cursedbelt 2.7.0 → 3.0.0

package/dist/server/drivers/saasJobWorker.d.ts

@@ -1,39 +0,0 @@
-import type { JobLogger } from '../jobs/types';
-import type { JobHandler } from './jobBroker';
-import { type JobResultStore } from './jobResults';
-import type { SaasQueueBackend } from './saasJobBroker';
-export interface SaasJobWorkerOptions {
-    /**
-     * The deployment's queue, which MUST expose the consumer-side `lease` — a
-     * producer-only backend cannot back a worker, and that is a boot error, not a
-     * silent no-op that leases nothing.
-     */
-    queue: SaasQueueBackend;
-    /** Shared across every API node and worker — the completion source of truth. */
-    results: JobResultStore;
-    /** The same handler map shape the local broker takes — `kind` selects one. */
-    handlers: Readonly<Record<string, JobHandler>>;
-    logger?: JobLogger;
-    /** Max jobs run through handlers concurrently. Default 4. */
-    concurrency?: number;
-    /**
-     * How often the worker scans the shared store for external cancellations of
-     * its in-flight jobs. Default 1000ms. Lower = faster cancel response at the
-     * cost of more reads; a push from {@link SaasQueueBackend.subscribe}, when the
-     * backend offers one, triggers an immediate scan on top of the interval.
-     */
-    cancelPollMs?: number;
-}
-export interface SaasJobWorker {
-    /**
-     * Drain and release. Stops accepting new leases, waits for the jobs already
-     * running to settle, then clears the cancel scan and any subscription.
-     * Idempotent — a second call (or a call racing SIGTERM) resolves against the
-     * same drain.
-     */
-    stop(): Promise<void>;
-}
-/** No handler registered for a leased kind — see {@link runSaasJobWorker}. */
-export declare const JOB_HANDLER_UNREGISTERED = "JOB_HANDLER_UNREGISTERED";
-export declare const runSaasJobWorker: (options: SaasJobWorkerOptions) => SaasJobWorker;
-//# sourceMappingURL=saasJobWorker.d.ts.map

package/dist/server/drivers/saasJobWorker.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"saasJobWorker.d.ts","sourceRoot":"","sources":["../../../src/server/drivers/saasJobWorker.ts"],"names":[],"mappings":"AAmDA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAS,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAA2B,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEjF,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,KAAK,EAAE,gBAAgB,CAAC;IACxB,gFAAgF;IAChF,OAAO,EAAE,cAAc,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAC/C,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,8EAA8E;AAC9E,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAKnE,eAAO,MAAM,gBAAgB,GAAI,SAAS,oBAAoB,KAAG,aAiJhE,CAAC"}

package/dist/server/drivers/saasJobWorker.js

@@ -1,200 +0,0 @@
-/**
- * The SaaS job WORKER runtime (08 §4a) — the far side of {@link
- * createSaasJobBroker}.
- *
- * The broker can `enqueue` and `awaitCompletion` across processes, but nothing
- * it ships EXECUTES a job: in the SaaS profile the enqueuer (an API node) and
- * the executor (a worker process) are deliberately different processes, which
- * is the whole point of a stateless multi-worker deployment. This module is the
- * executor. It leases payloads from the injected {@link SaasQueueBackend}
- * consumer side, runs the same `JobHandler` map the local broker runs, and
- * records the outcome in the shared {@link JobResultStore} — the one place every
- * API node reads through. The local {@link createLocalJobBroker} does the same
- * three things in one process; here they are split across the network, and the
- * result store is what keeps the completion contract identical.
- *
- * Four properties carry the correctness, and each is a failure mode a naive
- * "just run the handler" worker gets wrong in production:
- *
- *   * **Exactly-once EXECUTION, not just recording.** At-least-once delivery
- *     means the backend WILL redeliver a job whose worker died before acking.
- *     A handler with side effects (a charge, an email, an S3 write) run twice is
- *     a bug. So before running, the worker reads the store: a terminal row for
- *     this id means the job already settled (a crash after recording, or an
- *     external cancel) and the handler is SKIPPED — the lease is acked and the
- *     job disappears. Combined with first-writer-wins recording, a job executes
- *     to completion exactly once; only a crash in the narrow window between
- *     "handler returned" and "row written" re-runs it, and that window is the
- *     same one the local broker documents.
- *
- *   * **Record BEFORE ack.** The backend's own `completed` event (what wakes a
- *     waiting API node from its poll) fires when the lease is acked. If the
- *     worker acked first and recorded second, a waiter woken by that event would
- *     read the store a beat too early and see nothing. So the durable row is
- *     written first, always. See {@link recordWorkerResult}.
