@timqi/pier 0.0.1

package/dist/db.js

@@ -0,0 +1,268 @@
+// The one connection, and the one place the schema is written down.
+//
+// Every store used to open `pier.db` for itself and create its own tables with
+// `CREATE TABLE IF NOT EXISTS`. That works exactly once: it can add a table but
+// never change one, so the first column an upgrade needed would have left every
+// existing instance with a schema nothing could repair. `user_version` is a
+// single number per *database*, not per table, which is why the schema cannot
+// stay spread across five modules — and five connections to one file is also
+// five writers competing for the same lock.
+//
+// So: one connection, one ordered list of migrations, applied in one
+// transaction before any store exists. A store receives the handle and owns
+// only its queries.
+import { chmodSync, existsSync, mkdirSync, readdirSync, renameSync, rmSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { logger } from "./log.js";
+import { PIER_DB } from "./paths.js";
+const log = logger("db");
+/** Pre-migration snapshots to keep. Three is two upgrades of regret plus one:
+ *  they are full copies of the database, and the one that matters is the
+ *  newest. */
+const KEEP_BACKUPS = 3;
+/** How long a second process may wait for the write lock before failing. Two
+ *  Pier processes on one PIER_HOME contend exactly once — at boot, when both
+ *  want to migrate — and failing instantly there turns a restart race into a
+ *  crash loop. */
+const BUSY_TIMEOUT_MS = 5_000;
+/**
+ * Append-only, never edited: index + 1 is the `user_version` a database is at
+ * once that entry has run. An entry that shipped is history — fix a mistake
+ * with the next one, because somebody's database already ran the old one.
+ *
+ * Migration 1 is the whole schema as of 0.0.1 and assumes nothing before it:
+ * pre-release databases are not upgraded, they are deleted.
+ */
+const MIGRATIONS = [
+    // 1 — the 0.0.1 schema.
+    `
+  -- The single credential in front of every HTTP surface (web/auth.ts).
+  CREATE TABLE auth (
+    id INTEGER PRIMARY KEY CHECK (id = 1),
+    salt TEXT NOT NULL,
+    hash TEXT NOT NULL,
+    created_at INTEGER NOT NULL
+  );
+
+  -- Instance facts that are neither a credential nor per-session; one row per
+  -- setting, so the next setting is not the next table.
+  CREATE TABLE settings (
+    key TEXT PRIMARY KEY,
+    value TEXT NOT NULL
+  );
+
+  -- Workbench bookkeeping: pinned = listed under Projects, unread = a turn
+  -- finished that no client has acknowledged.
+  CREATE TABLE session_state (
+    session_id TEXT PRIMARY KEY,
+    pinned INTEGER NOT NULL DEFAULT 0,
+    unread INTEGER NOT NULL DEFAULT 0
+  );
+
+  -- One document per platform: credentials, defaults, chats, bound users.
+  CREATE TABLE channels (
+    platform TEXT PRIMARY KEY,
+    json TEXT NOT NULL
+  );
+
+  -- Durable conversation → session routing for IM channels.
+  CREATE TABLE conversations (
+    channel_id TEXT NOT NULL,
+    conversation_id TEXT NOT NULL,
+    session_id TEXT NOT NULL,
+    updated_at INTEGER NOT NULL,
+    PRIMARY KEY (channel_id, conversation_id)
+  );
+
+  -- Reaction receipts still to be cleared. message_id is TEXT: a Slack ts is
+  -- 1761234567.123456, which no float holds exactly.
+  CREATE TABLE receipts (
+    platform TEXT NOT NULL,
+    conversation_id TEXT NOT NULL,
+    chat_id TEXT NOT NULL,
+    message_id TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    PRIMARY KEY (platform, chat_id, message_id)
+  );
+
+  -- Scheduled work. The row keeps its whole JSON document; the columns beside
+  -- it are only what a query filters or orders by.
