@playcraft/cli 0.1.33 → 0.1.35-prod

package/dist/workspace-runtime/workspaces/artifacts.js

@@ -1,282 +0,0 @@
-import { createHash, randomUUID } from 'node:crypto';
-import { constants } from 'node:fs';
-import { lstat, mkdir, open, readdir, rename, unlink } from 'node:fs/promises';
-import { basename, join } from 'node:path';
-import sharp from 'sharp';
-import { WORKSPACE_ARTIFACT_OUTPUT_DIRECTORY, isWorkspaceArtifactOutputPath, isWorkspaceArtifactOutputVersion, workspaceArtifactContentQuerySchema, workspaceArtifactListSchema, } from '@playcraft/common/cloud-workspace/runtime';
-import { artifactBundleDigest, artifactDirectory, artifactFormat, artifactPath, artifactResources, snapshotArtifactBundle, snapshotArtifactFile } from './artifact-files.js';
-import { ARTIFACT_RECEIPTS_DIRECTORY, readArtifactReceipt } from './artifact-receipts.js';
-const serial = new Map();
-function digest(text) { return createHash('sha256').update(text).digest('hex'); }
-function artifactId(workspaceId, path) { return `artifact_${digest(`${workspaceId}\0${path}`).slice(0, 40)}`; }
-function outputArtifacts(artifacts) {
-    return artifacts.flatMap(artifact => {
-        const versions = artifact.versions.filter(isWorkspaceArtifactOutputVersion);
-        if (!versions.length)
-            return [];
-        const current = versions.find(version => version.id === artifact.currentVersionId)
-            ?? versions.reduce((latest, version) => version.createdAt > latest.createdAt ? version : latest);
-        return [{ ...artifact, versions, currentVersionId: current.id, updatedAt: current.createdAt }];
-    }).sort((a, b) => b.updatedAt.localeCompare(a.updatedAt) || a.id.localeCompare(b.id));
-}
-/** Catalogs and immutable bytes are control-owned, outside the mutable checkout. */
-export class WorkspaceArtifactStore {
-    stateDir;
-    workspaceId;
-    constructor(stateDir, workspaceId) {
-        this.stateDir = stateDir;
-        this.workspaceId = workspaceId;
-    }
-    async directory() {
-        await mkdir(this.stateDir, { recursive: true, mode: 0o700 });
-        return artifactDirectory(this.stateDir, `artifacts/${digest(this.workspaceId)}`);
-    }
-    async read(directory) {
-        const handle = await open(join(directory, 'catalog.json'), constants.O_RDONLY | constants.O_NOFOLLOW).catch(error => {
-            if (error.code === 'ENOENT')
-                return undefined;
-            throw error;
-        });
-        if (!handle)
-            return { artifacts: [], scannedAt: new Date().toISOString(), receipts: [], observations: {} };
-        try {
-            const stat = await handle.stat();
-            if (!stat.isFile() || stat.size > 32 * 1024 * 1024)
-                throw new Error('artifact_catalog_invalid');
-            const { receipts, observations = {}, ...body } = JSON.parse(await handle.readFile('utf8'));
-            if (!Array.isArray(receipts) || receipts.some(id => typeof id !== 'string'))
-                throw new Error('artifact_catalog_invalid');
-            return { ...workspaceArtifactListSchema.parse(body), receipts, observations };
-        }
-        finally {
-            await handle.close();
-        }
-    }
-    async write(directory, catalog) {
-        const temporary = join(directory, `${randomUUID()}.tmp`);
-        const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
-        try {
-            await handle.writeFile(JSON.stringify(catalog));
-            await handle.sync();
-            await handle.close();
-            await rename(temporary, join(directory, 'catalog.json'));
-        }
-        finally {
-            await handle.close();
-            await unlink(temporary).catch(error => { if (error.code !== 'ENOENT')
-                throw error; });
-        }
-    }
-    async discover(root, source = { kind: 'discovered' }, sourcePaths = []) {