- *
- *   * **Cooperative cancel across processes.** `broker.cancel(id)` on an API
- *     node writes a `cancelled` row; the worker running that job is in another
- *     process and never saw the call. It learns of it by watching the shared
- *     store — a low-frequency scan of its in-flight ids — and aborts the
- *     handler's signal when a row appears under it. Same semantics as the local
- *     broker's per-job `AbortController`, achieved through the store instead of
- *     a shared heap.
- *
- *   * **Drain, don't abort, on shutdown.** A deploy sends SIGTERM; a worker that
- *     dropped its leases would strand every in-flight job until the lease
- *     timeout. {@link SaasJobWorker.stop} instead stops accepting new leases and
- *     lets the jobs already running finish (the lease timeout is the backstop
- *     for a handler that ignores the drain, never the mechanism).
- */
-import { AppError } from '../errors';
-import { defaultJobLogger } from '../jobs/logger';
-import { recordWorkerResult } from './jobResults';
-/** No handler registered for a leased kind — see {@link runSaasJobWorker}. */
-export const JOB_HANDLER_UNREGISTERED = 'JOB_HANDLER_UNREGISTERED';
-const errorMessage = (error) => error instanceof Error ? error.message : typeof error === 'string' ? error : 'unknown error';
-export const runSaasJobWorker = (options) => {
-    const logger = options.logger ?? defaultJobLogger;
-    const concurrency = options.concurrency ?? 4;
-    const cancelPollMs = options.cancelPollMs ?? 1000;
-    if (typeof options.queue.lease !== 'function')
-        throw new AppError('This SaasQueueBackend has no `lease` — it cannot back a worker (producer-only queue).', {
-            code: 'SAAS_QUEUE_NOT_CONSUMABLE',
-            status: 500,
-            category: 'config',
-            isOperational: false,
-        });
-    const { results } = options;
-    /** In-flight handlers by job id, so a cancel scan can abort the right one. */
-    const inFlight = new Map();
-    /**
-     * A row appearing under an in-flight id can only have been written by another
-     * process — this worker records a job's outcome AFTER the handler settles, so
-     * while a handler runs its id is unrecorded here. Any row it finds is an
-     * external `cancel`, and the handler's signal is aborted so a cancel-aware job
-     * actually stops rather than running to completion under a doomed lease.
-     */
-    /**
-     * `scanning` is not belt-and-braces. The store answers over a network now, so
-     * a scan can outlive its own interval tick; without the guard, a store slower
-     * than `cancelPollMs` would stack one concurrent scan per tick and issue a
-     * read storm precisely when it is already struggling.
-     */
-    let scanning = false;
-    const scanForCancellations = async () => {
-        if (inFlight.size === 0 || scanning)
-            return;
-        scanning = true;
-        try {
-            for (const [id, controller] of inFlight) {
-                if (controller.signal.aborted)
-                    continue;
-                // Re-check membership: the handler may have settled and been deleted
-                // while an earlier id's read was in flight.
-                if (!inFlight.has(id))
-                    continue;
-                if (await results.read(id))
-                    controller.abort(new DOMException(`Job ${id} cancelled`, 'AbortError'));
-            }
-        }
-        finally {
-            scanning = false;
-        }
-    };
-    /** The interval and the queue subscription are both sync callers. */
-    const scanDetached = () => {
-        void scanForCancellations().catch((error) => {
-            logger.error('SaaS worker cancellation scan failed to read the result store', error);
-        });
-    };
-    const cancelTimer = setInterval(scanDetached, cancelPollMs);
-    // A bare interval keeps a Bun/Node process alive on its own; the worker's
-    // liveness is the lease loop, not this scan, so let the process exit when the
-    // real work is done.
-    cancelTimer.unref?.();
-    const detachSubscribe = options.queue.subscribe?.(scanDetached) ?? null;
-    const process = async (job) => {
-        // Exactly-once execution: a terminal row already under this id means the job
-        // settled elsewhere (a crash after recording, or a cancel before we leased
-        // it). Do NOT re-run a side-effecting handler — ack the lease and move on.
-        if (await results.read(job.id))
-            return;
-        const handler = options.handlers[job.kind];
-        if (!handler) {
-            // Fail closed and terminally. Redelivering forever on a missing handler is
-            // a poison-pill loop; a recorded failure lets a waiter see the truth and
-            // stops the churn. (A rolling deploy where only new workers know a new
-            // kind is the deployment's ordering problem, not a reason to spin.)
