cursedbelt 2.7.0 → 3.0.0

package/dist/server/notifications/service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/server/notifications/service.ts"],"names":[],"mappings":"AAeA,OAAO,EACN,wBAAwB,EACxB,6BAA6B,GAI7B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,qBAAqB,EAAwB,MAAM,OAAO,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAyCnD,MAAM,UAAU,yBAAyB,CACxC,OAAyC;IAEzC,MAAM,OAAO,GACZ,OAAO,CAAC,OAAO;QACf,CAAC,CAAC,KAAc,EAAE,OAAe,EAAE,EAAE,CACpC,OAAO,CAAC,KAAK,CAAC,mBAAmB,OAAO,GAAG,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAEhG,MAAM,KAAK,GAAG,6BAA6B,CAAC,OAAO,CAAC,EAA+B,EAAE;QACpF,KAAK,EAAE,OAAO,CAAC,KAAK;KACpB,CAAC,CAAC;IAEH,MAAM,GAAG,GACR,OAAO,CAAC,IAAI,KAAK,KAAK;QACrB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,qBAAqB,CAAC;YACtB,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO;SACP,CAAC,CAAC;IAEN,MAAM,MAAM,GAAG,wBAAwB,CAAC;QACvC,KAAK;QACL,IAAI,EAAE,GAAG,EAAE,IAAI;QACf,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO;KACP,CAAC,CAAC;IAEH,OAAO;QACN,MAAM;QACN,KAAK;QACL,GAAG;QACH,KAAK,CAAC,GAAG,EAAE,YAAY;YACtB,uBAAuB,CAAC,GAAG,EAAE;gBAC5B,MAAM;gBACN,GAAG,EAAE,GAAG,IAAI,SAAS;gBACrB,SAAS,EAAE,YAAY,CAAC,SAAS;gBACjC,QAAQ,EAAE,YAAY,CAAC,QAAQ;gBAC/B,QAAQ,EAAE,YAAY,CAAC,QAAQ;aAC/B,CAAC,CAAC;QACJ,CAAC;QACD,KAAK;YACJ,GAAG,EAAE,KAAK,EAAE,CAAC;QACd,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/server/ops/engineOps.d.ts

@@ -1,42 +0,0 @@
-import type { ExecutionDriver, JobBroker } from '../drivers';
-import type { OpHandler } from '../mixins/instance.mixin';
-import type { EngineServices } from '../mixins/services';
-import { type OutboundGuardOptions } from '../net/outboundGuard';
-import { type ServerPushHub } from '../stream';
-/** Job kinds these ops enqueue. A host must register a handler for each kind it enables. */
-export declare const OP_JOB_KINDS: {
-    readonly reindex: "reindex";
-    readonly transcode: "transcode";
-    readonly deploy: "deploy";
-    readonly import: "import";
-};
-/**
- * Manifest command ids the dev ops invoke. Defaults follow the
- * `<subject>:<verb>` convention; a host whose manifest names them differently
- * overrides here rather than forking the table.
- */
-export interface DevOpCommandIds {
-    /** Restart a registered app's server process. */
-    restartApp: string;
-}
-export declare const DEFAULT_DEV_OP_COMMANDS: DevOpCommandIds;
-/** A named, synchronous utility the `formatLab`/`lineFilter` features expose. */
-export type UtilityFn = (input: unknown) => unknown;
-export interface EngineOpsOptions {
-    services: EngineServices;
-    broker: JobBroker;
-    /**
-     * DevStudio ONLY (J3-4). Absent ⇒ the dev ops that execute commands are not
-     * registered at all, so they 501 rather than silently no-op.
-     */
-    exec?: ExecutionDriver;
-    commands?: Partial<DevOpCommandIds>;
-    /** Publishes job completions to the per-instance stream (03 §3.2). */
-    push?: ServerPushHub;
-    /** `system:run-utility` implementations, keyed by utility id. */
-    utilities?: Readonly<Record<string, UtilityFn>>;
-    /** Overrides for the outbound SSRF guard (test hosts, an allowlisted internal target). */
-    outboundGuard?: OutboundGuardOptions;
-}
-export declare function createEngineOpHandlers(options: EngineOpsOptions): Record<string, OpHandler>;
-//# sourceMappingURL=engineOps.d.ts.map

package/dist/server/ops/engineOps.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"engineOps.d.ts","sourceRoot":"","sources":["../../../src/server/ops/engineOps.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAgB,MAAM,0BAA0B,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAA2B,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAErE,4FAA4F;AAC5F,eAAO,MAAM,YAAY;;;;;CAKf,CAAC;AAEX;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,uBAAuB,EAAE,eAA+C,CAAC;AAEtF,iFAAiF;AACjF,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;AAEpD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,cAAc,CAAC;IACzB,MAAM,EAAE,SAAS,CAAC;IAClB;;;OAGG;IACH,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACpC,sEAAsE;IACtE,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,iEAAiE;IACjE,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAChD,0FAA0F;IAC1F,aAAa,CAAC,EAAE,oBAAoB,CAAC;CACtC;AAyDD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAyS3F"}