-        const key = `${this.stateDir}\0${this.workspaceId}`;
-        const previous = serial.get(key) ?? Promise.resolve();
-        const task = previous.catch(() => undefined).then(() => this.scan(root, source, sourcePaths));
-        serial.set(key, task);
-        try {
-            return await task;
-        }
-        finally {
-            if (serial.get(key) === task)
-                serial.delete(key);
-        }
-    }
-    async list() {
-        const catalog = await this.read(await this.directory());
-        return workspaceArtifactListSchema.parse({ artifacts: outputArtifacts(catalog.artifacts), scannedAt: catalog.scannedAt });
-    }
-    async scan(root, source, sourcePaths) {
-        const directory = await this.directory();
-        const objects = await artifactDirectory(directory, 'objects');
-        const catalog = await this.read(directory);
-        const original = JSON.stringify(outputArtifacts(catalog.artifacts));
-        const receipts = await this.receipts(root, catalog);
-        for (const receipt of receipts) {
-            try {
-                for (const file of receipt.files) {
-                    const copied = await snapshotArtifactFile(root, `${ARTIFACT_RECEIPTS_DIRECTORY}/objects/${file.sha256}`, objects);
-                    if (copied.sha256 !== file.sha256 || copied.size !== file.size)
-                        throw new Error('artifact_receipt_digest_mismatch');
-                }
-                const primary = receipt.files.find(file => file.role === 'primary' && file.path === receipt.path);
-                if (!primary || !artifactFormat(receipt.path))
-                    continue;
-                const version = {
-                    id: `version_${receipt.id}`, createdAt: receipt.source.generatedAt ?? new Date().toISOString(),
-                    path: receipt.path, mimeType: primary.mimeType, size: primary.size, sha256: primary.sha256,
-                    files: receipt.files, source: receipt.source,
-                    ...(receipt.width ? { width: receipt.width } : {}), ...(receipt.height ? { height: receipt.height } : {}),
-                    ...(receipt.duration !== undefined ? { duration: receipt.duration } : {}),
-                };
-                this.add(catalog, version);
-                catalog.receipts.push(receipt.id);
-            }
-            catch { /* An incomplete receipt stays pending; the next scan retries its original bytes. */ }
-        }
-        const candidates = await discoverPaths(root);
-        // Models are inspected before images so their explicitly referenced textures stay under the model.
-        candidates.sort((a, b) => Number(artifactFormat(b)?.[0] === 'model') - Number(artifactFormat(a)?.[0] === 'model') || a.localeCompare(b));
-        const visible = outputArtifacts(catalog.artifacts);
-        const members = new Set(visible.flatMap(artifact => artifact.versions.flatMap(version => version.files.filter(file => file.role !== 'primary').map(file => file.path))));
-        for (const path of candidates) {
-            if (members.has(path))
-                continue;
-            try {
-                const current = visible.find(artifact => artifact.id === artifactId(this.workspaceId, path));
-                const version = current?.versions.find(entry => entry.id === current.currentVersionId);
-                const knownWrite = sourcePaths.includes(path) && Boolean(source.operationId) && version?.source.operationId !== source.operationId;
-                const observation = catalog.observations[path];
-                if (!knownWrite && version && observation?.versionId === version.id && observation.signature === await fileSignature(root, version.files.map(file => file.path)))
-                    continue;
-                const thumbnail = version?.files.find(file => file.role === 'thumbnail');
