@tequila99/githuman 0.11.2 → 0.13.0

package/dist/server/adapters/pi-acp/vendor/prompt.js

@@ -0,0 +1,56 @@
+export function promptToPiMessage(blocks) {
+    let message = '';
+    const images = [];
+    for (const b of blocks) {
+        switch (b.type) {
+            case 'text':
+                message += b.text;
+                break;
+            case 'resource_link':
+                // A lightweight, human-readable hint for the LLM.
+                message += `\n[Context] ${b.uri}`;
+                break;
+            case 'image': {
+                // pi expects base64 image bytes in `data` without a data-url prefix.
+                images.push({
+                    type: 'image',
+                    mimeType: b.mimeType,
+                    data: b.data
+                });
+                break;
+            }
+            case 'resource': {
+                // Clients should not send this if embeddedContext=false, but be resilient.
+                const r = b.resource;
+                const uri = typeof r?.uri === 'string' ? r.uri : '(unknown)';
+                if ('text' in r && typeof r.text === 'string') {
+                    // TextResourceContents
+                    const mime = typeof r?.mimeType === 'string' ? r.mimeType : 'text/plain';
+                    message += `\n[Embedded Context] ${uri} (${mime})\n${r.text}`;
+                }
+                else if ('blob' in r && typeof r.blob === 'string') {
+                    // BlobResourceContents
+                    const mime = typeof r?.mimeType === 'string'
+                        ? r.mimeType
+                        : 'application/octet-stream';
+                    const bytes = Buffer.byteLength(r.blob, 'base64');
+                    message += `\n[Embedded Context] ${uri} (${mime}, ${bytes} bytes)`;
+                }
+                else {
+                    message += `\n[Embedded Context] ${uri}`;
+                }
+                break;
+            }
+            case 'audio': {
+                // Not supported by pi. Provide a marker so we don't silently drop context.
+                const bytes = Buffer.byteLength(b.data, 'base64');
+                message += `\n[Audio] (${b.mimeType}, ${bytes} bytes) not supported by pi-acp`;
+                break;
+            }
+            default:
+                // Ignore unknown block types for now.
+                break;
+        }
+    }
+    return { message, images };
+}

