cursedbelt 2.8.0 → 3.0.0

package/src/server/services/systemService.ts

@@ -1,484 +0,0 @@
-/**
- * `SystemService` (02 §1.5) — calendar, notifications, and Request Builder's
- * server-side send.
- *
- * `sendHttp` is the one that matters. The audit called the un-guarded version
- * "the single most dangerous finding" (§4.2): a caller-supplied URL handed to
- * `fetch` on the server reaches cloud metadata, the station on :4747, and every
- * internal admin endpoint. The route now guards the first hop — but a guard on
- * hop one is worthless if hop two is a redirect to `169.254.169.254`, which is
- * the classic bypass. So this implementation:
- *
- *   1. re-guards the URL it was handed (defense in depth — an ops path, a test,
- *      or a future caller may reach the service without the route);
- *   2. follows redirects MANUALLY, guarding every hop, with a hop ceiling;
- *   3. guards the RESOLVED address, not just the hostname, so a DNS name that
- *      points at a private IP is refused as well;
- *   4. caps the response body, because "fetch this URL for me" is also a memory
- *      amplification primitive if the answer can be 10GB.
- *
- * The SaaS profile must additionally enforce network-layer egress. That is
- * documented on `assertResolvedPublicUrl` and is not something a library can do.
- */
-import {
-  budgetsRepo,
-  type Calendar,
-  type CalendarEvent,
-  clearOccurrenceMark,
-  createCalendar,
-  createCalendarEvent,
-  deleteCalendar,
-  deleteCalendarEvent,
-  getCalendarEvent,
-  listCalendarEvents,
-  listCalendars,
-  listNotifications,
-  listOccurrenceMarks,
-  markNotificationDone,
-  type OccurrenceMark,
-  type RepoScope,
-  scopedExec,
-  setOccurrenceMark,
-  timeoffRepo,
-  updateCalendar,
-  updateCalendarEvent,
-} from 'cwip/repositories';
-import type { DomainHandle, RepoOp, StorageProvider } from 'cwip/storage';
-import { AppError } from '../errors';
-import { pruneUndefined } from './patch';
-import type {
-  BudgetEntryView,
-  BudgetService,
-  BudgetView,
-  CalendarEventDetailView,
-  CalendarEventView,
-  CalendarService,
-  CalendarView,
-  CallScope,
-  NotificationView,
-  OccurrenceMarkView,
-  SubscriptionService,
-  SubscriptionView,
-  SystemService,
-  TimeOffLedgerView,
-  TimeOffPolicyView,
-  TimeOffRequestView,
-  TimeOffService,
-} from '../mixins/services';
-import { assertResolvedPublicUrl, type OutboundGuardOptions } from '../net/outboundGuard';
-
-export interface SystemServiceOptions {
-  storage: StorageProvider;
-  /** Injected for tests; defaults to global `fetch`. */
-  fetchImpl?: typeof fetch;
-  outboundGuard?: OutboundGuardOptions;
-  /** Redirect hops followed before refusing. Default 5. */
-  maxRedirects?: number;
-  /** Response body ceiling in bytes. Default 8 MiB. */
-  maxResponseBytes?: number;
-  /** Per-request wall clock. Default 15s. */
-  timeoutMs?: number;
-}
-
-const scopeOf = (scope: CallScope): RepoScope => ({
-  tenantId: scope.claims.tenantId,
-  userId: scope.claims.userId,
-});
-
-/**
- * Headers a caller may NOT set. `host` and `content-length` are the transport's
- * to compute; the rest are how a request smuggles its way past a proxy or
- * impersonates an internal caller.