-            logger.error(`SaaS worker leased kind '${job.kind}' with no registered handler`, { jobId: job.id });
-            await recordWorkerResult(results, {
-                jobId: job.id,
-                ok: false,
-                error: `${JOB_HANDLER_UNREGISTERED}: '${job.kind}'`,
-                tenantId: job.tenantId,
-                instanceId: job.instanceId,
-            });
-            return;
-        }
-        const controller = new AbortController();
-        inFlight.set(job.id, controller);
-        // Catch a cancel that landed between the dedup read and now — the scan only
-        // sees ids already in `inFlight`, so close the gap by checking once here.
-        if (await results.read(job.id))
-            controller.abort(new DOMException(`Job ${job.id} cancelled`, 'AbortError'));
-        try {
-            const output = await handler(job.payload, {
-                jobId: job.id,
-                tenantId: job.tenantId,
-                instanceId: job.instanceId,
-                signal: controller.signal,
-                logger,
-            });
-            // First-writer-wins in the store means a late normal return cannot
-            // overwrite a `cancelled` row an API node already wrote — the store, not a
-            // local flag, is the arbiter of the settle race.
-            await recordWorkerResult(results, {
-                jobId: job.id,
-                ok: true,
-                output,
-                tenantId: job.tenantId,
-                instanceId: job.instanceId,
-            });
-        }
-        catch (error) {
-            await recordWorkerResult(results, {
-                jobId: job.id,
-                ok: false,
-                error: errorMessage(error),
-                tenantId: job.tenantId,
-                instanceId: job.instanceId,
-            });
-        }
-        finally {
-            inFlight.delete(job.id);
-        }
-        // Resolving acks the lease. The outcome is already durable, so a redelivery
-        // after this point (a crash mid-ack) is caught by the dedup read above.
-    };
-    // The non-null assertion is guarded by the SAAS_QUEUE_NOT_CONSUMABLE throw above. It
-    // carries no suppression comment on purpose: `lint/style/noNonNullAssertion` is off in
-    // this repo's config now, so the suppression that used to sit here was itself the error
-    // (`suppressions/unused`) and had been red on main.
-    const lease = options.queue.lease(process, { concurrency });
-    let stopping = null;
-    return {
-        stop() {
-            if (stopping)
-                return stopping;
-            stopping = (async () => {
-                clearInterval(cancelTimer);
-                detachSubscribe?.();
-                // Drain: `close` stops new leases and resolves once in-flight jobs
-                // settle. In-flight handlers are NOT aborted here — a graceful deploy
-                // lets them finish; the lease timeout backstops any that ignore it.
-                await lease.close();
-            })();
-            return stopping;
-        },
-    };
-};
-//# sourceMappingURL=saasJobWorker.js.map

package/dist/server/drivers/saasJobWorker.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"saasJobWorker.js","sourceRoot":"","sources":["../../../src/server/drivers/saasJobWorker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGlD,OAAO,EAAuB,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAoCvE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AAEnE,MAAM,YAAY,GAAG,CAAC,KAAc,EAAU,EAAE,CAC9C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC;AAE/F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAA6B,EAAiB,EAAE;IAC/E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,gBAAgB,CAAC;IAClD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC;IAElD,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,UAAU;QAC3C,MAAM,IAAI,QAAQ,CAAC,uFAAuF,EAAE;YAC1G,IAAI,EAAE,2BAA2B;YACjC,MAAM,EAAE,GAAG;YACX,QAAQ,EAAE,QAAQ;YAClB,aAAa,EAAE,KAAK;SACrB,CAAC,CAAC;IAEL,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAE5B,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IAEnD;;;;;;OAMG;IACH;;;;;OAKG;IACH,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,oBAAoB,GAAG,KAAK,IAAmB,EAAE;QACrD,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,QAAQ;YAAE,OAAO;QAC5C,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACxC,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;oBAAE,SAAS;gBACxC,qEAAqE;gBACrE,4CAA4C;gBAC5C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,SAAS;gBAChC,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAAE,UAAU,