yamlite 0.39.0 → 0.40.0

package/README.md

@@ -255,20 +255,22 @@ pages:
     access: { tasks: write, people: read } # tables and views; nothing else is reachable
     sql: false # true allows SELECT over the names in access
     network: [] # origins the page may load scripts, styles, images and fonts from, and connect to
+    files: [.images/] # files the page may read with yamlite.file; a folder ends in /
     ai: true # lets the page call the host's AI model; { maxOutputTokens: 2048 } raises the default 1024 (at most 8192)
 ```
 
-Start from [`examples/pages/kanban.html`](examples/pages/kanban.html): copy it into `.pages/`, set `TABLE`, `KEY`, `GROUP` and `TITLE` at the top, and declare it as above. [`examples/pages/summary.html`](examples/pages/summary.html) shows a page that asks AI to summarize a record.
+Start from [`examples/pages/kanban.html`](examples/pages/kanban.html): copy it into `.pages/`, set `TABLE`, `KEY`, `GROUP` and `TITLE` at the top, and declare it as above. [`examples/pages/summary.html`](examples/pages/summary.html) shows a page that asks AI to summarize a record. [`examples/pages/gallery.html`](examples/pages/gallery.html) lists a table's `image` column and shows each file with `yamlite.file`.
 
 To share a page with people who should see only that page, open it and click **Copy app link**. The link ends in `/-/apps/<name>/` and shows the page alone, with its own title and look: no sidebar, tables, SQL console, command menu or links into other records. Once there are edits, a bar at the bottom shows their count and **Send for review**; an embedding host can add its own controls at the left of that bar with the `appFooter` mount option. The part after `#` is where the page stands inside itself, which it sets with `yamlite.history`, so a reload, the back button and a copied address return there; changing it does not leave the app. It leaves the editor out of sight; it does not take it away, so anyone who removes `-/apps/<name>/` from the address can still reach the rest of the UI. With `serve`, the copied link has no token, and the login cookie is not sent when a link is opened from another site such as mail or chat: share `/-/apps/<name>/?token=…` instead, on the origin of the URL `serve` printed and with its token. `serve` is meant for trying an app out; to share one with a team, use a host that gives each viewer their own branch. An `export` has the same entry at `-/apps/<name>/` for each page it includes; open it with the trailing slash (static hosts add it), since without it the page's relative paths resolve one folder too high.
 
 | Call                                                                                             | Does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | ------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `await yamlite.ready`                                                                            | `{ page, title, access, sql, network, readOnly, ai }`; `ai` is `{ provider, models }` when the page has `ai` and the host holds a key, else `null`                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `await yamlite.ready`                                                                            | `{ page, title, access, sql, network, files, readOnly, ai }`; `ai` is `{ provider, models }` when the page has `ai` and the host holds a key, else `null`                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | `yamlite.rows(table, { filter, sort, search, limit, offset })`                                   | `{ rows, total }`, reads tables and views, same filters and search as the table screen; `limit` ≤ 500                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
 | `yamlite.get(table, key)`                                                                        | `{ row, file }`; tables only, a view gives 400                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | `yamlite.create(table, key, values)` / `update(table, key, values, base)` / `remove(table, key)` | needs `write`; `update` fails with status 409, `extra.stale` (the fields) and `extra.current` (their values now), if a field changed since `base`                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | `yamlite.sql(select)`                                                                            | needs `sql: true`; one SELECT over the names in `access`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `await yamlite.file(path)`                                                                       | needs `path` to match one of the page's `files` and not be a denied path; resolves to a `Blob` typed by extension (`image/png`, `image/jpeg`, `image/webp`, `image/gif`, `image/svg+xml`, `application/pdf`, `text/plain`, otherwise `application/octet-stream`), for `URL.createObjectURL`. Files on the branch or commit the viewer has open, at most 10 MB; 403 when `path` matches no entry, 404 when there is no such file, 413 over the limit                                                                                                                                       |
 | `yamlite.on("change", ({ tables }) => …)`                                                        | called after a sync changes a table or view the page can read                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
 | `yamlite.theme` / `yamlite.on("theme", ({ theme }) => …)`                                        | the current theme (`light` or `dark`), and a call when it changes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | `yamlite.ai.generate({ system, prompt, schema, model, maxOutputTokens })`                        | needs `ai` (a page without it gets 403); `{ text }`, or `{ object }` matching `schema` (a JSON Schema). `prompt` is a string or a list of `{ role: "user" \| "assistant", content }`; `model` is one of `ready`'s `ai.models`, the first by default; `maxOutputTokens` may lower the page's limit. Runs on the host's key, never one from the page. Fails with 503 and `extra.code: "no_key"` when the host has no key, 429 with `extra.retryAfter` (seconds) when busy, and 502 when the provider fails: `extra.provider` is the provider id and the provider's own text is in `message` |
@@ -303,7 +305,9 @@ The variable and class names are part of the page API: renaming one is a breakin
 - `network` is enforced with a Content Security Policy. It limits what the page loads and where it connects. Declaring an origin lets the page send data, including anything it can read through `access`, off your machine to that origin.