+  CREATE TABLE tasks (
+    id TEXT PRIMARY KEY,
+    updated_at INTEGER NOT NULL,
+    json TEXT NOT NULL
+  );
+  CREATE TABLE task_runs (
+    id TEXT PRIMARY KEY,
+    task_id TEXT NOT NULL,
+    queued_at INTEGER NOT NULL,
+    state TEXT NOT NULL,
+    callback_state TEXT,
+    json TEXT NOT NULL
+  );
+  CREATE INDEX task_runs_task_time ON task_runs(task_id, queued_at DESC);
+  CREATE TABLE task_messages (
+    id TEXT PRIMARY KEY,
+    run_id TEXT NOT NULL,
+    state TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    json TEXT NOT NULL
+  );
+  CREATE INDEX task_messages_run_time ON task_messages(run_id, created_at);
+  CREATE TABLE task_groups (
+    id TEXT PRIMARY KEY,
+    created_at INTEGER NOT NULL,
+    callback_state TEXT,
+    finished_at INTEGER,
+    json TEXT NOT NULL
+  );
+  `,
+    // 2 — provider credentials move from <agentDir>/auth.json into the database.
+    `
+  -- One row per provider (key = provider id), value sealed by secrets.ts.
+  -- Owned by agent/credentials.ts.
+  CREATE TABLE credentials (
+    key TEXT PRIMARY KEY,
+    value TEXT NOT NULL
+  );
+  `,
+];
+let shared;
+/**
+ * The process's one connection, opened and migrated on first use. Every store
+ * defaults to it; a test passes `openDb(":memory:")` instead.
+ */
+export const pierDb = () => (shared ??= openDb(PIER_DB));
+/** Open a database, bring it to the current schema, and lock down its files.
+ *  `migrations` is injectable only so tests can exercise an upgrade — there is
+ *  exactly one real list. */
+export function openDb(path, migrations = MIGRATIONS) {
+    if (path !== ":memory:")
+        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const db = new DatabaseSync(path);
+    // Outside the transaction below: journal_mode is a property of the file, and
+    // SQLite refuses to change it inside one.
+    db.exec("PRAGMA journal_mode = WAL");
+    db.exec(`PRAGMA busy_timeout = ${BUSY_TIMEOUT_MS}`);
+    migrate(db, path, migrations);
+    if (path !== ":memory:")
+        restrict(path);
+    return db;
+}
+/**
+ * Upgrades only. `user_version` counts up and nothing counts it back down, so a
+ * database from a newer Pier is refused rather than served: the old code would
+ * happily write the new schema's tables and lose whatever it did not know
+ * about. The way back is the `.bak` this function writes before upgrading.
+ */
+function migrate(db, path, migrations) {
+    const { user_version: at } = db.prepare("PRAGMA user_version").get();
+    const target = migrations.length;
+    if (at > target) {
+        // Name the snapshot that exists rather than a pattern: the operator is
+        // reading this because the service will not start.
+        const newest = path === ":memory:" ? undefined : backups(path)[0]?.file;
+        throw new Error(`${path} is at schema ${at}, this Pier speaks ${target}: a database is ` +
+            `never downgraded. Restore ${newest ?? `${path}.v*.bak`}, or run the newer Pier.`);
+    }
+    // Version 0 with tables is a database from before versioning existed.
+    // Migration 1 assumes an empty file, so the collision it would hit says
+    // "table already exists" — this says what is actually wrong and what to do.
+    if (at === 0 && db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' LIMIT 1").get()) {
+        throw new Error(`${path} predates schema versioning and cannot be upgraded — nothing was changed. ` +
+            `Move the file aside and restart; channel credentials, tasks and the password start over.`);
+    }
+    if (at === target)
+        return;
+    if (at > 0 && path !== ":memory:")
+        snapshot(db, path, at);
+    // One transaction for the statements *and* the version number: a crash
+    // between them would leave a database whose version describes a schema it
+    // does not have, which is worse than a crash.
+    db.exec("BEGIN IMMEDIATE");
+    // Re-read inside the lock. Two processes starting together both saw work to
+    // do; the one that waited for the lock would otherwise replay migrations the
+    // winner already committed and die on "table already exists", with a healthy
+    // database in front of it.
+    const { user_version: locked } = db.prepare("PRAGMA user_version").get();
+    if (locked >= target) {
+        db.exec("ROLLBACK");
+        log.info(`schema already at ${locked}, migrated by another process`);
+        return;
+    }
+    let step = locked;
+    try {
+        for (; step < target; step++)
+            db.exec(migrations[step]);
+        db.exec(`PRAGMA user_version = ${target}`);
+        db.exec("COMMIT");
+    }
+    catch (err) {
+        db.exec("ROLLBACK");
+        // Which one, and that the database is untouched: the operator's next move
+        // is to restore a backup or to report the migration, and a bare SQLite
+        // error says neither.