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;YACtG,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,qEAAqE;IACrE,MAAM,YAAY,GAAG,GAAS,EAAE;QAC9B,KAAK,oBAAoB,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1C,MAAM,CAAC,KAAK,CAAC,+DAA+D,EAAE,KAAK,CAAC,CAAC;QACvF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,WAAW,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAC5D,0EAA0E;IAC1E,8EAA8E;IAC9E,qBAAqB;IACpB,WAAsC,CAAC,KAAK,EAAE,EAAE,CAAC;IAClD,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;IAExE,MAAM,OAAO,GAAG,KAAK,EAAE,GAAc,EAAiB,EAAE;QACtD,6EAA6E;QAC7E,2EAA2E;QAC3E,2EAA2E;QAC3E,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO;QAEvC,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,2EAA2E;YAC3E,yEAAyE;YACzE,uEAAuE;YACvE,oEAAoE;YACpE,MAAM,CAAC,KAAK,CAAC,4BAA4B,GAAG,CAAC,IAAI,8BAA8B,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACpG,MAAM,kBAAkB,CAAC,OAAO,EAAE;gBAChC,KAAK,EAAE,GAAG,CAAC,EAAE;gBACb,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,GAAG,wBAAwB,MAAM,GAAG,CAAC,IAAI,GAAG;gBACnD,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,UAAU,EAAE,GAAG,CAAC,UAAU;aAC3B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QACjC,4EAA4E;QAC5E,0EAA0E;QAC1E,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,UAAU,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,OAAO,GAAG,CAAC,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;QAE5G,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE;gBACxC,KAAK,EAAE,GAAG,CAAC,EAAE;gBACb,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,MAAM;aACP,CAAC,CAAC;YACH,mEAAmE;YACnE,2EAA2E;YAC3E,iDAAiD;YACjD,MAAM,kBAAkB,CAAC,OAAO,EAAE;gBAChC,KAAK,EAAE,GAAG,CAAC,EAAE;gBACb,EAAE,EAAE,IAAI;gBACR,MAAM;gBACN,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,UAAU,EAAE,GAAG,CAAC,UAAU;aAC3B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,kBAAkB,CAAC,OAAO,EAAE;gBAChC,KAAK,EAAE,GAAG,CAAC,EAAE;gBACb,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;gBAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,UAAU,EAAE,GAAG,CAAC,UAAU;aAC3B,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;QACD,4EAA4E;QAC5E,wEAAwE;IAC1E,CAAC,CAAC;IAEF,qFAAqF;IACrF,uFAAuF;IACvF,wFAAwF;IACxF,oDAAoD;IACpD,MAAM,KAAK,GAAiB,OAAO,CAAC,KAAK,CAAC,KAAM,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IAE3E,IAAI,QAAQ,GAAyB,IAAI,CAAC;IAC1C,OAAO;QACL,IAAI;YACF,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC9B,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;gBACrB,aAAa,CAAC,WAAW,CAAC,CAAC;gBAC3B,eAAe,EAAE,EAAE,CAAC;gBACpB,mEAAmE;gBACnE,sEAAsE;gBACtE,oEAAoE;gBACpE,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;YACtB,CAAC,CAAC,EAAE,CAAC;YACL,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/server/drivers/siteCopy.d.ts

@@ -1,57 +0,0 @@
-import type { StatementExecutor } from 'cwip/storage';
-import { type SiteCopyKey } from '../../core/site/siteCopy';
-export declare const SITE_COPY_TABLE = "cc_site_copy";
-/**
- * Authored for SQLite and compiled to Postgres by `toPostgresDdl`, like every
- * other control-plane table. `updated_by` is NOT NULL for the same reason
- * `cc_retention_policy`'s is: every row is somebody changing the public face
- * of the product, and "who" is the first question asked afterwards.
- */
-export declare const SITE_COPY_DDL = "CREATE TABLE IF NOT EXISTS cc_site_copy (\n  key TEXT PRIMARY KEY NOT NULL,\n  value TEXT NOT NULL,\n  updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),\n  updated_by TEXT NOT NULL\n)";
-export interface SiteCopyEntry {
-    readonly key: SiteCopyKey;
-    /** The shipped default — what the page bakes and what "reset" restores. */
-    readonly defaultValue: string;
-    /** The stored override, absent when the deployment runs on the default. */
-    readonly value?: string;
-    readonly updatedAt?: string;
-    readonly updatedBy?: string;
-}
-export declare const ensureSiteCopySchema: (executor: StatementExecutor) => Promise<void>;
-/**
- * The public payload: ONLY overridden copy keys. One statement; the reserved
- * meta row is filtered by the key-list check rather than a `WHERE key != …`
- * that a second reserved row would silently outgrow.
- */
-export declare const readSiteCopyOverrides: (executor: StatementExecutor) => Promise<Record<string, string>>;
-/** The admin listing: every key in page order, default beside override. */
-export declare const readSiteCopyEntries: (executor: StatementExecutor) => Promise<SiteCopyEntry[]>;
-/**
- * Validate a proposed copy write, or throw naming what was wrong. Exported so
- * the route can refuse before touching the store, and a CLI could refuse
- * before opening a pool.
