waterplane 0.0.1 → 0.1.6

package/packages/host/dist/hoststore.js

@@ -0,0 +1,350 @@
+/**
+ * What the daemon's global state dir (`hostStateDir`, once `<root>/<state dir>`) holds, by owner and by bound — and the two parts of it a
+ * phone may remove.
+ *
+ * ── Why the READING is most of the point ────────────────────────────────────
+ *
+ * Measured on this desktop: 28 MB, of which 21 MB is the thumbnail cache. That
+ * is not a lot, and the interesting half of the answer is WHY it is not a lot —
+ * almost everything in here is already bounded by whoever writes it:
+ * `sentlog.ts` a 1000-entry ring, `decisionlog.ts` a 500-entry ring,
+ * `limit-events.jsonl` a 256 KB rotation, `usagelog.ts` 5000 rows / 30 days,
+ * `history/`, `summaries/` and `ctxseries/` a boot sweep behind a 7-day gate and an
+ * alive-set guard, `thumbs/` a 256 MB prune.
+ *
+ * So this module is not a second eviction policy — it is the report that makes
+ * those bounds visible, and the one finding inside it: `tokenstats.json` is the
+ * file with no bound of its own (2.2 MB and growing), which nothing said out
+ * loud before.
+ *
+ * ── What may be removed, and what may not ───────────────────────────────────
+ *
+ *  - `thumbs/` — a cache. Its owner re-makes it and already prunes it; a clear
+ *    costs one `sips` per picture the gallery next shows.
+ *  - migration leftovers (`*.json.bak`, `*.json.migrated`) — copies a one-time
+ *    upgrade took in case it was wrong. The file each one shadows has been
+ *    rewritten hundreds of times since; they are the only bytes here a person
+ *    cannot otherwise get rid of.
+ *  - **everything else is reported and never offered.** A ledger is history,
+ *    not a cache: deleting `usagelog.jsonl` does not cost a re-read, it costs
+ *    the record. Live state (`intents.json`, `acks.json`, the session stores)
+ *    is worse than slow to lose — `acks.json` IS the at-most-once memory, so
+ *    removing it can make a queued prompt run twice. Each of those rows carries
+ *    a `cant` naming its own bound, which is what makes the row readable as
+ *    "already handled" rather than as something the screen forgot to offer.
+ *  - **a file this catalogue does not name is `unknown`**: counted, shown, and
+ *    never touched. A sweep that removes what it cannot identify is a sweep
+ *    that removes the next feature's store.
+ *
+ * ── Containment, exactly ────────────────────────────────────────────────────
+ *
+ * This directory is NOT inside a repo worktree, so `contained(worktree, rel)` —
+ * the guard every transport delete goes through — does not apply and is
+ * deliberately not used. What guards it instead:
+ *
+ *  - **No path arrives from the client.** A clear request carries a catalogue
+ *    id and an instant, nothing else. Every filename is derived here.
+ *  - The directory is `hostStateDir(root)` (`branddirs.ts`), the directory
+ *    every store constructor in this daemon writes under, with `root` the
+ *    daemon's own configured root and never a request field.
+ *  - A name is matched against a strict regex per kind and **refused, never
+ *    sanitised** (`sessions/knobs.ts`' `STORE_FILE_RE` posture) — so `..json.bak`
+ *    is not a leftover, it is a non-match.
+ *  - `lstat`, files only, symlinks skipped, no recursion into anything the
+ *    catalogue does not name.
+ *  - `inRoot(dir, full)` as the realpath-resolving belt, because the dir
+ *    itself may be a symlink and the two guards in `paths.ts` exist precisely
+ *    so this one does not have to guess which kind it needs.
+ *
+ * **Nothing applies itself**: no clear on boot, on a timer or at a threshold.
+ * The report is a list; a person taps one row and confirms.
+ *
+ * `packages/host/test/hoststore.test.mjs`.
+ */
+import { lstatSync, readdirSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { hostStoreTotal } from "@waterplane/shared";
+import { hostStateDir } from "./branddirs.js";
+import { inRoot } from "./paths.js";
+import { clearThumbCache, thumbCacheUsage } from "./thumbs.js";
+/** The store directory — the one every store constructor writes under. */
+export function hostStoreDir(root) {
+    return hostStateDir(root);
+}
+/**
+ * A migration's leftover copy.
+ *
+ * Anchored at both ends and with no separator in the stem, so nothing with a
+ * path in it can match. `..json.bak` fails on the stem, which is the point of
+ * writing it as a match rather than as a strip.
