yamlite 0.39.0 → 0.41.0

package/README.md

@@ -255,26 +255,29 @@ pages:
     access: { tasks: write, people: read } # tables and views; nothing else is reachable
     sql: false # true allows SELECT over the names in access
     network: [] # origins the page may load scripts, styles, images and fonts from, and connect to
+    files: { .images/: read, .uploads/: write } # files the page may read (yamlite.files.read) or also write (yamlite.files.write); a folder ends in /
     ai: true # lets the page call the host's AI model; { maxOutputTokens: 2048 } raises the default 1024 (at most 8192)
 ```
 
-Start from [`examples/pages/kanban.html`](examples/pages/kanban.html): copy it into `.pages/`, set `TABLE`, `KEY`, `GROUP` and `TITLE` at the top, and declare it as above. [`examples/pages/summary.html`](examples/pages/summary.html) shows a page that asks AI to summarize a record.
+Start from [`examples/pages/kanban.html`](examples/pages/kanban.html): copy it into `.pages/`, set `TABLE`, `KEY`, `GROUP` and `TITLE` at the top, and declare it as above. [`examples/pages/summary.html`](examples/pages/summary.html) shows a page that asks AI to summarize a record. [`examples/pages/gallery.html`](examples/pages/gallery.html) lists a table's `image` column and shows each file with `yamlite.files.read`.
 
 To share a page with people who should see only that page, open it and click **Copy app link**. The link ends in `/-/apps/<name>/` and shows the page alone, with its own title and look: no sidebar, tables, SQL console, command menu or links into other records. Once there are edits, a bar at the bottom shows their count and **Send for review**; an embedding host can add its own controls at the left of that bar with the `appFooter` mount option. The part after `#` is where the page stands inside itself, which it sets with `yamlite.history`, so a reload, the back button and a copied address return there; changing it does not leave the app. It leaves the editor out of sight; it does not take it away, so anyone who removes `-/apps/<name>/` from the address can still reach the rest of the UI. With `serve`, the copied link has no token, and the login cookie is not sent when a link is opened from another site such as mail or chat: share `/-/apps/<name>/?token=…` instead, on the origin of the URL `serve` printed and with its token. `serve` is meant for trying an app out; to share one with a team, use a host that gives each viewer their own branch. An `export` has the same entry at `-/apps/<name>/` for each page it includes; open it with the trailing slash (static hosts add it), since without it the page's relative paths resolve one folder too high.
 
-| Call                                                                                             | Does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| ------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `await yamlite.ready`                                                                            | `{ page, title, access, sql, network, readOnly, ai }`; `ai` is `{ provider, models }` when the page has `ai` and the host holds a key, else `null`                                                                                                                                                                                                                                                                                                                                                                                                                                        |
-| `yamlite.rows(table, { filter, sort, search, limit, offset })`                                   | `{ rows, total }`, reads tables and views, same filters and search as the table screen; `limit` ≤ 500                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| `yamlite.get(table, key)`                                                                        | `{ row, file }`; tables only, a view gives 400                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| `yamlite.create(table, key, values)` / `update(table, key, values, base)` / `remove(table, key)` | needs `write`; `update` fails with status 409, `extra.stale` (the fields) and `extra.current` (their values now), if a field changed since `base`                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| `yamlite.sql(select)`                                                                            | needs `sql: true`; one SELECT over the names in `access`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| `yamlite.on("change", ({ tables }) => …)`                                                        | called after a sync changes a table or view the page can read                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| `yamlite.theme` / `yamlite.on("theme", ({ theme }) => …)`                                        | the current theme (`light` or `dark`), and a call when it changes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| `yamlite.ai.generate({ system, prompt, schema, model, maxOutputTokens })`                        | needs `ai` (a page without it gets 403); `{ text }`, or `{ object }` matching `schema` (a JSON Schema). `prompt` is a string or a list of `{ role: "user" \| "assistant", content }`; `model` is one of `ready`'s `ai.models`, the first by default; `maxOutputTokens` may lower the page's limit. Runs on the host's key, never one from the page. Fails with 503 and `extra.code: "no_key"` when the host has no key, 429 with `extra.retryAfter` (seconds) when busy, and 502 when the provider fails: `extra.provider` is the provider id and the provider's own text is in `message` |
-| `yamlite.ai.stream({ system, prompt, model })`                                                   | the same without `schema`, as an async iterable of text deltas: `for await (const text of yamlite.ai.stream(…))`; leaving the loop early cancels the call                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| `yamlite.open(table, key)`                                                                       | opens the record in YAMLite's own form; tables only, a view gives 400                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| `yamlite.history`                                                                                | where the page stands inside itself, with the `history` package's shape (`location`, `push`, `replace`, `go`, `back`, `forward`, `listen`, `createHref`) that routers take; in an app it is kept after the `#` of the address, and `back` and `go` stay within the app. `push(to, state)` and `replace(to, state)` throw for a path outside the page or longer than 2048 characters; `state` must be structured-cloneable, and comes back as `location.state` on back and forward, and as JSON after a reload                                                                             |