package/dist/server/app.js

@@ -1,3 +1,13 @@
+import { artifactActionRoutes } from "./routes/artifact-actions.js";
+import { artifactTransitionRoutes } from "./routes/artifact-transitions.js";
+import { addressUrl } from "../shared/network/address-url.js";
+import { artifactAgentRoutes } from "./routes/artifact-agent.js";
+import { ForbiddenError } from "./errors/http.js";
+import { artifactDefinitionRoutes } from "./routes/artifact-definitions.js";
+import { DEFAULT_DB_PREFIX } from "../shared/app/storage-constants.js";
+import { artifactRoutes } from "./routes/artifacts.js";
+import { ArtifactStorageService } from "./services/artifact-storage.service.js";
+import { ArtifactMaintenanceService } from "./services/artifact-maintenance.service.js";
 import { watchNotes } from "./services/notes-watcher.service.js";
 import { notesRoutes } from "./routes/notes.js";
 import { NotesService } from "./services/notes.service.js";
@@ -49,8 +59,15 @@ const DEVICE_SWEEP_MS = 60 * 60 * 1000;
 // also when another server process on the same database revoked it.
 // One indexed SELECT per connected device.
 const DEVICE_RECHECK_MS = 2000;
+// A wildcard bind accepts loopback connections; the MCP process connects there.
+const WILDCARD_LOOPBACK = {
+    '::': '::1',
+    '0.0.0.0': '127.0.0.1'
+};
 export function buildApp(options = {}) {
     const app = Fastify({
+        // Logging is off. Redact the Authorization header before you turn it on:
+        // it carries the agent session key (ADR 0096).
         logger: false,
         forceCloseConnections: true,
         ajv: {
@@ -62,6 +79,7 @@ export function buildApp(options = {}) {
             ]
         }
     });
+    const allowedHosts = new AllowedHosts(options.allowedHosts);
     const repositoryPath = options.repositoryPath ?? process.cwd();
     const db = options.db ?? createTestDatabase();
     const eventBus = options.eventBus ?? createEventBus();
@@ -70,6 +88,8 @@ export function buildApp(options = {}) {
         onChange: () => eventBus.publish({ type: 'devices:changed' })
     });
     const deviceConnections = new DeviceConnections(devices);
+    // Set after the access hook exists, because the registry needs the listening server address.
+    let agentRegistry;
     devices.removeExpired();
     const sweep = setInterval(() => devices.removeExpired(), DEVICE_SWEEP_MS);
     sweep.unref();
@@ -92,7 +112,16 @@ export function buildApp(options = {}) {
     app.register(fastifyPlugin(async (root) => {
         root.addHook('onRequest', createAccessHook({
             devices,
-            allowedHosts: new AllowedHosts(options.allowedHosts)
+            allowedHosts,
+            authorizeArtifactAgent(request, reply) {
+                const id = agentRegistry?.authenticateArtifactKey(request.headers.authorization);
+                if (!id || !agentRegistry) {
+                    throw new ForbiddenError('Artifact session access denied.');
+                }
+                const release = agentRegistry.trackArtifactRequest(id, () => reply.raw.destroy());
+                reply.raw.once('finish', release);
+                reply.raw.once('close', release);
+            }
         }));
     }));
     // The spec collects routes as they are added, so it comes before them.
@@ -120,6 +149,48 @@ export function buildApp(options = {}) {
             watcher.close();
         });
     }
+    const artifacts = options.artifacts ??
+        new ArtifactStorageService({
+            db,
+            repositoryPath,
+            prefix: options.artifactPrefix ?? DEFAULT_DB_PREFIX,
+            eventBus
+        });
+    app.register(artifactRoutes, { service: artifacts });
+    app.register(artifactActionRoutes, {
+        service: artifacts.lifecycle,
+        recheckAccess: createAccessHook({ devices, allowedHosts })
+    });
+    artifacts.lifecycle.transitions.setActorGuard(actor => actor.id === 'local' || devices.isTrusted(actor.id));
+    artifacts.lifecycle.transitions.setErrorHandler(error => app.log.error({ err: error }, 'Artifact transition work failed'));
+    if (options.onValidationDebug) {
+        artifacts.lifecycle.jobs.setDebug(options.onValidationDebug);
+    }
+    app.register(artifactTransitionRoutes, {
+        service: artifacts.lifecycle.transitions,
+        recheckAccess: createAccessHook({ devices, allowedHosts })
+    });
+    app.addHook('onReady', async () => {
+        artifacts.lifecycle.jobs.recover();
+        artifacts.lifecycle.transitions.start();
+    });
+    app.addHook('onClose', async () => {
+        artifacts.lifecycle.transitions.stop();
+        artifacts.lifecycle.jobs.close();
+    });
+    app.register(artifactDefinitionRoutes, { storage: artifacts });
+    const artifactMaintenance = new ArtifactMaintenanceService({
+        storage: artifacts,
+        onError: (error, phase) => {
+            app.log.error({ err: error, phase }, 'Artifact maintenance failed');
+        }
+    });
+    app.addHook('onReady', async () => {
+        artifactMaintenance.start();
+    });
+    app.addHook('onClose', async () => {
+        artifactMaintenance.stop();
+    });
     app.register(diffRoutes, { repositoryPath });
     app.register(gitRoutes, { repositoryPath });
     app.register(projectFileRoutes, { repositoryPath });
@@ -148,12 +219,31 @@ export function buildApp(options = {}) {
         });
     }
     if (options.agentPresets) {
+        const registry = createSessionRegistry({
+            presets: options.agentPresets,
+            connections: deviceConnections,
+            artifactUrl: () => {
+                const address = app.server.address();
+                // Before listen there is no address; only tests that skip listen get here.
+                if (!address)
+                    return undefined;
+                if (typeof address === 'string') {
+                    throw new Error(`Artifact tools need a TCP address, but the server listens on "${address}".`);
+                }
+                return `${addressUrl(WILDCARD_LOOPBACK[address.address] ?? address.address, address.port)}/`;
+            },
+            repositoryPath,
+            taskIds: sessionId => artifacts.definitions.assignment(sessionId).taskIds,
+            taskAssignment: sessionId => artifacts.definitions.assignment(sessionId)
+        });
+        agentRegistry = registry;
+        app.register(artifactAgentRoutes, { storage: artifacts, registry });
+        artifacts.tasks.attachSessions(registry);
+        artifacts.lifecycle.attachSessions(registry);
         app.register(agentRoutes, {
+            artifacts,
             notes,
-            registry: createSessionRegistry({
-                presets: options.agentPresets,
-                repositoryPath
-            }),
+            registry,
             db,
             repositoryPath,
             eventBus,