 - `ai` lets the page send anything it can read through `access` to the host's AI provider, billed to the host's key.
 - Every page, even with `network: []`, can leak data by navigating its own frame to another site with the data in the URL. YAMLite then disconnects the page, but the data has already left. Only declare pages you trust, as you would any script you run.
-- In an [export](#export) pages are read-only, and `access` does not hide data: the exported `db.sqlite` is downloadable, and `sql: true` reads every exported table. Pages whose `access` names a table left out of the export are skipped with a warning.
+- `files` is a read grant like `access`: the page can read every file under a declared folder, and anything a page can read can leave through navigation, as for records. An entry ending in `/` is a folder, any other entry one exact file; `..`, absolute paths and entries inside `.yamlite/` or naming `yamlite.yaml` are config errors. A page cannot read YAMLite's state folder, the database (and its `-wal`, `-shm` and `-journal` files) or the config files, whatever `files` says: a broad folder entry still gets 403 for them. Symlinks are followed and must stay inside a granted path.
+- `serve` reads the working tree, so a `files` entry also covers files git does not track, such as a local `.env` or build output. Declare folders that hold only what the page should show.
+- In an [export](#export) pages are read-only, and `access` does not hide data: the exported `db.sqlite` is downloadable, and `sql: true` reads every exported table. Pages whose `access` names a table left out of the export are skipped with a warning. An export also copies the files a page declares into `data/files/`, each stored with a `.bin` suffix so a host serves it as a download rather than as a page; deploying the export makes them public; a file over 10 MB is skipped with a warning.
 
 ## Check
 

package/dist/browser/chokidar.mjs

@@ -1,4 +1,4 @@
-import { p as onChange } from "../fs-DZ4QHM93.mjs";
+import { m as onChange } from "../fs-BM30qNPb.mjs";
 import { resolve } from "pathe";
 //#region src/browser/chokidar.ts
 const list = (paths) => (Array.isArray(paths) ? paths : [paths]).map((p) => resolve(p));

package/dist/browser/expose.mjs

@@ -1,4 +1,12 @@
 //#region src/browser/expose.ts
+function post(port, id, bytes) {
+	const data = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+	port.postMessage({
+		id,
+		kind: "chunk",
+		data
+	}, [data]);
+}
 function expose(port, dispatch) {
 	const open = /* @__PURE__ */ new Map();
 	port.onmessage = async (e) => {
@@ -29,24 +37,13 @@ function expose(port, dispatch) {
 			});
 			headSent = true;
 			if (res.body) {
-				const decoder = new TextDecoder();
 				const reader = res.body.getReader();
 				ac.signal.addEventListener("abort", () => void reader.cancel(), { once: true });
 				for (;;) {
 					const { done, value } = await reader.read();
 					if (done) break;
-					port.postMessage({
-						id: m.id,
-						kind: "chunk",
-						data: decoder.decode(value, { stream: true })
-					});
+					post(port, m.id, value);
 				}
-				const rest = decoder.decode();
-				if (rest) port.postMessage({
-					id: m.id,
-					kind: "chunk",
-					data: rest
-				});
 			}
 		} catch (err) {
 			if (!ac.signal.aborted && !headSent) {
@@ -56,11 +53,7 @@ function expose(port, dispatch) {
 					status: 500,
 					headers: [["content-type", "application/json"]]
 				});
-				port.postMessage({
-					id: m.id,
-					kind: "chunk",
-					data: JSON.stringify({ error: String(err) })
-				});
+				post(port, m.id, new TextEncoder().encode(JSON.stringify({ error: String(err) })));
 			}
 		} finally {
 			open.delete(m.id);

package/dist/browser/fs.d.mts

@@ -24,6 +24,9 @@ export declare function statSync(p: string, opts?: {
 export declare const lstatSync: typeof statSync;
 export declare function accessSync(p: string): void;
 export declare function realpathSync(p: string): string;
+export declare namespace realpathSync {
+  export { realpathSync as native };
+}
 export declare function readFileSync(p: string, opts?: string | {
   encoding?: string;
 }): string | Buffer<ArrayBuffer>;
@@ -51,6 +54,7 @@ export declare function rmSync(p: string, opts?: {
 }): void;
 export declare function renameSync(from: string, to: string): void;
 export declare function linkSync(from: string, to: string): void;
+export declare function copyFileSync(from: string, to: string): void;
