@playcraft/cli 0.1.54 → 0.1.56-beta

package/dist/workspace-runtime/workspaces/asset-library-import.js

@@ -0,0 +1,387 @@
+import { createHash } from 'node:crypto';
+import { constants } from 'node:fs';
+import { lstat, mkdir, mkdtemp, open, readdir, realpath, rename, rm, rmdir } from 'node:fs/promises';
+import { basename, dirname, extname, join, relative } from 'node:path';
+import { BINARY_WORKSPACE_FILE_MAX_BYTES, WORKSPACE_LIBRARY_ATTACHMENT_MAX_BYTES, WORKSPACE_LIBRARY_ATTACHMENT_MAX_FILES, workspaceAssetLibraryImportPayloadSchema, workspaceAssetLibraryImportResultSchema, workspaceAssetLibraryImportTransportSchema, workspaceRelativePathSchema, } from '@playcraft/common/cloud-workspace/runtime';
+import { observeWorkspaceBinaryFile, writeWorkspaceBinaryFile } from './binary-write.js';
+import { shareWorkspaceAssetDirectory } from './asset-publication-access.js';
+const RESERVED = new Set(['.git', 'node_modules', '.playcraft-temp', '.tmp']);
+const digest = (value) => createHash('sha256').update(value).digest('hex');
+const missing = (error) => error?.code === 'ENOENT';
+export class AssetLibraryImportError extends Error {
+    constructor(code) { super(code); this.name = 'AssetLibraryImportError'; }
+}
+function validPath(path) {
+    if (!workspaceRelativePathSchema.safeParse(path).success || path.split('/').some(part => RESERVED.has(part)))
+        throw new AssetLibraryImportError('invalid_library_import_path');
+    return path;
+}
+async function safeDirectory(root, path, create = false) {
+    const rootStat = await lstat(root);
+    if (!rootStat.isDirectory() || rootStat.isSymbolicLink() || await realpath(root) !== root)
+        throw new AssetLibraryImportError('invalid_library_import_path');
+    let current = root;
+    for (const part of path.split('/').filter(Boolean)) {
+        current = join(current, part);
+        if (create)
+            await mkdir(current, { mode: 0o700 }).catch((error) => {
+                if (error.code !== 'EEXIST')
+                    throw error;
+            });
+        const stat = await lstat(current);
+        if (!stat.isDirectory() || stat.isSymbolicLink() || await realpath(current) !== current)
+            throw new AssetLibraryImportError('invalid_library_import_path');
+    }
+    return current;
+}
+/** Create only published project parents with development-group access, leaving transaction storage private. */
+async function createPublicDirectory(root, path) {
+    let current = '';
+    for (const part of path.split('/').filter(Boolean)) {
+        const parent = current;
+        current = [current, part].filter(Boolean).join('/');
+        try {
+            await safeDirectory(root, current);
+        }
+        catch (error) {
+            if (!missing(error))
+                throw error;
+            await safeDirectory(root, parent);
+            await mkdir(join(root, current), { mode: 0o700 });
+            await shareWorkspaceAssetDirectory(root, join(root, current));
+            await safeDirectory(root, current);
+        }
+    }
+}
+async function statTarget(root, path) {
+    try {
+        await safeDirectory(root, dirname(path) === '.' ? '' : dirname(path));
+        return await lstat(join(root, path));
+    }
+    catch (error) {
+        if (missing(error))
+            return undefined;
+        throw error;
+    }
+}
+function validateAsset(asset) {
+    let size = 0;
+    for (const file of asset.files) {
+        validPath(file.path);
+        const bytes = Buffer.from(file.content, 'base64');
+        if (bytes.toString('base64') !== file.content || digest(bytes) !== file.sha256)
+            throw new AssetLibraryImportError('library_asset_changed');
+        if (bytes.length > BINARY_WORKSPACE_FILE_MAX_BYTES)
+            throw new AssetLibraryImportError('binary_file_too_large');
+        size += bytes.length;
+    }
+    if (size > WORKSPACE_LIBRARY_ATTACHMENT_MAX_BYTES)
+        throw new AssetLibraryImportError('library_asset_too_large');
+    const files = asset.files.map(file => [file.path, file.sha256]).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+    if (digest(JSON.stringify(files)) !== asset.contentHash)
+        throw new AssetLibraryImportError('library_asset_changed');
+}
+async function directorySnapshot(root) {