-                const thumbnailPath = thumbnail && await lstat(join(root, thumbnail.path)).then(stat => stat.isFile(), () => false) ? thumbnail.path : undefined;
-                const paths = [path, ...await artifactResources(root, path), ...(thumbnailPath ? [thumbnailPath] : [])];
-                const signature = await fileSignature(root, paths);
-                const files = await snapshotArtifactBundle(root, path, objects, thumbnailPath);
-                if (signature !== await fileSignature(root, files.map(file => file.path)))
-                    continue;
-                for (const file of files)
-                    if (file.role !== 'primary')
-                        members.add(file.path);
-                if (!knownWrite && version && artifactBundleDigest(version.files) === artifactBundleDigest(files)) {
-                    catalog.observations[path] = { signature, versionId: version.id };
-                    continue;
-                }
-                const primary = files[0];
-                const next = {
-                    id: `version_${knownWrite ? source.operationId : randomUUID()}`, createdAt: new Date().toISOString(),
-                    path, mimeType: primary.mimeType, size: primary.size, sha256: primary.sha256, files,
-                    source: sourcePaths.includes(path) ? source : { kind: 'discovered' },
-                    ...await this.dimensions(objects, primary),
-                };
-                this.add(catalog, next);
-                catalog.observations[path] = { signature, versionId: next.id };
-            }
-            catch { /* Files being written or temporarily missing are retried, never published as complete. */ }
-        }
-        catalog.artifacts = catalog.artifacts.filter(artifact => {
-            const current = artifact.versions.find(version => version.id === artifact.currentVersionId);
-            return !isWorkspaceArtifactOutputVersion(current) || current.source.kind !== 'discovered' || !members.has(current.path);
-        });
-        catalog.artifacts.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt) || a.id.localeCompare(b.id));
-        catalog.scannedAt = new Date().toISOString();
-        const list = workspaceArtifactListSchema.parse({ artifacts: outputArtifacts(catalog.artifacts), scannedAt: catalog.scannedAt });
-        await this.write(directory, catalog);
-        return { list, changed: original !== JSON.stringify(list.artifacts) };
-    }
-    add(catalog, version) {
-        const id = artifactId(this.workspaceId, version.path);
-        let artifact = catalog.artifacts.find(item => item.id === id);
-        if (!artifact) {
-            artifact = { id, kind: artifactFormat(version.path)[0], name: basename(version.path), currentVersionId: version.id, updatedAt: version.createdAt, versions: [] };
-            catalog.artifacts.push(artifact);
-        }
-        if (!artifact.versions.some(item => item.id === version.id)) {
-            // Display ordering is monotonic; the original generation time stays in source.generatedAt.
-            const latest = Math.max(0, ...artifact.versions.map(item => Date.parse(item.createdAt)));
-            version.createdAt = new Date(Math.max(Date.parse(version.createdAt), latest + 1)).toISOString();
-            artifact.versions.unshift(version);
-        }
-        artifact.currentVersionId = version.id;
-        artifact.updatedAt = version.createdAt;
-    }
-    async receipts(root, catalog) {
-        let directory;
-        try {
-            const target = join(root, ARTIFACT_RECEIPTS_DIRECTORY);
-            if (!(await lstat(target)).isDirectory())
-                return [];
-            directory = await artifactDirectory(root, ARTIFACT_RECEIPTS_DIRECTORY);
-        }
-        catch {
-            return [];
-        }
-        const seen = new Set(catalog.receipts), receipts = [];
-        for (const name of await readdir(directory)) {