+ */
+const ROLLBACK_RE = /^[A-Za-z0-9_-]+\.json\.(bak|migrated)$/;
+/**
+ * Records with a bound their own writer enforces. The value is that bound, said
+ * in the words the row shows — a `cant` that only says "no" teaches nothing,
+ * and the whole value of this report is knowing which files are handled.
+ */
+const BOUNDED_LEDGERS = {
+    "sent.json": "a 1000-entry ring — it cannot grow past that.",
+    "decision-log.json": "a 500-entry ring — it cannot grow past that.",
+    "limit-events.jsonl": "rotates itself at 256 KB.",
+    "usagelog.jsonl": "capped at 5000 rows and 30 days.",
+    "deliveries.json": "bounded by its own writer.",
+    "ui-usage.json": "bounded by its own writer.",
+    "netstats.json": "one rolling window, rewritten in place.",
+    "usage-meter.json": "one rolling window, rewritten in place.",
+    "localusage.json": "120 days per local model, rewritten in place.",
+};
+/** The unbounded record — the finding this report exists to surface. */
+const TOKENSTATS = "tokenstats.json";
+/** Directories the catalogue knows, and what they are. `thumbs` is handled by
+ *  its owner (`thumbs.ts`) and never walked here. */
+const KNOWN_DIRS = {
+    history: "live",
+    summaries: "live",
+    /** A source session's recorded context series (`sessions/ctxseries.ts`), swept with `history/`. */
+    ctxseries: "live",
+    live: "live",
+    /** Each plugin's `settings.json` and its own `dataDir` (`plugins/pluginregistry.ts`). */
+    plugins: "live",
+};
+/** Bytes and files directly inside one flat directory. Files only, symlinks
+ *  skipped, no recursion — every directory this is called for is flat by
+ *  construction, and a nested one would be something this catalogue does not
+ *  know about. */
+function flatUsage(dir) {
+    try {
+        let count = 0;
+        let bytes = 0;
+        for (const n of readdirSync(dir)) {
+            const full = join(dir, n);
+            try {
+                const st = lstatSync(full);
+                if (!st.isFile())
+                    continue;
+                count++;
+                bytes += st.size;
+            }
+            catch { /* raced */ }
+        }
+        return { count, bytes };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Files the daemon is actively using. A fixed list rather than "everything not
+ * matched above", because the fallback for an unrecognised name must be
+ * `unknown` — a new store that lands in `live` by default would be described to
+ * a person as something it may not be, and a new store that landed in
+ * `rollback` by default would be deleted.
+ */
+const LIVE_FILES = new Set([
+    // Dotfiles included: `readdirSync` returns them, and `.env` in particular
+    // must land here rather than in `unknown`. It is the most sensitive file in
+    // the directory, `unknown` is already unclearable so nothing was ever at
+    // risk — but a row reading "not in this catalogue" about the daemon's own
+    // credentials is a sentence that invites somebody to go and look.
+    ".env",
+    // `branddirs.ts` boot move: where this dir came from, so an interrupted move can be finished.
+    "moved-from.json",
+    // `oracle.json` is the retired in-core oracle's config: kept, because the
+    // oracle PLUGIN reads it once to seed its own settings.
+    "acks.json", "assess.json", "auth.json", "backend-catalogue.json", "backlog-config.json", "backlog.json",
+    "budget.json", "burnwatch.json", "clihealth.json", "closed.json", "contextlimits.json", "ctxwindow.json",
+    "installs.json", "intents-archive.jsonl", "intents.json", "launches.json", "limit.json",
+    "notify.json", "oracle.json", "peer-jobs.json", "plugins.json", "pulls.json", "push-subs.json", "reviews.json",
+    "schedules.json", "sessions.json", "settings.json", "setup.json",
+    "stars.json", "tmux.conf", "updates.json", "vapid.json",
+]);
+/**
+ * What the store holds, as rows.
+ *
+ * Never throws: an unreadable store answers an empty report with `partial`, the
+ * way every other reading in this daemon degrades to absent rather than to a
+ * wrong number.
+ */
+export function hostStoreReport(root, now = Date.now()) {
+    const dir = hostStoreDir(root);
+    const rollback = { count: 0, bytes: 0, known: true };
+    const ledgers = { count: 0, bytes: 0, known: true };
+    const live = { count: 0, bytes: 0, known: true };
+    const unknown = { count: 0, bytes: 0, known: false };
+    let tokenstats = null;
+    let readable = true;
+    let names = [];
+    try {
+        names = readdirSync(dir);
+    }
+    catch {
+        readable = false;
+    }
+    for (const n of names) {
+        const full = join(dir, n);
+        let st;
+        try {
+            st = lstatSync(full);
+        }
+        catch {
+            continue;
+        }
+        // A symlink in here is not this daemon's, and following one is how a walk
+        // of a private directory becomes a walk of somewhere else.