 export declare function cpSync(from: string, to: string): void;
 export declare function chmodSync(p: string, mode: number): void;
 export declare function mkdtempSync(prefix: string): string;
@@ -64,6 +68,7 @@ declare const _default: {
     W_OK: number;
     X_OK: number;
   };
+  copyFileSync: typeof copyFileSync;
   cpSync: typeof cpSync;
   createReadStream: typeof createReadStream;
   existsSync: typeof existsSync;

package/dist/browser/fs.mjs

@@ -1 +1 @@
-export { t as accessSync, n as chmodSync, r as constants, i as cpSync, a as createReadStream, c as default, o as existsSync, s as external, l as linkSync, u as lstatSync, d as mkdirSync, f as mkdtempSync, p as onChange, m as onRemove, h as readFileSync, g as readdirSync, _ as realpathSync, v as renameSync, y as rmSync, b as rmdirSync, x as statSync, S as unlinkSync, C as writeFileSync } from "../fs-DZ4QHM93.mjs";
+export { t as accessSync, n as chmodSync, r as constants, i as copyFileSync, a as cpSync, o as createReadStream, l as default, s as existsSync, c as external, u as linkSync, d as lstatSync, f as mkdirSync, p as mkdtempSync, m as onChange, h as onRemove, g as readFileSync, _ as readdirSync, v as realpathSync, y as renameSync, b as rmSync, x as rmdirSync, S as statSync, C as unlinkSync, w as writeFileSync } from "../fs-BM30qNPb.mjs";

package/dist/cli.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { F as createHandler, L as isLoopback, R as loopbackHosts, a as query, c as exportSite, i as formatTable, n as formatCsv, o as generateConfig, r as formatJson, s as init, t as open, z as check } from "./src-BMrfSYwa.mjs";
-import { n as guide, r as envKeys, t as createWorkspace } from "./workspace-gtZ3m7LH.mjs";
+import { B as check, I as createHandler, R as isLoopback, a as query, c as exportSite, i as formatTable, n as formatCsv, o as generateConfig, r as formatJson, s as init, t as open, z as loopbackHosts } from "./src-NOJw_gTE.mjs";
+import { n as guide, r as envKeys, t as createWorkspace } from "./workspace-Cp5-yHYp.mjs";
 import { createRequire } from "node:module";
 import { relative, resolve } from "node:path";
 import { homedir } from "node:os";
@@ -423,6 +423,7 @@ program.command("export").description("write the web UI as a read-only static si
 	console.log(`${out("green", "✓")} exported ${count} to ${displayPath(r.out)}`);
 	for (const [table, warnings] of Object.entries(r.warnings)) for (const w of warnings) console.log(`  ${out("yellow", "!")} ${table}: ${w}`);
 	for (const [page, reason] of Object.entries(r.skippedPages)) console.log(`  ${out("yellow", "!")} page ${page} not exported: ${reason}`);
+	for (const [path, reason] of Object.entries(r.skippedFiles)) console.log(`  ${out("yellow", "!")} file ${path} not exported: ${reason}`);
 	console.log(out("dim", "  serve the folder over HTTP to open it; file:// does not work"));
 });
 program.parseAsync().catch((e) => {

package/dist/core.d.mts

@@ -1,4 +1,4 @@
-import { A as parseConfig, B as HistoryEntry, C as Decision, D as OpenOptions, E as DeclaredTable, F as ColumnType, G as Rec, H as IndexSpec, I as ConflictInfo, J as ViewRecord, K as SchemaChange, L as DbRow, M as Capture, N as Change, O as TableInput, P as ChangeOp, R as DbValue, S as BaseHashes, T as Config, U as PageAccess, V as HistoryPage, W as PageSpec, _ as check, a as formatCsv, b as Watcher, c as query, d as init, f as ExportOptions, g as CheckTable, h as CheckResult, i as QueryResult, j as readsFile, k as TableLocation, l as InitOptions, m as exportSite, n as open, o as formatJson, p as ExportResult, q as TableSpec, r as QueryOptions, s as formatTable, t as Yamlite, u as generateConfig, v as WatchHandlers, w as CONFIG_NAMES, x as TableResult, y as WatchOptions, z as FieldChange } from "./index-OSyELQEX.mjs";
+import { A as parseConfig, B as HistoryEntry, C as Decision, D as OpenOptions, E as DeclaredTable, F as ColumnType, G as Rec, H as IndexSpec, I as ConflictInfo, J as ViewRecord, K as SchemaChange, L as DbRow, M as Capture, N as Change, O as TableInput, P as ChangeOp, R as DbValue, S as BaseHashes, T as Config, U as PageAccess, V as HistoryPage, W as PageSpec, _ as check, a as formatCsv, b as Watcher, c as query, d as init, f as ExportOptions, g as CheckTable, h as CheckResult, i as QueryResult, j as readsFile, k as TableLocation, l as InitOptions, m as exportSite, n as open, o as formatJson, p as ExportResult, q as TableSpec, r as QueryOptions, s as formatTable, t as Yamlite, u as generateConfig, v as WatchHandlers, w as CONFIG_NAMES, x as TableResult, y as WatchOptions, z as FieldChange } from "./index-CDLxve55.mjs";