+| Call                                                                                                           | Does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| -------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `await yamlite.ready`                                                                                          | `{ page, title, access, sql, network, files, readOnly, ai }`; `ai` is `{ provider, models }` when the page has `ai` and the host holds a key, else `null`                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| `yamlite.rows(table, { filter, sort, search, limit, offset })`                                                 | `{ rows, total }`, reads tables and views, same filters and search as the table screen; `limit` ≤ 500                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `yamlite.get(table, key)`                                                                                      | `{ row, file }`; tables only, a view gives 400                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `yamlite.create(table, key, values)` / `update(table, key, values, { base })` / `remove(table, key, { base })` | needs `write`; `base` is the record as the page last read it, or the fields of it the page relies on. `update` fails with status 409, `extra.stale` (the fields) and `extra.current` (the record now) if a field it saves changed since `base`; `remove` does if any field in `base` changed. Leaving `base` out skips the check                                                                                                                                                                                                                                                          |
+| `yamlite.sql(select)`                                                                                          | needs `sql: true`; one SELECT over the names in `access`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `await yamlite.files.read(path)`                                                                               | needs `path` to match one of the page's `files` entries (`read` or `write`) and not be a denied path; resolves to a `Blob` typed by extension (`image/png`, `image/jpeg`, `image/webp`, `image/gif`, `image/svg+xml`, `application/pdf`, `text/plain`, otherwise `application/octet-stream`), for `URL.createObjectURL`. Files on the branch or commit the viewer has open, at most 10 MB; 403 when `path` matches no entry, 404 when there is no such file, 413 over the limit                                                                                                           |
+| `await yamlite.files.write(path, blob, { base })` / `files.delete(path, { base })`                             | needs `path` to fall under a `write` entry; `write` stores a PNG, JPEG, GIF, WebP or PDF file (the bytes must match the extension, at most 10 MB), creating its folders, and resolves to `{ sha256 }`; `delete` removes the file. `base` is the `Blob` the page last got from `files.read`, the `sha256` its last `files.write` returned, or `null` when it expects no file there; when the file has changed since, the call fails with status 409 and `extra.current` (the SHA-256 of the content now; absent when the file is over 10 MB). Leaving `base` out skips the check           |
+| `yamlite.on("change", ({ tables, files }) => …)`                                                               | called after a sync changes a table or view the page can read (`tables`), or after a file under the page's `files` changes on disk (`files`, root-relative paths), whoever changed it                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `yamlite.theme` / `yamlite.on("theme", ({ theme }) => …)`                                                      | the current theme (`light` or `dark`), and a call when it changes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| `yamlite.ai.generate({ system, prompt, schema, model, maxOutputTokens })`                                      | needs `ai` (a page without it gets 403); `{ text }`, or `{ object }` matching `schema` (a JSON Schema). `prompt` is a string or a list of `{ role: "user" \| "assistant", content }`; `model` is one of `ready`'s `ai.models`, the first by default; `maxOutputTokens` may lower the page's limit. Runs on the host's key, never one from the page. Fails with 503 and `extra.code: "no_key"` when the host has no key, 429 with `extra.retryAfter` (seconds) when busy, and 502 when the provider fails: `extra.provider` is the provider id and the provider's own text is in `message` |
+| `yamlite.ai.stream({ system, prompt, model })`                                                                 | the same without `schema`, as an async iterable of text deltas: `for await (const text of yamlite.ai.stream(…))`; leaving the loop early cancels the call                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| `yamlite.open(table, key)`                                                                                     | opens the record in YAMLite's own form; tables only, a view gives 400                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `yamlite.history`                                                                                              | where the page stands inside itself, with the `history` package's shape (`location`, `push`, `replace`, `go`, `back`, `forward`, `listen`, `createHref`) that routers take; in an app it is kept after the `#` of the address, and `back` and `go` stay within the app. `push(to, state)` and `replace(to, state)` throw for a path outside the page or longer than 2048 characters; `state` must be structured-cloneable, and comes back as `location.state` on back and forward, and as JSON after a reload                                                                             |
 
 Errors reject with `yamlite.YamliteError` (`status`, `message`, `extra`).