+        throw new Error(`migration ${step + 1} failed on ${path} — nothing was changed: ${String(err)}`, { cause: err });
+    }
+    log.info(locked === 0 ? `schema created at version ${target}` : `schema ${locked} → ${target}`);
+    if (path !== ":memory:")
+        prune(path);
+}
+/**
+ * The copy that exists because `user_version` only counts up: the transaction
+ * above protects against a migration that *failed*, and this against one that
+ * succeeded and should not have. `VACUUM INTO`, not `cp`: under WAL the
+ * committed tail of the database lives in the `-wal` sidecar.
+ *
+ * Written under a temporary name and renamed into place. `VACUUM INTO` refuses
+ * an existing target, so the alternative is deleting the previous snapshot
+ * first — which means the likely failure here, a full disk, leaves neither the
+ * old snapshot nor a complete new one. A rename is atomic: the `.bak` name only
+ * ever refers to a finished copy.
+ */
+function snapshot(db, path, at) {
+    const bak = `${path}.v${at}.bak`;
+    const tmp = `${bak}.tmp`;
+    rmSync(tmp, { force: true }); // a previous crash may have left one
+    db.exec(`VACUUM INTO '${tmp.replaceAll("'", "''")}'`);
+    chmodSync(tmp, 0o600); // it holds everything the 0600 database holds
+    renameSync(tmp, bak);
+    log.info(`pre-migration backup: ${bak}`);
+}
+/** Snapshots beside the database, newest schema first. */
+function backups(path) {
+    const prefix = `${basename(path)}.v`;
+    return readdirSync(dirname(path))
+        .filter((name) => name.startsWith(prefix) && name.endsWith(".bak"))
+        .map((name) => ({
+        version: Number(name.slice(prefix.length, -".bak".length)),
+        file: join(dirname(path), name),
+    }))
+        .filter(({ version }) => Number.isInteger(version))
+        .sort((a, b) => b.version - a.version);
+}
+/** Keep the newest few. Nobody restores a database from four upgrades ago, and
+ *  every one of these is the size of the whole database. */
+function prune(path) {
+    for (const { file } of backups(path).slice(KEEP_BACKUPS)) {
+        rmSync(file, { force: true });
+        log.info(`removed superseded backup: ${file}`);
+    }
+}
+/**
+ * The database holds the password hash, so it is not world-readable — and
+ * neither are the sidecars, where a 0644 `-wal` would leak exactly what the
+ * 0600 database is hiding. Done after the migration, so the sidecars that
+ * writing created exist by now; SQLite gives later ones the database's mode.
+ * The directory too: it exists only to hold this database and its sidecars
+ * (paths.ts puts them under their own `db/`, away from the boards PIER_HOME
+ * also holds), so nothing else needs to see into it.
+ */
+function restrict(path) {
+    for (const file of [path, `${path}-wal`, `${path}-shm`]) {
+        if (existsSync(file))
+            chmodSync(file, 0o600);
+    }
+    chmodSync(dirname(path), 0o700);
+}

package/dist/log.js

@@ -0,0 +1,55 @@
+// What Pier writes to its own log, and the one place that decides how it looks.
+//
+// The destination is stdout/stderr and nothing else — no files, no rotation, no
+// log configuration. Under systemd that *is* the log: journald stamps the time,
+// keeps the history, rotates it and lets `journalctl -p warning` filter it
+// (docs/deploy.md), and in a terminal it is the terminal. A logger that opened
+// its own file would duplicate all of that and hide half the output from
+// `journalctl` — the one place an operator actually looks.
+//
+// Like paths.ts, this is a leaf everything may import and that imports nothing:
+// a log line is not a seam crossing, so no area owns it.