 import { DatabaseSync } from "node:sqlite";
 import { LanguageModel, ModelMessage } from "ai";
 //#region src/store.d.ts
@@ -53,6 +53,22 @@ declare class Store {
   dropState(table: string, key: string): void;
 }
 //#endregion
+//#region src/pages/access.d.ts
+interface PageRules {
+  name: string;
+  access: Record<string, PageAccess>;
+  sql: boolean;
+  network: string[];
+  files: string[];
+  ai: {
+    maxOutputTokens: number;
+  } | null;
+}
+export declare const DENIED_FILES: string[];
+export declare const MAX_PAGE_FILE_BYTES = 10485760;
+export declare function normalizeFilePath(path: string): string | null;
+export declare const fileGranted: (files: string[], path: string) => boolean;
+//#endregion
 //#region src/agent/providers.d.ts
 interface Credentials {
   provider: string;
@@ -355,17 +371,6 @@ declare class EventHub {
   private send;
 }
 //#endregion
-//#region src/pages/access.d.ts
-interface PageRules {
-  name: string;
-  access: Record<string, PageAccess>;
-  sql: boolean;
-  network: string[];
-  ai: {
-    maxOutputTokens: number;
-  } | null;
-}
-//#endregion
 //#region src/serve/pagesql.d.ts
 declare class PageSql {
   private readonly path;
@@ -393,6 +398,8 @@ interface ApiContext {
   agent: AgentHost | null;
   git: GitDriver | null;
   reloadConfig: () => void;
+  pageFiles: WorkspaceOptions["pageFiles"] | null;
+  deniedFiles: string[];
 }
 //#endregion
 //#region src/agent/tools.d.ts
@@ -523,6 +530,7 @@ declare class Router {
 //#endregion
 //#region src/serve/workspace.d.ts
 type AiOptions = Omit<HostOptions, "tools" | "feedback" | "notes">;
+type PageFileResult = Uint8Array<ArrayBuffer> | "missing" | "too-large" | undefined;
 interface WorkspaceOptions {
   root: string;
   db?: string;
@@ -530,6 +538,7 @@ interface WorkspaceOptions {
   ai?: AiOptions | null;
   git?: GitDriver | null;
   gh?: string | null;
+  pageFiles?: (path: string, signal: AbortSignal) => Promise<PageFileResult>;
 }
 interface Workspace {
   readonly context: ApiContext;
@@ -541,4 +550,4 @@ export declare function createWorkspace(o: WorkspaceOptions): Promise<Workspace>
 //#region src/git/pr.d.ts
 export declare function templatePath(paths: readonly string[]): string | null;
 //#endregion
-export { type AiOptions, type ApiContext, CONFIG_NAMES, type Capture, type Change, type ChangeOp, type CheckResult, type CheckTable, type ColumnType, type Config, type ConflictInfo, type Credentials, type Decision, type DeclaredTable, type DefaultBranchFiles, type DiffResult, type ExportOptions, type ExportResult, type Extract, type Extracted, type GitDriver, type GitStatus, type GitStep, type HistoryEntry, type HistoryPage, type HistoryTarget, type IndexSpec, type InitOptions, type OpenOptions, type PageSpec, type QueryOptions, type QueryResult, type Repo, type ReviewOutcome, type ReviewRequest, type RunOptions, type SchemaChange, type StepResult, type StepRunner, type TableInput, type TableLocation, type TableResult, type TableSpec, type WatchHandlers, type WatchOptions, type Watcher, type Workspace, type WorkspaceOptions, Yamlite, check, exportSite, formatCsv, formatJson, formatTable, generateConfig, init, open, parseConfig, query, readsFile };
+export { type AiOptions, type ApiContext, CONFIG_NAMES, type Capture, type Change, type ChangeOp, type CheckResult, type CheckTable, type ColumnType, type Config, type ConflictInfo, type Credentials, type Decision, type DeclaredTable, type DefaultBranchFiles, type DiffResult, type ExportOptions, type ExportResult, type Extract, type Extracted, type GitDriver, type GitStatus, type GitStep, type HistoryEntry, type HistoryPage, type HistoryTarget, type IndexSpec, type InitOptions, type OpenOptions, type PageFileResult, type PageSpec, type QueryOptions, type QueryResult, type Repo, type ReviewOutcome, type ReviewRequest, type RunOptions, type SchemaChange, type StepResult, type StepRunner, type TableInput, type TableLocation, type TableResult, type TableSpec, type WatchHandlers, type WatchOptions, type Watcher, type Workspace, type WorkspaceOptions, Yamlite, check, exportSite, formatCsv, formatJson, formatTable, generateConfig, init, open, parseConfig, query, readsFile };

package/dist/core.mjs

@@ -1,3 +1,3 @@