package/dist/server/config/agents.js

@@ -1,3 +1,4 @@
+import { localPiLaunch } from "../adapters/pi-acp/launch.js";
 import { isSystemError } from "../utils/system-error.js";
 import { readFileSync } from 'node:fs';
 import { Type } from '@sinclair/typebox';
@@ -5,10 +6,8 @@ import { Value } from '@sinclair/typebox/value';
 import { isOnPath } from "../utils/executable.js";
 import { isRecord } from "../../shared/utils/guards.js";
 /**
- * Packages are pinned to the versions the ADR 0023 spike was run against —
- * `npx -y` otherwise executes whatever was published last. Cursor and Codex
- * are not verified yet (Codex's adapter moved to the agentclientprotocol org
- * after zed-industries/codex-acp was archived) and stay unpinned.
+ * Pin external adapters where verified. The local pi bridge uses the installed runtime.
+ * Cursor and Codex keep their existing launch configuration.
  */
 export const DEFAULT_AGENT_PRESETS = [
     {
@@ -21,8 +20,7 @@ export const DEFAULT_AGENT_PRESETS = [
     {
         id: 'pi',
         title: 'pi',
-        command: 'npx',
-        args: ['-y', 'pi-acp@0.0.34'],
+        ...localPiLaunch(),
         requires: 'pi',
         autoApprovesEdits: true
     },

package/dist/server/db/artifact-graph-migrations.js

@@ -0,0 +1,56 @@
+import { protectArtifactTables } from "./artifact-migrations.js";
+export function applyArtifactGraphMigrations(db) {
+    db.exec(`
+ CREATE TABLE IF NOT EXISTS artifact_store_changes (
+ seq INTEGER PRIMARY KEY AUTOINCREMENT, store_id TEXT NOT NULL,
+ entity_kind TEXT NOT NULL, entity_id TEXT NOT NULL, request_id TEXT NOT NULL,
+ UNIQUE(store_id,entity_kind,request_id));
+ CREATE TABLE IF NOT EXISTS artifact_revision_parents (
+ store_id TEXT NOT NULL, child_id TEXT NOT NULL, parent_id TEXT NOT NULL,
+ PRIMARY KEY(store_id,child_id));
+ CREATE INDEX IF NOT EXISTS artifact_revision_children ON artifact_revision_parents(store_id,parent_id,child_id);
+ CREATE TABLE IF NOT EXISTS artifact_definition_operations (
+ store_id TEXT NOT NULL, request_id TEXT NOT NULL, payload_hash TEXT NOT NULL,
+ result_json TEXT NOT NULL, PRIMARY KEY(store_id,request_id));
+ CREATE TABLE IF NOT EXISTS artifact_type_versions (
+ store_id TEXT NOT NULL, id TEXT NOT NULL, version INTEGER NOT NULL,
+ request_id TEXT NOT NULL, snapshot_json TEXT NOT NULL, actor_json TEXT NOT NULL,
+ created_at TEXT NOT NULL, PRIMARY KEY(store_id,id,version), UNIQUE(store_id,request_id));
+ CREATE TABLE IF NOT EXISTS artifact_type_current (
+ store_id TEXT NOT NULL, id TEXT NOT NULL, snapshot_json TEXT NOT NULL,
+ PRIMARY KEY(store_id,id));
+ CREATE TABLE IF NOT EXISTS task_versions (
+ store_id TEXT NOT NULL, id TEXT NOT NULL, version INTEGER NOT NULL,
+ request_id TEXT NOT NULL, snapshot_json TEXT NOT NULL, actor_json TEXT NOT NULL,
+ created_at TEXT NOT NULL, PRIMARY KEY(store_id,id,version), UNIQUE(store_id,request_id));
+ CREATE TABLE IF NOT EXISTS task_current (
+ store_id TEXT NOT NULL, id TEXT NOT NULL, snapshot_json TEXT NOT NULL,
+ PRIMARY KEY(store_id,id));
+ CREATE TABLE IF NOT EXISTS task_chat_link_events (
+ seq INTEGER PRIMARY KEY AUTOINCREMENT,store_id TEXT NOT NULL,session_id TEXT NOT NULL,
+ version INTEGER NOT NULL,request_id TEXT NOT NULL, task_ids_json TEXT NOT NULL,
+ chat_title_snapshot TEXT NOT NULL,actor_json TEXT NOT NULL,created_at TEXT NOT NULL,
+ UNIQUE(store_id,session_id,version),UNIQUE(store_id,request_id));
+ `);
+    const columns = db
+        .prepare('PRAGMA table_info(artifact_store_changes)')
+        .all();
+    if (!columns.some(column => column.name === 'validation_relevant')) {
+        // Older changes conservatively invalidate validations after upgrade.
+        db.exec('ALTER TABLE artifact_store_changes ADD COLUMN validation_relevant INTEGER NOT NULL DEFAULT 1');
+    }
+    db.exec('CREATE INDEX IF NOT EXISTS artifact_validation_changes ON artifact_store_changes(store_id,validation_relevant,seq)');
+    // Copy an 0088 history once: the journal is empty only before the first copy.
+    // Events that older code adds after this point are not copied.
+    db.exec(`INSERT INTO artifact_store_changes(seq,store_id,entity_kind,entity_id,request_id)
+ SELECT seq,store_id,'artifact',artifact_id,request_id FROM artifact_events e
+ WHERE NOT EXISTS(SELECT 1 FROM artifact_store_changes);`);
+    protectArtifactTables(db, {
+        artifact_store_changes: 'seq=NEW.seq OR (store_id=NEW.store_id AND entity_kind=NEW.entity_kind AND request_id=NEW.request_id)',
+        artifact_revision_parents: 'store_id=NEW.store_id AND child_id=NEW.child_id',
+        artifact_definition_operations: 'store_id=NEW.store_id AND request_id=NEW.request_id',
+        artifact_type_versions: 'store_id=NEW.store_id AND ((id=NEW.id AND version=NEW.version) OR request_id=NEW.request_id)',
+        task_versions: 'store_id=NEW.store_id AND ((id=NEW.id AND version=NEW.version) OR request_id=NEW.request_id)',
+        task_chat_link_events: 'seq=NEW.seq OR (store_id=NEW.store_id AND ((session_id=NEW.session_id AND version=NEW.version) OR request_id=NEW.request_id))'
+    });
+}