 
@@ -303,7 +306,10 @@ The variable and class names are part of the page API: renaming one is a breakin
 - `network` is enforced with a Content Security Policy. It limits what the page loads and where it connects. Declaring an origin lets the page send data, including anything it can read through `access`, off your machine to that origin.
 - `ai` lets the page send anything it can read through `access` to the host's AI provider, billed to the host's key.
 - Every page, even with `network: []`, can leak data by navigating its own frame to another site with the data in the URL. YAMLite then disconnects the page, but the data has already left. Only declare pages you trust, as you would any script you run.
-- In an [export](#export) pages are read-only, and `access` does not hide data: the exported `db.sqlite` is downloadable, and `sql: true` reads every exported table. Pages whose `access` names a table left out of the export are skipped with a warning.
+- `files` is a grant like `access`: each entry is `read` or `write`, the page can read every file under a declared folder, and anything a page can read can leave through navigation, as for records. An entry ending in `/` is a folder, any other entry one exact file; `..`, absolute paths and entries inside `.yamlite/` or naming `yamlite.yaml` are config errors, as is any level but `read` or `write`. A page cannot read YAMLite's state folder, the database (and its `-wal`, `-shm` and `-journal` files) or the config files, whatever `files` says: a broad folder entry still gets 403 for them. Symlinks are followed and must stay inside a granted path.
+- A `write` entry lets the page add, replace and delete files under it, but only pictures and PDFs whose bytes match their extension: never HTML, SVG or anything else that could run script where the files are later served. A page cannot write YAMLite's own files, or through a symlinked file; a symlinked folder must lead to a path the page may write. Written files land in the working tree like any other edit, so **Send for review** lists them. Grant `write` only on folders that hold nothing but what the page should manage.
+- `serve` reads the working tree, so a `files` entry also covers files git does not track, such as a local `.env` or build output. Declare folders that hold only what the page should show.
+- In an [export](#export) pages are read-only, and `access` does not hide data: the exported `db.sqlite` is downloadable, and `sql: true` reads every exported table. Pages whose `access` names a table left out of the export are skipped with a warning. An export also copies the files a page declares into `data/files/`, each stored with a `.bin` suffix so a host serves it as a download rather than as a page; deploying the export makes them public; a file over 10 MB is skipped with a warning.