-import { B as CONFIG_NAMES, C as describeChange, H as parseConfig, I as HttpError, T as worthShowing, U as readsFile, a as query, c as exportSite, f as ReviewRefused, h as templatePath, i as formatTable, n as formatCsv, o as generateConfig, r as formatJson, s as init, t as open, w as fieldChanges, z as check } from "./src-BMrfSYwa.mjs";
-import { t as createWorkspace } from "./workspace-gtZ3m7LH.mjs";
-export { CONFIG_NAMES, HttpError, ReviewRefused, check, createWorkspace, describeChange, exportSite, fieldChanges, formatCsv, formatJson, formatTable, generateConfig, init, open, parseConfig, query, readsFile, templatePath, worthShowing };
+import { B as check, C as describeChange, J as fileGranted, K as DENIED_FILES, L as HttpError, T as worthShowing, U as parseConfig, V as CONFIG_NAMES, W as readsFile, Y as normalizeFilePath, a as query, c as exportSite, f as ReviewRefused, h as templatePath, i as formatTable, n as formatCsv, o as generateConfig, q as MAX_PAGE_FILE_BYTES, r as formatJson, s as init, t as open, w as fieldChanges } from "./src-NOJw_gTE.mjs";
+import { t as createWorkspace } from "./workspace-Cp5-yHYp.mjs";
+export { CONFIG_NAMES, DENIED_FILES, HttpError, MAX_PAGE_FILE_BYTES, ReviewRefused, check, createWorkspace, describeChange, exportSite, fieldChanges, fileGranted, formatCsv, formatJson, formatTable, generateConfig, init, normalizeFilePath, open, parseConfig, query, readsFile, templatePath, worthShowing };

package/dist/{fs-DZ4QHM93.mjs → fs-BM30qNPb.mjs}

@@ -94,6 +94,7 @@ function realpathSync(p) {
 	get(abs(p), "realpath");
 	return abs(p);
 }
+realpathSync.native = realpathSync;
 function readFileSync(p, opts) {
 	const path = abs(p);
 	const e = get(path, "open");
@@ -199,6 +200,11 @@ function linkSync(from, to) {
 	tree.set(b, e);
 	emit("add", b);
 }
+function copyFileSync(from, to) {
+	const e = get(abs(from), "copyfile");
+	if (e.kind === "dir") fail("EISDIR", "illegal operation on a directory", "copyfile", abs(from));
+	writeFileSync(to, e.data);
+}
 function cpSync(from, to) {
 	const a = abs(from);
 	const b = abs(to);
@@ -230,6 +236,7 @@ var fs_default = {
 	accessSync,
 	chmodSync,
 	constants,
+	copyFileSync,
 	cpSync,
 	createReadStream,
 	existsSync,
@@ -248,4 +255,4 @@ var fs_default = {
 	writeFileSync
 };
 //#endregion
-export { writeFileSync as C, unlinkSync as S, realpathSync as _, createReadStream as a, rmdirSync as b, fs_default as c, mkdirSync as d, mkdtempSync as f, readdirSync as g, readFileSync as h, cpSync as i, linkSync as l, onRemove as m, chmodSync as n, existsSync as o, onChange as p, constants as r, external as s, accessSync as t, lstatSync as u, renameSync as v, statSync as x, rmSync as y };
+export { unlinkSync as C, statSync as S, readdirSync as _, cpSync as a, rmSync as b, external as c, lstatSync as d, mkdirSync as f, readFileSync as g, onRemove as h, copyFileSync as i, fs_default as l, onChange as m, chmodSync as n, createReadStream as o, mkdtempSync as p, constants as r, existsSync as s, accessSync as t, linkSync as u, realpathSync as v, writeFileSync as w, rmdirSync as x, renameSync as y };

package/dist/{index-OSyELQEX.d.mts → index-CDLxve55.d.mts}

@@ -81,6 +81,7 @@ interface PageSpec {
   access: Record<string, PageAccess>;
   sql: boolean;
   network: string[];
+  files: string[];
   ai: {
     maxOutputTokens: number;
   } | null;
@@ -268,6 +269,7 @@ interface ExportResult {
   warnings: Record<string, string[]>;
   pages: string[];
   skippedPages: Record<string, string>;
+  skippedFiles: Record<string, string>;
 }
 declare function exportSite(opts: ExportOptions): Promise<ExportResult>;
 //#endregion

package/dist/index.d.mts

@@ -1,2 +1,2 @@
-import { C as Decision, D as OpenOptions, F as ColumnType, H as IndexSpec, I as ConflictInfo, K as SchemaChange, N as Change, O as TableInput, P as ChangeOp, W as PageSpec, _ as check, a as formatCsv, b as Watcher, c as query, d as init, f as ExportOptions, g as CheckTable, h as CheckResult, i as QueryResult, l as InitOptions, m as exportSite, n as open, o as formatJson, p as ExportResult, q as TableSpec, r as QueryOptions, s as formatTable, t as Yamlite, u as generateConfig, v as WatchHandlers, x as TableResult, y as WatchOptions } from "./index-OSyELQEX.mjs";
+import { C as Decision, D as OpenOptions, F as ColumnType, H as IndexSpec, I as ConflictInfo, K as SchemaChange, N as Change, O as TableInput, P as ChangeOp, W as PageSpec, _ as check, a as formatCsv, b as Watcher, c as query, d as init, f as ExportOptions, g as CheckTable, h as CheckResult, i as QueryResult, l as InitOptions, m as exportSite, n as open, o as formatJson, p as ExportResult, q as TableSpec, r as QueryOptions, s as formatTable, t as Yamlite, u as generateConfig, v as WatchHandlers, x as TableResult, y as WatchOptions } from "./index-CDLxve55.mjs";