package/dist/server/db/artifact-migrations.js

@@ -0,0 +1,70 @@
+// Authoritative records remain append-only even when a caller bypasses the repository.
+const IMMUTABLE_KEYS = {
+    artifact_stores: 'id=NEW.id OR (canonical_root=NEW.canonical_root AND db_namespace=NEW.db_namespace)',
+    artifacts: 'store_id=NEW.store_id AND (id=NEW.id OR file_name=NEW.file_name)',
+    artifact_metadata_versions: 'store_id=NEW.store_id AND ((artifact_id=NEW.artifact_id AND version=NEW.version) OR request_id=NEW.request_id)',
+    artifact_events: 'seq=NEW.seq OR (store_id=NEW.store_id AND request_id=NEW.request_id)',
+    artifact_operations: 'store_id=NEW.store_id AND request_id=NEW.request_id',
+    artifact_operation_events: 'seq=NEW.seq'
+};
+export function applyArtifactMigrations(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS artifact_stores (
+      id TEXT PRIMARY KEY, canonical_root TEXT NOT NULL, db_namespace TEXT NOT NULL,
+      schema_version INTEGER NOT NULL, UNIQUE(canonical_root, db_namespace)
+    );
+    CREATE TABLE IF NOT EXISTS artifacts (
+      store_id TEXT NOT NULL, id TEXT NOT NULL, file_name TEXT NOT NULL,
+      sha256 TEXT NOT NULL, bytes INTEGER NOT NULL, body_start_line INTEGER NOT NULL,
+      created_at TEXT NOT NULL, PRIMARY KEY(store_id,id), UNIQUE(store_id,file_name)
+    );
+    CREATE INDEX IF NOT EXISTS artifact_catalog_order ON artifacts(store_id,created_at,id);
+    CREATE TABLE IF NOT EXISTS artifact_metadata_versions (
+      store_id TEXT NOT NULL, artifact_id TEXT NOT NULL, version INTEGER NOT NULL,
+      request_id TEXT NOT NULL, snapshot_json TEXT NOT NULL,
+      PRIMARY KEY(store_id,artifact_id,version), UNIQUE(store_id,request_id)
+    );
+    CREATE TABLE IF NOT EXISTS artifact_events (
+      seq INTEGER PRIMARY KEY AUTOINCREMENT, store_id TEXT NOT NULL,
+      artifact_id TEXT NOT NULL, request_id TEXT NOT NULL, data_json TEXT NOT NULL,
+      UNIQUE(store_id,request_id)
+    );
+    CREATE INDEX IF NOT EXISTS artifact_history ON artifact_events(store_id,artifact_id,seq);
+    CREATE TABLE IF NOT EXISTS artifact_current (
+      store_id TEXT NOT NULL, artifact_id TEXT NOT NULL, version INTEGER NOT NULL,
+      snapshot_json TEXT NOT NULL, PRIMARY KEY(store_id,artifact_id)
+    );
+    CREATE TABLE IF NOT EXISTS artifact_store_epochs (
+      store_id TEXT PRIMARY KEY, store_epoch INTEGER NOT NULL DEFAULT 0
+    );
+    CREATE TABLE IF NOT EXISTS artifact_operations (
+      store_id TEXT NOT NULL, request_id TEXT NOT NULL, kind TEXT NOT NULL,
+      payload_hash TEXT NOT NULL, artifact_id TEXT NOT NULL, data_json TEXT NOT NULL,
+      PRIMARY KEY(store_id,request_id)
+    );
+    CREATE TABLE IF NOT EXISTS artifact_operation_events (
+      seq INTEGER PRIMARY KEY AUTOINCREMENT, store_id TEXT NOT NULL,
+      request_id TEXT NOT NULL, state TEXT NOT NULL, created_at TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS artifact_operation_history ON artifact_operation_events(store_id,request_id,seq);
+    CREATE TABLE IF NOT EXISTS artifact_operation_leases (
+      store_id TEXT NOT NULL, request_id TEXT NOT NULL, owner TEXT NOT NULL,
+      expires_at INTEGER NOT NULL, PRIMARY KEY(store_id,request_id)
+    );
+  `);
+    protectArtifactTables(db, IMMUTABLE_KEYS);
+}
+export function protectArtifactTables(db, tables) {
+    for (const [table, keys] of Object.entries(tables)) {
+        // REPLACE can bypass DELETE triggers when recursive triggers are disabled.
+        // The rowid test stops REPLACE with an explicit rowid in tables without an
+        // integer primary key. SQLite does not define NEW.rowid when it assigns the rowid.
+        db.exec(`CREATE TRIGGER IF NOT EXISTS ${table}_no_replace BEFORE INSERT ON ${table}
+      WHEN EXISTS(SELECT 1 FROM ${table} WHERE rowid=NEW.rowid OR (${keys}))
+      BEGIN SELECT RAISE(ABORT, 'Artifact history is immutable'); END;`);
+        for (const action of ['UPDATE', 'DELETE']) {
+            db.exec(`CREATE TRIGGER IF NOT EXISTS ${table}_no_${action.toLowerCase()}
+        BEFORE ${action} ON ${table} BEGIN SELECT RAISE(ABORT, 'Artifact history is immutable'); END;`);
+        }
+    }
+}