 
 ## Check
 

package/dist/browser/chokidar.mjs

@@ -1,4 +1,4 @@
-import { p as onChange } from "../fs-DZ4QHM93.mjs";
+import { m as onChange } from "../fs-BM30qNPb.mjs";
 import { resolve } from "pathe";
 //#region src/browser/chokidar.ts
 const list = (paths) => (Array.isArray(paths) ? paths : [paths]).map((p) => resolve(p));

package/dist/browser/expose.mjs

@@ -1,4 +1,12 @@
 //#region src/browser/expose.ts
+function post(port, id, bytes) {
+	const data = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+	port.postMessage({
+		id,
+		kind: "chunk",
+		data
+	}, [data]);
+}
 function expose(port, dispatch) {
 	const open = /* @__PURE__ */ new Map();
 	port.onmessage = async (e) => {
@@ -29,24 +37,13 @@ function expose(port, dispatch) {
 			});
 			headSent = true;
 			if (res.body) {
-				const decoder = new TextDecoder();
 				const reader = res.body.getReader();
 				ac.signal.addEventListener("abort", () => void reader.cancel(), { once: true });
 				for (;;) {
 					const { done, value } = await reader.read();
 					if (done) break;
-					port.postMessage({
-						id: m.id,
-						kind: "chunk",
-						data: decoder.decode(value, { stream: true })
-					});
+					post(port, m.id, value);
 				}
-				const rest = decoder.decode();
-				if (rest) port.postMessage({
-					id: m.id,
-					kind: "chunk",
-					data: rest
-				});
 			}
 		} catch (err) {
 			if (!ac.signal.aborted && !headSent) {
@@ -56,11 +53,7 @@ function expose(port, dispatch) {
 					status: 500,
 					headers: [["content-type", "application/json"]]
 				});
-				port.postMessage({
-					id: m.id,
-					kind: "chunk",
-					data: JSON.stringify({ error: String(err) })
-				});
+				post(port, m.id, new TextEncoder().encode(JSON.stringify({ error: String(err) })));
 			}
 		} finally {
 			open.delete(m.id);

package/dist/browser/fs.d.mts

@@ -24,6 +24,9 @@ export declare function statSync(p: string, opts?: {
 export declare const lstatSync: typeof statSync;
 export declare function accessSync(p: string): void;
 export declare function realpathSync(p: string): string;
+export declare namespace realpathSync {
+  export { realpathSync as native };
+}
 export declare function readFileSync(p: string, opts?: string | {
   encoding?: string;
 }): string | Buffer<ArrayBuffer>;
@@ -51,6 +54,7 @@ export declare function rmSync(p: string, opts?: {
 }): void;
 export declare function renameSync(from: string, to: string): void;
 export declare function linkSync(from: string, to: string): void;
+export declare function copyFileSync(from: string, to: string): void;
 export declare function cpSync(from: string, to: string): void;
 export declare function chmodSync(p: string, mode: number): void;
 export declare function mkdtempSync(prefix: string): string;
@@ -64,6 +68,7 @@ declare const _default: {
     W_OK: number;
     X_OK: number;
   };
+  copyFileSync: typeof copyFileSync;
   cpSync: typeof cpSync;
   createReadStream: typeof createReadStream;
   existsSync: typeof existsSync;

package/dist/browser/fs.mjs

@@ -1 +1 @@
-export { t as accessSync, n as chmodSync, r as constants, i as cpSync, a as createReadStream, c as default, o as existsSync, s as external, l as linkSync, u as lstatSync, d as mkdirSync, f as mkdtempSync, p as onChange, m as onRemove, h as readFileSync, g as readdirSync, _ as realpathSync, v as renameSync, y as rmSync, b as rmdirSync, x as statSync, S as unlinkSync, C as writeFileSync } from "../fs-DZ4QHM93.mjs";