+        if (st.isSymbolicLink())
+            continue;
+        if (st.isDirectory()) {
+            if (n === "thumbs")
+                continue; // its owner reports it
+            const usage = flatUsage(full);
+            const bucket = KNOWN_DIRS[n] ? live : unknown;
+            if (usage) {
+                bucket.count += usage.count;
+                bucket.bytes += usage.bytes;
+            }
+            continue;
+        }
+        if (!st.isFile())
+            continue;
+        if (n === TOKENSTATS) {
+            tokenstats = { count: 1, bytes: st.size };
+            continue;
+        }
+        const bucket = ROLLBACK_RE.test(n) ? rollback
+            : BOUNDED_LEDGERS[n] ? ledgers
+                : LIVE_FILES.has(n) ? live
+                    : unknown;
+        bucket.count++;
+        bucket.bytes += st.size;
+    }
+    const thumbs = thumbCacheUsage();
+    const rows = [
+        {
+            id: "thumbs",
+            label: "thumbnail cache",
+            kind: "cache",
+            count: thumbs?.count ?? 0,
+            bytes: thumbs ? thumbs.bytes : null,
+            cost: "The gallery re-makes each one the next time it shows that picture. Already pruned at 256 MB by its own writer — clearing is only about getting the space back sooner.",
+        },
+        {
+            id: "rollback",
+            label: "migration leftovers",
+            kind: "rollback",
+            count: rollback.count,
+            bytes: rollback.bytes,
+            cost: "Copies an upgrade took of a store before rewriting it. The live file has moved on many times since; these are here in case the upgrade was wrong.",
+        },
+        {
+            id: "tokenstats",
+            label: "token statistics",
+            kind: "ledger",
+            count: tokenstats?.count ?? 0,
+            bytes: tokenstats?.bytes ?? 0,
+            cost: "Every token this desktop has ever used, per day, model and repo.",
+            // Reported and not offered, deliberately. It CAN be re-derived from the
+            // CLI's own conversation logs — but only as far back as the CLI still
+            // keeps them, so a rebuild silently shortens the history rather than
+            // restoring it. That is a loss wearing a cache's clothes.
+            cant: "it is the one store here with no bound of its own — and rebuilding it only reaches as far back as the CLI still keeps its logs, so a clear would quietly shorten the history.",
+        },
+        {
+            id: "ledgers",
+            label: "bounded records",
+            kind: "ledger",
+            count: ledgers.count,
+            bytes: ledgers.bytes,
+            cost: "Deliveries, usage, limit events, the decision log. History rather than cache.",
+            cant: "each of these is already bounded by whoever writes it — a ring, a row cap or a size rotation — so none of them can grow without limit.",
+        },
+        {
+            id: "live",
+            label: "in use right now",
+            kind: "live",
+            count: live.count,
+            bytes: live.bytes,
+            cost: "The intent ledger, the ack memory, per-session stores, settings and credentials.",
+            cant: "the daemon is reading these. Losing the ack memory can make a queued prompt run twice, which is worse than any amount of space.",
+        },
+        {
+            id: "unknown",
+            label: "not in this catalogue",
+            kind: "unknown",
+            count: unknown.count,
+            bytes: unknown.bytes,
+            cost: "Files this build does not recognise — a newer store, or something left by hand.",
+            cant: "this screen will not remove what it cannot name.",
+        },
+    ];
+    const { total, partial } = hostStoreTotal(rows);
+    return { at: now, dir, rows, total, partial: partial || !readable };
+}
+/**
+ * Remove one clearable row's files.
+ *
+ * `at` is the instant the report a person read was taken: nothing written since
+ * goes. That is the same promise the transport sweep makes by sending its rows,
+ * kept here with one number because the individual files were never the
+ * decision — nobody chooses which thumbnails to keep.
+ *
+ * Refuses in words rather than silently doing nothing: an id that is not
+ * clearable, or not a catalogue id at all, comes back as a sentence with
+ * `deleted: 0`.
+ */
+export function clearHostStore(root, store, at) {
+    const dir = hostStoreDir(root);
+    // Nothing below ever joins a client string onto this path. The directory is
+    // the daemon's own global state dir (outside the code root since it moved —
+    // `branddirs.ts`), so the realpath belt is per FILE: every removal must
+    // resolve inside `dir` itself, which a symlinked state dir also passes.
+    if (store === "thumbs") {
+        const r = clearThumbCache(at);
+        return { deleted: r.deleted, bytes: r.bytes, failed: r.failed };
+    }
+    if (store === "rollback") {
+        const out = { deleted: 0, bytes: 0, failed: 0 };
+        let names;
+        try {
+            names = readdirSync(dir);
+        }
+        catch {
+            return out;
+        }
+        for (const n of names) {
+            // A match, never a strip: `..json.bak` fails the stem and is simply not a
+            // leftover.