+import { homedir } from "node:os";
+const ORDER = ["debug", "info", "warn", "error"];
+/** `silent` exists for test runs, which drive failure paths on purpose. */
+const THRESHOLDS = [...ORDER, "silent"];
+const isThreshold = (value) => THRESHOLDS.includes(value);
+const RANK = { debug: 0, info: 1, warn: 2, error: 3, silent: 4 };
+/** `PIER_LOG=debug` turns on the per-message tracing; default keeps it out. */
+const raw = (process.env.PIER_LOG ?? "").toLowerCase();
+const threshold = isThreshold(raw) ? raw : "info";
+// systemd sets JOURNAL_STREAM when our output goes to the journal. There the
+// time and the level are journal fields, not text: a `<N>` prefix is how a
+// plain stream tells journald its priority (sd-daemon(3)), so the same line
+// that reads well in a terminal stays greppable *and* filterable by level.
+const toJournal = process.env.JOURNAL_STREAM !== undefined;
+const PRIORITY = { debug: "<7>", info: "<6>", warn: "<4>", error: "<3>" };
+/** `$HOME` back to `~`: a log line is read by a human, and paths dominate.
+ *  Skipped when `$HOME` is `/` (containers do this), where it would rewrite
+ *  every slash in every message. */
+const home = homedir();
+const shorten = (text) => home.length > 1 ? text.replaceAll(home, "~") : text;
+/** An Error contributes its stack — the post-mortem is why it was logged. */
+const describe = (cause) => cause instanceof Error ? (cause.stack ?? `${cause.name}: ${cause.message}`) : String(cause);
+function write(level, area, message, cause) {
+    if (RANK[level] < RANK[threshold])
+        return;
+    const text = shorten(cause === undefined ? message : `${message}: ${describe(cause)}`);
+    // Per line, not per message: journald reads a prefix off each line, so a
+    // stack's frames would otherwise land at the default priority — and a
+    // newline in something a browser reported would let it forge a level.
+    const line = toJournal
+        ? text.split("\n").map((part, i) => `${PRIORITY[level]}${i === 0 ? `${area}: ` : ""}${part}`).join("\n")
+        : `${new Date().toISOString()} ${level.toUpperCase().padEnd(5)} ${area}: ${text}`;
+    // Warnings and errors on stderr: it is what journald and every wrapper
+    // already treat as the abnormal stream, with or without the prefix above.
+    const stream = level === "warn" || level === "error" ? process.stderr : process.stdout;
+    stream.write(`${line}\n`);
+}
+/** `logger("slack")` — the area is the grep handle, so keep it stable. */
+export const logger = (area) => ({
+    debug: (message, cause) => write("debug", area, message, cause),
+    info: (message, cause) => write("info", area, message, cause),
+    warn: (message, cause) => write("warn", area, message, cause),
+    error: (message, cause) => write("error", area, message, cause),
+});

package/dist/main.js

@@ -0,0 +1,183 @@
+// Wiring only — no logic lives here. See docs/architecture.md.
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { serve } from "@hono/node-server";
+import { Hono } from "hono";
+import { PiConfigStore } from "./agent/config.js";
+import { CredentialStore } from "./agent/credentials.js";
+import { PiAgentFactory } from "./agent/pi.js";
+import { defaultBoardsDir, registerBoardRoutes } from "./boards/boards.js";
+import { ChannelStore } from "./channels/config.js";
+import { createControl } from "./channels/control.js";
+import { ConversationStore, resolveConversation } from "./channels/conversations.js";
+import { registerChannelRoutes } from "./channels/routes.js";
+import { ChannelRuntime } from "./channels/runtime.js";
+import { SlackApi } from "./channels/slack-api.js";
+import { SlackDirectory } from "./channels/slack-directory.js";
+import { handleSlackTool, slackToolSpec } from "./channels/slack-tool.js";
+import { parseConversation as parseSlackConversation } from "./channels/slack.js";
+import { EventHub } from "./core/hub.js";
+import { pierDb } from "./db.js";
+import { surfacePrompt } from "./core/reply.js";
+import { Router } from "./core/router.js";
+import { logger } from "./log.js";
+import { registerTaskRoutes } from "./tasks/routes.js";
+import { TaskService } from "./tasks/service.js";
+import { TaskStore } from "./tasks/store.js";
+import { taskToolSpec } from "./tasks/tool.js";
+import { PIER_HOME, pierPath } from "./paths.js";
+import { Secrets } from "./secrets.js";
+import { SettingsStore } from "./settings.js";
+import { AuthStore, registerAuthRoutes, requireAuth } from "./web/auth.js";
+import { SessionStateStore } from "./web/session-state.js";
+import { createServer } from "./web/server.js";
+const log = logger("pier");
+// Pier owns the Pi runtime dir. Set before any SDK call resolves a path, so
+// everything Pi derives from its agent dir (auth.json, models.json, sessions,
+// bin) lands under PIER_HOME instead of ~/.pi. An operator override wins.