-            if (!/^[a-f0-9-]{36}\.json$/.test(name) || seen.has(name.slice(0, -5)))
-                continue;
-            try {
-                const receipt = await readArtifactReceipt(join(directory, name));
-                if (receipt.workspaceId === this.workspaceId && `${receipt.id}.json` === name && isWorkspaceArtifactOutputVersion(receipt))
-                    receipts.push(receipt);
-            }
-            catch { /* Malformed output metadata is never trusted as a completed artifact. */ }
-        }
-        return receipts.sort((a, b) => (a.source.generatedAt ?? '').localeCompare(b.source.generatedAt ?? '') || a.id.localeCompare(b.id));
-    }
-    async dimensions(objects, file) {
-        if (!file.mimeType.startsWith('image/') || file.mimeType === 'image/svg+xml')
-            return {};
-        try {
-            const metadata = await sharp(join(objects, file.sha256), { limitInputPixels: 100_000_000 }).metadata();
-            return { ...(metadata.width ? { width: metadata.width } : {}), ...(metadata.height ? { height: metadata.height } : {}) };
-        }
-        catch {
-            return {};
-        }
-    }
-    async content(input) {
-        const query = workspaceArtifactContentQuerySchema.parse(input);
-        const directory = await this.directory(), catalog = await this.read(directory);
-        const artifact = catalog.artifacts.find(item => item.id === query.artifactId);
-        const version = artifact?.versions.find(item => item.id === query.versionId && isWorkspaceArtifactOutputVersion(item));
-        const file = version?.files.find(item => item.path === (query.path ?? version.path));
-        if (!file)
-            throw new Error('artifact_not_found');
-        if (query.offset > file.size)
-            throw new Error('artifact_range_invalid');
-        const handle = await open(join(directory, 'objects', file.sha256), constants.O_RDONLY | constants.O_NOFOLLOW);
-        try {
-            const stat = await handle.stat();
-            if (!stat.isFile() || stat.nlink !== 1 || stat.size !== file.size)
-                throw new Error('artifact_snapshot_invalid');
-            const bytes = Buffer.alloc(Math.min(query.length, file.size - query.offset));
-            let read = 0;
-            while (read < bytes.length) {
-                const part = await handle.read(bytes, read, bytes.length - read, query.offset + read);
-                if (!part.bytesRead)
-                    throw new Error('artifact_snapshot_invalid');
-                read += part.bytesRead;
-            }
-            return { content: bytes.toString('base64'), mimeType: file.mimeType, totalBytes: file.size, offset: query.offset, sha256: file.sha256 };
-        }
-        finally {
-            await handle.close();
-        }
-    }
-}
-async function fileSignature(root, paths) {
-    const records = [];
-    for (const path of [...new Set(paths)].sort()) {
-        const stat = await lstat(await artifactPath(root, path));
-        if (!stat.isFile() || stat.nlink !== 1)
-            throw new Error('artifact_file_unavailable');
-        records.push([path, stat.dev, stat.ino, stat.size, stat.mtimeMs, stat.ctimeMs]);
-    }
-    return JSON.stringify(records);
-}
-async function discoverPaths(root, directory = WORKSPACE_ARTIFACT_OUTPUT_DIRECTORY, result = []) {
-    if (directory !== WORKSPACE_ARTIFACT_OUTPUT_DIRECTORY && !isWorkspaceArtifactOutputPath(directory))
-        throw new Error('invalid_artifact_path');
-    let target;
-    try {
-        target = await artifactPath(root, directory);
-    }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return result;
-        throw error;
-    }
-    if (!(await lstat(target)).isDirectory())
-        throw new Error('invalid_artifact_directory');
-    for (const entry of await readdir(target, { withFileTypes: true })) {