- */
-const FORBIDDEN_REQUEST_HEADERS = new Set([
-  'host',
-  'content-length',
-  'connection',
-  'transfer-encoding',
-  'upgrade',
-  'x-forwarded-for',
-  'x-forwarded-host',
-  'x-real-ip',
-]);
-
-const sanitizeHeaders = (headers: Record<string, string> | undefined): Record<string, string> => {
-  const clean: Record<string, string> = {};
-  for (const [name, value] of Object.entries(headers ?? {})) {
-    if (FORBIDDEN_REQUEST_HEADERS.has(name.toLowerCase())) continue;
-    clean[name] = value;
-  }
-  return clean;
-};
-
-export function createSystemService(options: SystemServiceOptions): SystemService {
-  const doFetch = options.fetchImpl ?? fetch;
-  const maxRedirects = options.maxRedirects ?? 5;
-  const maxResponseBytes = options.maxResponseBytes ?? 8 * 1024 * 1024;
-  const timeoutMs = options.timeoutMs ?? 15_000;
-  const domain = () => options.storage.domain('system');
-
-  return {
-    async listEvents(scope, range): Promise<readonly CalendarEventView[]> {
-      const repoScope = scopeOf(scope);
-      const events = await scopedExec(domain(), repoScope, listCalendarEvents(repoScope, range));
-      return events.map((event) => ({
-        id: event.id,
-        title: event.title,
-        startsAt: event.startsAt,
-        endsAt: event.endsAt,
-      }));
-    },
-
-    async listNotifications(scope): Promise<readonly NotificationView[]> {
-      const repoScope = scopeOf(scope);
-      const rows = await scopedExec(domain(), repoScope, listNotifications(repoScope));
-      return rows.map((row) => ({ id: row.id, title: row.title, body: row.body, done: row.done }));
-    },
-
-    async markNotificationDone(scope, id): Promise<boolean> {
-      const repoScope = scopeOf(scope);
-      return await scopedExec(domain(), repoScope, markNotificationDone(repoScope, id));
-    },
-
-    // Calendar CRUD + occurrence marks (§3 / §4). Same `system` domain accessor;
-    // a thin `scopedExec` over the flat `systemRepo` calendar ops.
-    calendar: createCalendarService(domain),
-
-    // Time-off, budgets and subscriptions (§3 / §4) — all in `system.db`, so they
-    // share the SAME domain accessor. Thin `scopedExec` wrappers over the
-    // `timeoffRepo`/`budgetsRepo` namespaces.
-    timeOff: createTimeOffService(domain),
-    budgets: createBudgetService(domain),
-    subscriptions: createSubscriptionService(domain),
-
-    async sendHttp(_scope, spec) {
-      // Hop 0. Re-guarded here even though the route already did: this method is
-      // reachable from the ops table too, and a guard that lives only at one
-      // caller is a guard with a second door.
-      let target = await assertResolvedPublicUrl(spec.url, options.outboundGuard);
-
-      const controller = new AbortController();
-      const timer = setTimeout(() => controller.abort(), timeoutMs);
-      const headers = sanitizeHeaders(spec.headers);
-
-      try {
-        for (let hop = 0; hop <= maxRedirects; hop++) {
-          const response = await doFetch(target.toString(), {
-            method: spec.method,
-            headers,
-            body: spec.body,
-            // MANUAL: the platform's automatic redirect following would jump to
-            // an unguarded host, which is the whole bypass.
-            redirect: 'manual',
-            signal: controller.signal,
-          });
-
-          const location = response.headers.get('location');
-          const isRedirect = response.status >= 300 && response.status < 400 && location !== null;
-          if (!isRedirect) return await readCappedResponse(response, maxResponseBytes);
-
-          if (hop === maxRedirects)
-            throw new AppError(`Outbound request exceeded ${maxRedirects} redirects.`, {
-              code: 'OUTBOUND_REDIRECT_LIMIT',
-              status: 502,
-              category: 'security',
-              context: { maxRedirects },
-            });
-
-          // Resolve relative Locations against the CURRENT hop, then guard the
-          // result exactly as hop 0 was guarded.
-          const next = new URL(location, target);
-          target = await assertResolvedPublicUrl(next.toString(), options.outboundGuard);
-        }
-        // Unreachable: the loop either returns or throws.
-        throw new AppError('Outbound request terminated without a response.', {
-          code: 'OUTBOUND_NO_RESPONSE',
-          status: 502,
-        });
-      } finally {
-        clearTimeout(timer);
-      }
-    },
-  };
-}
-
-/**
- * Read at most `limit` bytes. A fetched response is attacker-influenced size, so
- * `await response.text()` on it is an unbounded allocation the caller never
- * asked for.