+process.env.PI_CODING_AGENT_DIR ??= pierPath("pi");
+// First, and explicitly: every store below shares this one connection, and a
+// schema that cannot be migrated must stop the process here — before a port is
+// open and before anything has written a row.
+const db = pierDb();
+// Files earlier versions kept beside the database. Their values live in
+// pier.db now, and a setting that silently stops being read is a 5b violation:
+// the operator who wrote it deserves to hear that it no longer applies.
+for (const stale of ["settings.json", "pins.json", "unread.json"]) {
+    if (existsSync(pierPath(stale))) {
+        log.warn(`${pierPath(stale)} is no longer read — its value lives in pier.db now; re-enter it in the Console and delete the file`);
+    }
+}
+// One store, two readers: the Console writes the public URL, and every session
+// opened after that is told the new one.
+const settings = new SettingsStore(db);
+// Layer-1 credential encryption (channel tokens today). Constructed here,
+// unlocked below: file mode is instant, vt mode waits on a human approval, and
+// nothing that needs a token may run before the key arrives.
+const secrets = new Secrets();
+let tasks;
+const conversations = new ConversationStore(db);
+let resolveIm;
+// Declared before the store exists because the factory is built first; the tool
+// only ever runs long after wiring is done.
+let channelStore;
+// Shared by the adapter and the tool: a display name is looked up once per
+// process, not once per message and again per transcript.
+const slackDirectory = new SlackDirectory((m) => logger("slack").warn(m));
+const factory = new PiAgentFactory([
+    taskToolSpec((params, callerSessionId) => tasks.tool(params, callerSessionId)),
+    slackToolSpec((params, callerSessionId) => handleSlackTool({
+        store: channelStore,
+        directory: slackDirectory,
+        // Rebuilt per call: the Console can change the token underneath us,
+        // and a client captured at boot would keep using the old one.
+        client: () => {
+            const config = channelStore.get("slack");
+            return config.token ? new SlackApi(config.token, config.appToken) : null;
+        },
+        // Which Slack thread this session is answering, so "post here" needs no
+        // ids. Looked up per call: the mapping is durable, the session is not.
+        here: (sessionId) => {
+            const key = router.conversationOf(sessionId);
+            if (key?.channelId !== "slack")
+                return null;
+            const { channel, threadTs } = parseSlackConversation(key.conversationId);
+            return channel && threadTs ? { channel, threadTs } : null;
+        },
+        log: (m) => logger("slack.tool").warn(m),
+    }, params, callerSessionId)),
+], 
+// Called per session open, so a setting changed in the Console reaches the
+// next session without a restart.
+() => surfacePrompt({ boardsDir: defaultBoardsDir(), publicUrl: settings.get().publicUrl }), 
+// Ships with Pier: documents Pier's own tools, so it loads only inside a
+// Pier session — not in a bare Pi session that has no task tool.
+[fileURLToPath(new URL("../skills", import.meta.url))], 
+// Provider credentials live sealed in pier.db; a leftover auth.json is
+// imported on first use and renamed to auth.json.imported.
+new CredentialStore(db, secrets));
+const hub = new EventHub();
+const router = new Router(hub, (key) => {
+    // Web conversation ids ARE session ids; an IM conversation id is a chat or a
+    // topic, so its session is looked up in the durable map (and created in the
+    // cwd the chat is configured for) — a restart must not re-route a group.
+    if (key.channelId === "web" || key.channelId === "task") {
+        return factory.resume(key.conversationId);
+    }
+    return resolveIm(key);
+});
+tasks = new TaskService(new TaskStore(db), factory, router, hub);
+tasks.start();
+channelStore = new ChannelStore(db, secrets);
+const control = createControl({ router, factory, conversations, store: channelStore });
+const channels = new ChannelRuntime(channelStore, router, control);
+resolveIm = resolveConversation(conversations, factory, control.launchFor, (message) => logger("channels").warn(message));
+// Channels connect only once tokens are readable. A refused unlock (vt denial,
+// corrupt master.key) must not take the web surface down — it is where the
+// operator goes to repair — but it is named loudly, not served as silence.