+    const rootStat = await lstat(root);
+    if (!rootStat.isDirectory() || rootStat.isSymbolicLink())
+        throw new AssetLibraryImportError('invalid_library_import_path');
+    const contents = [];
+    let bytes = 0;
+    const visit = async (relative = '') => {
+        for (const entry of await readdir(join(root, relative), { withFileTypes: true })) {
+            const path = relative ? `${relative}/${entry.name}` : entry.name;
+            validPath(path);
+            if (entry.isSymbolicLink())
+                throw new AssetLibraryImportError('invalid_library_import_path');
+            if (entry.isDirectory()) {
+                contents.push([`${path}/`, '']);
+                await safeDirectory(root, path);
+                await visit(path);
+            }
+            else if (entry.isFile()) {
+                const file = await observeWorkspaceBinaryFile(root, path);
+                if (!file)
+                    throw new AssetLibraryImportError('content_conflict');
+                bytes += file.size;
+                contents.push([path, file.contentHash]);
+            }
+            else
+                throw new AssetLibraryImportError('invalid_library_import_path');
+            if (contents.length > WORKSPACE_LIBRARY_ATTACHMENT_MAX_FILES * 2 || bytes > WORKSPACE_LIBRARY_ATTACHMENT_MAX_BYTES)
+                throw new AssetLibraryImportError('library_asset_too_large');
+        }
+    };
+    await safeDirectory(root, '');
+    await visit();
+    return digest(JSON.stringify(contents.sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)));
+}
+async function syncDirectory(path) {
+    const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function saveTransaction(root, transaction, value) {
+    await safeDirectory(root, relative(root, transaction));
+    const temporary = join(transaction, 'manifest.next');
+    const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_NOFOLLOW, 0o600);
+    try {
+        await handle.writeFile(JSON.stringify(value));
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+    await rename(temporary, join(transaction, 'manifest.json'));
+    await syncDirectory(transaction);
+}
+async function removeTransaction(root, transaction) {
+    await safeDirectory(root, relative(root, transaction));
+    await rm(transaction, { recursive: true, force: true });
+}
+async function readTransaction(root, transaction) {
+    await safeDirectory(root, relative(root, transaction));
+    const handle = await open(join(transaction, 'manifest.json'), constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const stat = await handle.stat();
+        if (!stat.isFile() || stat.nlink !== 1 || stat.size > 1024 * 1024)
+            throw new AssetLibraryImportError('invalid_library_import');
+        const value = JSON.parse(await handle.readFile('utf8'));
+        if (!value || value.version !== 1 || typeof value.target !== 'string'
+            || !['prepared', 'backed_up', 'reserved', 'published'].includes(value.phase)
+            || !(value.originalHash === null || /^[a-f0-9]{64}$/.test(value.originalHash))
+            || !/^[a-f0-9]{64}$/.test(value.incomingHash))
+            throw new AssetLibraryImportError('invalid_library_import');
+        validPath(value.target);
+        if ((value.operationId !== undefined || value.assetId !== undefined || value.paths !== undefined)
+            && (typeof value.operationId !== 'string' || !value.operationId || value.operationId.length > 128
+                || typeof value.assetId !== 'string' || !value.assetId || value.assetId.length > 128
+                || !Array.isArray(value.paths) || !value.paths.length || value.paths.length > WORKSPACE_LIBRARY_ATTACHMENT_MAX_FILES
+                || value.paths.some(path => typeof path !== 'string' || !path.startsWith(`${value.target}/`) || !workspaceRelativePathSchema.safeParse(path).success)))
+            throw new AssetLibraryImportError('invalid_library_import');
+        return value;
+    }
+    finally {
+        await handle.close();
+    }
+}
+/** Restore interrupted replacements before serving files; ambiguous states retain every backup. */
+export async function recoverInterruptedLibraryImports(root) {
+    const rootReal = await realpath(root);
+    const result = { recovered: [], pending: [], published: [] };