- */
-const readCappedResponse = async (
-  response: Response,
-  limit: number,
-): Promise<{ status: number; headers: Record<string, string>; body: string }> => {
-  const headers: Record<string, string> = {};
-  response.headers.forEach((value, name) => {
-    headers[name] = value;
-  });
-
-  const reader = response.body?.getReader();
-  if (!reader) return { status: response.status, headers, body: '' };
-
-  const decoder = new TextDecoder();
-  let body = '';
-  let read = 0;
-  try {
-    while (read < limit) {
-      const { value, done } = await reader.read();
-      if (done) break;
-      read += value.byteLength;
-      body += decoder.decode(value, { stream: true });
-    }
-    body += decoder.decode();
-  } finally {
-    await reader.cancel().catch(() => undefined);
-  }
-  return { status: response.status, headers, body: read > limit ? body.slice(0, limit) : body };
-};
-
-const toCalendarView = (calendar: Calendar): CalendarView => ({
-  id: calendar.id,
-  title: calendar.title,
-  color: calendar.color,
-  visible: calendar.visible,
-});
-const toEventView = (event: CalendarEvent): CalendarEventDetailView => ({
-  id: event.id,
-  calendarId: event.calendarId,
-  title: event.title,
-  bodyMd: event.bodyMd,
-  location: event.location,
-  startsAt: event.startsAt,
-  endsAt: event.endsAt,
-  allDay: event.allDay,
-  rrule: event.rrule,
-  kItemId: event.kItemId,
-});
-const toMarkView = (mark: OccurrenceMark): OccurrenceMarkView => ({
-  eventId: mark.eventId,
-  occurredOn: mark.occurredOn,
-  state: mark.state,
-});
-
-/**
- * The calendar sub-service (§3 / §4). `cal_events`/`cal_done_marks` carry no
- * `tenant_id`; the repo re-earns tenancy through the FK chain to `cal_calendars`
- * on every write, so a foreign `calendarId`/`eventId` returns `null`/`false` and
- * the mixin turns that into a typed 404. Recurrence expansion is NOT here — it is
- * the pure `core/calendar` `expandEvent(rule, window)`, shared with the client.
- */
-function createCalendarService(domain: () => DomainHandle): CalendarService {
-  const run = <T>(scope: CallScope, op: RepoOp<T>): Promise<T> => scopedExec(domain(), scopeOf(scope), op);
-  return {
-    async listCalendars(scope): Promise<readonly CalendarView[]> {
-      return (await run(scope, listCalendars(scopeOf(scope)))).map(toCalendarView);
-    },
-    async createCalendar(scope, input): Promise<CalendarView> {
-      return toCalendarView(await run(scope, createCalendar(scopeOf(scope), input)));
-    },
-    async updateCalendar(scope, id, patch): Promise<CalendarView | null> {
-      const calendar = await run(scope, updateCalendar(scopeOf(scope), id, pruneUndefined(patch)));
-      return calendar ? toCalendarView(calendar) : null;
-    },
-    async removeCalendar(scope, id): Promise<boolean> {
-      return await run(scope, deleteCalendar(scopeOf(scope), id));
-    },
-    async getEvent(scope, id): Promise<CalendarEventDetailView | null> {
-      const event = await run(scope, getCalendarEvent(scopeOf(scope), id));
-      return event ? toEventView(event) : null;
-    },
-    async createEvent(scope, input): Promise<CalendarEventDetailView | null> {
-      const event = await run(scope, createCalendarEvent(scopeOf(scope), input));
-      return event ? toEventView(event) : null;
-    },
-    async updateEvent(scope, id, patch): Promise<CalendarEventDetailView | null> {
-      const event = await run(scope, updateCalendarEvent(scopeOf(scope), id, pruneUndefined(patch)));
-      return event ? toEventView(event) : null;
-    },
-    async removeEvent(scope, id): Promise<boolean> {
-      return await run(scope, deleteCalendarEvent(scopeOf(scope), id));
-    },
-    async listMarks(scope, calendarId): Promise<readonly OccurrenceMarkView[]> {
-      return (await run(scope, listOccurrenceMarks(scopeOf(scope), calendarId))).map(toMarkView);
-    },
-    async setMark(scope, eventId, occurredOn, state): Promise<OccurrenceMarkView | null> {
-      const mark = await run(scope, setOccurrenceMark(scopeOf(scope), eventId, occurredOn, state));
-      return mark ? toMarkView(mark) : null;