package/dist/server/db/artifact-review-migrations.js

@@ -0,0 +1,24 @@
+import { protectArtifactTables } from "./artifact-migrations.js";
+export function applyArtifactReviewMigrations(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS artifact_review_events (
+      seq INTEGER PRIMARY KEY AUTOINCREMENT, store_id TEXT NOT NULL,
+      thread_id TEXT NOT NULL, origin_artifact_id TEXT NOT NULL,
+      version INTEGER NOT NULL CHECK(version >= 1), request_id TEXT NOT NULL,
+      data_json TEXT NOT NULL,
+      UNIQUE(store_id,thread_id,version), UNIQUE(store_id,request_id)
+    );
+    CREATE INDEX IF NOT EXISTS artifact_review_history
+      ON artifact_review_events(store_id,thread_id,seq);
+    CREATE TABLE IF NOT EXISTS artifact_thread_current (
+      store_id TEXT NOT NULL, thread_id TEXT NOT NULL,
+      origin_artifact_id TEXT NOT NULL, version INTEGER NOT NULL,
+      snapshot_json TEXT NOT NULL, PRIMARY KEY(store_id,thread_id)
+    );
+    CREATE INDEX IF NOT EXISTS artifact_thread_origin
+      ON artifact_thread_current(store_id,origin_artifact_id,thread_id);
+  `);
+    protectArtifactTables(db, {
+        artifact_review_events: 'seq=NEW.seq OR (store_id=NEW.store_id AND ((thread_id=NEW.thread_id AND version=NEW.version) OR request_id=NEW.request_id))'
+    });
+}