-        if (entry.name.startsWith('.') || entry.isSymbolicLink())
-            continue;
-        const path = `${directory}/${entry.name}`;
-        if (entry.isDirectory()) {
-            await discoverPaths(root, path, result);
-        }
-        else if (entry.isFile() && artifactFormat(path))
-            result.push(path);
-    }
-    return result;
-}

package/dist/workspace-runtime/workspaces/attachment-content.js

@@ -1,123 +0,0 @@
-import { constants } from 'node:fs';
-import { open } from 'node:fs/promises';
-import { extname } from 'node:path';
-import { pipeline } from 'node:stream/promises';
-import { attachmentIdsSchema, attachmentUploadSchema, WORKSPACE_ATTACHMENT_MAX_BYTES, WORKSPACE_USER_UPLOADS_DIRECTORY, WORKSPACE_VIDEO_ATTACHMENT_MAX_BYTES, } from '@playcraft/common/cloud-workspace/runtime';
-import { artifactMime, artifactPath } from './artifact-files.js';
-import { openLibraryAttachmentFile, readLibraryAttachmentMetadata } from './library-attachments.js';
-import { openWorkspaceDirectoryFile, readWorkspaceDirectoryMetadata } from './directory-attachments.js';
-const additionalMediaTypes = {
-    '.aac': 'audio/aac', '.opus': 'audio/ogg', '.oga': 'audio/ogg', '.aif': 'audio/aiff', '.aiff': 'audio/aiff',
-    '.bmp': 'image/bmp', '.ico': 'image/vnd.microsoft.icon', '.heic': 'image/heic', '.heif': 'image/heif',
-    '.tif': 'image/tiff', '.tiff': 'image/tiff',
-};
-const detectedImageTypes = new Set(['image/png', 'image/jpeg', 'image/gif', 'image/webp']);
-function attachmentRange(header, size) {
-    if (!header)
-        return undefined;
-    const match = /^bytes=(\d*)-(\d*)$/.exec(header.trim());
-    if (!match || (!match[1] && !match[2]) || !size)
-        return null;
-    const first = match[1] ? Number(match[1]) : undefined;
-    const last = match[2] ? Number(match[2]) : undefined;
-    if ((first !== undefined && !Number.isSafeInteger(first)) || (last !== undefined && !Number.isSafeInteger(last)))
-        return null;
-    const start = first ?? Math.max(0, size - (last ?? 0));
-    const end = first === undefined ? size - 1 : Math.min(last ?? size - 1, size - 1);
-    return start >= size || start > end ? null : { start, end };
-}
-async function openAttachment(root, id, filePath) {
-    const metadataPath = await artifactPath(root, `${WORKSPACE_USER_UPLOADS_DIRECTORY}/.metadata/${id}.json`);
-    const metadataFile = await open(metadataPath, constants.O_RDONLY | constants.O_NOFOLLOW);
-    let metadata;
-    try {
-        const stat = await metadataFile.stat();
-        if (!stat.isFile() || stat.nlink !== 1 || stat.size > 1024 * 1024)
-            throw new Error('attachment_unavailable');
-        metadata = JSON.parse(await metadataFile.readFile('utf8'));
-        if (metadata.id !== id || !attachmentUploadSchema.shape.name.safeParse(metadata.name).success)
-            throw new Error('attachment_unavailable');
-    }
-    finally {
-        await metadataFile.close();
-    }
-    if (metadata.origin?.kind === 'asset-library') {
-        const library = await readLibraryAttachmentMetadata(root, id);
-        return openLibraryAttachmentFile(root, library, filePath);
-    }
-    if (metadata.kind === 'directory') {
-        const directory = await readWorkspaceDirectoryMetadata(root, id);
-        return openWorkspaceDirectoryFile(root, directory, filePath);
-    }
-    if (filePath !== undefined)
-        throw new Error('attachment_unavailable');
-    const path = await artifactPath(root, `${WORKSPACE_USER_UPLOADS_DIRECTORY}/${id}/${metadata.name}`);
-    const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
-    try {
-        const stat = await handle.stat();
-        const mimeType = detectedImageTypes.has(metadata.mimeType) ? metadata.mimeType
-            : additionalMediaTypes[extname(metadata.name).toLowerCase()] ?? artifactMime(metadata.name);