-    },
-    async clearMark(scope, eventId, occurredOn): Promise<boolean> {
-      return await run(scope, clearOccurrenceMark(scopeOf(scope), eventId, occurredOn));
-    },
-  };
-}
-
-const toPolicyView = (policy: timeoffRepo.TimeOffPolicy): TimeOffPolicyView => ({
-  id: policy.id,
-  title: policy.title,
-  accrualDays: policy.accrualDays,
-  carryoverMax: policy.carryoverMax,
-});
-const toRequestView = (request: timeoffRepo.TimeOffRequest): TimeOffRequestView => ({
-  id: request.id,
-  userId: request.userId,
-  policyId: request.policyId,
-  startsOn: request.startsOn,
-  endsOn: request.endsOn,
-  days: request.days,
-  status: request.status,
-  note: request.note,
-  createdAt: request.createdAt,
-  decidedAt: request.decidedAt,
-});
-const toLedgerView = (entry: timeoffRepo.LedgerEntry): TimeOffLedgerView => ({
-  id: entry.id,
-  userId: entry.userId,
-  policyId: entry.policyId,
-  requestId: entry.requestId,
-  deltaDays: entry.deltaDays,
-  reason: entry.reason,
-  at: entry.at,
-});
-
-/**
- * The time-off sub-service (§3 / §4). CRUD is `scopedExec` over the `timeoffRepo`
- * RepoOps; the three state-machine transitions (`approveRequest`/`denyRequest`/
- * `cancelRequest`) are the repo's transaction-composed PLAIN fns — they take a
- * `DomainHandle` directly (they open their own `scopedTransaction` to flip the
- * status AND move the ledger atomically), so they are called `fn(domain(), …)`
- * rather than through `scopedExec`.
- */
-function createTimeOffService(domain: () => DomainHandle): TimeOffService {
-  const run = <T>(scope: CallScope, op: RepoOp<T>): Promise<T> => scopedExec(domain(), scopeOf(scope), op);
-  return {
-    async listPolicies(scope): Promise<readonly TimeOffPolicyView[]> {
-      return (await run(scope, timeoffRepo.listPolicies(scopeOf(scope)))).map(toPolicyView);
-    },
-    async createPolicy(scope, input): Promise<TimeOffPolicyView> {
-      return toPolicyView(await run(scope, timeoffRepo.createPolicy(scopeOf(scope), input)));
-    },
-    async updatePolicy(scope, id, patch): Promise<TimeOffPolicyView | null> {
-      const policy = await run(scope, timeoffRepo.updatePolicy(scopeOf(scope), id, pruneUndefined(patch)));
-      return policy ? toPolicyView(policy) : null;
-    },
-    async removePolicy(scope, id): Promise<boolean> {
-      return await run(scope, timeoffRepo.deletePolicy(scopeOf(scope), id));
-    },
-    async listRequests(scope, opts): Promise<readonly TimeOffRequestView[]> {
-      return (await run(scope, timeoffRepo.listRequests(scopeOf(scope), pruneUndefined(opts)))).map(toRequestView);
-    },
-    async getRequest(scope, id): Promise<TimeOffRequestView | null> {
-      const request = await run(scope, timeoffRepo.getRequest(scopeOf(scope), id));
-      return request ? toRequestView(request) : null;
-    },
-    async createRequest(scope, input): Promise<TimeOffRequestView> {
-      return toRequestView(await run(scope, timeoffRepo.createRequest(scopeOf(scope), input)));
-    },
-    async approveRequest(scope, id): Promise<TimeOffRequestView | null> {
-      const request = await timeoffRepo.approveRequest(domain(), scopeOf(scope), id);
-      return request ? toRequestView(request) : null;
-    },
-    async denyRequest(scope, id): Promise<TimeOffRequestView | null> {
-      const request = await timeoffRepo.denyRequest(domain(), scopeOf(scope), id);
-      return request ? toRequestView(request) : null;
-    },
-    async cancelRequest(scope, id): Promise<TimeOffRequestView | null> {
-      const request = await timeoffRepo.cancelRequest(domain(), scopeOf(scope), id);
-      return request ? toRequestView(request) : null;
-    },
-    async listLedger(scope, opts): Promise<readonly TimeOffLedgerView[]> {
-      return (await run(scope, timeoffRepo.listLedger(scopeOf(scope), pruneUndefined(opts)))).map(toLedgerView);
-    },
-    async balance(scope, policyId): Promise<number> {
-      return await run(scope, timeoffRepo.balance(scopeOf(scope), policyId));
-    },
-  };
-}
-
-const toBudgetView = (budget: budgetsRepo.Budget): BudgetView => ({
-  id: budget.id,