+            if (!ROLLBACK_RE.test(n))
+                continue;
+            const full = join(dir, n);
+            let st;
+            try {
+                st = lstatSync(full);
+            }
+            catch {
+                continue;
+            }
+            if (!st.isFile())
+                continue;
+            if (st.mtimeMs > at)
+                continue;
+            if (!inRoot(dir, full)) {
+                out.failed++;
+                continue;
+            }
+            try {
+                rmSync(full);
+                out.deleted++;
+                out.bytes += st.size;
+            }
+            catch {
+                out.failed++;
+            }
+        }
+        return out;
+    }
+    return {
+        deleted: 0, bytes: 0, failed: 0,
+        refused: `“${store}” is not something this screen removes. Only the thumbnail cache and the migration leftovers are ever cleared from here.`,
+    };
+}
+//# sourceMappingURL=hoststore.js.map

package/packages/host/dist/hoststore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hoststore.js","sourceRoot":"","sources":["../src/hoststore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE/D,0EAA0E;AAC1E,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,GAAG,wCAAwC,CAAC;AAE7D;;;;GAIG;AACH,MAAM,eAAe,GAA2B;IAC9C,WAAW,EAAE,+CAA+C;IAC5D,mBAAmB,EAAE,8CAA8C;IACnE,oBAAoB,EAAE,2BAA2B;IACjD,gBAAgB,EAAE,kCAAkC;IACpD,iBAAiB,EAAE,4BAA4B;IAC/C,eAAe,EAAE,4BAA4B;IAC7C,eAAe,EAAE,yCAAyC;IAC1D,kBAAkB,EAAE,yCAAyC;IAC7D,iBAAiB,EAAE,+CAA+C;CACnE,CAAC;AAEF,wEAAwE;AACxE,MAAM,UAAU,GAAG,iBAAiB,CAAC;AAErC;qDACqD;AACrD,MAAM,UAAU,GAA2B;IACzC,OAAO,EAAE,MAAM;IACf,SAAS,EAAE,MAAM;IACjB,mGAAmG;IACnG,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,MAAM;IACZ,yFAAyF;IACzF,OAAO,EAAE,MAAM;CAChB,CAAC;AAEF;;;kBAGkB;AAClB,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC;QACH,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC3B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;oBAAE,SAAS;gBAC3B,KAAK,EAAE,CAAC;gBACR,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,kEAAkE;IAClE,MAAM;IACN,8FAA8F;IAC9F,iBAAiB;IACjB,0EAA0E;IAC1E,wDAAwD;IACxD,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,cAAc;IACxG,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,oBAAoB,EAAE,gBAAgB;IACxG,eAAe,EAAE,uBAAuB,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY;IACvF,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,cAAc;IAC9G,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY;IAChE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY;CACxD,CAAC,CAAC;AAMH;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC5D,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAW,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC7D,MAAM,OAAO,GAAW,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC5D,MAAM,IAAI,GAAW,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzD,MAAM,OAAO,GAAW,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC7D,IAAI,UAAU,GAA4C,IAAI,CAAC;IAC/D,IAAI,QAAQ,GAAG,IAAI,CAAC;IAEpB,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC;QAAC,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,QAAQ,GAAG,KAAK,CAAC;IAAC,CAAC;IAE7D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC1B,IAAI,EAAE,CAAC;QACP,IAAI,CAAC;YAAC,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QACjD,0EAA0E;QAC1E,2DAA2D;QAC3D,IAAI,EAAE,CAAC,cAAc,EAAE;YAAE,SAAS;QAClC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YACrB,IAAI,CAAC,KAAK,QAAQ;gBAAE,SAAS,CAAe,uBAAuB;YACnE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC9B,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YAC9C,IAAI,KAAK,EAAE,CAAC;gBAAC,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC;gBAAC,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC;YAAC,CAAC;YACxE,SAAS;QACX,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;YAAE,SAAS;QAC3B,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YAAC,UAAU,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ;YAC3C,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO;gBAC5B,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;oBACxB,CAAC,CAAC,OAAO,CAAC;QAChB,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;IAC1B,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,MAAM,IAAI,GAAmB;QAC3B;YACE,EAAE,EAAE,QAAQ;YACZ,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;YACzB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;YACnC,IAAI,EAAE,uKAAuK;SAC9K;QACD;YACE,EAAE,EAAE,UAAU;YACd,KAAK,EAAE,qBAAqB;YAC5B,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,IAAI,EAAE,mJAAmJ;SAC1J;QACD;YACE,EAAE,EAAE,YAAY;YAChB,