yamlite 0.39.0 → 0.41.0

package/dist/{src-BMrfSYwa.mjs → src-ChJZPkg9.mjs}

@@ -1,5 +1,5 @@
 import { basename, delimiter, dirname, extname, isAbsolute, join, matchesGlob, normalize, posix, relative, resolve, sep } from "node:path";
-import { accessSync, chmodSync, constants, cpSync, createReadStream, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { accessSync, chmodSync, constants, copyFileSync, cpSync, createReadStream, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { Document, Scalar, isMap, isNode, isScalar, isSeq, parse, parseDocument, stringify } from "yaml";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
@@ -1105,6 +1105,12 @@ function reconcileViews(store, spec, apply) {
 }
 //#endregion
 //#region src/pages/access.ts
+const DENIED_FILES = [
+	".yamlite/",
+	"yamlite.yaml",
+	"yamlite.yml"
+];
+const MAX_PAGE_FILE_BYTES = 10485760;
 const PAGE_AI_DEFAULT_TOKENS = 1024;
 const PAGE_AI_MAX_TOKENS = 8192;
 const canRead = (page, name) => Object.hasOwn(page.access, name);
@@ -1115,6 +1121,76 @@ function trustedViews(page, views) {
 	for (const name of Object.keys(page.access)) for (let v = name; v !== void 0 && parentOf.has(v) && !trusted.has(v); v = parentOf.get(v)) trusted.add(v);
 	return trusted;
 }
+function normalizeFilePath(path) {
+	if (path.startsWith("/") || path.startsWith("\\") || /^[a-z]:/i.test(path)) return null;
+	const parts = path.split(/[\\/]/);
+	if (parts.includes("..")) return null;
+	const kept = parts.filter((p) => p !== "" && p !== ".");
+	if (kept.length === 0) return null;
+	return kept.join("/") + (path.endsWith("/") ? "/" : "");
+}
+const entryCovers = (entry, path) => entry.endsWith("/") ? path.startsWith(entry) : path === entry;
+const fileGranted = (files, path) => Object.keys(files).some((entry) => entryCovers(entry, path));
+const fileWritable = (files, path) => Object.entries(files).some(([entry, level]) => level === "write" && entryCovers(entry, path));
+const deniedFile = (path, denied) => denied.some((d) => entryCovers(d.toLowerCase(), path.toLowerCase()));
+const CONTENT_TYPES = {
+	png: "image/png",
+	jpg: "image/jpeg",
+	jpeg: "image/jpeg",
+	webp: "image/webp",
+	gif: "image/gif",
+	svg: "image/svg+xml",
+	pdf: "application/pdf",
+	txt: "text/plain"
+};
+const starts = (b, magic) => magic.every((m, i) => b[i] === m);
+const WRITABLE_TYPES = {
+	"image/png": (b) => starts(b, [
+		137,
+		80,
+		78,
+		71,
+		13,
+		10,
+		26,
+		10
+	]),
+	"image/jpeg": (b) => starts(b, [
+		255,
+		216,
+		255
+	]),
+	"image/gif": (b) => starts(b, [
+		71,
+		73,
+		70,
+		56
+	]),
+	"image/webp": (b) => starts(b, [
+		82,
+		73,
+		70,
+		70
+	]) && starts(b.subarray(8), [
+		87,
+		69,
+		66,
+		80
+	]),
+	"application/pdf": (b) => starts(b, [
+		37,
+		80,
+		68,
+		70,
+		45
+	])
+};
+const writableType = (path) => Object.hasOwn(WRITABLE_TYPES, contentTypeOf(path));
+const bytesMatchType = (path, bytes) => WRITABLE_TYPES[contentTypeOf(path)]?.(bytes) ?? false;
+function contentTypeOf(path) {
+	const ext = path.slice(path.lastIndexOf(".") + 1).toLowerCase();
+	return path.includes(".") && Object.hasOwn(CONTENT_TYPES, ext) ? CONTENT_TYPES[ext] : "application/octet-stream";
+}
 //#endregion
 //#region src/config.ts
 const CONFIG_NAMES = ["yamlite.yaml", "yamlite.yml"];
@@ -1639,6 +1715,7 @@ const PAGE_KEYS = [
 	"access",
 	"sql",
 	"network",
+	"files",
 	"ai"
 ];
 const PAGE_NAME = /^[a-z0-9][a-z0-9_-]*$/;
@@ -1654,6 +1731,20 @@ function toOrigin(where, raw) {