+    let scratch;
+    try {
+        scratch = await safeDirectory(rootReal, '.playcraft-temp');
+    }
+    catch (error) {
+        if (missing(error))
+            return result;
+        throw error;
+    }
+    for (const entry of await readdir(scratch, { withFileTypes: true })) {
+        if (!entry.isDirectory() || !entry.name.startsWith('library-import-'))
+            continue;
+        const transaction = join(scratch, entry.name);
+        try {
+            const manifest = await readTransaction(rootReal, transaction);
+            const target = join(rootReal, manifest.target);
+            const parent = dirname(manifest.target) === '.' ? '' : dirname(manifest.target);
+            await safeDirectory(rootReal, parent, true);
+            const current = await statTarget(rootReal, manifest.target);
+            const backup = await lstat(join(transaction, 'previous')).catch(error => { if (missing(error))
+                return undefined; throw error; });
+            const incoming = await lstat(join(transaction, 'incoming')).catch(error => { if (missing(error))
+                return undefined; throw error; });
+            if (backup && (!backup.isDirectory() || backup.isSymbolicLink()))
+                throw new AssetLibraryImportError('invalid_library_import_path');
+            if (current?.isDirectory() && !current.isSymbolicLink() && !incoming
+                && await directorySnapshot(target) === manifest.incomingHash) {
+                if (manifest.operationId && manifest.assetId && manifest.paths)
+                    result.published.push({ operationId: manifest.operationId, assetId: manifest.assetId, paths: manifest.paths });
+                await removeTransaction(rootReal, transaction);
+                result.recovered.push(manifest.target);
+                continue;
+            }
+            if (backup) {
+                if (current) {
+                    if (!current.isDirectory() || current.isSymbolicLink() || (await readdir(target)).length)
+                        throw new AssetLibraryImportError('content_conflict');
+                    if (manifest.reservation && (current.ino !== manifest.reservation.ino || current.dev !== manifest.reservation.dev))
+                        throw new AssetLibraryImportError('content_conflict');
+                    await safeDirectory(rootReal, parent);
+                    await rmdir(target);
+                }
+                await safeDirectory(rootReal, parent);
+                await safeDirectory(rootReal, relative(rootReal, transaction));
+                await rename(join(transaction, 'previous'), target);
+                await syncDirectory(dirname(target));
+                await removeTransaction(rootReal, transaction);
+                result.recovered.push(manifest.target);
+                continue;
+            }
+            if (manifest.originalHash !== null && !current)
+                throw new AssetLibraryImportError('content_conflict');
+            await removeTransaction(rootReal, transaction);
+        }
+        catch {
+            result.pending.push(relative(rootReal, transaction));
+        }
+    }
+    return result;
+}
+async function publishBundle(root, target, asset, replace, assertCurrent, operationId) {
+    const parent = dirname(target) === '.' ? '' : dirname(target);
+    await createPublicDirectory(root, parent);
+    const previous = await statTarget(root, target);
+    if (previous && (!replace || !previous.isDirectory() || previous.isSymbolicLink()))
+        throw new AssetLibraryImportError('content_conflict');
+    const originalHash = previous ? await directorySnapshot(join(root, target)) : undefined;
+    const scratch = await safeDirectory(root, '.playcraft-temp', true);
+    const transaction = await mkdtemp(join(scratch, 'library-import-'));
+    const staged = join(transaction, 'incoming'), backup = join(transaction, 'previous');
+    await mkdir(staged, { mode: 0o700 });
+    let moved = false, published = false, preserve = false;
+    let reservation;
+    try {
+        await shareWorkspaceAssetDirectory(root, staged);
+        for (const file of asset.files) {
+            await writeWorkspaceBinaryFile(staged, { path: file.path, contentBase64: file.content, expectedContentHash: null });