+export { t as accessSync, n as chmodSync, r as constants, i as copyFileSync, a as cpSync, o as createReadStream, l as default, s as existsSync, c as external, u as linkSync, d as lstatSync, f as mkdirSync, p as mkdtempSync, m as onChange, h as onRemove, g as readFileSync, _ as readdirSync, v as realpathSync, y as renameSync, b as rmSync, x as rmdirSync, S as statSync, C as unlinkSync, w as writeFileSync } from "../fs-BM30qNPb.mjs";

package/dist/cli.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { F as createHandler, L as isLoopback, R as loopbackHosts, a as query, c as exportSite, i as formatTable, n as formatCsv, o as generateConfig, r as formatJson, s as init, t as open, z as check } from "./src-BMrfSYwa.mjs";
-import { n as guide, r as envKeys, t as createWorkspace } from "./workspace-gtZ3m7LH.mjs";
+import { B as check, I as createHandler, R as isLoopback, a as query, c as exportSite, i as formatTable, n as formatCsv, o as generateConfig, r as formatJson, s as init, t as open, z as loopbackHosts } from "./src-ChJZPkg9.mjs";
+import { n as guide, r as envKeys, t as createWorkspace } from "./workspace-D7xHlBPc.mjs";
 import { createRequire } from "node:module";
 import { relative, resolve } from "node:path";
 import { homedir } from "node:os";
@@ -423,6 +423,7 @@ program.command("export").description("write the web UI as a read-only static si
 	console.log(`${out("green", "✓")} exported ${count} to ${displayPath(r.out)}`);
 	for (const [table, warnings] of Object.entries(r.warnings)) for (const w of warnings) console.log(`  ${out("yellow", "!")} ${table}: ${w}`);
 	for (const [page, reason] of Object.entries(r.skippedPages)) console.log(`  ${out("yellow", "!")} page ${page} not exported: ${reason}`);
+	for (const [path, reason] of Object.entries(r.skippedFiles)) console.log(`  ${out("yellow", "!")} file ${path} not exported: ${reason}`);
 	console.log(out("dim", "  serve the folder over HTTP to open it; file:// does not work"));
 });
 program.parseAsync().catch((e) => {

package/dist/core.d.mts

@@ -1,4 +1,4 @@
-import { A as parseConfig, B as HistoryEntry, C as Decision, D as OpenOptions, E as DeclaredTable, F as ColumnType, G as Rec, H as IndexSpec, I as ConflictInfo, J as ViewRecord, K as SchemaChange, L as DbRow, M as Capture, N as Change, O as TableInput, P as ChangeOp, R as DbValue, S as BaseHashes, T as Config, U as PageAccess, V as HistoryPage, W as PageSpec, _ as check, a as formatCsv, b as Watcher, c as query, d as init, f as ExportOptions, g as CheckTable, h as CheckResult, i as QueryResult, j as readsFile, k as TableLocation, l as InitOptions, m as exportSite, n as open, o as formatJson, p as ExportResult, q as TableSpec, r as QueryOptions, s as formatTable, t as Yamlite, u as generateConfig, v as WatchHandlers, w as CONFIG_NAMES, x as TableResult, y as WatchOptions, z as FieldChange } from "./index-OSyELQEX.mjs";
+import { A as parseConfig, B as HistoryEntry, C as Decision, D as OpenOptions, E as DeclaredTable, F as ColumnType, G as Rec, H as IndexSpec, I as ConflictInfo, J as ViewRecord, K as SchemaChange, L as DbRow, M as Capture, N as Change, O as TableInput, P as ChangeOp, R as DbValue, S as BaseHashes, T as Config, U as PageAccess, V as HistoryPage, W as PageSpec, _ as check, a as formatCsv, b as Watcher, c as query, d as init, f as ExportOptions, g as CheckTable, h as CheckResult, i as QueryResult, j as readsFile, k as TableLocation, l as InitOptions, m as exportSite, n as open, o as formatJson, p as ExportResult, q as TableSpec, r as QueryOptions, s as formatTable, t as Yamlite, u as generateConfig, v as WatchHandlers, w as CONFIG_NAMES, x as TableResult, y as WatchOptions, z as FieldChange } from "./index-Bd2ctbJm.mjs";
 import { DatabaseSync } from "node:sqlite";