package/dist/server/ops/engineOps.js

@@ -1,373 +0,0 @@
-/**
- * The production op handler table for `/api/instance/:id/ops/:op` (03 §3.2).
- *
- * `instanceMixin` ships with an empty handler map and `composeServer` takes the
- * table as an option, which was the right *shape* and the wrong *state*: the
- * only table that ever existed lived in the verify harness. `exec` was threaded
- * onto `DevMixinContext`, contained beautifully by the type system, and then
- * used by nobody — the jail guarded a door that was not installed (§4.1). This
- * module installs the door.
- *
- * Three rules the table encodes, none of which are optional:
- *
- *   1. **Every OS execution goes through `ExecutionDriver`.** An op never builds
- *      an argv, never sees a shell. It names a `commandId` that the driver
- *      resolves against `cc-manifest.json`'s whitelist; an unknown id is a typed
- *      `EXEC_COMMAND_NOT_WHITELISTED` (H-2, V7.14).
- *   2. **Long work goes through the `JobBroker`**, never a request held open and
- *      never a bare `setTimeout` (03 §7.3). Ops that start work return a
- *      `jobId`, and the completion is published on the server push hub so the
- *      client learns about it without polling.
- *   3. **`system:http-send` re-applies the outbound guard.** The route form of
- *      Request Builder's send is guarded (finding 4.2); an ops path that reached
- *      the same service without guarding would re-open the SSRF through a
- *      different door. The guard is applied HERE, at the boundary, for exactly
- *      that reason.
- *
- * Ops whose engine service is absent are simply not registered: `instanceMixin`
- * answers 501 for an unregistered handler, which is louder and more honest than
- * a handler that reports success without running.
- */
-import { z } from 'zod';
-import { AppError } from '../errors';
-import { assertPublicOutboundUrl } from '../net/outboundGuard';
-import { publishJobCompletion } from '../stream';
-/** Job kinds these ops enqueue. A host must register a handler for each kind it enables. */
-export const OP_JOB_KINDS = {
-    reindex: 'reindex',
-    transcode: 'transcode',
-    deploy: 'deploy',
-    import: 'import',
-};
-export const DEFAULT_DEV_OP_COMMANDS = { restartApp: 'app:restart' };
-/* --------------------------------------------------------------- schemas */
-const runPipelineBody = z
-    .object({
-    commandId: z.string().min(1),
-    args: z.record(z.string(), z.string()).default({}),
-    cwd: z.string().optional(),
-})
-    .strict();
-const restartAppBody = z.object({ appId: z.string().min(1) }).strict();
-const deployAppBody = z.object({ appId: z.string().min(1) }).strict();
-const writeConfigBody = z.object({ appId: z.string().min(1), patch: z.record(z.string(), z.string()) }).strict();
-const dbExportBody = z.object({ domain: z.string().min(1) }).strict();
-const idBody = z.object({ id: z.string().min(1) }).strict();
-const idsBody = z.object({ ids: z.array(z.string().min(1)).min(1) }).strict();
-const corpusBody = z.object({ corpus: z.string().min(1).default('default') }).strict();
-const importBody = z.object({ listId: z.string().min(1), rows: z.array(z.record(z.string(), z.unknown())) }).strict();
-const rotateSecretBody = z.object({ key: z.string().min(1) }).strict();
-const reorderColumnBody = z.object({ columnId: z.string().min(1), position: z.number().finite() }).strict();
-const moveCardBody = z
-    .object({ cardId: z.string().min(1), toColumnId: z.string().min(1), position: z.number().finite() })
-    .strict();
-const reorderAlbumMemberBody = z
-    .object({ albumId: z.string().min(1), assetId: z.string().min(1), position: z.number().finite() })
-    .strict();
-const occurrenceMarkBody = z
-    .object({ eventId: z.string().min(1), occurredOn: z.string().min(1), state: z.enum(['done', 'skipped']) })
-    .strict();
-const clearOccurrenceBody = z.object({ eventId: z.string().min(1), occurredOn: z.string().min(1) }).strict();
-const utilityBody = z.object({ utility: z.string().min(1), input: z.unknown() }).strict();
-const httpSendBody = z
-    .object({
-    url: z.string().min(1),
-    method: z.string().default('GET'),
-    headers: z.record(z.string(), z.string()).optional(),
-    body: z.string().optional(),
-})
-    .strict();
-/**
- * Parse an op body, turning a Zod failure into a 400 that NAMES the violated
- * rule. Generic "Validation failed" strings are banned (03 §2.2).
- */
-const parseBody = (schema, op, body) => {
-    const result = schema.safeParse(body ?? {});
-    if (result.success)
-        return result.data;
-    const issue = result.error.issues[0];
-    throw new AppError(`Op '${op}': ${issue?.path.join('.') || 'body'} ${issue?.message ?? 'is invalid'}.`, {
-        code: 'OP_BODY_INVALID',
-        status: 400,
-        context: { op, path: issue?.path.map(String) ?? [] },
-    });
-};
-export function createEngineOpHandlers(options) {
-    const { services, broker } = options;
-    const commands = { ...DEFAULT_DEV_OP_COMMANDS, ...options.commands };
-    const handlers = {};
-    /** Enqueue and register the push notification in one place. */
-    const enqueue = async (invocation, kind, payload) => {
-        const jobId = await broker.enqueue({
-            kind,
-            tenantId: invocation.claims.tenantId,
-            instanceId: invocation.instanceId,
-            payload,
-        });
-        if (options.push)
-            publishJobCompletion(broker, {
-                hub: options.push,
-                jobId,
-                tenantId: invocation.claims.tenantId,
-                instanceId: invocation.instanceId,
-            });
-        return { jobId };
-    };
-    const scopeOf = (invocation) => ({
-        claims: invocation.claims,
-        instanceId: invocation.instanceId,
-    });
-    /* ------------------------------------------------------------- asset */
-    const asset = services.asset;
-    if (asset) {
-        handlers['asset:reindex-media'] = (invocation) => enqueue(invocation, OP_JOB_KINDS.reindex, { corpus: 'media' });
-        handlers['asset:transcode'] = (invocation) => {
-            const { id } = parseBody(idBody, 'transcode', invocation.body);
-            return enqueue(invocation, OP_JOB_KINDS.transcode, { id, userId: invocation.claims.userId });
-        };
-        handlers['asset:ocr-extract'] = async (invocation) => {
-            const { id } = parseBody(idBody, 'ocr-extract', invocation.body);
-            // OCR already has a service seam (its output feeds `knowledge` via CDC),
-            // so this op delegates rather than enqueuing a second, parallel job path.
-            return await asset.requestOcr(scopeOf(invocation), id);
-        };
-        handlers['asset:delete'] = async (invocation) => {
