act the fields belong to. */
-export declare function applyDocumentFields(db: DatabaseSync, doc: ObjectRow, fields: DocumentFields): ObjectRow;
+export declare function applyDocumentFields(db: CanvasDb, doc: ObjectRow, fields: DocumentFields): Promise<ObjectRow>;
 /** Create a document with its first revision. The actor becomes a watcher whose read base is
  *  the new revision; `created` is published. Returns the names that stayed text. */
-export declare function writeDocument(db: DatabaseSync, reader: Reader, spec: WriteSpec, body: string, reposFn?: ReposFn): {
+export declare function writeDocument(db: CanvasDb, reader: Reader, spec: WriteSpec, body: string, reposFn?: ReposFn): Promise<{
     object: ObjectRow;
     revision: number;
     unresolved: string[];
-};
+}>;
 /** The base of the reader's next edit: the heads it last read or wrote, or null when it never has. */
-export declare function readBase(db: DatabaseSync, reader: Reader, doc: ObjectRow): string | null;
+export declare function readBase(db: CanvasDb, reader: Reader, doc: ObjectRow): Promise<string | null>;
 /** Apply exact-text replacements to one head's body; each `old` must occur exactly once. */
 export declare function applyReplacements(body: string, replace: ReadonlyArray<{
     old: string;
@@ -96,7 +93,7 @@ export declare function applyReplacements(body: string, replace: ReadonlyArray<{
  * head, so an edit from a read that showed several heads merges them. `fields` are record
  * changes applied with the edit.
  */
-export declare function editDocument(db: DatabaseSync, reader: Reader, doc: ObjectRow, change: DocumentChange, rationale: string, base: string | null, fields?: DocumentFields, reposFn?: ReposFn): {
+export declare function editDocument(db: CanvasDb, reader: Reader, doc: ObjectRow, change: DocumentChange, rationale: string, base: string | null, fields?: DocumentFields, reposFn?: ReposFn): Promise<{
     revision: number;
     heads_key: string;
     unresolved: string[];
@@ -105,37 +102,37 @@ export declare function editDocument(db: DatabaseSync, reader: Reader, doc: Obje
         heads_key: string;
         revision: number;
     };
-};
+}>;
 /** Change record fields (preview, summary, privacy, rules, …) without a new revision. A null
  *  reader is repo sync, which carries no reader and checks no access. */
-export declare function setDocumentRecord(db: DatabaseSync, reader: Reader | null, doc: ObjectRow, fields: DocumentFields): ObjectRow;
+export declare function setDocumentRecord(db: CanvasDb, reader: Reader | null, doc: ObjectRow, fields: DocumentFields): Promise<ObjectRow>;
 /** Record that the reader holds the document's current heads: a `read` watch with that read
  *  base, and a `read` push. Delivery's content load calls this without reading the body. */
-export declare function recordRead(db: DatabaseSync, reader: Reader, doc: ObjectRow, reposFn?: ReposFn): void;
+export declare function recordRead(db: CanvasDb, reader: Reader, doc: ObjectRow, reposFn?: ReposFn): Promise<void>;
 /** The document's record, each head with its body (several = needs merge) and its links under
  *  their current names; records the read. */
-export declare function readDocument(db: DatabaseSync, reader: Reader, doc: ObjectRow, reposFn?: ReposFn): DocumentRead;
+export declare function readDocument(db: CanvasDb, reader: Reader, doc: ObjectRow, reposFn?: ReposFn): Promise<DocumentRead>;
 /** Every revision, newest first, with authors, rationales and parents. Records nothing. */
-export declare function history(db: DatabaseSync, reader: Reader, doc: ObjectRow): Revision[];
+export declare function history(db: CanvasDb, reader: Reader, doc: ObjectRow): Promise<Revision[]>;
 /** Rename and/or re-own a document. Only `objects` changes: links point at the id, so no body is