 export { type Change, type ChangeOp, type CheckResult, type CheckTable, type ColumnType, type ConflictInfo, type Decision, type ExportOptions, type ExportResult, type IndexSpec, type InitOptions, type OpenOptions, type PageSpec, type QueryOptions, type QueryResult, type SchemaChange, type TableInput, type TableResult, type TableSpec, type WatchHandlers, type WatchOptions, type Watcher, Yamlite, check, exportSite, formatCsv, formatJson, formatTable, generateConfig, init, open, query };

package/dist/index.mjs

@@ -1 +1 @@
-export { z as check, c as exportSite, n as formatCsv, r as formatJson, i as formatTable, o as generateConfig, s as init, t as open, a as query } from "./src-BMrfSYwa.mjs";
+export { B as check, c as exportSite, n as formatCsv, r as formatJson, i as formatTable, o as generateConfig, s as init, t as open, a as query } from "./src-NOJw_gTE.mjs";

package/dist/{src-BMrfSYwa.mjs → src-NOJw_gTE.mjs}

@@ -1,5 +1,5 @@
 import { basename, delimiter, dirname, extname, isAbsolute, join, matchesGlob, normalize, posix, relative, resolve, sep } from "node:path";
-import { accessSync, chmodSync, constants, cpSync, createReadStream, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { accessSync, chmodSync, constants, copyFileSync, cpSync, createReadStream, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { Document, Scalar, isMap, isNode, isScalar, isSeq, parse, parseDocument, stringify } from "yaml";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
@@ -1105,6 +1105,12 @@ function reconcileViews(store, spec, apply) {
 }
 //#endregion
 //#region src/pages/access.ts
+const DENIED_FILES = [
+	".yamlite/",
+	"yamlite.yaml",
+	"yamlite.yml"
+];
+const MAX_PAGE_FILE_BYTES = 10485760;
 const PAGE_AI_DEFAULT_TOKENS = 1024;
 const PAGE_AI_MAX_TOKENS = 8192;
 const canRead = (page, name) => Object.hasOwn(page.access, name);
@@ -1115,6 +1121,30 @@ function trustedViews(page, views) {
 	for (const name of Object.keys(page.access)) for (let v = name; v !== void 0 && parentOf.has(v) && !trusted.has(v); v = parentOf.get(v)) trusted.add(v);
 	return trusted;
 }
+function normalizeFilePath(path) {
+	if (path.startsWith("/") || path.startsWith("\\") || /^[a-z]:/i.test(path)) return null;
+	const parts = path.split(/[\\/]/);
+	if (parts.includes("..")) return null;
+	const kept = parts.filter((p) => p !== "" && p !== ".");
+	if (kept.length === 0) return null;
+	return kept.join("/") + (path.endsWith("/") ? "/" : "");
+}
+const fileGranted = (files, path) => files.some((entry) => entry.endsWith("/") ? path.startsWith(entry) : path === entry);
+const deniedFile = (path, denied) => fileGranted(denied.map((d) => d.toLowerCase()), path.toLowerCase());
+const CONTENT_TYPES = {
+	png: "image/png",
+	jpg: "image/jpeg",
+	jpeg: "image/jpeg",
+	webp: "image/webp",
+	gif: "image/gif",
+	svg: "image/svg+xml",
+	pdf: "application/pdf",
+	txt: "text/plain"
+};
+function contentTypeOf(path) {
+	const ext = path.slice(path.lastIndexOf(".") + 1).toLowerCase();
+	return path.includes(".") && Object.hasOwn(CONTENT_TYPES, ext) ? CONTENT_TYPES[ext] : "application/octet-stream";
+}
 //#endregion
 //#region src/config.ts
 const CONFIG_NAMES = ["yamlite.yaml", "yamlite.yml"];
@@ -1639,6 +1669,7 @@ const PAGE_KEYS = [
 	"access",
 	"sql",
 	"network",
+	"files",
 	"ai"
 ];
 const PAGE_NAME = /^[a-z0-9][a-z0-9_-]*$/;
@@ -1654,6 +1685,16 @@ function toOrigin(where, raw) {
 	if (url.protocol !== "https:" && url.protocol !== "http:" || raw.replace(/\/$/, "") !== url.origin) throw invalid();
 	return url.origin;
 }
+function toFiles(where, raw) {
+	if (raw === void 0 || raw === null) return [];
+	if (!Array.isArray(raw)) throw new Error(`${where}files must be a list of root-relative files and folders`);
+	return raw.map((entry) => {
+		const invalid = (why) => /* @__PURE__ */ new Error(`${where}files entry ${JSON.stringify(entry)} ${why}`);
+		if (typeof entry !== "string" || normalizeFilePath(entry) !== entry) throw invalid("must be a root-relative path without .., . or empty segments");
+		if (deniedFile(entry, DENIED_FILES)) throw invalid("is YAMLite's own and cannot be granted");
+		return entry;
+	});
+}
 function toPageAi(where, raw) {
 	if (raw === void 0 || raw === null || raw === false) return null;