+        }
+        const manifest = { version: 1, target, phase: 'prepared', originalHash: originalHash ?? null,
+            incomingHash: await directorySnapshot(staged), ...(operationId ? { operationId, assetId: asset.assetId,
+                paths: asset.files.map(file => `${target}/${file.path}`) } : {}) };
+        await saveTransaction(root, transaction, manifest);
+        await assertCurrent();
+        await safeDirectory(root, parent);
+        const current = await statTarget(root, target);
+        if (previous) {
+            if (!current || current.ino !== previous.ino || current.dev !== previous.dev || !current.isDirectory()
+                || await directorySnapshot(join(root, target)) !== originalHash)
+                throw new AssetLibraryImportError('content_conflict');
+            await rename(join(root, target), backup);
+            moved = true;
+            preserve = true;
+            await syncDirectory(join(root, parent));
+            await saveTransaction(root, transaction, { ...manifest, phase: 'backed_up' });
+            if (await directorySnapshot(backup) !== originalHash)
+                throw new AssetLibraryImportError('content_conflict');
+        }
+        else if (current)
+            throw new AssetLibraryImportError('content_conflict');
+        await mkdir(join(root, target), { mode: 0o700 });
+        reservation = await lstat(join(root, target));
+        await saveTransaction(root, transaction, { ...manifest, phase: 'reserved', reservation: { dev: reservation.dev, ino: reservation.ino } });
+        await assertCurrent();
+        await safeDirectory(root, parent);
+        await safeDirectory(root, relative(root, transaction));
+        const verified = await lstat(join(root, target));
+        if (!verified.isDirectory() || verified.isSymbolicLink() || verified.ino !== reservation.ino || verified.dev !== reservation.dev)
+            throw new AssetLibraryImportError('content_conflict');
+        await rename(staged, join(root, target));
+        published = true;
+        preserve = Boolean(operationId);
+        await syncDirectory(join(root, parent));
+        await saveTransaction(root, transaction, { ...manifest, phase: 'published' });
+        return operationId ? transaction : undefined;
+    }
+    catch (error) {
+        if (!published && reservation) {
+            const current = await statTarget(root, target);
+            if (current?.ino === reservation.ino && current.dev === reservation.dev)
+                await rmdir(join(root, target)).catch(() => undefined);
+        }
+        if (moved && !published) {
+            preserve = true;
+            if (!await statTarget(root, target)) {
+                await rename(backup, join(root, target));
+                preserve = false;
+            }
+        }
+        throw error;
+    }
+    finally {
+        // A concurrent replacement can prevent rollback; keep the original bytes for recovery.
+        if (!preserve)
+            await removeTransaction(root, transaction).catch(() => undefined);
+    }
+}
+export async function importWorkspaceLibraryAssets(root, selection, snapshot, assertCurrent = async () => undefined, options = {}) {
+    const payload = workspaceAssetLibraryImportPayloadSchema.parse(selection);
+    const transport = workspaceAssetLibraryImportTransportSchema.parse(snapshot);
+    const exported = new Map(transport.assets.map(asset => [asset.assetId, asset]));
+    const received = new Set([...exported.keys(), ...transport.failures.map(failure => failure.assetId)]);
+    if (payload.assetIds.length !== received.size || payload.assetIds.some(id => !received.has(id)))
+        throw new AssetLibraryImportError('invalid_library_import');
+    if (payload.targetDirectory)
+        validPath(payload.targetDirectory);
+    const rootReal = await realpath(root);
+    await createPublicDirectory(rootReal, payload.targetDirectory);
+    const result = { paths: [], skippedPaths: [], failures: [...transport.failures] };
+    const processed = new Set(transport.failures.map(failure => failure.assetId));
+    const progress = () => options.onProgress?.({ ...result, failures: [...result.failures,
+            ...payload.assetIds.filter(id => !processed.has(id)).map(assetId => ({ assetId, error: 'asset_library_import_interrupted' }))] });