-  title: budget.title,
-  period: budget.period,
-  amountCents: budget.amountCents,
-  currency: budget.currency,
-});
-const toBudgetEntryView = (entry: budgetsRepo.BudgetEntry): BudgetEntryView => ({
-  id: entry.id,
-  budgetId: entry.budgetId,
-  occurredOn: entry.occurredOn,
-  amountCents: entry.amountCents,
-  category: entry.category,
-  note: entry.note,
-});
-
-/** The budgets sub-service (§3 / §4). Thin `scopedExec` over `budgetsRepo`. */
-function createBudgetService(domain: () => DomainHandle): BudgetService {
-  const run = <T>(scope: CallScope, op: RepoOp<T>): Promise<T> => scopedExec(domain(), scopeOf(scope), op);
-  return {
-    async list(scope): Promise<readonly BudgetView[]> {
-      return (await run(scope, budgetsRepo.listBudgets(scopeOf(scope)))).map(toBudgetView);
-    },
-    async create(scope, input): Promise<BudgetView> {
-      return toBudgetView(await run(scope, budgetsRepo.createBudget(scopeOf(scope), input)));
-    },
-    async update(scope, id, patch): Promise<BudgetView | null> {
-      const budget = await run(scope, budgetsRepo.updateBudget(scopeOf(scope), id, pruneUndefined(patch)));
-      return budget ? toBudgetView(budget) : null;
-    },
-    async remove(scope, id): Promise<boolean> {
-      return await run(scope, budgetsRepo.deleteBudget(scopeOf(scope), id));
-    },
-    async listEntries(scope, budgetId, window): Promise<readonly BudgetEntryView[]> {
-      return (await run(scope, budgetsRepo.listEntries(scopeOf(scope), budgetId, pruneUndefined(window)))).map(
-        toBudgetEntryView,
-      );
-    },
-    async createEntry(scope, budgetId, input): Promise<BudgetEntryView | null> {
-      // null ⇒ the budget is not this caller's — the repo guards the parent in
-      // SQL, so a foreign `budgetId` writes nothing and the mixin reports 404.
-      const entry = await run(scope, budgetsRepo.createEntry(scopeOf(scope), budgetId, input));
-      return entry ? toBudgetEntryView(entry) : null;
-    },
-    async removeEntry(scope, id): Promise<boolean> {
-      return await run(scope, budgetsRepo.deleteEntry(scopeOf(scope), id));
-    },
-    async spend(scope, budgetId, window): Promise<number> {
-      return await run(scope, budgetsRepo.budgetSpend(scopeOf(scope), budgetId, pruneUndefined(window)));
-    },
-  };
-}
-
-const toSubscriptionView = (subscription: budgetsRepo.Subscription): SubscriptionView => ({
-  id: subscription.id,
-  title: subscription.title,
-  amountCents: subscription.amountCents,
-  currency: subscription.currency,
-  cadence: subscription.cadence,
-  nextDueOn: subscription.nextDueOn,
-  cancelledAt: subscription.cancelledAt,
-});
-
-/**
- * The subscriptions sub-service (§3 / §4). Lives in `budgetsRepo` beside budgets;
- * `cancel` is the idempotent state action (a second cancel returns `null`).
- */
-function createSubscriptionService(domain: () => DomainHandle): SubscriptionService {
-  const run = <T>(scope: CallScope, op: RepoOp<T>): Promise<T> => scopedExec(domain(), scopeOf(scope), op);
-  return {
-    async list(scope, opts): Promise<readonly SubscriptionView[]> {
-      return (await run(scope, budgetsRepo.listSubscriptions(scopeOf(scope), pruneUndefined(opts)))).map(
-        toSubscriptionView,
-      );
-    },
-    async create(scope, input): Promise<SubscriptionView> {
-      return toSubscriptionView(await run(scope, budgetsRepo.createSubscription(scopeOf(scope), input)));
-    },
-    async update(scope, id, patch): Promise<SubscriptionView | null> {
-      const subscription = await run(scope, budgetsRepo.updateSubscription(scopeOf(scope), id, pruneUndefined(patch)));
-      return subscription ? toSubscriptionView(subscription) : null;
-    },
-    async cancel(scope, id): Promise<SubscriptionView | null> {
-      const subscription = await run(scope, budgetsRepo.cancelSubscription(scopeOf(scope), id));
-      return subscription ? toSubscriptionView(subscription) : null;
-    },
-  };
-}

package/src/server/services/vaultReaper.ts

@@ -1,126 +0,0 @@
-/**
- * The stale-upload reaper (05 §A2) — the safety net the vault replacement
- * regressed.