-            const { id } = parseBody(idBody, 'delete', invocation.body);
-            // Soft-delete + negative storage credit live in the service (§2c). A
-            // false here is an unknown/foreign/already-trashed id → typed 404, which
-            // keeps the id's existence undisclosed (the same law `read` follows).
-            const deleted = await asset.remove(scopeOf(invocation), id);
-            if (!deleted)
-                throw new AppError(`No media item '${id}'.`, { code: 'MEDIA_NOT_FOUND', status: 404, context: { id } });
-            return { deleted: true };
-        };
-        // Ordered album membership reorder (§2a / §4) — the album-member analog of
-        // `move-card`: ONE `UPDATE … SET position`, guarded to the caller's album AND
-        // asset. `false` ⇒ a foreign album/asset → typed 404.
-        handlers['asset:reorder-album-member'] = async (invocation) => {
-            const { albumId, assetId, position } = parseBody(reorderAlbumMemberBody, 'reorder-album-member', invocation.body);
-            const ok = await asset.albums.reorderAsset(scopeOf(invocation), albumId, assetId, position);
-            if (!ok)
-                throw opNotFound('album member', `${albumId}/${assetId}`);
-            return { reordered: true };
-        };
-    }
-    /* --------------------------------------------------------- knowledge */
-    const knowledge = services.knowledge;
-    if (knowledge) {
-        handlers['knowledge:reindex-corpus'] = (invocation) => {
-            const { corpus } = parseBody(corpusBody, 'reindex-corpus', invocation.body);
-            return enqueue(invocation, OP_JOB_KINDS.reindex, { corpus });
-        };
-        handlers['knowledge:organize-notes'] = async (invocation) => {
-            const { ids } = parseBody(idsBody, 'organize-notes', invocation.body);
-            // MUST go through `completeStructured` inside the service (03 §7.2) — a
-            // free-text model response can never become an instruction here.
-            return await knowledge.organize(scopeOf(invocation), ids);
-        };
-        handlers['knowledge:import-records'] = (invocation) => {
-            const body = parseBody(importBody, 'import-records', invocation.body);
-            // Imports project through `l_columns` metadata (02 §7.2). No user action
-            // ever generates DDL, so this is a data job, not a migration.
-            return enqueue(invocation, OP_JOB_KINDS.import, { listId: body.listId, rows: body.rows });
-        };
-        // The two O(1) kanban ordering ACTIONS (§1b / §4). They are ops, not page
-        // routes, because a drag-drop is an action on the board, not a resource. Each
-        // is ONE `UPDATE … SET position` in the repo; `false` (unknown/foreign id, or
-        // a cross-tenant target column on a move) becomes a typed 404 that keeps the
-        // id's existence undisclosed — the same law the read paths follow.
-        handlers['knowledge:reorder-column'] = async (invocation) => {
-            const { columnId, position } = parseBody(reorderColumnBody, 'reorder-column', invocation.body);
-            const ok = await knowledge.kanban.reorderColumn(scopeOf(invocation), columnId, position);
-            if (!ok)
-                throw opNotFound('column', columnId);
-            return { reordered: true };
-        };
-        handlers['knowledge:move-card'] = async (invocation) => {
-            const { cardId, toColumnId, position } = parseBody(moveCardBody, 'move-card', invocation.body);
-            const ok = await knowledge.kanban.moveCard(scopeOf(invocation), cardId, toColumnId, position);
-            // false ⇒ the card OR the destination column is not the caller's — the repo
-            // guards both sides, so a card can never be flung into another tenant's board.
-            if (!ok)
-                throw opNotFound('card', cardId);
-            return { moved: true };
-        };
-        // The Airtable-list column reorder ACTION (§1c / §4) — the list analog of
-        // `reorder-column`: ONE `UPDATE … SET position` in `l_columns`, tenant-guarded
-        // through its list. A separate op from the kanban reorder because it targets a
-        // different table; `false` (unknown/foreign column) becomes a typed 404.
-        handlers['knowledge:reorder-list-column'] = async (invocation) => {
-            const { columnId, position } = parseBody(reorderColumnBody, 'reorder-list-column', invocation.body);
-            const ok = await knowledge.lists.reorderColumn(scopeOf(invocation), columnId, position);
-            if (!ok)
-                throw opNotFound('list column', columnId);
-            return { reordered: true };
-        };
-    }
-    /* --------------------------------------------------------------- dev */
-    const dev = services.dev;
-    const exec = options.exec;
-    if (dev && exec) {
-        /**
-         * The op probe 14 drives. `commandId` is caller-supplied ON PURPOSE — a
-         * pipeline names which whitelisted step to run — and the driver is what
-         * refuses anything not in `cc-manifest.json`. Validating the id here as
-         * well would be theater: the whitelist is the authority, and it is checked
-         * on the way in.
-         */
-        handlers['dev:run-pipeline'] = async (invocation) => {
-            const body = parseBody(runPipelineBody, 'run-pipeline', invocation.body);
-            const handle = await exec.run({
-                commandId: body.commandId,
-                args: body.args,
-                cwd: body.cwd,
-                tenantId: invocation.claims.tenantId,
-                instanceId: invocation.instanceId,
-            });
-            return { handleId: handle.handleId, pid: handle.pid, commandId: handle.commandId };
-        };
-        handlers['dev:restart-app'] = async (invocation) => {
-            const { appId } = parseBody(restartAppBody, 'restart-app', invocation.body);
-            const handle = await exec.run({
-                commandId: commands.restartApp,
-                args: { appId },
-                tenantId: invocation.claims.tenantId,
-                instanceId: invocation.instanceId,
-            });
-            return { handleId: handle.handleId, pid: handle.pid };
-        };
-    }
-    if (dev) {
-        handlers['dev:deploy-app'] = (invocation) => {
-            const { appId } = parseBody(deployAppBody, 'deploy-app', invocation.body);
-            return enqueue(invocation, OP_JOB_KINDS.deploy, { appId });
-        };
-        handlers['dev:write-config'] = async (invocation) => {
-            const body = parseBody(writeConfigBody, 'write-config', invocation.body);
-            await dev.writeConfig(scopeOf(invocation), body.appId, body.patch);