-        const limit = mimeType.startsWith('video/') ? WORKSPACE_VIDEO_ATTACHMENT_MAX_BYTES : WORKSPACE_ATTACHMENT_MAX_BYTES;
-        if (!stat.isFile() || stat.nlink !== 1 || stat.size !== metadata.size || stat.size > limit)
-            throw new Error('attachment_unavailable');
-        return { handle, name: metadata.name, mimeType, size: stat.size };
-    }
-    catch (error) {
-        await handle.close();
-        throw error;
-    }
-}
-/** Serve only registered references; no caller-supplied file paths reach the filesystem. */
-export async function serveWorkspaceAttachment(root, attachmentId, request, response, filePath) {
-    if (!attachmentIdsSchema.safeParse([attachmentId]).success) {
-        response.writeHead(400, { 'content-type': 'application/json', 'cache-control': 'no-store' });
-        response.end(JSON.stringify({ error: 'invalid_attachment' }));
-        return;
-    }
-    let content;
-    try {
-        content = await openAttachment(root, attachmentId, filePath);
-    }
-    catch {
-        response.writeHead(404, { 'content-type': 'application/json', 'cache-control': 'no-store' });
-        response.end(JSON.stringify({ error: 'attachment_not_found' }));
-        return;
-    }
-    try {
-        const range = attachmentRange(request.headers.range, content.size);
-        const headers = {
-            'content-type': content.mimeType,
-            'cache-control': 'private, no-store',
-            'x-content-type-options': 'nosniff',
-            'content-security-policy': "sandbox; default-src 'none'; style-src 'unsafe-inline'",
-            'referrer-policy': 'no-referrer',
-            'accept-ranges': 'bytes',
-        };
-        if (!/^(?:image|video|audio|model)\//.test(content.mimeType) || content.mimeType === 'image/svg+xml')
-            headers['content-disposition'] = `attachment; filename*=UTF-8''${encodeURIComponent(content.name).replace(/'/g, '%27')}`;
-        if (range === null) {
-            response.writeHead(416, { ...headers, 'content-range': `bytes */${content.size}`, 'content-length': '0' });
-            response.end();
-            return;
-        }
-        if (range)
-            headers['content-range'] = `bytes ${range.start}-${range.end}/${content.size}`;
-        headers['content-length'] = String(range ? range.end - range.start + 1 : content.size);
-        response.writeHead(range ? 206 : 200, headers);
-        if (request.method === 'HEAD' || !content.size) {
-            response.end();
-            return;
-        }
-        await pipeline(content.handle.createReadStream({
-            start: range?.start ?? 0,
-            end: range?.end ?? content.size - 1,
-            autoClose: false,
-        }), response);
-    }
-    catch (error) {
-        response.destroy(error instanceof Error ? error : undefined);
-    }
-    finally {
-        await content.handle.close();
-    }
-}

package/dist/workspace-runtime/workspaces/attachments.js

@@ -1,181 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import { constants } from 'node:fs';
-import { chmod, lstat, mkdir, open, rm, writeFile } from 'node:fs/promises';
-import { join } from 'node:path';
-import { WORKSPACE_USER_UPLOADS_DIRECTORY, attachmentIdsSchema, attachmentUploadSchema, WORKSPACE_ATTACHMENT_MAX_BYTES, WORKSPACE_VIDEO_ATTACHMENT_MAX_BYTES, WORKSPACE_VIDEO_ATTACHMENT_MIME_TYPES, workspaceVideoAttachmentQuerySchema, } from '@playcraft/common/cloud-workspace/runtime';
-import { NativePreparationError } from '../codex/native-adapter.js';
-import { excludeFromGit } from './dependencies.js';
-import { hashAttachment, probeAttachmentVideo } from './video-attachments.js';
-import { resolveLibraryAttachment } from './library-attachments.js';
-import { resolveWorkspaceDirectoryAttachment } from './directory-attachments.js';
-async function attachmentRoot(root) {
-    // Reject redirected upload directories, including symlinks that stay inside the workspace.