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,UAAU,EAAE,KAAK,IAAI,CAAC;YAC7B,KAAK,EAAE,UAAU,EAAE,KAAK,IAAI,CAAC;YAC7B,IAAI,EAAE,kEAAkE;YACxE,wEAAwE;YACxE,sEAAsE;YACtE,qEAAqE;YACrE,0DAA0D;YAC1D,IAAI,EAAE,+KAA+K;SACtL;QACD;YACE,EAAE,EAAE,SAAS;YACb,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,+EAA+E;YACrF,IAAI,EAAE,wIAAwI;SAC/I;QACD;YACE,EAAE,EAAE,MAAM;YACV,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,kFAAkF;YACxF,IAAI,EAAE,iIAAiI;SACxI;QACD;YACE,EAAE,EAAE,SAAS;YACb,KAAK,EAAE,uBAAuB;YAC9B,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,iFAAiF;YACvF,IAAI,EAAE,kDAAkD;SACzD;KACF,CAAC;IAEF,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAa,EAAE,EAAU;IACpE,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,4EAA4E;IAC5E,4EAA4E;IAC5E,wEAAwE;IACxE,wEAAwE;IACxE,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;QACzB,MAAM,GAAG,GAAqB,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAClE,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YAAC,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,GAAG,CAAC;QAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,0EAA0E;YAC1E,YAAY;YACZ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,SAAS;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC1B,IAAI,EAAE,CAAC;YACP,IAAI,CAAC;gBAAC,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,SAAS;YAAC,CAAC;YACjD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;gBAAE,SAAS;YAC3B,IAAI,EAAE,CAAC,OAAO,GAAG,EAAE;gBAAE,SAAS;YAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;gBAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC;YACnD,IAAI,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAAC,GAAG,CAAC,OAAO,EAAE,CAAC;gBAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAAC,CAAC;QACpF,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,KAAK,0HAA0H;KAC7I,CAAC;AACJ,CAAC"}

package/packages/host/dist/httpio.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Response compression + conditional-GET helpers.
+ *
+ * Everything the phone pulls over HTTP was previously sent raw and uncacheable:
+ * transcript documents (hundreds of KB of JSON, refetched on every turn while a
+ * turn is in flight), artifact listings, git diffs, the app bundle, and every
+ * image — with no `ETag`, so a revisit re-downloaded bytes the phone already
+ * had. On a hotel/roaming link that is the whole cost. These two helpers add
+ * br/gzip negotiation and 304 handling in one place so every route gets both.
+ *
+ * Ranges are deliberately NOT compressed: a 206 is for <video> seeking, and a
+ * compressed byte range is meaningless.
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+/** True when this content type is worth compressing (already-compressed media isn't). */
+export declare function compressible(mime: string): boolean;
+/**
+ * Send a body with content negotiation. Callers pass the UNcompressed buffer;
+ * this picks br/gzip/identity.
+ *
+ * `cacheKey` marks the body as immutable for that key (pass something that
+ * changes when the bytes do, e.g. the ETag): the compressed form is memoised and
+ * encoded at maximum brotli quality instead of the fast per-request setting.
+ */
+export declare function sendBody(req: IncomingMessage, res: ServerResponse, status: number, buf: Buffer, headers: Record<string, string>, cacheKey?: string): void;
+/**
+ * Answer 304 when the client's `If-None-Match` matches. Returns true if it did
+ * (the caller must then send nothing else).
+ */
+export declare function notModified(req: IncomingMessage, res: ServerResponse, etag: string, cacheControl: string): boolean;
+/** Weak validator from a file stat — cheap and good enough for local files. */
+export declare function statTag(size: number, mtimeMs: number): string;
+/**
+ * A request body that is not the JSON its route reads: unparsable (usually a
+ * body cut off on the way), not an object, missing where the route needs one,
+ * or over the route's cap. Thrown by `readJsonBody` and answered in ONE place
+ * per HTTP edge (`api.ts`'s `handleApi`, `server/http.ts`'s error path) as
+ * `{ ok: false, error }` with `status` — so the phone reads "the body was bad",
+ * not a downstream refusal about a field that was never really absent.
+ * Before this, every such body read as `{}`.
+ */
+export declare class BadBody extends Error {
+    readonly status: 400 | 413;
+    constructor(message: string, status?: 400 | 413);
+}
+export interface ReadJsonOpts {
+    /** Byte cap on the raw body (default 1 MB). Past it ⇒ `BadBody` 413. */
+    limit?: number;
+    /** An EMPTY body reads as `{}` — for a route whose every field is optional.