-            return { written: true };
-        };
-        handlers['dev:db-export'] = async (invocation) => {
-            const { domain } = parseBody(dbExportBody, 'db-export', invocation.body);
-            // `VACUUM INTO` a snapshot inside the service — never a copy of a live
-            // `.db` (01 §6.1).
-            return await dev.exportDatabase(scopeOf(invocation), domain);
-        };
-    }
-    /* ------------------------------------------------------------- guard */
-    const guard = services.guard;
-    if (guard) {
-        handlers['guard:lock'] = async (invocation) => {
-            await guard.lock(scopeOf(invocation));
-            // The lock is mandatory-broadcast: one tab locking locks all tabs
-            // (03 §6.5, V7.9). Publishing app-wide — not per instance — is the point;
-            // a lock concerns every surface, not the one that asked for it.
-            options.push?.publish({
-                event: 'lifecycle',
-                data: { type: 'VAULT_LOCKED' },
-                tenantId: invocation.claims.tenantId,
-            });
-            return { locked: true };
-        };
-        handlers['guard:rotate-secret'] = async (invocation) => {
-            const { key } = parseBody(rotateSecretBody, 'rotate-secret', invocation.body);
-            const summary = await guard.rotateSecret(scopeOf(invocation), key);
-            return { rotated: true, key: summary.key, updatedAt: summary.updatedAt };
-        };
-    }
-    /* ------------------------------------------------------------ system */
-    const system = services.system;
-    if (system) {
-        handlers['system:run-utility'] = (invocation) => {
-            const body = parseBody(utilityBody, 'run-utility', invocation.body);
-            const utility = options.utilities?.[body.utility];
-            if (!utility)
-                throw new AppError(`No utility '${body.utility}' is registered on this host.`, {
-                    code: 'UTILITY_NOT_REGISTERED',
-                    status: 404,
-                    // The utility NAME the caller asked for, never the registered set —
-                    // enumerating it back is free reconnaissance (§3.2).
-                    context: { utility: body.utility },
-                });
-            return { output: utility(body.input) };
-        };
-        handlers['system:http-send'] = async (invocation) => {
-            const body = parseBody(httpSendBody, 'http-send', invocation.body);
-            // Fail-closed BEFORE the service runs. Same guard, same placement as the
-            // route (finding 4.2): an ops path that skipped it would re-open the SSRF
-            // through a second door.
-            assertPublicOutboundUrl(body.url, options.outboundGuard);
-            return await system.sendHttp(scopeOf(invocation), {
-                url: body.url,
-                method: body.method,
-                headers: body.headers,
-                body: body.body,
-            });
-        };
-        // Occurrence marking (§3 / §4) — toggling ONE recurrence occurrence
-        // done/skipped is an action on the series, not a resource, so it is an op.
-        // The mark feeds the pure `expandEvent` expander's completions/exdates sets;
-        // the repo re-earns tenancy through the FK chain to `cal_calendars`, so a
-        // foreign `eventId` marks nothing and returns null → typed 404.
-        handlers['system:mark-occurrence'] = async (invocation) => {
-            const { eventId, occurredOn, state } = parseBody(occurrenceMarkBody, 'mark-occurrence', invocation.body);
-            const mark = await system.calendar.setMark(scopeOf(invocation), eventId, occurredOn, state);
-            if (!mark)
-                throw opNotFound('calendar event', eventId);
-            return { mark };
-        };
-        handlers['system:clear-occurrence'] = async (invocation) => {
-            const { eventId, occurredOn } = parseBody(clearOccurrenceBody, 'clear-occurrence', invocation.body);
-            const cleared = await system.calendar.clearMark(scopeOf(invocation), eventId, occurredOn);
-            if (!cleared)
-                throw opNotFound('occurrence mark', `${eventId}@${occurredOn}`);
-            return { cleared: true };
-        };
-        // Time-off state machine (§3 / §4). A decision on a request is an ACTION, not
-        // a resource write, so it is an op. Approval debits the ledger EXACTLY ONCE in
-        // the repo's own transaction; a `null` (foreign, or not in the required source
-        // state) becomes a typed 404 that keeps the request's existence undisclosed.
-        handlers['system:approve-timeoff'] = async (invocation) => {
-            const { id } = parseBody(idBody, 'approve-timeoff', invocation.body);
-            const request = await system.timeOff.approveRequest(scopeOf(invocation), id);
-            if (!request)
-                throw opNotFound('time-off request', id);
-            return { request };
-        };
-        handlers['system:deny-timeoff'] = async (invocation) => {
-            const { id } = parseBody(idBody, 'deny-timeoff', invocation.body);
-            const request = await system.timeOff.denyRequest(scopeOf(invocation), id);
-            if (!request)
-                throw opNotFound('time-off request', id);
-            return { request };
-        };
-        handlers['system:cancel-timeoff'] = async (invocation) => {
-            const { id } = parseBody(idBody, 'cancel-timeoff', invocation.body);
-            const request = await system.timeOff.cancelRequest(scopeOf(invocation), id);
-            if (!request)
-                throw opNotFound('time-off request', id);
-            return { request };
-        };
-        // Subscription cancel (§4) — idempotent: the repo stamps `cancelled_at`, and a
-        // second cancel returns `null` → typed 404, so a double-cancel is a safe no-op.
-        handlers['system:cancel-subscription'] = async (invocation) => {
-            const { id } = parseBody(idBody, 'cancel-subscription', invocation.body);
-            const subscription = await system.subscriptions.cancel(scopeOf(invocation), id);
-            if (!subscription)
-                throw opNotFound('subscription', id);
-            return { subscription };
-        };
-    }
-    return handlers;
-}
-/**
- * A typed 404 for an op whose target resource does not exist for this caller.
- * The message names the KIND but the code is the generic `ENTITY_NOT_FOUND`, so
- * a cross-tenant probe cannot tell "no such id" from "not yours" (J3-2).
- */
-const opNotFound = (kind, id) => new AppError(`No ${kind} '${id}' for this tenant.`, {
-    code: 'ENTITY_NOT_FOUND',
-    status: 404,
-    context: { id },
-});
-//# sourceMappingURL=engineOps.js.map