package/dist/server/db/artifact-search-migrations.js

@@ -0,0 +1,31 @@
+import { withSavepoint } from "./transaction.js";
+export function probeArtifactSearch(db) {
+    try {
+        withSavepoint(db, () => {
+            db.exec("CREATE VIRTUAL TABLE temp.ght_search_probe_words USING fts5(text,tokenize='unicode61'); CREATE VIRTUAL TABLE temp.ght_search_probe_grams USING fts5(text,tokenize='trigram'); DROP TABLE temp.ght_search_probe_words; DROP TABLE temp.ght_search_probe_grams;");
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function applyArtifactSearchMigrations(db) {
+    db.exec(`CREATE TABLE IF NOT EXISTS artifact_search_capabilities (id INTEGER PRIMARY KEY CHECK(id=1), available INTEGER NOT NULL);
+    CREATE TABLE IF NOT EXISTS artifact_search_documents (
+      rowid INTEGER PRIMARY KEY, store_id TEXT NOT NULL, artifact_id TEXT NOT NULL,
+      version INTEGER NOT NULL, sha256 TEXT NOT NULL, title TEXT NOT NULL, body TEXT NOT NULL,
+      title_offsets TEXT NOT NULL, body_offsets TEXT NOT NULL, UNIQUE(store_id,artifact_id));
+    CREATE TABLE IF NOT EXISTS artifact_search_suppressed (store_id TEXT NOT NULL, artifact_id TEXT NOT NULL, reason TEXT NOT NULL, PRIMARY KEY(store_id,artifact_id));
+    CREATE TABLE IF NOT EXISTS artifact_search_words (store_id TEXT NOT NULL, token TEXT NOT NULL, length INTEGER NOT NULL, frequency INTEGER NOT NULL, PRIMARY KEY(store_id,token));
+    CREATE INDEX IF NOT EXISTS artifact_search_word_length ON artifact_search_words(store_id,length);
+    CREATE TABLE IF NOT EXISTS artifact_search_word_grams (store_id TEXT NOT NULL, gram TEXT NOT NULL, width INTEGER NOT NULL, token TEXT NOT NULL, PRIMARY KEY(store_id,width,gram,token));
+    CREATE TABLE IF NOT EXISTS artifact_search_document_words (store_id TEXT NOT NULL, artifact_id TEXT NOT NULL, token TEXT NOT NULL, PRIMARY KEY(store_id,artifact_id,token));
+    CREATE TABLE IF NOT EXISTS artifact_search_epochs (store_id TEXT PRIMARY KEY, epoch INTEGER NOT NULL DEFAULT 0);
+  `);
+    const available = probeArtifactSearch(db);
+    db.prepare('INSERT INTO artifact_search_capabilities VALUES(1,?) ON CONFLICT(id) DO UPDATE SET available=excluded.available').run(Number(available));
+    if (available) {
+        db.exec("CREATE VIRTUAL TABLE IF NOT EXISTS artifact_search_fts USING fts5(title,body, tokenize='unicode61 remove_diacritics 0'); CREATE VIRTUAL TABLE IF NOT EXISTS artifact_search_trigrams USING fts5(title,body, tokenize='trigram');");
+    }
+}

package/dist/server/db/artifact-validation-migrations.js

@@ -0,0 +1,70 @@
+import { protectArtifactTables } from "./artifact-migrations.js";
+export function applyArtifactValidationMigrations(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS artifact_change_set_events (
+      seq INTEGER PRIMARY KEY AUTOINCREMENT, store_id TEXT NOT NULL,
+      id TEXT NOT NULL, version INTEGER NOT NULL, request_id TEXT NOT NULL,
+      payload_json TEXT NOT NULL, UNIQUE(store_id,id,version), UNIQUE(store_id,request_id)
+    );
+    CREATE TABLE IF NOT EXISTS artifact_validation_events (
+      seq INTEGER PRIMARY KEY AUTOINCREMENT, store_id TEXT NOT NULL,
+      id TEXT NOT NULL, payload_json TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS artifact_validation_history ON artifact_validation_events(store_id,id,seq);
+    CREATE TABLE IF NOT EXISTS artifact_validation_current (
+      store_id TEXT NOT NULL, id TEXT NOT NULL, payload_json TEXT NOT NULL,
+      PRIMARY KEY(store_id,id)
+    );
+    CREATE TABLE IF NOT EXISTS artifact_validation_leases (
+      store_id TEXT PRIMARY KEY, validation_id TEXT NOT NULL,
+      owner TEXT NOT NULL, owner_pid INTEGER NOT NULL, expires_at INTEGER NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS artifact_user_authorizations (
+      seq INTEGER PRIMARY KEY AUTOINCREMENT, store_id TEXT NOT NULL,
+      id TEXT NOT NULL, payload_json TEXT NOT NULL, UNIQUE(store_id,id)
+    );
+    CREATE TABLE IF NOT EXISTS artifact_authorization_events (
+      seq INTEGER PRIMARY KEY AUTOINCREMENT, store_id TEXT NOT NULL,
+      id TEXT NOT NULL, kind TEXT NOT NULL, payload_json TEXT NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS artifact_owner_heartbeats (
+      store_id TEXT NOT NULL, owner TEXT NOT NULL, beat_at INTEGER NOT NULL,
+      PRIMARY KEY(store_id,owner)
+    );
+    CREATE TABLE IF NOT EXISTS artifact_transition_events (
+      seq INTEGER PRIMARY KEY AUTOINCREMENT, store_id TEXT NOT NULL,
+      id TEXT NOT NULL, payload_json TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS artifact_transition_history ON artifact_transition_events(store_id,id,seq);
+    CREATE TABLE IF NOT EXISTS artifact_transition_current (
+      store_id TEXT NOT NULL, id TEXT NOT NULL, artifact_id TEXT NOT NULL,
+      payload_json TEXT NOT NULL, PRIMARY KEY(store_id,id)
+    );
+    CREATE INDEX IF NOT EXISTS artifact_transition_by_artifact ON artifact_transition_current(store_id,artifact_id);
+    CREATE TABLE IF NOT EXISTS artifact_transition_requests (
+      seq INTEGER PRIMARY KEY AUTOINCREMENT, store_id TEXT NOT NULL,
+      request_id TEXT NOT NULL, payload_hash TEXT NOT NULL, operation_id TEXT NOT NULL,
+      UNIQUE(store_id,request_id)
+    );
+    CREATE TABLE IF NOT EXISTS artifact_transition_consents (
+      seq INTEGER PRIMARY KEY AUTOINCREMENT, store_id TEXT NOT NULL,
+      operation_id TEXT NOT NULL, payload_json TEXT NOT NULL,
+      UNIQUE(store_id,operation_id)
+    );
+    CREATE TABLE IF NOT EXISTS artifact_lifecycle_commits (
+      seq INTEGER PRIMARY KEY AUTOINCREMENT, store_id TEXT NOT NULL,
+      request_id TEXT NOT NULL, payload_hash TEXT NOT NULL, result_json TEXT NOT NULL,
+      UNIQUE(store_id,request_id)
+    );
+  `);
+    protectArtifactTables(db, {
+        artifact_change_set_events: 'seq=NEW.seq OR (store_id=NEW.store_id AND ((id=NEW.id AND version=NEW.version) OR request_id=NEW.request_id))',
+        artifact_validation_events: 'seq=NEW.seq',
+        artifact_user_authorizations: 'seq=NEW.seq OR (store_id=NEW.store_id AND id=NEW.id)',
+        artifact_authorization_events: 'seq=NEW.seq',
+        artifact_transition_events: 'seq=NEW.seq',
+        artifact_transition_requests: 'seq=NEW.seq OR (store_id=NEW.store_id AND request_id=NEW.request_id)',
+        artifact_transition_consents: 'seq=NEW.seq OR (store_id=NEW.store_id AND operation_id=NEW.operation_id)',
+        artifact_lifecycle_commits: 'seq=NEW.seq OR (store_id=NEW.store_id AND request_id=NEW.request_id)'
+    });
+}