- */
-export declare const assertSiteCopyWrite: (key: string, value: string) => SiteCopyKey;
-/** Set one override, recording who and when by the DATABASE clock (the same
- *  provenance rule as `setRetentionWindow`, for the same audit reason). */
-export declare const setSiteCopyValue: (executor: StatementExecutor, options: {
-    readonly key: string;
-    readonly value: string;
-    readonly updatedBy: string;
-}) => Promise<void>;
-/** Remove one override — the page falls back to the baked default. */
-export declare const clearSiteCopyValue: (executor: StatementExecutor, key: string) => Promise<void>;
-/**
- * The tenant whose OWNER may edit site copy. Stored row wins; the fallback is
- * the reserved local bootstrap tenant, which no saas tenant can ever be named
- * as (`assertNotReserved` refuses it at mint), so an unseeded saas deployment
- * fails CLOSED rather than open.
- */
-export declare const platformAdminTenant: (executor: StatementExecutor) => Promise<string>;
-/** Record the platform tenant — called by the owner-seed step of the first
- *  deploy, beside the account it creates (launch spec §4 phase 1). */
-export declare const setPlatformAdminTenant: (executor: StatementExecutor, options: {
-    readonly tenantId: string;
-    readonly updatedBy: string;
-}) => Promise<void>;
-//# sourceMappingURL=siteCopy.d.ts.map

package/dist/server/drivers/siteCopy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"siteCopy.d.ts","sourceRoot":"","sources":["../../../src/server/drivers/siteCopy.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,0BAA0B,CAAC;AAElC,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAM9C;;;;;GAKG;AACH,eAAO,MAAM,aAAa,mNAKxB,CAAC;AAEH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AASD,eAAO,MAAM,oBAAoB,GAAU,UAAU,iBAAiB,KAAG,OAAO,CAAC,IAAI,CAEpF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAU,UAAU,iBAAiB,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAKvG,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,GAAU,UAAU,iBAAiB,KAAG,OAAO,CAAC,aAAa,EAAE,CAgB9F,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAI,KAAK,MAAM,EAAE,OAAO,MAAM,KAAG,WAYhE,CAAC;AAEF;2EAC2E;AAC3E,eAAO,MAAM,gBAAgB,GAC3B,UAAU,iBAAiB,EAC3B,SAAS;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KACpF,OAAO,CAAC,IAAI,CAad,CAAC;AAEF,sEAAsE;AACtE,eAAO,MAAM,kBAAkB,GAAU,UAAU,iBAAiB,EAAE,KAAK,MAAM,KAAG,OAAO,CAAC,IAAI,CAI/F,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAU,UAAU,iBAAiB,KAAG,OAAO,CAAC,MAAM,CAOrF,CAAC;AAEF;sEACsE;AACtE,eAAO,MAAM,sBAAsB,GACjC,UAAU,iBAAiB,EAC3B,SAAS;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KACjE,OAAO,CAAC,IAAI,CAcd,CAAC"}

package/dist/server/drivers/siteCopy.js

@@ -1,161 +0,0 @@
-/**
- * The marketing-copy STORE — owner decision **D36** (2026-07-27), the db half.
- *
- * The contract (keys, defaults, the three consumers) lives in
- * `core/site/siteCopy.ts`; this module owns only persistence and the one
- * authorization fact persistence has to carry: WHICH tenant's OWNER may edit a
- * deployment-global surface.
- *
- * ## Only overrides are stored
- *
- * A row exists exactly when the owner changed a key. `readSiteCopyOverrides`
- * is therefore the whole public payload — a fresh deployment serves `{}` and
- * the page renders its baked defaults. "Reset to default" is a DELETE, not a
- * write of the default's text, so a later improvement to a default reaches
- * every deployment that never overrode it.
- *
- * ## The platform tenant — why edit rights need a stored fact
- *
- * Site copy is DEPLOYMENT-global, but every authorization primitive in the
- * tree is tenant-scoped, and under saas EVERY self-served signup mints its own
- * tenant with the signer as OWNER (02 §2). "Any OWNER may edit" would
- * therefore hand the marketing page to the first GA customer. The rule:
- *
- *   - the platform tenant is the one recorded by {@link setPlatformAdminTenant}
- *     — written by the owner-seed step of the first deploy (launch spec §4
- *     phase 1), beside the account it creates;
- *   - absent that row, it defaults to the reserved local bootstrap tenant
- *     (`t_local`) — which EXISTS only under the `local` profile, so an
- *     unseeded saas deployment fails closed: no tenant matches, nobody edits.
- *
- * The row lives in the same table under a reserved key. Reserved keys are
- * structurally unreachable through the copy API: `setSiteCopyValue` admits
- * only members of `SITE_COPY_KEYS`, and every read path filters to that same
- * list — so "the meta row leaked into the public payload" and "a copy edit
- * overwrote the admin tenant" are both type-level impossibilities, not
- * conventions.