package/dist/server/ops/engineOps.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"engineOps.js","sourceRoot":"","sources":["../../../src/server/ops/engineOps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAIrC,OAAO,EAAE,uBAAuB,EAA6B,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EAAE,oBAAoB,EAAsB,MAAM,WAAW,CAAC;AAErE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACR,CAAC;AAYX,MAAM,CAAC,MAAM,uBAAuB,GAAoB,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;AAsBtF,6EAA6E;AAE7E,MAAM,eAAe,GAAG,CAAC;KACtB,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACvE,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACtE,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACjH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACtE,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC5D,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC9E,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACvF,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACtH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACvE,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC5G,MAAM,YAAY,GAAG,CAAC;KACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;KACnG,MAAM,EAAE,CAAC;AACZ,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;KACjG,MAAM,EAAE,CAAC;AACZ,MAAM,kBAAkB,GAAG,CAAC;KACzB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;KACzG,MAAM,EAAE,CAAC;AACZ,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC7G,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC1F,MAAM,YAAY,GAAG,CAAC;KACnB,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;GAGG;AACH,MAAM,SAAS,GAAG,CAAyB,MAAS,EAAE,EAAU,EAAE,IAAa,EAAc,EAAE;IAC7F,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAkB,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,MAAM,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,IAAI,KAAK,EAAE,OAAO,IAAI,YAAY,GAAG,EAAE;QACtG,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;KACrD,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,UAAU,sBAAsB,CAAC,OAAyB;IAC9D,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACrC,MAAM,QAAQ,GAAoB,EAAE,GAAG,uBAAuB,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IACtF,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAE/C,+DAA+D;IAC/D,MAAM,OAAO,GAAG,KAAK,EACnB,UAAwB,EACxB,IAAY,EACZ,OAAgC,EACJ,EAAE;QAC9B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACjC,IAAI;YACJ,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ;YACpC,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,OAAO;SACR,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,IAAI;YACd,oBAAoB,CAAC,MAAM,EAAE;gBAC3B,GAAG,EAAE,OAAO,CAAC,IAAI;gBACjB,KAAK;gBACL,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ;gBACpC,UAAU,EAAE,UAAU,CAAC,UAAU;aAClC,CAAC,CAAC;QACL,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,UAAwB,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,UAAU,EAAE,UAAU,CAAC,UAAU;KAClC,CAAC,CAAC;IAEH,yEAAyE;IAEzE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7B,IAAI,KAAK,EAAE,CAAC;QACV,QAAQ,CAAC,qBAAqB,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAC/C,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAEjE,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE;YAC3C,MAAM,EAAE,EAAE,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YAC/D,OAAO,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/F,CAAC,CAAC;QAEF,QAAQ,CAAC,mBAAmB,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE;YACnD,MAAM,EAAE,EAAE,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YACjE,yEAAyE;YACzE,0EAA0E;YAC1E,OAAO,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACzD,CAAC,CAAC;QAEF,QAAQ,CAAC,cAAc,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE;YAC9C,MAAM,EAAE,EAAE,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YAC5D,qEAAqE;YACrE,yEAAyE;YACzE,sEAAsE;YACtE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,OAAO;gBACV,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1G,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC,CAAC;QAEF,2EAA2E;QAC3E,8EAA8E;QAC9E,sDAAsD;QACtD,QAAQ,CAAC,4BAA4B,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE;YAC5D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,sBAAsB,EAAE,sBAAsB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YAClH,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC5F,IAAI,CAAC,EAAE;gBAAE,MAAM,UAAU,CAAC,cAAc,EAAE,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;YACnE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC,CAAC;IACJ,CAAC;IAED,yEAAyE;IAEzE,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACrC,IAAI,SAAS,EAAE,CAAC;QACd,QAAQ,CAAC,0BAA0B,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE;YACpD,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YAC5E,OAAO,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/D,CAAC,CAAC;QAEF,QAAQ,CAAC,0BAA0B,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE;YAC1D,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,gBAAgB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YACtE,wEAAwE;YACxE,iEAAiE;YACjE,OAAO,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC,CAAC;QAEF,QAAQ,CAAC,0BAA0B,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE;YACpD,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YACtE,yEAAyE;YACzE,8DAA8D;YAC9D,OAAO,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5F,CAAC,CAAC;QAEF,0EAA0E;QAC1E,8EAA8E;QAC9E,8EAA8E;QAC9E,6EAA6E;QAC7E,mEAAmE;QACnE,QAAQ,CAAC,0BAA0B,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE;YAC1D,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YAC/F,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACzF,IAAI,CAAC,EAAE;gBAAE,MAAM,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC9C,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC,CAAC;QAEF,QAAQ,CAAC,qBAAqB,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE;YACrD,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,YAAY,EAAE,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YAC/F,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC9F,4EAA4E;YAC5E,+EAA+E;YAC/E,IAAI,CAAC,EAAE;gBAAE,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC,CAAC;QAEF,0EAA0E;QAC1E,+EAA+E;QAC/E,+EAA+E;QAC/E,yEAAyE;QACzE,QAAQ,CAAC,+BAA+B,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE;YAC/D,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,iBAAiB,EAAE,qBAAqB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YACpG,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACxF,IAAI,CAAC,EAAE;gBAAE,MAAM,UAAU,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;YACnD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC,CAAC;IACJ,CAAC;IAED,yEAAyE;IAEzE,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;IACzB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAE1B,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAChB;;;;;;WAMG;QACH,QAAQ,CAAC,kBAAkB,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE;YAClD,MAAM,IAAI,GAAG,SAAS,CAAC,eAAe,EAAE,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YACzE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC;gBAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ;gBACpC,UAAU,EAAE,UAAU,CAAC,UAAU;aAClC,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QACrF,CAAC,CAAC;QAEF,QAAQ,CAAC,iBAAiB,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE;YACjD,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,cAAc,EAAE,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YAC5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC;gBAC5B,SAAS,EAAE,QAAQ,CAAC,UAAU;gBAC9B,IAAI,EAAE,EAAE,KAAK,EAAE;gBACf,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ;gBACpC,UAAU,EAAE,UAAU,CAAC,UAAU;aAClC,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;QACxD,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,EAAE,CAAC;QACR,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE;YAC1C,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,aAAa,EAAE,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YAC1E,OAAO,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,CAAC,CAAC;QAEF,QAAQ,CAAC,kBAAkB,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE;YAClD,MAAM,IAAI,GAAG,SAAS,CAAC,eAAe,EAAE,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YACzE,MAAM,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACnE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC,CAAC;QAEF,QAAQ,CAAC,eAAe,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE;YAC/C,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,YAAY,EAAE,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YACzE,uEAAuE;YACvE,mBAAmB;YACnB,OAAO,MAAM,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/D,CAAC,CAAC;IACJ,CAAC;IAED,yEAAyE;IAEzE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7B,IAAI,KAAK,EAAE,CAAC;QACV,QAAQ,CAAC,YAAY,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE;YAC5C,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YACtC,kEAAkE;YAClE,0EAA0E;YAC1E,gEAAgE;YAChE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;gBACpB,KAAK,EAAE,WAAW;gBAClB,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;gBAC9B,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ;aACrC,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC,CAAC;QAEF,QAAQ,CAAC,qBAAqB,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE;YACrD,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,gBAAgB,EAAE,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YAC9E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;YACnE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QAC3E,CAAC,CAAC;IACJ,CAAC;IAED,yEAAyE;IAEzE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,IAAI,MAAM,EAAE,CAAC;QACX,QAAQ,CAAC,oBAAoB,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE;YAC9C,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,EAAE,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YACpE,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,CAAC,OAAO;gBACV,MAAM,IAAI,QAAQ,CAAC,eAAe,IAAI,CAAC,OAAO,+BAA+B,EAAE;oBAC7E,IAAI,EAAE,wBAAwB;oBAC9B,MAAM,EAAE,GAAG;oBACX,oEAAoE;oBACpE,qDAAqD;oBACrD,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;iBACnC,CAAC,CAAC;YACL,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,CAAC,CAAC;QAEF,QAAQ,CAAC,kBAAkB,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE;YAClD,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,EAAE,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YACnE,yEAAyE;YACzE,0EAA0E;YAC1E,yBAAyB;YACzB,uBAAuB,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;YACzD,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;gBAChD,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,oEAAoE;QACpE,2EAA2E;QAC3E,6EAA6E;QAC7E,0EAA0E;QAC1E,gEAAgE;QAChE,QAAQ,CAAC,wBAAwB,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE;YACxD,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YACzG,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;YAC5F,IAAI,CAAC,IAAI;gBAAE,MAAM,UAAU,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;YACvD,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,CAAC,CAAC;QAEF,QAAQ,CAAC,yBAAyB,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE;YACzD,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC,mBAAmB,EAAE,kBAAkB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YACpG,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YAC1F,IAAI,CAAC,OAAO;gBAAE,MAAM,UAAU,CAAC,iBAAiB,EAAE,GAAG,OAAO,IAAI,UAAU,EAAE,CAAC,CAAC;YAC9E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC,CAAC;QAEF,8EAA8E;QAC9E,+EAA+E;QAC/E,+EAA+E;QAC/E,6EAA6E;QAC7E,QAAQ,CAAC,wBAAwB,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE;YACxD,MAAM,EAAE,EAAE,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,iBAAiB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7E,IAAI,CAAC,OAAO;gBAAE,MAAM,UAAU,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;YACvD,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC;QAEF,QAAQ,CAAC,qBAAqB,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE;YACrD,MAAM,EAAE,EAAE,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC,OAAO;gBAAE,MAAM,UAAU,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;YACvD,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC;QAEF,QAAQ,CAAC,uBAAuB,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE;YACvD,MAAM,EAAE,EAAE,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YACpE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5E,IAAI,CAAC,OAAO;gBAAE,MAAM,UAAU,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;YACvD,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC;QAEF,+EAA+E;QAC/E,gFAAgF;QAChF,QAAQ,CAAC,4BAA4B,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE;YAC5D,MAAM,EAAE,EAAE,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,qBAAqB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YACzE,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YAChF,IAAI,CAAC,YAAY;gBAAE,MAAM,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YACxD,OAAO,EAAE,YAAY,EAAE,CAAC;QAC1B,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAU,EAAY,EAAE,CACxD,IAAI,QAAQ,CAAC,MAAM,IAAI,KAAK,EAAE,oBAAoB,EAAE;IAClD,IAAI,EAAE,kBAAkB;IACxB,MAAM,EAAE,GAAG;IACX,OAAO,EAAE,EAAE,EAAE,EAAE;CAChB,CAAC,CAAC"}