 import { LanguageModel, ModelMessage } from "ai";
 //#region src/store.d.ts
@@ -53,6 +53,22 @@ declare class Store {
   dropState(table: string, key: string): void;
 }
 //#endregion
+//#region src/pages/access.d.ts
+interface PageRules {
+  name: string;
+  access: Record<string, PageAccess>;
+  sql: boolean;
+  network: string[];
+  files: Record<string, PageAccess>;
+  ai: {
+    maxOutputTokens: number;
+  } | null;
+}
+export declare const DENIED_FILES: string[];
+export declare const MAX_PAGE_FILE_BYTES = 10485760;
+export declare function normalizeFilePath(path: string): string | null;
+export declare const fileGranted: (files: Record<string, PageAccess>, path: string) => boolean;
+//#endregion
 //#region src/agent/providers.d.ts
 interface Credentials {
   provider: string;
@@ -333,6 +349,10 @@ type ServeEvent = {
   type: "page";
   at: string;
   pages: string[];
+} | {
+  type: "files";
+  at: string;
+  paths: string[];
 };
 //#endregion
 //#region src/serve/events.d.ts
@@ -348,6 +368,7 @@ declare class EventHub {
   warnings(): Record<string, string[]>;
   configError(): string | null;
   pagesChanged(pages: string[]): void;
+  filesChanged(paths: string[]): void;
   stream(signal: AbortSignal): ReadableStream<Uint8Array>;
   close(): void;
   private onSync;
@@ -355,17 +376,6 @@ declare class EventHub {
   private send;
 }
 //#endregion
-//#region src/pages/access.d.ts
-interface PageRules {
-  name: string;
-  access: Record<string, PageAccess>;
-  sql: boolean;
-  network: string[];
-  ai: {
-    maxOutputTokens: number;
-  } | null;
-}
-//#endregion
 //#region src/serve/pagesql.d.ts
 declare class PageSql {
   private readonly path;
@@ -393,6 +403,8 @@ interface ApiContext {
   agent: AgentHost | null;
   git: GitDriver | null;
   reloadConfig: () => void;
+  pageFiles: WorkspaceOptions["pageFiles"] | null;
+  deniedFiles: string[];
 }
 //#endregion
 //#region src/agent/tools.d.ts
@@ -513,16 +525,20 @@ interface ApiRequest {
 type Handler = (req: ApiRequest) => unknown;
 declare class Router {
   private readonly routes;
-  add(method: string, pattern: string, handler: Handler): this;
+  add(method: string, pattern: string, handler: Handler, opts?: {
+    maxBody?: number;
+  }): this;
   match(method: string, pathname: string): {
     handler: Handler;
     params: Record<string, string>;
+    maxBody: number;
   } | "method" | null;
   dispatch(request: Request): Promise<Response>;
 }
 //#endregion
 //#region src/serve/workspace.d.ts
 type AiOptions = Omit<HostOptions, "tools" | "feedback" | "notes">;
+type PageFileResult = Uint8Array<ArrayBuffer> | "missing" | "too-large" | undefined;
 interface WorkspaceOptions {
   root: string;
   db?: string;
@@ -530,6 +546,7 @@ interface WorkspaceOptions {
   ai?: AiOptions | null;
   git?: GitDriver | null;
   gh?: string | null;
+  pageFiles?: (path: string, signal: AbortSignal) => Promise<PageFileResult>;
 }
 interface Workspace {
   readonly context: ApiContext;
@@ -541,4 +558,4 @@ export declare function createWorkspace(o: WorkspaceOptions): Promise<Workspace>
 //#region src/git/pr.d.ts
 export declare function templatePath(paths: readonly string[]): string | null;
 //#endregion