+    await progress();
+    for (const assetId of payload.assetIds) {
+        const asset = exported.get(assetId);
+        if (!asset)
+            continue;
+        let publishedTransaction;
+        try {
+            validateAsset(asset);
+            await assertCurrent();
+            const originalName = asset.kind === 'bundle'
+                ? asset.name.replace(/\.(?:prefab|aiaudio|aiimage|aiconfig|aigameplay)$/i, '')
+                : basename(asset.files[0].path);
+            validPath(originalName);
+            if (originalName.includes('/'))
+                throw new AssetLibraryImportError('invalid_library_import_path');
+            let name = originalName;
+            let target = validPath([payload.targetDirectory, name].filter(Boolean).join('/'));
+            let existing = await statTarget(rootReal, target);
+            if (existing && payload.collision === 'skip') {
+                result.skippedPaths.push(target);
+                processed.add(assetId);
+                await progress();
+                continue;
+            }
+            if (payload.collision === 'rename') {
+                const extension = asset.kind === 'bundle' ? '' : extname(originalName);
+                const stem = originalName.slice(0, originalName.length - extension.length);
+                for (let suffix = 1; existing; suffix++) {
+                    if (suffix > 10_000)
+                        throw new AssetLibraryImportError('content_conflict');
+                    name = `${stem} (${suffix})${extension}`;
+                    target = validPath([payload.targetDirectory, name].filter(Boolean).join('/'));
+                    existing = await statTarget(rootReal, target);
+                }
+            }
+            if (asset.kind === 'bundle') {
+                const paths = asset.files.map(file => validPath(`${target}/${file.path}`));
+                publishedTransaction = await publishBundle(rootReal, target, asset, payload.collision === 'replace', assertCurrent, options.operationId);
+                result.paths.push(...paths);
+            }
+            else {
+                const observed = existing ? await observeWorkspaceBinaryFile(rootReal, target) : undefined;
+                await assertCurrent();
+                await writeWorkspaceBinaryFile(rootReal, { path: target, contentBase64: asset.files[0].content,
+                    expectedContentHash: observed?.contentHash ?? null });
+                result.paths.push(target);
+            }
+        }
+        catch (error) {
+            const code = error instanceof AssetLibraryImportError ? error.message
+                : error?.code === 'content_conflict' ? 'content_conflict'
+                    : ['EACCES', 'EPERM'].includes(String(error?.code)) ? 'workspace_permission_denied'
+                        : 'asset_library_import_failed';
+            result.failures.push({ assetId, error: code });
+        }
+        processed.add(assetId);
+        await progress();
+        if (publishedTransaction)
+            await removeTransaction(rootReal, publishedTransaction).catch(() => undefined);
+    }
+    return workspaceAssetLibraryImportResultSchema.parse(result);
+}

package/dist/workspace-runtime/workspaces/asset-publication-access.js

@@ -0,0 +1,29 @@
+import { constants } from 'node:fs';
+import { lstat, open } from 'node:fs/promises';
+async function shareWithWorkspaceGroup(root, handle, directory) {
+    const workspace = await lstat(root), target = await handle.stat();
+    if (!workspace.isDirectory() || workspace.isSymbolicLink()
+        || (directory ? !target.isDirectory() : !target.isFile() || target.nlink !== 1))
+        throw new Error('invalid_workspace_asset');
+    const shared = directory ? 0o2770 : 0o660;
+    // Already shared: the other identity owns this entry and cannot re-shape it from here.
+    if (target.gid === workspace.gid && (target.mode & 0o7777) === shared)
+        return;
+    if (target.gid !== workspace.gid)
+        await handle.chown(target.uid, workspace.gid);
+    // Match directory-access.ts: the development group can read and edit public project files.
+    // Private transfers, chunks, transaction records and backups never use these helpers.