package/dist/server/ops/index.d.ts

@@ -1,2 +0,0 @@
-export * from './engineOps';
-//# sourceMappingURL=index.d.ts.map

package/dist/server/ops/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/ops/index.ts"],"names":[],"mappings":"AAGA,cAAc,aAAa,CAAC"}

package/dist/server/ops/index.js

@@ -1,5 +0,0 @@
-// The production op handler table for `/api/instance/:id/ops/:op` (03 §3.2) —
-// the wiring that turns the contained `ExecutionDriver` into DevStudio's actual
-// server power (§4.1).
-export * from './engineOps';
-//# sourceMappingURL=index.js.map

package/dist/server/ops/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/ops/index.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,gFAAgF;AAChF,uBAAuB;AACvB,cAAc,aAAa,CAAC"}

package/dist/server/paths/appDataHome.d.ts

@@ -1,20 +0,0 @@
-/** The one env var. A machine with a shared data root sets this and nothing else. */
-export declare const APP_DATA_HOME_ENV = "APP_DATA_HOME";
-/** The cross-desktop convention this honors ahead of the platform default. */
-export declare const XDG_DATA_HOME_ENV = "XDG_DATA_HOME";
-export interface ResolveAppDataHomeOptions {
-    /** An explicit answer from the caller. Wins outright — this is the "argument" half. */
-    readonly override?: string;
-    /** Environment to read. Injected by tests; defaults to the process's own. */
-    readonly env?: Record<string, string | undefined>;
-    /**
-     * Platform to resolve for. Injected by tests so both branches are proved on one
-     * machine; defaults to the running platform.
-     */
-    readonly platform?: string;
-}
-/**
- * The machine's app-data home. See the module note for the ordering rationale.
- */
-export declare function resolveAppDataHome(options?: ResolveAppDataHomeOptions): string;
-//# sourceMappingURL=appDataHome.d.ts.map

package/dist/server/paths/appDataHome.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"appDataHome.d.ts","sourceRoot":"","sources":["../../../src/server/paths/appDataHome.ts"],"names":[],"mappings":"AAqCA,qFAAqF;AACrF,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,MAAM,WAAW,yBAAyB;IACzC,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAClD;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAQD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,yBAA8B,GAAG,MAAM,CAmBlF"}

package/dist/server/paths/appDataHome.js

@@ -1,69 +0,0 @@
-/**
- * Where a machine keeps an app's data — as CONFIGURATION, never as a convention
- * baked into the library.
- *
- * ## What this replaces, and why it is a defect rather than untidiness
- *
- * Until 2026-09-13 three live modules in this package joined the ambient home
- * directory to a hardcoded dotfolder belonging to the previous generation: the
- * retention store, the archive, and `resolveAppDataRoot`. This package is
- * PUBLISHED. Anybody who installed it got a library that went looking for a
- * directory in their home that has nothing to do with them, and — worse — wrote
- * into it if it happened to exist.
- *
- * A library may not know the name of a directory in somebody's home. It may know
- * two things: what the caller told it, and what the operating system says the
- * convention is. That is the whole ladder below.
- *
- * ## The ladder
- *
- *   1. an explicit `override` — a `--data-root` flag, a host's own resolution;
- *   2. `$APP_DATA_HOME` — the ONE env var, for a machine that keeps every app's
- *      data under one root so a fleet-wide tool can see all of it at once;
- *   3. `$XDG_DATA_HOME` — the user already told the OS where data goes;
- *   4. the platform default: `~/Library/Application Support` on macOS,
- *      `~/.local/share` everywhere else.
- *
- * `$XDG_DATA_HOME` is honored on macOS too. It is not the platform's own
- * convention there, but a user who sets it has stated a preference, and a
- * preference outranks a default on any platform.
- *
- * Nothing here touches the filesystem: it is a pure mapping from environment to
- * path, so a caller can reason about the answer before creating anything, and a
- * test can assert both platforms on one machine.
- */
-import { homedir } from "node:os";
-import { join } from "node:path";
-/** The one env var. A machine with a shared data root sets this and nothing else. */
-export const APP_DATA_HOME_ENV = "APP_DATA_HOME";
-/** The cross-desktop convention this honors ahead of the platform default. */
-export const XDG_DATA_HOME_ENV = "XDG_DATA_HOME";
-/** Trimmed, or undefined — an env var set to whitespace is not a configuration. */
-function configured(value) {
-    const trimmed = value?.trim();
-    return trimmed ? trimmed : undefined;
-}
-/**
- * The machine's app-data home. See the module note for the ordering rationale.
- */
-export function resolveAppDataHome(options = {}) {
-    const env = options.env ?? process.env;
-    const override = configured(options.override);
-    if (override)
-        return override;
-    const appDataHome = configured(env[APP_DATA_HOME_ENV]);
-    if (appDataHome)
-        return appDataHome;
-    const xdg = configured(env[XDG_DATA_HOME_ENV]);
-    if (xdg)
-        return xdg;
-    // `env.HOME` rather than `homedir()` alone, so a caller passing an env object
-    // gets a resolution it can actually control — every test below depends on it,
-    // and so does any host that boots an app under a different account.
-    const home = configured(env.HOME) ?? homedir();
-    const platform = options.platform ?? process.platform;
-    return platform === "darwin"
-        ? join(home, "Library", "Application Support")
-        : join(home, ".local", "share");
-}
-//# sourceMappingURL=appDataHome.js.map