-export { type AiOptions, type ApiContext, CONFIG_NAMES, type Capture, type Change, type ChangeOp, type CheckResult, type CheckTable, type ColumnType, type Config, type ConflictInfo, type Credentials, type Decision, type DeclaredTable, type DefaultBranchFiles, type DiffResult, type ExportOptions, type ExportResult, type Extract, type Extracted, type GitDriver, type GitStatus, type GitStep, type HistoryEntry, type HistoryPage, type HistoryTarget, type IndexSpec, type InitOptions, type OpenOptions, type PageSpec, type QueryOptions, type QueryResult, type Repo, type ReviewOutcome, type ReviewRequest, type RunOptions, type SchemaChange, type StepResult, type StepRunner, type TableInput, type TableLocation, type TableResult, type TableSpec, type WatchHandlers, type WatchOptions, type Watcher, type Workspace, type WorkspaceOptions, Yamlite, check, exportSite, formatCsv, formatJson, formatTable, generateConfig, init, open, parseConfig, query, readsFile };
+export { type AiOptions, type ApiContext, CONFIG_NAMES, type Capture, type Change, type ChangeOp, type CheckResult, type CheckTable, type ColumnType, type Config, type ConflictInfo, type Credentials, type Decision, type DeclaredTable, type DefaultBranchFiles, type DiffResult, type ExportOptions, type ExportResult, type Extract, type Extracted, type GitDriver, type GitStatus, type GitStep, type HistoryEntry, type HistoryPage, type HistoryTarget, type IndexSpec, type InitOptions, type OpenOptions, type PageFileResult, type PageSpec, type QueryOptions, type QueryResult, type Repo, type ReviewOutcome, type ReviewRequest, type RunOptions, type SchemaChange, type StepResult, type StepRunner, type TableInput, type TableLocation, type TableResult, type TableSpec, type WatchHandlers, type WatchOptions, type Watcher, type Workspace, type WorkspaceOptions, Yamlite, check, exportSite, formatCsv, formatJson, formatTable, generateConfig, init, open, parseConfig, query, readsFile };

package/dist/core.mjs

@@ -1,3 +1,3 @@
-import { B as CONFIG_NAMES, C as describeChange, H as parseConfig, I as HttpError, T as worthShowing, U as readsFile, a as query, c as exportSite, f as ReviewRefused, h as templatePath, i as formatTable, n as formatCsv, o as generateConfig, r as formatJson, s as init, t as open, w as fieldChanges, z as check } from "./src-BMrfSYwa.mjs";
-import { t as createWorkspace } from "./workspace-gtZ3m7LH.mjs";
-export { CONFIG_NAMES, HttpError, ReviewRefused, check, createWorkspace, describeChange, exportSite, fieldChanges, formatCsv, formatJson, formatTable, generateConfig, init, open, parseConfig, query, readsFile, templatePath, worthShowing };
+import { B as check, C as describeChange, K as DENIED_FILES, L as HttpError, T as worthShowing, U as parseConfig, V as CONFIG_NAMES, W as readsFile, X as fileGranted, Z as normalizeFilePath, a as query, c as exportSite, f as ReviewRefused, h as templatePath, i as formatTable, n as formatCsv, o as generateConfig, q as MAX_PAGE_FILE_BYTES, r as formatJson, s as init, t as open, w as fieldChanges } from "./src-ChJZPkg9.mjs";
+import { t as createWorkspace } from "./workspace-D7xHlBPc.mjs";
+export { CONFIG_NAMES, DENIED_FILES, HttpError, MAX_PAGE_FILE_BYTES, ReviewRefused, check, createWorkspace, describeChange, exportSite, fieldChanges, fileGranted, formatCsv, formatJson, formatTable, generateConfig, init, normalizeFilePath, open, parseConfig, query, readsFile, templatePath, worthShowing };

package/dist/{fs-DZ4QHM93.mjs → fs-BM30qNPb.mjs}

@@ -94,6 +94,7 @@ function realpathSync(p) {
 	get(abs(p), "realpath");
 	return abs(p);
 }
+realpathSync.native = realpathSync;
 function readFileSync(p, opts) {
 	const path = abs(p);
 	const e = get(path, "open");
@@ -199,6 +200,11 @@ function linkSync(from, to) {
 	tree.set(b, e);
 	emit("add", b);
 }
+function copyFileSync(from, to) {
+	const e = get(abs(from), "copyfile");
+	if (e.kind === "dir") fail("EISDIR", "illegal operation on a directory", "copyfile", abs(from));
+	writeFileSync(to, e.data);
+}
 function cpSync(from, to) {
 	const a = abs(from);
 	const b = abs(to);