+    await handle.chmod(shared);
+}
+export async function shareWorkspaceAssetFile(root, handle) {
+    await shareWithWorkspaceGroup(root, handle, false);
+}
+export async function shareWorkspaceAssetDirectory(root, path) {
+    const handle = await open(path, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    try {
+        await shareWithWorkspaceGroup(root, handle, true);
+    }
+    finally {
+        await handle.close();
+    }
+}

package/dist/workspace-runtime/workspaces/asset-transfer-dependencies.js

@@ -0,0 +1,81 @@
+import { constants } from 'node:fs';
+import { open } from 'node:fs/promises';
+import { extname, join, posix } from 'node:path';
+import { AssetTransferError, safeAssetTransferDirectory } from './asset-transfer-storage.js';
+const METADATA_MAX_BYTES = 8 * 1024 * 1024;
+/** Parse only bounded model metadata; all external dependencies must be explicit package members. */
+export async function validateAssetTransferDependencies(transfer) {
+    const paths = new Set(transfer.record.manifest.files.map(file => file.path));
+    for (const [index, file] of transfer.record.manifest.files.entries()) {
+        const extension = extname(file.path).toLowerCase();
+        if (extension !== '.gltf' && extension !== '.glb')
+            continue;
+        await safeAssetTransferDirectory(transfer.directory, 'incoming');
+        const handle = await open(join(transfer.directory, 'incoming', String(index)), constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+            let start = 0, size = file.size;
+            if (extension === '.glb') {
+                const header = Buffer.alloc(20);
+                const read = await handle.read(header, 0, header.length, 0);
+                if (read.bytesRead !== 20 || header.readUInt32LE(0) !== 0x46546c67 || header.readUInt32LE(4) !== 2
+                    || header.readUInt32LE(8) !== file.size || header.readUInt32LE(16) !== 0x4e4f534a)
+                    throw new AssetTransferError('asset_transfer_invalid_model');
+                size = header.readUInt32LE(12);
+                start = 20;
+            }
+            if (size > METADATA_MAX_BYTES)
+                throw new AssetTransferError('asset_transfer_metadata_too_large', 413);
+            if (size < 2 || size + start > file.size)
+                throw new AssetTransferError('asset_transfer_invalid_model');
+            const bytes = Buffer.alloc(size);
+            let offset = 0;
+            while (offset < size) {
+                const read = await handle.read(bytes, offset, size - offset, start + offset);
+                if (!read.bytesRead)
+                    throw new AssetTransferError('asset_transfer_invalid_model');
+                offset += read.bytesRead;
+            }
+            let body;
+            try {
+                body = JSON.parse(bytes.toString('utf8'));
+            }
+            catch {
+                throw new AssetTransferError('asset_transfer_invalid_model');
+            }
+            if (!body || typeof body !== 'object' || Array.isArray(body)
+                || !Array.isArray(body.buffers ?? []) || !Array.isArray(body.images ?? []))
+                throw new AssetTransferError('asset_transfer_invalid_model');
+            for (const resource of [...(body.buffers ?? []), ...(body.images ?? [])]) {
+                if (!resource || typeof resource !== 'object' || Array.isArray(resource))
+                    throw new AssetTransferError('asset_transfer_invalid_model');
+                if (resource.uri === undefined)
+                    continue;
+                if (typeof resource.uri !== 'string')
+                    throw new AssetTransferError('asset_transfer_invalid_model');
+                const target = assetTransferDependencyPath(file, resource.uri);
+                if (target && !paths.has(target))
+                    throw new AssetTransferError('asset_transfer_missing_dependency');
+            }
+        }
+        finally {
+            await handle.close();
+        }
+    }
+}
+function assetTransferDependencyPath(file, uri) {
+    if (/^data:/i.test(uri))
+        return undefined;
+    let decoded;
+    try {
+        decoded = decodeURIComponent(uri);
+    }
+    catch {
+        throw new AssetTransferError('asset_transfer_invalid_dependency');
+    }
+    if (!decoded || /^[a-z][a-z\d+.-]*:/i.test(decoded) || /^[\/\\]/.test(decoded) || /[\\:\x00-\x1f\x7f?#]/.test(decoded))
+        throw new AssetTransferError('asset_transfer_invalid_dependency');
+    const target = posix.normalize(posix.join(posix.dirname(file.path), decoded));
+    if (target === '..' || target.startsWith('../'))
+        throw new AssetTransferError('asset_transfer_invalid_dependency');
+    return target;
+}