+     *  Never covers a malformed one: empty is "nothing to say", garbage is not. */
+    optional?: boolean;
+    /** Accept any JSON value, not only an object/array (a plugin's own payload). */
+    anyJson?: boolean;
+}
+/**
+ * Read a JSON request body, or throw `BadBody`. Returns `any` on purpose:
+ * the ~45 routes destructure what they read and check each field themselves;
+ * this guarantees only that what they destructure is a JSON object that
+ * arrived whole.
+ */
+export declare function readJsonBody(req: IncomingMessage, opts?: ReadJsonOpts): Promise<any>;
+/** The reply for a `BadBody`; `false` (nothing written) for any other error.
+ *  `headers` carries what the caller's edge adds (CORS on the auth path). */
+export declare function answerBadBody(res: ServerResponse, err: unknown, headers?: Record<string, string>): boolean;

package/packages/host/dist/httpio.js

@@ -0,0 +1,199 @@
+import { brotliCompressSync, constants as zc, gzipSync } from "node:zlib";
+import { env } from "./env.js";
+/** Under this, framing + CPU cost more than the saved bytes. */
+const MIN_COMPRESS = 1024;
+/** Above this we skip brotli (CPU) and use gzip, which is ~10x faster to encode. */
+const BROTLI_MAX = 4 * 1024 * 1024;
+const COMPRESSIBLE = /^(?:text\/|application\/(?:json|javascript|xml|x-ndjson)|image\/svg)/;
+const enabled = env("COMPRESS") !== "0";
+/** True when this content type is worth compressing (already-compressed media isn't). */
+export function compressible(mime) {
+    return COMPRESSIBLE.test(mime);
+}
+/**
+ * Compressed-body cache for content that never changes for a given key (the
+ * static bundle). Lets those use max-effort brotli — ~20% smaller than the
+ * quality-4 setting a per-request encode can afford — without paying the CPU on
+ * every cold client. Bounded by entry count; the app ships a handful of assets.
+ */
+const CACHE_MAX_ENTRIES = 32;
+const bodyCache = new Map();
+function cached(key, make) {
+    const hit = bodyCache.get(key);
+    if (hit)
+        return hit;
+    const made = make();
+    if (bodyCache.size >= CACHE_MAX_ENTRIES)
+        bodyCache.delete(bodyCache.keys().next().value);
+    bodyCache.set(key, made);
+    return made;
+}
+/**
+ * Send a body with content negotiation. Callers pass the UNcompressed buffer;
+ * this picks br/gzip/identity.
+ *
+ * `cacheKey` marks the body as immutable for that key (pass something that
+ * changes when the bytes do, e.g. the ETag): the compressed form is memoised and
+ * encoded at maximum brotli quality instead of the fast per-request setting.
+ */
+export function sendBody(req, res, status, buf, headers, cacheKey) {
+    const mime = headers["content-type"] || "application/octet-stream";
+    const accept = String(req.headers["accept-encoding"] || "");
+    let body = buf;
+    const out = { ...headers };
+    if (enabled && buf.length >= MIN_COMPRESS && compressible(mime)) {
+        try {
+            if (/\bbr\b/.test(accept) && buf.length <= BROTLI_MAX) {
+                // Quality 4 is the knee for a one-shot encode: near-gzip speed, better
+                // ratio than gzip -6. A cacheable body pays 11 once and keeps it.
+                const q = cacheKey ? 11 : 4;
+                const enc = () => brotliCompressSync(buf, {
+                    params: { [zc.BROTLI_PARAM_QUALITY]: q, [zc.BROTLI_PARAM_SIZE_HINT]: buf.length },
+                });
+                body = cacheKey ? cached(`br:${q}:${cacheKey}`, enc) : enc();
+                out["content-encoding"] = "br";
+            }
+            else if (/\bgzip\b/.test(accept)) {
+                const enc = () => gzipSync(buf, { level: cacheKey ? 9 : 6 });
+                body = cacheKey ? cached(`gz:${cacheKey}`, enc) : enc();
+                out["content-encoding"] = "gzip";
+            }
+        }
+        catch {
+            body = buf; // compression is an optimisation, never a failure mode
+            delete out["content-encoding"];
+        }
+        if (out["content-encoding"])
+            out["vary"] = out["vary"] ? `${out["vary"]}, Accept-Encoding` : "Accept-Encoding";
+    }
+    out["content-length"] = String(body.length);
+    res.writeHead(status, out);
+    if (req.method === "HEAD")
+        res.end();
+    else
+        res.end(body);
+}
+/**
+ * Answer 304 when the client's `If-None-Match` matches. Returns true if it did
+ * (the caller must then send nothing else).