@@ -230,6 +236,7 @@ var fs_default = {
 	accessSync,
 	chmodSync,
 	constants,
+	copyFileSync,
 	cpSync,
 	createReadStream,
 	existsSync,
@@ -248,4 +255,4 @@ var fs_default = {
 	writeFileSync
 };
 //#endregion
-export { writeFileSync as C, unlinkSync as S, realpathSync as _, createReadStream as a, rmdirSync as b, fs_default as c, mkdirSync as d, mkdtempSync as f, readdirSync as g, readFileSync as h, cpSync as i, linkSync as l, onRemove as m, chmodSync as n, existsSync as o, onChange as p, constants as r, external as s, accessSync as t, lstatSync as u, renameSync as v, statSync as x, rmSync as y };
+export { unlinkSync as C, statSync as S, readdirSync as _, cpSync as a, rmSync as b, external as c, lstatSync as d, mkdirSync as f, readFileSync as g, onRemove as h, copyFileSync as i, fs_default as l, onChange as m, chmodSync as n, createReadStream as o, mkdtempSync as p, constants as r, existsSync as s, accessSync as t, linkSync as u, realpathSync as v, writeFileSync as w, rmdirSync as x, renameSync as y };

package/dist/{index-OSyELQEX.d.mts → index-Bd2ctbJm.d.mts}

@@ -81,6 +81,7 @@ interface PageSpec {
   access: Record<string, PageAccess>;
   sql: boolean;
   network: string[];
+  files: Record<string, PageAccess>;
   ai: {
     maxOutputTokens: number;
   } | null;
@@ -268,6 +269,7 @@ interface ExportResult {
   warnings: Record<string, string[]>;
   pages: string[];
   skippedPages: Record<string, string>;
+  skippedFiles: Record<string, string>;
 }
 declare function exportSite(opts: ExportOptions): Promise<ExportResult>;
 //#endregion

package/dist/index.d.mts

@@ -1,2 +1,2 @@
-import { C as Decision, D as OpenOptions, F as ColumnType, H as IndexSpec, I as ConflictInfo, K as SchemaChange, N as Change, O as TableInput, P as ChangeOp, W as PageSpec, _ as check, a as formatCsv, b as Watcher, c as query, d as init, f as ExportOptions, g as CheckTable, h as CheckResult, i as QueryResult, l as InitOptions, m as exportSite, n as open, o as formatJson, p as ExportResult, q as TableSpec, r as QueryOptions, s as formatTable, t as Yamlite, u as generateConfig, v as WatchHandlers, x as TableResult, y as WatchOptions } from "./index-OSyELQEX.mjs";
+import { C as Decision, D as OpenOptions, F as ColumnType, H as IndexSpec, I as ConflictInfo, K as SchemaChange, N as Change, O as TableInput, P as ChangeOp, W as PageSpec, _ as check, a as formatCsv, b as Watcher, c as query, d as init, f as ExportOptions, g as CheckTable, h as CheckResult, i as QueryResult, l as InitOptions, m as exportSite, n as open, o as formatJson, p as ExportResult, q as TableSpec, r as QueryOptions, s as formatTable, t as Yamlite, u as generateConfig, v as WatchHandlers, x as TableResult, y as WatchOptions } from "./index-Bd2ctbJm.mjs";
 export { type Change, type ChangeOp, type CheckResult, type CheckTable, type ColumnType, type ConflictInfo, type Decision, type ExportOptions, type ExportResult, type IndexSpec, type InitOptions, type OpenOptions, type PageSpec, type QueryOptions, type QueryResult, type SchemaChange, type TableInput, type TableResult, type TableSpec, type WatchHandlers, type WatchOptions, type Watcher, Yamlite, check, exportSite, formatCsv, formatJson, formatTable, generateConfig, init, open, query };

package/dist/index.mjs

@@ -1 +1 @@
-export { z as check, c as exportSite, n as formatCsv, r as formatJson, i as formatTable, o as generateConfig, s as init, t as open, a as query } from "./src-BMrfSYwa.mjs";
+export { B as check, c as exportSite, n as formatCsv, r as formatJson, i as formatTable, o as generateConfig, s as init, t as open, a as query } from "./src-ChJZPkg9.mjs";