 	if (raw === true) return { maxOutputTokens: PAGE_AI_DEFAULT_TOKENS };
@@ -1694,6 +1735,7 @@ function toPages(raw, place) {
 			access,
 			sql: v.sql === true,
 			network: (v.network ?? []).map((o) => toOrigin(where, o)),
+			files: toFiles(where, v.files),
 			ai: toPageAi(where, v.ai)
 		};
 	});
@@ -4238,6 +4280,37 @@ var ProposalStore = class {
 };
 //#endregion
 //#region src/serve/context.ts
+function onDisk(path) {
+	try {
+		return realpathSync.native(path);
+	} catch {
+		try {
+			return join(realpathSync.native(dirname(path)), basename(path));
+		} catch {
+			return path;
+		}
+	}
+}
+function deniedFiles(root, stateDir, dbPath) {
+	const base = onDisk(root);
+	const inside = (path) => {
+		const rel = relative(base, path);
+		return rel === "" || rel.startsWith("..") || isAbsolute(rel) ? null : rel.split(sep).join("/");
+	};
+	const state = inside(onDisk(stateDir));
+	const given = inside(join(onDisk(dirname(dbPath)), basename(dbPath)));
+	const dbs = [.../* @__PURE__ */ new Set([given, inside(onDisk(dbPath))])].filter((db) => db !== null);
+	return [
+		...DENIED_FILES,
+		...state === null ? [] : [`${state}/`],
+		...dbs.flatMap((db) => [
+			db,
+			`${db}-wal`,
+			`${db}-shm`,
+			`${db}-journal`
+		])
+	];
+}
 function displayPath$1(root, path) {
 	const rel = relative(root, path);
 	return rel === "" || rel.startsWith("..") ? path : rel;
@@ -6520,11 +6593,56 @@ function pageSpec(ctx, name) {
 	if (!page) throw new HttpError(404, `unknown page: ${name}`);
 	return page;
 }
+const FILE_HEADERS = {
+	"cache-control": "no-store",
+	"x-content-type-options": "nosniff",
+	"content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; sandbox"
+};
+const tooLarge = (path) => new HttpError(413, `${path} is larger than 10 MB`);
+const missing = (path) => new HttpError(404, `file not found: ${path}`);
+function grantedFile(root, files, denied, path) {
+	let real;
+	let size;
+	try {
+		real = realpathSync.native(join(root, path));
+		const st = statSync(real);
+		if (!st.isFile()) throw missing(path);
+		size = st.size;
+	} catch (e) {
+		if (e instanceof HttpError) throw e;
+		throw missing(path);
+	}
+	const rel = relative(realpathSync.native(root), real);
+	const shown = rel.split(sep).join("/");
+	if (rel.startsWith("..") || isAbsolute(rel) || !fileGranted(files, shown) || deniedFile(shown, denied)) throw new HttpError(403, `${path} leads outside this page's files`);
+	if (size > 10485760) throw tooLarge(path);
+	return {
+		real,
+		size
+	};
+}
+const readGranted = (ctx, page, path) => readFileSync(grantedFile(ctx.root, page.files, ctx.deniedFiles, path).real);
 const pageRoutes = (router, ctx) => {
 	router.add("GET", "/api/pages/:page/html", ({ params }) => {
 		const page = pageSpec(ctx, params.page);
 		return { html: readPageHtml(page.path, displayPath$1(ctx.root, page.path)) };
 	});
+	router.add("GET", "/api/pages/:page/file", async ({ params, query, signal }) => {
+		const page = pageSpec(ctx, params.page);
+		const asked = query.get("path");
+		if (!asked) throw new HttpError(400, "path is required");
+		const path = normalizeFilePath(asked);
+		if (path === null || !fileGranted(page.files, path)) throw new HttpError(403, `${asked} is not in this page's files`);
+		if (deniedFile(path, ctx.deniedFiles)) throw new HttpError(403, `${asked} is YAMLite's own and no page may read it`);
+		let bytes = await ctx.pageFiles?.(path, signal);
+		if (bytes === "missing") throw missing(path);
+		if (bytes === "too-large" || bytes !== void 0 && bytes.length > 10485760) throw tooLarge(path);
+		bytes ??= readGranted(ctx, page, path);
+		return new Response(bytes, { headers: {
+			...FILE_HEADERS,
+			"content-type": contentTypeOf(path)
+		} });
+	});
 };
 //#endregion
 //#region src/serve/routes/pageai.ts
@@ -7077,6 +7195,7 @@ const metaRoutes = (router, ctx) => {
 			access: p.access,
 			sql: p.sql,
 			network: p.network,
+			files: p.files,
 			ai: p.ai
 		})),
 		views: ctx.y.tables.flatMap((t) => declaredViews(t).map(({ spec, parent, depth, path }) => {
@@ -7586,6 +7705,40 @@ function warningScrubber(root, specPaths) {
 		return name === "" ? out : out.split(root).join(name);
 	};
 }
+function grantedCandidates(root, entries) {
+	const found = [];
+	const walk = (rel) => {
+		let items;
+		try {
+			items = readdirSync(join(root, rel), { withFileTypes: true });
+		} catch {
+			return;
+		}
+		for (const item of items) {
+			const path = `${rel}${item.name}`;
+			if (item.isDirectory()) walk(`${path}/`);