-    let directory = root;
-    for (const part of WORKSPACE_USER_UPLOADS_DIRECTORY.split('/')) {
-        directory = join(directory, part);
-        await mkdir(directory, { mode: 0o755 }).catch((error) => {
-            if (error.code !== 'EEXIST')
-                throw error;
-        });
-        if (!(await lstat(directory)).isDirectory())
-            throw new Error('invalid_attachment');
-        await chmod(directory, 0o755);
-    }
-    return directory;
-}
-function imageMime(bytes) {
-    if (bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10])))
-        return 'image/png';
-    if (bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255)
-        return 'image/jpeg';
-    if (/^GIF8[79]a$/.test(bytes.subarray(0, 6).toString('ascii')))
-        return 'image/gif';
-    if (bytes.subarray(0, 4).toString() === 'RIFF' && bytes.subarray(8, 12).toString() === 'WEBP')
-        return 'image/webp';
-    return 'application/octet-stream';
-}
-export async function readAttachmentUpload(request) {
-    const chunks = [];
-    let size = 0;
-    for await (const chunk of request) {
-        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        size += bytes.length;
-        if (size > 4 * Math.ceil(WORKSPACE_ATTACHMENT_MAX_BYTES / 3) + 4096)
-            throw new Error('invalid_attachment');
-        chunks.push(bytes);
-    }
-    return JSON.parse(Buffer.concat(chunks).toString('utf8'));
-}
-/** References belong to the workspace and are retained by its checkpoints. */
-export async function uploadWorkspaceAttachment(root, body) {
-    const parsed = attachmentUploadSchema.parse(body);
-    const bytes = Buffer.from(parsed.content, 'base64');
-    if (bytes.length > WORKSPACE_ATTACHMENT_MAX_BYTES || bytes.toString('base64') !== parsed.content)
-        throw new Error('invalid_attachment');
-    const attachment = {
-        id: randomUUID(),
-        name: parsed.name,
-        size: bytes.length,
-        mimeType: imageMime(bytes),
-    };
-    await excludeFromGit(root, `/${WORKSPACE_USER_UPLOADS_DIRECTORY}/`);
-    const uploads = await attachmentRoot(root);
-    const directory = join(uploads, attachment.id);
-    const metadataDirectory = join(uploads, '.metadata');
-    await mkdir(metadataDirectory, { mode: 0o755 }).catch((error) => {
-        if (error.code !== 'EEXIST')
-            throw error;
-    });
-    if (!(await lstat(metadataDirectory)).isDirectory())
-        throw new Error('invalid_attachment');
-    // Codex can run as a different user from the sandbox control process.
-    await mkdir(directory, { mode: 0o755 });
-    await writeFile(join(directory, attachment.name), bytes, { flag: 'wx', mode: 0o644 });
-    await writeFile(join(metadataDirectory, `${attachment.id}.json`), JSON.stringify(attachment), {
-        flag: 'wx',
-        mode: 0o644,
-    });
-    return attachment;
-}
-/** Video bodies are streamed into an unpublished attachment and never decoded as base64. */
-export async function uploadWorkspaceVideoAttachment(root, request, query) {
-    const { name } = workspaceVideoAttachmentQuerySchema.parse(query);
-    const contentType = String(request.headers['content-type'] ?? '').split(';')[0].trim().toLowerCase();
-    const declaredSize = request.headers['content-length'];
-    if (!WORKSPACE_VIDEO_ATTACHMENT_MIME_TYPES.includes(contentType)
-        || (declaredSize !== undefined && (!/^\d+$/.test(declaredSize) || Number(declaredSize) > WORKSPACE_VIDEO_ATTACHMENT_MAX_BYTES)))
-        throw new Error('invalid_attachment');
-    await excludeFromGit(root, `/${WORKSPACE_USER_UPLOADS_DIRECTORY}/`);
-    const uploads = await attachmentRoot(root);
-    const id = randomUUID(), directory = join(uploads, id), metadataDirectory = join(uploads, '.metadata');
-    await mkdir(metadataDirectory, { mode: 0o755 }).catch((error) => { if (error.code !== 'EEXIST')
-        throw error; });
-    if (!(await lstat(metadataDirectory)).isDirectory())
-        throw new Error('invalid_attachment');
-    await mkdir(directory, { mode: 0o755 });
-    const handle = await open(join(directory, name), constants.O_CREAT | constants.O_EXCL | constants.O_RDWR | constants.O_NOFOLLOW, 0o644);
-    try {
-        let size = 0;