+ */
+export function notModified(req, res, etag, cacheControl) {
+    const inm = req.headers["if-none-match"];
+    if (!inm)
+        return false;
+    const tags = String(inm).split(",").map((s) => s.trim());
+    if (!tags.includes(etag) && !tags.includes("*"))
+        return false;
+    res.writeHead(304, { etag, "cache-control": cacheControl });
+    res.end();
+    return true;
+}
+/** Weak validator from a file stat — cheap and good enough for local files. */
+export function statTag(size, mtimeMs) {
+    return `W/"${size.toString(36)}-${Math.floor(mtimeMs).toString(36)}"`;
+}
+// ── JSON request bodies ─────────────────────────────────────────────
+/**
+ * A request body that is not the JSON its route reads: unparsable (usually a
+ * body cut off on the way), not an object, missing where the route needs one,
+ * or over the route's cap. Thrown by `readJsonBody` and answered in ONE place
+ * per HTTP edge (`api.ts`'s `handleApi`, `server/http.ts`'s error path) as
+ * `{ ok: false, error }` with `status` — so the phone reads "the body was bad",
+ * not a downstream refusal about a field that was never really absent.
+ * Before this, every such body read as `{}`.
+ */
+export class BadBody extends Error {
+    status;
+    constructor(message, status = 400) {
+        super(message);
+        this.name = "BadBody";
+        this.status = status;
+    }
+}
+const NOTHING_DONE = "nothing was done with it";
+function sizeWords(n) {
+    return n >= 1_000_000 ? `${Math.round(n / 100_000) / 10} MB` : `${Math.round(n / 1000)} kB`;
+}
+/** Collect the body up to `limit`. Past it the stream is PAUSED, not destroyed,
+ *  so the 413 can still be written (the reply asks for `connection: close`). */
+function collect(req, limit) {
+    return new Promise((resolve, reject) => {
+        if (req.readableEnded) {
+            resolve(Buffer.alloc(0));
+            return;
+        }
+        const chunks = [];
+        let total = 0;
+        let settled = false;
+        const done = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            req.off("data", onData);
+            req.off("end", onEnd);
+            req.off("error", onError);
+            req.off("close", onClose);
+            fn();
+        };
+        const onData = (c) => {
+            total += c.length;
+            if (total > limit) {
+                req.pause();
+                done(() => reject(new BadBody(`the request body is over ${sizeWords(limit)}; ${NOTHING_DONE}`, 413)));
+                return;
+            }
+            chunks.push(c);
+        };
+        const onEnd = () => done(() => resolve(Buffer.concat(chunks)));
+        const onError = (e) => done(() => reject(e));
+        const onClose = () => done(() => reject(new Error("request closed before its body arrived")));
+        req.on("data", onData);
+        req.on("end", onEnd);
+        req.on("error", onError);
+        req.on("close", onClose);
+    });
+}
+/**
+ * Read a JSON request body, or throw `BadBody`. Returns `any` on purpose:
+ * the ~45 routes destructure what they read and check each field themselves;
+ * this guarantees only that what they destructure is a JSON object that
+ * arrived whole.
+ */
+export async function readJsonBody(req, opts = {}) {
+    const buf = await collect(req, opts.limit ?? 1_000_000);
+    if (!buf.length) {
+        if (opts.optional)
+            return {};
+        throw new BadBody(`this request needs a JSON body and arrived with none; ${NOTHING_DONE}`);
+    }
+    let v;
+    try {
+        v = JSON.parse(buf.toString("utf8"));
+    }
+    catch {
+        throw new BadBody(`malformed JSON body — it may have been cut off on the way; ${NOTHING_DONE}`);
+    }
+    if (!opts.anyJson && (v === null || typeof v !== "object")) {
+        throw new BadBody(`the request body must be a JSON object; ${NOTHING_DONE}`);
+    }
+    return v;
+}
+/** The reply for a `BadBody`; `false` (nothing written) for any other error.
+ *  `headers` carries what the caller's edge adds (CORS on the auth path). */
+export function answerBadBody(res, err, headers = {}) {
+    if (!(err instanceof BadBody))
+        return false;
+    if (res.headersSent) {
+        res.end();
+        return true;
+    }
+    const body = Buffer.from(JSON.stringify({ ok: false, error: err.message }), "utf8");
+    res.writeHead(err.status, {
+        "content-type": "application/json", "content-length": String(body.length), ...headers,
+        // An over-cap body was left unread: this connection cannot carry another request.