package/dist/server/paths/appDataHome.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"appDataHome.js","sourceRoot":"","sources":["../../../src/server/paths/appDataHome.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,qFAAqF;AACrF,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAEjD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAcjD,mFAAmF;AACnF,SAAS,UAAU,CAAC,KAAyB;IAC5C,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAqC,EAAE;IACzE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACvD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC/C,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IAEpB,8EAA8E;IAC9E,8EAA8E;IAC9E,oEAAoE;IACpE,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,OAAO,QAAQ,KAAK,QAAQ;QAC3B,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC"}

package/dist/server/private-media/crypto.d.ts

@@ -1,38 +0,0 @@
-export type KeyMode = 'standard' | 'deniable';
-/** A random per-user salt (non-secret, stored plaintext, stable once created). Domain-separates
- * a user's password-derived keys so the same password yields different keys across users. */
-export declare const generateUserSalt: () => string;
-/** Zero-knowledge set key: scrypt(password, per-user salt). The server never stores this (or a
- * hash of it); it exists only transiently after an unlock. Different passwords → disjoint sets. */
-export declare const derivePasswordSetKey: (password: string, userSalt: string) => Buffer;
-/** Recoverable set key: scrypt(serverSecret, userId). The server can always derive it, so
- * `standard`-mode media is decryptable once private is unlocked (session-gated) — protects a
- * stolen disk / Finder / backups, but a compromised running server can decrypt. */
-export declare const deriveServerSetKey: (serverSecret: string, userId: string) => Buffer;
-export declare const sealMeta: (setKey: Buffer, meta: unknown) => string;
-/** Open a sealed envelope, or null if this key doesn't own it (wrong password / mode key).
- * The null return IS the membership signal — no stored set identifier is needed. */
-export declare function openMeta<T = unknown>(setKey: Buffer, sealed: string): T | null;
-export type ContentKey = {
-    key: Buffer;
-    iv: Buffer;
-};
-export declare const generateContentKey: () => ContentKey;
-export declare const wrapContentKey: (setKey: Buffer, content: ContentKey) => string;
-/** Unwrap a content key, or null if the set key can't open it (wrong password / mode key). */
-export declare function unwrapContentKey(setKey: Buffer, wrapped: string): ContentKey | null;
-/** Pipe a byte stream through the item's AES-128-CTR keystream. Symmetric: pass ciphertext to
- * decrypt, plaintext to encrypt. */
-/** Big-endian increment of a 16-byte CTR IV by `blocks` — the counter arithmetic that lets a
- * decryptor start mid-stream (genapp-100: Range/seek on private blobs). */
-export declare function incrementIv(iv: Buffer, blocks: number): Buffer;
-/**
- * Decrypt a CTR ciphertext stream that starts at the BLOCK-ALIGNED offset covering plaintext
- * byte `startOffset`, dropping the intra-block lead-in — the seek half of {@link cryptBlobStream}.
- * CTR is length-preserving and positionally keyed, so byte N of plaintext only needs ciphertext
- * from block ⌊N/16⌋ onward with the IV counter advanced by that many blocks (genapp-100: this is
- * what makes big private videos scrub on a remote-store host with no local derivatives).
- */
-export declare function cryptBlobRangeStream(content: ContentKey, stream: ReadableStream<Uint8Array>, startOffset: number): ReadableStream<Uint8Array>;
-export declare function cryptBlobStream(content: ContentKey, stream: ReadableStream<Uint8Array>): ReadableStream<Uint8Array>;
-//# sourceMappingURL=crypto.d.ts.map

package/dist/server/private-media/crypto.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../../src/server/private-media/crypto.ts"],"names":[],"mappings":"AAaA,MAAM,MAAM,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC;AAE9C;6FAC6F;AAC7F,eAAO,MAAM,gBAAgB,QAAO,MAA+C,CAAC;AAEpF;mGACmG;AACnG,eAAO,MAAM,oBAAoB,GAAI,UAAU,MAAM,EAAE,UAAU,MAAM,KAAG,MAC/B,CAAC;AAE5C;;mFAEmF;AACnF,eAAO,MAAM,kBAAkB,GAAI,cAAc,MAAM,EAAE,QAAQ,MAAM,KAAG,MACzB,CAAC;AAMlD,eAAO,MAAM,QAAQ,GAAI,QAAQ,MAAM,EAAE,MAAM,OAAO,KAAG,MACZ,CAAC;AAE9C;oFACoF;AACpF,wBAAgB,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI,CAM9E;AAOD,MAAM,MAAM,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD,eAAO,MAAM,kBAAkB,QAAO,UAGpC,CAAC;AAEH,eAAO,MAAM,cAAc,GAAI,QAAQ,MAAM,EAAE,SAAS,UAAU,KAAG,MACwB,CAAC;AAE9F,8FAA8F;AAC9F,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAQnF;AAQD;oCACoC;AACpC;2EAC2E;AAC3E,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAS9D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,UAAU,EACnB,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,EAClC,WAAW,EAAE,MAAM,GAClB,cAAc,CAAC,UAAU,CAAC,CA0B5B;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,UAAU,EACnB,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,GACjC,cAAc,CAAC,UAAU,CAAC,CAkB5B"}