- *
- * `plugin-media-vault/src/store.ts` carried an `expires_at` sweep. The engine
- * model's `mv_uploads` staging table shipped with the same three states and NO
- * sweep, so every upload that died between `beginUpload` and `completeUpload` —
- * a killed process, a dropped socket, a DB error after the object settled — left
- * a row `processing` forever with an object behind it that no asset references.
- * The poll route reported those uploads as still in flight, and the bytes were
- * invisible to the storage meter (law #6).
- *
- * Three properties are the whole design:
- *
- *   * **It reclaims the OBJECT first, then marks the row.** A crash between the
- *     two leaves a `processing` row the next tick retries — recoverable. The
- *     other order leaves a `failed` row whose bytes nobody will ever look for.
- *   * **The tenants are NAMED by the caller, never discovered.** Enumerating
- *     tenants means an unscoped read, which is precisely what RLS forbids under
- *     saas and what a `tenant_id` predicate exists to prevent everywhere else.
- *     `bootEngineApp` passes `[LOCAL_TENANT_ID]` under the local profile — a
- *     fact about that profile, not a guess — and a saas host passes its own.
- *   * **A tick that throws does not kill the timer.** A reaper that stops on the
- *     first transient store error is a reaper that silently stops reaping.
- */
-import type { AssetService, CallScope } from '../mixins/services';
-
-/** How often a tick runs when the caller does not say. Hourly: this is janitorial. */
-export const VAULT_REAP_INTERVAL_MS = 60 * 60 * 1000;
-
-export interface VaultUploadReaperOptions {
-  /** The service whose `reapStaleUploads` does the work. */
-  readonly assets: Pick<AssetService, 'reapStaleUploads'>;
-  /**
-   * The tenants to sweep, re-read every tick so a tenant created after boot is
-   * picked up without a restart. Never discovered from the table — see the
-   * header.
-   */
-  readonly tenants: () => readonly string[] | Promise<readonly string[]>;
-  /** Milliseconds between ticks. Default {@link VAULT_REAP_INTERVAL_MS}. */
-  readonly intervalMs?: number;
-  /** Rows a tick may reclaim per tenant. Default 100 — a page, not a backlog. */
-  readonly limit?: number;
-  /** How long `processing` is allowed to last. Default `VAULT_UPLOAD_STALE_MS`. */
-  readonly olderThanMs?: number;
-  /** A tick's failure. Absent ⇒ swallowed, which is the caller's choice to make. */
-  readonly onError?: (error: unknown, tenantId: string) => void;
-  /** Injected by tests; defaults to the global timer. */
-  readonly setInterval?: (fn: () => void, ms: number) => ReturnType<typeof setInterval>;
-  readonly clearInterval?: (handle: ReturnType<typeof setInterval>) => void;
-}
-
-export interface VaultUploadReaper {
-  /** Run one pass now — what the timer calls, and what a test drives directly. */
-  tick(): Promise<{ reaped: number; objectsDeleted: number }>;
-  /** Stop the timer. Idempotent. */
-  stop(): void;
-}
-
-/**
- * A CallScope for a maintenance sweep. The reaper acts as the tenant's own
- * system user: it touches only that tenant's rows, and every read it drives is
- * `tenant_id`-predicated in the repository regardless.
- */
-const sweepScope = (tenantId: string): CallScope => ({
-  instanceId: 'vault-reaper',
-  claims: {
-    tenantId,
-    userId: 'system',
-    role: 'OWNER',
-    permissions: [],
-    privateScope: false,
-    // The sweep never presents these to a verifier — no route is involved — but
-    // the claims type is `.strict()`, and a shape that only LOOKS like a session
-    // is how a maintenance path drifts from the real one.