+void secrets.unlock().then(() => channels.reload(), (err) => log.error("secrets locked — channels not started; unlock from Console → Settings → Security, or repair master.key", err));
+// Composition happens here so web/ and tasks/ never import each other.
+const app = new Hono();
+// A route that threw would otherwise answer 500 and leave no trace anywhere:
+// Hono's default handler writes nothing to the log, so the operator sees a
+// failed request in the browser and an empty journal.
+app.onError((err, c) => {
+    log.error(`${c.req.method} ${c.req.path} failed`, err);
+    return c.json({ error: String(err) }, 500);
+});
+// Before every route on purpose: Hono runs middleware in registration order,
+// so a surface added later is covered without knowing this exists. Built
+// before the listener: a first run generates and prints its password here.
+const auth = new AuthStore(db);
+registerAuthRoutes(app, auth);
+app.use("*", requireAuth(auth));
+registerTaskRoutes(app, tasks, { factory, router });
+registerChannelRoutes(app, channelStore, channels);
+registerBoardRoutes(app);
+app.route("/", createServer({
+    factory,
+    router,
+    hub,
+    sessions: new SessionStateStore(db),
+    config: new PiConfigStore(),
+    settings,
+    secrets,
+    // Unlocked from the Console: start the channels boot held back.
+    onUnlocked: () => void channels.reload(),
+    backgroundRuns: (id) => tasks.backgroundRuns(id),
+}));
+const port = Number(process.env.PORT ?? 3141);
+const hostname = process.env.HOST ?? "127.0.0.1";
+const server = serve({ fetch: app.fetch, port, hostname }, () => {
+    log.info(`workbench on http://${hostname}:${port}`);
+    log.info(`pid ${process.pid}, node ${process.version}, home ${PIER_HOME}`);
+});
+// A crash and a clean stop must be distinguishable after the fact, and both
+// left nothing behind before this.
+process.on("uncaughtException", (err) => {
+    log.error("uncaught exception, exiting", err);
+    process.exit(1); // Node's own default outcome, with the area named
+});
+// This one *does* change behaviour: Node's default is to crash. A stray
+// rejection in one adapter's background work must not take every session and
+// every scheduled task down with it — so it is logged loudly and Pier serves on.
+process.on("unhandledRejection", (reason) => {
+    log.error("unhandled rejection", reason);
+});
+for (const signal of ["SIGTERM", "SIGINT"]) {
+    process.once(signal, () => {
+        log.info(`${signal} received, shutting down`);
+        // Best-effort, and bounded: a socket an adapter cannot close must not turn
+        // `systemctl restart` into a 90-second wait for SIGKILL.
+        setTimeout(() => process.exit(0), 3000).unref();
+        tasks.stop();
+        void channels.stop().finally(() => {
+            server.close(() => process.exit(0));
+            // Every workbench tab holds an SSE stream open, so `close()` alone would
+            // always wait out the timer above. (`in` because the served type is a
+            // union with HTTP/2, which has no such method — and no such problem.)
+            if ("closeAllConnections" in server)
+                server.closeAllConnections();
+        });
+    });
+}

package/dist/paths.js

@@ -0,0 +1,17 @@
+// Where Pier keeps its state, resolved once.
+//
+// This is process configuration, not a per-call decision: the same
+// `PIER_HOME ?? ~/.pier` line had grown six copies, one per module that needed
+// a file, and no area could own the fix — channels/ must not import tasks/,
+// web/ must not import channels/. So it lives in a leaf that everything may
+// depend on and that depends on nothing.
+import { homedir } from "node:os";
+import { join } from "node:path";
+/** `$PIER_HOME`, or `~/.pier`. Fixed for the life of the process. */
+export const PIER_HOME = process.env.PIER_HOME ?? join(homedir(), ".pier");
+/** A path inside it — `pierPath("boards")`. */
+export const pierPath = (...parts) => join(PIER_HOME, ...parts);
+/** The one SQLite file; every store opens this same path. In its own
+ *  directory so db.ts can lock that directory down to 0700 without touching
+ *  the boards PIER_HOME also holds. */
+export const PIER_DB = pierPath("db", "pier.db");