+			else found.push(path);
+		}
+	};
+	for (const entry of entries) if (entry.endsWith("/")) walk(entry);
+	else found.push(entry);
+	return found;
+}
+function copyPageFiles(root, dir, grants, denied, skipped) {
+	for (const path of new Set(grantedCandidates(root, grants))) {
+		if (deniedFile(path, denied)) continue;
+		let real;
+		try {
+			real = grantedFile(root, grants, denied, path).real;
+		} catch (e) {
+			if (e instanceof HttpError && e.status === 413) skipped[path] = "is larger than 10 MB";
+			continue;
+		}
+		const dest = join(dir, "data", "files", `${path}.bin`);
+		mkdirSync(dirname(dest), { recursive: true });
+		copyFileSync(real, dest);
+	}
+}
 const writeJson = (path, value) => writeFileSync(path, JSON.stringify(value));
 async function writeSnapshotData(opts) {
 	const root = resolve(opts.root);
@@ -7597,6 +7750,7 @@ async function writeSnapshotData(opts) {
 		const yaml = [];
 		const pages = [];
 		const skippedPages = {};
+		const skippedFiles = {};
 		const all = y.tables.map((t) => t.name);
 		const unknown = (opts.tables ?? []).filter((n) => !all.includes(n));
 		if (unknown.length > 0) throw new Error(`unknown table: ${unknown.join(", ")}`);
@@ -7621,6 +7775,8 @@ async function writeSnapshotData(opts) {
 				agent: null,
 				git: null,
 				reloadConfig: () => {},
+				pageFiles: null,
+				deniedFiles: deniedFiles(root, stateDir, dbPath),
 				proposals: new ProposalStore({
 					store,
 					dry: store,
@@ -7652,6 +7808,7 @@ async function writeSnapshotData(opts) {
 				}
 			}
 			const kept = new Set(pages.map(([name]) => name));
+			copyPageFiles(root, opts.dir, y.pages.filter((p) => kept.has(p.name)).flatMap((p) => p.files), ctx.deniedFiles, skippedFiles);
 			meta = {
 				...served,
 				root: basename(root),
@@ -7722,7 +7879,8 @@ async function writeSnapshotData(opts) {
 			tables: selected,
 			warnings,
 			pages: pages.map(([name]) => name),
-			skippedPages
+			skippedPages,
+			skippedFiles
 		};
 	});
 }
@@ -7810,7 +7968,7 @@ async function exportSite(opts) {
 		if (!html.includes("<head>")) throw new Error(`${indexPath} has no <head>`);
 		const index = html.replace("<head>", `<head>\n    ${STATIC_META}\n    ${FILE_GUARD}`);
 		writeFileSync(join(staging, "index.html"), index);
-		const { tables, warnings, pages, skippedPages } = await writeSnapshotData({
+		const { tables, warnings, pages, skippedPages, skippedFiles } = await writeSnapshotData({
 			root: opts.root,
 			tables: opts.tables,
 			dir: staging,
@@ -7839,7 +7997,8 @@ async function exportSite(opts) {
 			tables,
 			warnings,
 			pages,
-			skippedPages
+			skippedPages,
+			skippedFiles
 		};
 	} catch (e) {
 		rmSync(staging, {
@@ -8415,4 +8574,4 @@ async function open(options) {
 	};
 }
 //#endregion
-export { ProposalStore as A, CONFIG_NAMES as B, describeChange as C, isRead as D, PageSql as E, createHandler as F, declaredViews as G, parseConfig as H, HttpError as I, Store as K, isLoopback as L, assertSynced as M, toWire as N, statementCount as O, Router as P, loopbackHosts as R, which as S, worthShowing as T, readsFile as U, configPath as V, resolveConfig as W, ghReady as _, query as a, gitLog as b, exportSite as c, validateNewTable as d, ReviewRefused as f, DIFF_LIMIT as g, templatePath as h, formatTable as i, readRecord as j, EventHub as k, ROUTES as l, STEP_KINDS as m, formatCsv as n, generateConfig as o, localDriver as p, COLUMN_TYPES as q, formatJson as r, init as s, open as t, createTable as u, gitBranches as v, fieldChanges as w, gitStatus as x, gitDiff as y, check as z };
+export { deniedFiles as A, check as B, describeChange as C, isRead as D, PageSql as E, Router as F, resolveConfig as G, configPath as H, createHandler as I, fileGranted as J, DENIED_FILES as K, HttpError as L, readRecord as M, assertSynced as N, statementCount as O, toWire as P, COLUMN_TYPES as Q, isLoopback as R, which as S, worthShowing as T, parseConfig as U, CONFIG_NAMES as V, readsFile as W, declaredViews as X, normalizeFilePath as Y, Store as Z, ghReady as _, query as a, gitLog as b, exportSite as c, validateNewTable as d, ReviewRefused as f, DIFF_LIMIT as g, templatePath as h, formatTable as i, ProposalStore as j, EventHub as k, ROUTES as l, STEP_KINDS as m, formatCsv as n, generateConfig as o, localDriver as p, MAX_PAGE_FILE_BYTES as q, formatJson as r, init as s, open as t, createTable as u, gitBranches as v, fieldChanges as w, gitStatus as x, gitDiff as y, loopbackHosts as z };