-    exp: Math.floor(Date.now() / 1000) + 60,
-    jti: `vault-reaper:${tenantId}`,
-  },
-});
-
-/** Start the reaper. The returned handle is stopped by `bootEngineApp`'s `stop()`. */
-export function createVaultUploadReaper(options: VaultUploadReaperOptions): VaultUploadReaper {
-  const start = options.setInterval ?? setInterval;
-  const stopTimer = options.clearInterval ?? clearInterval;
-  let running = false;
-
-  const tick = async (): Promise<{ reaped: number; objectsDeleted: number }> => {
-    const total = { reaped: 0, objectsDeleted: 0 };
-    // A slow tick must not overlap the next one: two passes over the same page
-    // would each try to delete the same object and each count it.
-    if (running) return total;
-    running = true;
-    try {
-      for (const tenantId of await options.tenants()) {
-        try {
-          const result = await options.assets.reapStaleUploads(sweepScope(tenantId), {
-            ...(options.olderThanMs === undefined ? {} : { olderThanMs: options.olderThanMs }),
-            ...(options.limit === undefined ? {} : { limit: options.limit }),
-          });
-          total.reaped += result.reaped;
-          total.objectsDeleted += result.objectsDeleted;
-        } catch (error) {
-          // One tenant's failure is not the sweep's failure.
-          options.onError?.(error, tenantId);
-        }
-      }
-    } finally {
-      running = false;
-    }
-    return total;
-  };
-
-  const handle = start(() => {
-    void tick();
-  }, options.intervalMs ?? VAULT_REAP_INTERVAL_MS);
-  // A janitor must never hold the process open — if the app is otherwise idle
-  // and shutting down, the sweep is not a reason to keep the event loop alive.
-  (handle as { unref?: () => void }).unref?.();
-
-  return {
-    tick,
-    stop() {
-      stopTimer(handle);
-    },
-  };
-}

package/src/server/sharing/index.ts

@@ -1,65 +0,0 @@
-/**
- * `cursedbelt/server/sharing` — the fleet's ONE per-record sharing/access model.
- *
- * The vocabulary is `cursedbelt/sharing` (pure), the panel is
- * `cursedbelt/react/sharing`, and this is the storage + resolver half. Read
- * `./store.ts`'s header for the five properties it guarantees and `./sql.ts` for
- * why the row filter is a SQL fragment rather than a list of ids.
- */
-export { SHARE_MIGRATIONS } from "./migrations";
-export {
-	SHARE_EVENTS_TABLE,
-	SHARE_GRANTS_TABLE,
-	SHARE_GROUPS_TABLE,
-	SHARE_GROUP_MEMBERS_TABLE,
-} from "./migrations";
-export {
-	GROUP_SUBJECT_PREFIX,
-	mountShareRoutes,
-	parseSubjectParam,
-	subjectParam,
-} from "./router";
-export type { ShareRouterOptions, ShareRouterViewer, ShareRoutesPayload } from "./router";
-export { sharedResourceSql, sqlColumn, sqlLiteral } from "./sql";
-export type { SharedResourceSqlOptions } from "./sql";
-export { createShareStore, group, user } from "./store";
-export type {
-	GrantInput,
-	RevokeInput,
-	ShareEventQuery,
-	ShareStore,
-	ShareStoreOptions,
-	ShareTarget,
-} from "./store";
-// Re-exported so a server consumer needs ONE import for the whole contract; the
-// pure entry (`cursedbelt/sharing`) stays available for a browser or a test.
-export {
-	accessMeets,
-	describeAccess,
-	describeShareEvent,
-	isShareAccess,
-	isShareLevel,
-	isShareSubjectType,
-	levelsMeeting,
-	normalizeSubject,
-	normalizeSubjectId,
-	resolveAccess,
-	resourceKey,
-	sameResource,
-	sameSubject,
-	SHARE_ACTIONS,
-	strongerAccess,
-} from "../../core/sharing/model";
-export type {
-	ShareAccess,
-	ShareAction,
-	ShareEvent,
-	ShareGrant,
-	ShareGroup,
-	ShareGroupMember,
-	ShareLevel,
-	ShareResource,
-	ShareSubject,
-	ShareSubjectType,
-	ShareViewer,
-} from "../../core/sharing/model";