- */
-import { RESERVED_TENANT_ID } from 'cwip/cc-registry';
-import { isSiteCopyKey, SITE_COPY_DEFAULTS, SITE_COPY_KEYS, SITE_COPY_MAX_VALUE_LENGTH, } from '../../core/site/siteCopy';
-export const SITE_COPY_TABLE = 'cc_site_copy';
-/** The reserved row naming the tenant whose OWNER may edit (see the header).
- *  Deliberately not a valid {@link SiteCopyKey}, so no copy API can touch it. */
-const PLATFORM_ADMIN_ROW = '__platform_admin_tenant__';
-/**
- * Authored for SQLite and compiled to Postgres by `toPostgresDdl`, like every
- * other control-plane table. `updated_by` is NOT NULL for the same reason
- * `cc_retention_policy`'s is: every row is somebody changing the public face
- * of the product, and "who" is the first question asked afterwards.
- */
-export const SITE_COPY_DDL = `CREATE TABLE IF NOT EXISTS ${SITE_COPY_TABLE} (
-  key TEXT PRIMARY KEY NOT NULL,
-  value TEXT NOT NULL,
-  updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
-  updated_by TEXT NOT NULL
-)`;
-export const ensureSiteCopySchema = async (executor) => {
-    await executor.write({ sql: SITE_COPY_DDL });
-};
-/**
- * The public payload: ONLY overridden copy keys. One statement; the reserved
- * meta row is filtered by the key-list check rather than a `WHERE key != …`
- * that a second reserved row would silently outgrow.
- */
-export const readSiteCopyOverrides = async (executor) => {
-    const rows = await executor.all({ sql: `SELECT key, value FROM ${SITE_COPY_TABLE}` });
-    const overrides = {};
-    for (const row of rows)
-        if (isSiteCopyKey(row.key))
-            overrides[row.key] = row.value;
-    return overrides;
-};
-/** The admin listing: every key in page order, default beside override. */
-export const readSiteCopyEntries = async (executor) => {
-    const rows = await executor.all({
-        sql: `SELECT key, value, updated_at, updated_by FROM ${SITE_COPY_TABLE}`,
-    });
-    const stored = new Map();
-    for (const row of rows)
-        stored.set(row.key, row);
-    return SITE_COPY_KEYS.map((key) => {
-        const row = stored.get(key);
-        return {
-            key,
-            defaultValue: SITE_COPY_DEFAULTS[key],
-            ...(row === undefined
-                ? {}
-                : { value: row.value, updatedAt: row.updated_at, updatedBy: row.updated_by }),
-        };
-    });
-};
-/**
- * Validate a proposed copy write, or throw naming what was wrong. Exported so
- * the route can refuse before touching the store, and a CLI could refuse
- * before opening a pool.
- */
-export const assertSiteCopyWrite = (key, value) => {
-    if (!isSiteCopyKey(key))
-        throw new Error(`'${key}' is not a site-copy key. Valid keys: ${SITE_COPY_KEYS.join(', ')}.`);
-    if (value.length === 0)
-        throw new Error(`An empty value would render a blank hole in the page — to return '${key}' to its default, delete the override instead.`);
-    if (value.length > SITE_COPY_MAX_VALUE_LENGTH)
-        throw new Error(`The value for '${key}' is ${value.length} characters; the ceiling is ${SITE_COPY_MAX_VALUE_LENGTH}. Every visitor may download this string.`);
-    return key;
-};
-/** Set one override, recording who and when by the DATABASE clock (the same
- *  provenance rule as `setRetentionWindow`, for the same audit reason). */
-export const setSiteCopyValue = async (executor, options) => {
-    const key = assertSiteCopyWrite(options.key, options.value);
-    const updatedBy = options.updatedBy.trim();
-    if (updatedBy.length === 0)
-        throw new Error('setSiteCopyValue requires a non-empty `updatedBy`.');
-    await executor.write({
-        sql: `INSERT INTO ${SITE_COPY_TABLE} (key, value, updated_at, updated_by)
-          VALUES (?, ?, {{now}}, ?)
-          ON CONFLICT (key) DO UPDATE SET
-            value = excluded.value,
-            updated_at = excluded.updated_at,
-            updated_by = excluded.updated_by`,
-        params: [key, options.value, updatedBy],
-    });
-};
-/** Remove one override — the page falls back to the baked default. */
-export const clearSiteCopyValue = async (executor, key) => {
-    if (!isSiteCopyKey(key))
-        throw new Error(`'${key}' is not a site-copy key. Valid keys: ${SITE_COPY_KEYS.join(', ')}.`);
-    await executor.write({ sql: `DELETE FROM ${SITE_COPY_TABLE} WHERE key = ?`, params: [key] });
-};
-/**
- * The tenant whose OWNER may edit site copy. Stored row wins; the fallback is
- * the reserved local bootstrap tenant, which no saas tenant can ever be named
- * as (`assertNotReserved` refuses it at mint), so an unseeded saas deployment
- * fails CLOSED rather than open.