  *  rewritten. A null actor is repo sync, which carries no reader and checks no access. */
-export declare function moveDocument(db: DatabaseSync, reader: Reader | null, doc: ObjectRow, to: {
+export declare function moveDocument(db: CanvasDb, reader: Reader | null, doc: ObjectRow, to: {
     name?: string;
     owner?: ObjectRow;
-}, reposFn?: ReposFn): ObjectRow;
+}, reposFn?: ReposFn): Promise<ObjectRow>;
 /** Mark the document deleted; the row stays with its last preview. Publishes `deleted`
  *  (level 8), then ends the watches on it and drops its rules. A null actor is repo sync or
  *  node deletion; `deletedAt` is the tombstone's own time when sync imports one. What it linked to is re-checked by {@link collectUnlinked}. */
-export declare function deleteDocument(db: DatabaseSync, reader: Reader | null, doc: ObjectRow, reposFn?: ReposFn, deletedAt?: string): ObjectRow;
+export declare function deleteDocument(db: CanvasDb, reader: Reader | null, doc: ObjectRow, reposFn?: ReposFn, deletedAt?: string): Promise<ObjectRow>;
 /** Repo sync: bring a deleted document back under `name` (checked free first). Revisions, record
  *  and links are untouched; the watches and rules deletion dropped are not recreated here. */
-export declare function restoreDocument(db: DatabaseSync, doc: ObjectRow, name: string, reposFn?: ReposFn): ObjectRow;
+export declare function restoreDocument(db: CanvasDb, doc: ObjectRow, name: string, reposFn?: ReposFn): Promise<ObjectRow>;
 /** Delete each of `targets` that is a kept document nothing links to any more: a live document
  *  whose owner is deleted (node deletion kept it because a live document linked to it) and that
  *  no other live document links to. Each one deleted re-checks what it linked to, so chains of
  *  kept documents collapse; a cycle of kept documents keeps itself. Call it after a document
  *  stops linking to `targets` — it was deleted, or an edit dropped the links. */
-export declare function collectUnlinked(db: DatabaseSync, targets: Iterable<number>, reposFn?: ReposFn): void;
+export declare function collectUnlinked(db: CanvasDb, targets: Iterable<number>, reposFn?: ReposFn): Promise<void>;
 export interface ImportedRevision {
     rev_id?: string;
     body_hash: string;
@@ -151,7 +148,7 @@ export interface ImportSpec extends WriteSpec {
 /** Migration: a document with its linear history (oldest first; bodies already in the body
  *  store). Explicit authors and times; records no edge or watch and publishes nothing — the
  *  caller adds links (`setRevisionLinks`), acted-on edges and watches. */
-export declare function importDocument(db: DatabaseSync, spec: ImportSpec, reposFn?: ReposFn): ObjectRow;
+export declare function importDocument(db: CanvasDb, spec: ImportSpec, reposFn?: ReposFn): Promise<ObjectRow>;
 export interface SyncedRevision {
     rev_id: string;
     parents: readonly string[];
@@ -163,9 +160,9 @@ export interface SyncedRevision {
 /** Repo sync: add revisions that arrived from another runtime, skipping known `rev_id`s. No
  *  CAS, author NULL, publishes nothing; the caller publishes `edited` (with `needs_merge`
  *  when `headCount > 1`) and re-derives links from the head it trusts. */
-export declare function insertImportedRevisions(db: DatabaseSync, doc: ObjectRow, revs: readonly SyncedRevision[]): {
+export declare function insertImportedRevisions(db: CanvasDb, doc: ObjectRow, revs: readonly SyncedRevision[]): Promise<{
     heads_key: string;
     headCount: number;
-};
+}>;
 /** Look up a live document by id (convenience for handlers and importers). */
-export declare function documentById(db: DatabaseSync, id: string): ObjectRow;
+export declare function documentById(db: CanvasDb, id: string): Promise<ObjectRow>;