package/dist/server/db/index.js

@@ -2,6 +2,8 @@ import { DatabaseSync } from 'node:sqlite';
 import { mkdirSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { applyMigrations } from "./migrations.js";
+// Give concurrent local processes time to finish short write transactions.
+const WRITE_BUSY_TIMEOUT_MS = 5000;
 export function createTestDatabase() {
     const db = new DatabaseSync(':memory:');
     applyMigrations(db);
@@ -10,6 +12,7 @@ export function createTestDatabase() {
 export function createFileDatabase(path) {
     mkdirSync(dirname(path), { recursive: true });
     const db = new DatabaseSync(path);
+    db.exec(`PRAGMA busy_timeout = ${WRITE_BUSY_TIMEOUT_MS};`);
     // WAL allows a concurrent reader (`list`/`export`) while `serve` holds the file open.
     db.exec('PRAGMA journal_mode = WAL;');
     applyMigrations(db);

package/dist/server/db/migrations.js

@@ -1,4 +1,14 @@
+import { applyArtifactSearchMigrations } from "./artifact-search-migrations.js";
+import { applyArtifactValidationMigrations } from "./artifact-validation-migrations.js";
+import { applyArtifactReviewMigrations } from "./artifact-review-migrations.js";
+import { applyArtifactGraphMigrations } from "./artifact-graph-migrations.js";
+import { applyArtifactMigrations } from "./artifact-migrations.js";
 export function applyMigrations(db) {
+    applyArtifactMigrations(db);
+    applyArtifactGraphMigrations(db);
+    applyArtifactReviewMigrations(db);
+    applyArtifactValidationMigrations(db);
+    applyArtifactSearchMigrations(db);
     db.exec(`
     CREATE TABLE IF NOT EXISTS note_storages (
       id TEXT PRIMARY KEY,

package/dist/server/db/sqlite-error.js

@@ -0,0 +1,15 @@
+// SQLite stores the primary result code in the low byte of extended codes.
+const PRIMARY_CODE_MASK = 0xff;
+// Another connection owns a conflicting database lock.
+const SQLITE_BUSY = 5;
+// A conflicting operation holds a table or connection lock.
+const SQLITE_LOCKED = 6;
+export function isSqliteBusyError(error) {
+    if (!(error instanceof Error) ||
+        !('errcode' in error) ||
+        typeof error.errcode !== 'number') {
+        return false;
+    }
+    const code = error.errcode & PRIMARY_CODE_MASK;
+    return code === SQLITE_BUSY || code === SQLITE_LOCKED;
+}