- */
-export const platformAdminTenant = async (executor) => {
-    const rows = await executor.all({
-        sql: `SELECT key, value, updated_at, updated_by FROM ${SITE_COPY_TABLE} WHERE key = ?`,
-        params: [PLATFORM_ADMIN_ROW],
-    });
-    const value = rows[0]?.value;
-    return value === undefined || value.length === 0 ? RESERVED_TENANT_ID : value;
-};
-/** Record the platform tenant — called by the owner-seed step of the first
- *  deploy, beside the account it creates (launch spec §4 phase 1). */
-export const setPlatformAdminTenant = async (executor, options) => {
-    const tenantId = options.tenantId.trim();
-    const updatedBy = options.updatedBy.trim();
-    if (tenantId.length === 0)
-        throw new Error('setPlatformAdminTenant requires a non-empty tenantId.');
-    if (updatedBy.length === 0)
-        throw new Error('setPlatformAdminTenant requires a non-empty `updatedBy`.');
-    await executor.write({
-        sql: `INSERT INTO ${SITE_COPY_TABLE} (key, value, updated_at, updated_by)
-          VALUES (?, ?, {{now}}, ?)
-          ON CONFLICT (key) DO UPDATE SET
-            value = excluded.value,
-            updated_at = excluded.updated_at,
-            updated_by = excluded.updated_by`,
-        params: [PLATFORM_ADMIN_ROW, tenantId, updatedBy],
-    });
-};
-//# sourceMappingURL=siteCopy.js.map

package/dist/server/drivers/siteCopy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"siteCopy.js","sourceRoot":"","sources":["../../../src/server/drivers/siteCopy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,0BAA0B,GAE3B,MAAM,0BAA0B,CAAC;AAElC,MAAM,CAAC,MAAM,eAAe,GAAG,cAAc,CAAC;AAE9C;iFACiF;AACjF,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,8BAA8B,eAAe;;;;;EAKxE,CAAC;AAmBH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EAAE,QAA2B,EAAiB,EAAE;IACvF,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;AAC/C,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EAAE,QAA2B,EAAmC,EAAE;IAC1G,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAU,EAAE,GAAG,EAAE,0BAA0B,eAAe,EAAE,EAAE,CAAC,CAAC;IAC/F,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC;IACnF,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,QAA2B,EAA4B,EAAE;IACjG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAU;QACvC,GAAG,EAAE,kDAAkD,eAAe,EAAE;KACzE,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjD,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAChC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO;YACL,GAAG;YACH,YAAY,EAAE,kBAAkB,CAAC,GAAG,CAAC;YACrC,GAAG,CAAC,GAAG,KAAK,SAAS;gBACnB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;SAChF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAE,KAAa,EAAe,EAAE;IAC7E,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,IAAI,GAAG,yCAAyC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChG,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,qEAAqE,GAAG,gDAAgD,CACzH,CAAC;IACJ,IAAI,KAAK,CAAC,MAAM,GAAG,0BAA0B;QAC3C,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,QAAQ,KAAK,CAAC,MAAM,+BAA+B,0BAA0B,2CAA2C,CAC9I,CAAC;IACJ,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF;2EAC2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,QAA2B,EAC3B,OAAqF,EACtE,EAAE;IACjB,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAClG,MAAM,QAAQ,CAAC,KAAK,CAAC;QACnB,GAAG,EAAE,eAAe,eAAe;;;;;6CAKM;QACzC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC;KACxC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,sEAAsE;AACtE,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EAAE,QAA2B,EAAE,GAAW,EAAiB,EAAE;IAClG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,IAAI,GAAG,yCAAyC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChG,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,eAAe,eAAe,gBAAgB,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC/F,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,QAA2B,EAAmB,EAAE;IACxF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAU;QACvC,GAAG,EAAE,kDAAkD,eAAe,gBAAgB;QACtF,MAAM,EAAE,CAAC,kBAAkB,CAAC;KAC7B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;IAC7B,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC;AAChF,CAAC,CAAC;AAEF;sEACsE;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EACzC,QAA2B,EAC3B,OAAkE,EACnD,EAAE;IACjB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACpG,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACxG,MAAM,QAAQ,CAAC,KAAK,CAAC;QACnB,GAAG,EAAE,eAAe,eAAe;;;;;6CAKM;QACzC,MAAM,EAAE,CAAC,kBAAkB,EAAE,QAAQ,EAAE,SAAS,CAAC;KAClD,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/server/dropzone/duplicates.d.ts

@@ -1,83 +0,0 @@
-/**
- * Asking binary-server "do you already have this?" — the client half.