+        ...(err.status === 413 ? { connection: "close" } : {}),
+    });
+    res.end(body);
+    return true;
+}
+//# sourceMappingURL=httpio.js.map

package/packages/host/dist/httpio.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpio.js","sourceRoot":"","sources":["../src/httpio.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,kBAAkB,EAAE,SAAS,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,gEAAgE;AAChE,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,oFAAoF;AACpF,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnC,MAAM,YAAY,GAAG,sEAAsE,CAAC;AAE5F,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC;AAExC,yFAAyF;AACzF,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;AAC5C,SAAS,MAAM,CAAC,GAAW,EAAE,IAAkB;IAC7C,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC;IACpB,IAAI,SAAS,CAAC,IAAI,IAAI,iBAAiB;QAAE,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAC;IACnG,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CACtB,GAAoB,EACpB,GAAmB,EACnB,MAAc,EACd,GAAW,EACX,OAA+B,EAC/B,QAAiB;IAEjB,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,0BAA0B,CAAC;IACnE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,IAAI,IAAI,GAAG,GAAG,CAAC;IACf,MAAM,GAAG,GAA2B,EAAE,GAAG,OAAO,EAAE,CAAC;IACnD,IAAI,OAAO,IAAI,GAAG,CAAC,MAAM,IAAI,YAAY,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;gBACtD,uEAAuE;gBACvE,kEAAkE;gBAClE,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5B,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE;oBACxC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,oBAAoB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,sBAAsB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;iBAClF,CAAC,CAAC;gBACH,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;gBAC7D,GAAG,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC;YACjC,CAAC;iBAAM,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC7D,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;gBACxD,GAAG,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC;YACnC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,GAAG,CAAC,CAAC,uDAAuD;YACnE,OAAO,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,GAAG,CAAC,kBAAkB,CAAC;YAAE,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACjH,CAAC;IACD,GAAG,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,GAAG,CAAC,GAAG,EAAE,CAAC;;QAChC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,GAAoB,EACpB,GAAmB,EACnB,IAAY,EACZ,YAAoB;IAEpB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC,CAAC;IAC5D,GAAG,CAAC,GAAG,EAAE,CAAC;IACV,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,OAAe;IACnD,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC;AACxE,CAAC;AAED,uEAAuE;AAEvE;;;;;;;;GAQG;AACH,MAAM,OAAO,OAAQ,SAAQ,KAAK;IACvB,MAAM,CAAY;IAC3B,YAAY,OAAe,EAAE,SAAoB,GAAG;QAClD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAYD,MAAM,YAAY,GAAG,0BAA0B,CAAC;AAEhD,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;AAC9F,CAAC;AAED;gFACgF;AAChF,SAAS,OAAO,CAAC,GAAoB,EAAE,KAAa;IAClD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC5D,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,EAAc,EAAE,EAAE;YAC9B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACrG,EAAE,EAAE,CAAC;QACP,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE;YAC3B,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;YAClB,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;gBAClB,GAAG,CAAC,KAAK,EAAE,CAAC;gBACZ,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,4BAA4B,SAAS,CAAC,KAAK,CAAC,KAAK,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;gBACtG,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,CAAC,CAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC,CAAC,CAAC;QAC9F,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAoB,EAAE,OAAqB,EAAE;IAC9E,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,OAAO,CAAC,yDAAyD,YAAY,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,CAAU,CAAC;IACf,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,OAAO,CAAC,8DAA8D,YAAY,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,OAAO,CAAC,2CAA2C,YAAY,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;6EAC6E;AAC7E,MAAM,UAAU,aAAa,CAAC,GAAmB,EAAE,GAAY,EAAE,UAAkC,EAAE;IACnG,IAAI,CAAC,CAAC,GAAG,YAAY,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACpF,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE;QACxB,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO;QACrF,kFAAkF;QAClF,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,IAAI,CAAC;AACd,CAAC"}

package/packages/host/dist/installlog.d.ts

@@ -0,0 +1,25 @@
+import { type InstallLogDoc, type InstallReporter } from "@waterplane/shared";
+export declare class InstallLogStore {
+    private path;
+    private entries;
+    private timer;
+    constructor(root: string);
+    /** Everything, for `install.log`. The devices are DERIVED on every read
+     *  (`installDevices`) rather than kept beside the entries: a device list that
+     *  can disagree with the log is one nobody can trust. */
+    doc(): InstallLogDoc;
+    /**
+     * Fold one phone's report in.
+     *
+     * Answers what CHANGED, so the route can stay quiet when a reconnect
+     * re-states a history the host already holds — which is the common case and
+     * would otherwise broadcast the whole log to every socket on every handshake.
+     */
+    report(reporter: InstallReporter, rows: readonly unknown[]): {
+        added: number;
+        updated: number;
+    };
+    flush(): void;
+    private schedule;
+    private persist;
+}