package/dist/server/db/transaction.js

@@ -0,0 +1,40 @@
+import { randomUUID } from 'node:crypto';
+import { isPromise } from 'node:util/types';
+import { AsyncTransactionError } from "../errors/database.js";
+function complete(db, run, commit, rollback) {
+    try {
+        const result = run();
+        if (result !== null &&
+            (typeof result === 'object' || typeof result === 'function') &&
+            'then' in result &&
+            typeof result.then === 'function') {
+            // Reject async results without leaving a native Promise rejection unhandled.
+            if (isPromise(result))
+                void result.catch(() => { });
+            throw new AsyncTransactionError();
+        }
+        db.exec(commit);
+        return result;
+    }
+    catch (error) {
+        try {
+            db.exec(rollback);
+        }
+        catch (rollbackError) {
+            // oxlint-disable-next-line preserve-caught-error -- Both errors are retained; the operation failure remains the primary cause.
+            throw new AggregateError([error, rollbackError], 'Transaction failed and rollback also failed.', { cause: error });
+        }
+        throw error;
+    }
+}
+export function withTransaction(db, run, options = { mode: 'deferred' }) {
+    // A failed BEGIN must not roll back a transaction owned by the caller.
+    db.exec(options.mode === 'immediate' ? 'BEGIN IMMEDIATE' : 'BEGIN DEFERRED');
+    return complete(db, run, 'COMMIT', 'ROLLBACK');
+}
+export function withSavepoint(db, run) {
+    // Unique names keep nested scopes independent of other repository calls.
+    const name = `ght_${randomUUID().replaceAll('-', '')}`;
+    db.exec(`SAVEPOINT ${name}`);
+    return complete(db, run, `RELEASE ${name}`, `ROLLBACK TO ${name}; RELEASE ${name}`);
+}

package/dist/server/errors/artifacts.js

@@ -0,0 +1,28 @@
+import createError from '@fastify/error';
+// @fastify/error matches instanceof by code, so a subclass cannot be told apart.
+// Markers keep the public code GHT_ARTIFACT_CONFLICT while callers still can.
+const BUSY = Symbol('artifact.busy');
+const LEASE_BUSY = Symbol('artifact.leaseBusy');
+export const ArtifactInputError = createError('GHT_ARTIFACT_INVALID_INPUT', '%s', 400);
+export const ArtifactNotFoundError = createError('GHT_ARTIFACT_NOT_FOUND', 'Artifact not found.', 404);
+export const ArtifactConflictError = createError('GHT_ARTIFACT_CONFLICT', '%s', 409);
+function marked(message, marker) {
+    return Object.assign(new ArtifactConflictError(message), { [marker]: true });
+}
+/** The database is locked by another writer; the same call can succeed later. */
+export function artifactBusyError(message) {
+    return marked(message, BUSY);
+}
+/** Another validation job holds the store lease; start again when it ends. */
+export function artifactLeaseBusyError(message) {
+    return marked(message, LEASE_BUSY);
+}
+export function isArtifactBusyError(error) {
+    return typeof error === 'object' && error !== null && BUSY in error;
+}
+export function isArtifactLeaseBusyError(error) {
+    return typeof error === 'object' && error !== null && LEASE_BUSY in error;
+}
+export const ArtifactIntegrityError = createError('GHT_ARTIFACT_INTEGRITY', '%s', 422);
+export const ArtifactTooLargeError = createError('GHT_ARTIFACT_TOO_LARGE', 'Artifact exceeds the storage limit.', 413);
+export const ArtifactSearchUnavailableError = createError('GHT_ARTIFACT_SEARCH_UNAVAILABLE', 'Artifact search is unavailable: SQLite FTS5 unicode61 and trigram are required.', 503);

package/dist/server/errors/database.js

@@ -0,0 +1,2 @@
+import createError from '@fastify/error';
+export const AsyncTransactionError = createError('GHT_DB_ASYNC_TRANSACTION', 'Database transaction callbacks must be synchronous.', 500);

package/dist/server/hooks/access/local-request.js

@@ -1,5 +1,10 @@
 import { isLoopbackHost } from "../../../shared/network/loopback.js";
 import { forwardedAddresses, isLoopbackAddress, parseHost, sameOrigin } from "../../utils/request-origin.js";
+/** True when the `Host` header names this machine (`localhost`, `127.0.0.1`, `[::1]`). */
+export function isLoopbackHostHeader(host) {
+    const target = parseHost(host);
+    return target !== undefined && isLoopbackHost(target.hostname);
+}
 /**
  * True when the request comes from a page or a client on this machine
  * (ADR 0079). The `Host` header alone is not proof: with a bind on