- *
- * Owner's ask, 2026-08-13: *"make strategy to always check for duplicate binaries in same app
- * for same user, automatically skip if it's literally a duplicate file"* … *"if it's an
- * automated upload with ingestions or an agent guiding it and I need to make a decision put it
- * in binary-server UI for me to see and handle it."*
- *
- * ── 🔴 Asked BEFORE the bytes move, and that ordering is the whole point ───────────────
- * The obvious design is upload-then-detect: store it, notice the collision, delete one. That
- * moves every duplicate twice, and on a media dropzone it does so for multi-gigabyte video the
- * store already holds. The scraper has the file, so it has the digest; one small POST answers
- * the question before a single byte is sent.
- *
- * ── 🔴 It lives in cursedbelt, not in satellite-kit ────────────────────────────────────
- * binary-server itself consumes `cursedbelt` and does NOT consume `satellite-kit`, and every
- * ingesting app consumes both. This is the one shelf both sides can see. It is also the reason
- * the request/response shape is stated here as types rather than being re-declared by each
- * caller — a dropzone that got `hold` backwards would upload exactly the files the owner asked
- * it to park.
- */
-export interface DuplicateQuestion {
-    /** binary-server's loopback origin. Never the public tunnel — see the note below. */
-    baseUrl: string;
-    /** The shared internal secret; this route is internal-only and 403s without it. */
-    internalSecret: string;
-    /** The binary-server tenant, e.g. `music`. */
-    app: string;
-    /** Scope the comparison to one user. Null on the owner-only apps, which is normal. */
-    ownerId?: string | null;
-    /** sha256 of the bytes about to be uploaded, hex. {@link hashFile} produces it. */
-    checksum: string;
-    size: number;
-    /** The name the object would carry — what the "same name" half of the rule compares. */
-    name: string;
-    /** Where the file is right now, so the owner's later decision can act on it. */
-    heldPath?: string | null;
-}
-export interface DuplicateVerdict {
-    /** Present when the store already holds these exact bytes. Skip the upload entirely. */
-    exact: {
-        key: string;
-        title: string | null;
-        size: number;
-    } | null;
-    /** Name-alikes with different bytes — a question, never an instruction. */
-    likely: {
-        key: string;
-        title: string | null;
-        size: number;
-        reason: string;
-    }[];
-    /** True when the caller must NOT upload and must park the file for the owner. */
-    hold: boolean;
-    /** The review-queue row binary-server filed, when it filed one. */
-    candidateId: string | null;
-}
-/**
- * Streaming sha256 of a file on disk.
- *
- * Streamed rather than buffered because a music library is thousands of files and some of them
- * are 60 MB; reading each one whole to hash it is how an ingest becomes a memory problem.
- */
-export declare function hashFile(path: string): Promise<string>;
-/**
- * Ask binary-server about one incoming file.
- *
- * 🔴 **Fails OPEN, deliberately.** If binary-server cannot be reached, or answers something
- * unexpected, the verdict is "no duplicate, do not hold" and the ingest proceeds. The
- * alternative is that a dropzone stops taking the owner's files because a de-duplication
- * nicety is down — trading a real capability for a housekeeping one. A duplicate that slips
- * through costs disk and is found later by the scan button, which is exactly what that button
- * is for.
- *
- * 🔴 **`baseUrl` must be the LOOPBACK origin.** The route is absent from binary-server's
- * public path allowlist and 404s when the request arrives bearing the public tunnel Host —
- * because it reports the titles and sizes of stored objects, and listing is what the tunnel
- * must never publish. A caller that passes the public URL gets a 404 and, through the
- * fail-open above, silently loses de-duplication entirely. notes shipped this exact bug once
- * with `/api/transcode`.
- */
-export declare function askBinaryServerAboutDuplicate(q: DuplicateQuestion): Promise<DuplicateVerdict>;
-//# sourceMappingURL=duplicates.d.ts.map

package/dist/server/dropzone/duplicates.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"duplicates.d.ts","sourceRoot":"","sources":["../../../src/server/dropzone/duplicates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,MAAM,WAAW,iBAAiB;IACjC,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,cAAc,EAAE,MAAM,CAAC;IACvB,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,sFAAsF;IACtF,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAChC,wFAAwF;IACxF,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAClE,2EAA2E;IAC3E,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9E,iFAAiF;IACjF,IAAI,EAAE,OAAO,CAAC;IACd,mEAAmE;IACnE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQtD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,6BAA6B,CAClD,CAAC,EAAE,iBAAiB,GAClB,OAAO,CAAC,gBAAgB,CAAC,CA+B3B"}