-        for await (const data of request) {
-            const bytes = Buffer.isBuffer(data) ? data : Buffer.from(data);
-            size += bytes.length;
-            if (size > WORKSPACE_VIDEO_ATTACHMENT_MAX_BYTES)
-                throw new Error('invalid_attachment');
-            let offset = 0;
-            while (offset < bytes.length)
-                offset += (await handle.write(bytes, offset, bytes.length - offset, size - bytes.length + offset)).bytesWritten;
-        }
-        if (!size || (declaredSize !== undefined && Number(declaredSize) !== size))
-            throw new Error('invalid_attachment');
-        await handle.sync();
-        const media = await probeAttachmentVideo(handle);
-        if (contentType !== media.mimeType && !(contentType === 'video/quicktime' && media.mimeType === 'video/mp4'))
-            throw new Error('invalid_attachment');
-        const attachment = { id, name, size, ...media, sha256: await hashAttachment(handle) };
-        await writeFile(join(metadataDirectory, `${id}.json`), JSON.stringify(attachment), { flag: 'wx', mode: 0o644 });
-        return attachment;
-    }
-    catch (error) {
-        await rm(directory, { recursive: true, force: true });
-        throw error;
-    }
-    finally {
-        await handle.close();
-    }
-}
-export async function resolveWorkspaceAttachments(root, input) {
-    try {
-        const ids = attachmentIdsSchema.parse(input ?? []);
-        return await Promise.all(ids.map(async (id) => {
-            const uploads = await attachmentRoot(root);
-            const directory = join(uploads, id);
-            if (!(await lstat(directory)).isDirectory())
-                throw new Error('invalid_attachment');
-            await chmod(directory, 0o755);
-            if (!(await lstat(join(uploads, '.metadata'))).isDirectory())
-                throw new Error('invalid_attachment');
-            const metadataHandle = await open(join(uploads, '.metadata', `${id}.json`), constants.O_RDONLY | constants.O_NOFOLLOW);
-            let metadata;
-            try {
-                const stat = await metadataHandle.stat();
-                if (!stat.isFile() || stat.nlink !== 1 || stat.size > 1024 * 1024)
-                    throw new Error('invalid_attachment');
-                metadata = JSON.parse(await metadataHandle.readFile('utf8'));
-            }
-            finally {
-                await metadataHandle.close();
-            }
-            if (metadata.origin?.kind === 'asset-library')
-                return resolveLibraryAttachment(root, id);
-            if (metadata.kind === 'directory')
-                return resolveWorkspaceDirectoryAttachment(root, id);
-            attachmentUploadSchema.shape.name.parse(metadata.name);
-            if (metadata.id !== id)
-                throw new Error('invalid_attachment');
-            const path = join(directory, metadata.name);
-            const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
-            try {
-                const stat = await handle.stat();
-                const video = metadata.mimeType?.startsWith('video/');
-                if (!stat.isFile() || stat.nlink !== 1 || stat.size !== metadata.size || stat.size > (video ? WORKSPACE_VIDEO_ATTACHMENT_MAX_BYTES : WORKSPACE_ATTACHMENT_MAX_BYTES))
-                    throw new Error('invalid_attachment');
-                if (video) {
-                    const media = await probeAttachmentVideo(handle);
-                    const sha256 = await hashAttachment(handle);
-                    if (sha256 !== metadata.sha256 || media.mimeType !== metadata.mimeType || media.durationMs !== metadata.durationMs
-                        || media.width !== metadata.width || media.height !== metadata.height)
-                        throw new Error('invalid_attachment');
-                    return { ...metadata, ...media, path };
-                }
-                const bytes = await handle.readFile();
-                return { ...metadata, size: bytes.length, mimeType: imageMime(bytes), path };
-            }
-            finally {
-                await handle.close();
-            }
-        }));
-    }
-    catch {
-        throw new NativePreparationError('attachment_unavailable');
-    }
-}