 	if (url.protocol !== "https:" && url.protocol !== "http:" || raw.replace(/\/$/, "") !== url.origin) throw invalid();
 	return url.origin;
 }
+function toFiles(where, raw) {
+	if (raw === void 0 || raw === null) return {};
+	if (typeof raw !== "object" || Array.isArray(raw)) throw new Error(`${where}files must map root-relative files and folders to read or write`);
+	const out = {};
+	for (const [entry, level] of Object.entries(raw)) {
+		const invalid = (why) => /* @__PURE__ */ new Error(`${where}files entry ${JSON.stringify(entry)} ${why}`);
+		if (normalizeFilePath(entry) !== entry) throw invalid("must be a root-relative path without .., . or empty segments");
+		if (deniedFile(entry, DENIED_FILES)) throw invalid("is YAMLite's own and cannot be granted");
+		if (level !== "read" && level !== "write") throw invalid("must be read or write");
+		if (level === "write" && !entry.endsWith("/") && !writableType(entry)) throw invalid("cannot be write: a page may write only PNG, JPEG, GIF, WebP or PDF files");
+		out[entry] = level;
+	}
+	return out;
+}
 function toPageAi(where, raw) {
 	if (raw === void 0 || raw === null || raw === false) return null;
 	if (raw === true) return { maxOutputTokens: PAGE_AI_DEFAULT_TOKENS };
@@ -1694,6 +1785,7 @@ function toPages(raw, place) {
 			access,
 			sql: v.sql === true,
 			network: (v.network ?? []).map((o) => toOrigin(where, o)),
+			files: toFiles(where, v.files),
 			ai: toPageAi(where, v.ai)
 		};
 	});
@@ -3582,13 +3674,15 @@ var Reply = class {
 		this.body = body;
 	}
 };
+const MAX_BODY = 1048576;
 var Router = class {
 	routes = [];
-	add(method, pattern, handler) {
+	add(method, pattern, handler, opts = {}) {
 		this.routes.push({
 			method,
 			parts: pattern.split("/").filter(Boolean),
-			handler
+			handler,
+			maxBody: opts.maxBody ?? MAX_BODY
 		});
 		return this;
 	}
@@ -3614,7 +3708,8 @@ var Router = class {
 			}
 			return {
 				handler: route.handler,
-				params
+				params,
+				maxBody: route.maxBody
 			};
 		}
 		return wrongMethod ? "method" : null;
@@ -3628,7 +3723,7 @@ var Router = class {
 			let body;
 			if (request.method !== "GET" && request.method !== "HEAD") {
 				if (!/^application\/json\s*(;|$)/i.test(request.headers.get("content-type") ?? "")) throw new HttpError(415, "content-type must be application/json");
-				body = await readBody(request);
+				body = await readBody(request, match.maxBody);
 			}
 			const out = await match.handler({
 				params: match.params,
@@ -3665,10 +3760,9 @@ function sendJson(res, status, body) {
 	});
 	res.end(JSON.stringify(body, jsonReplacer$1));
 }
-const MAX_BODY = 1048576;
-async function readBody(request) {
+async function readBody(request, max) {
 	const tooLarge = () => new HttpError(413, "request body is too large");
-	if (Number(request.headers.get("content-length")) > MAX_BODY) throw tooLarge();
+	if (Number(request.headers.get("content-length")) > max) throw tooLarge();
 	const chunks = [];
 	let size = 0;
 	if (request.body) {
@@ -3677,7 +3771,7 @@ async function readBody(request) {
 			const { value, done } = await reader.read();
 			if (done) break;
 			size += value.length;
-			if (size > MAX_BODY) {
+			if (size > max) {
 				await reader.cancel().catch(() => {});
 				throw tooLarge();
 			}
@@ -4238,6 +4332,37 @@ var ProposalStore = class {
 };
 //#endregion
 //#region src/serve/context.ts
+function onDisk(path) {
+	try {
+		return realpathSync.native(path);
+	} catch {
+		try {
+			return join(realpathSync.native(dirname(path)), basename(path));
+		} catch {
+			return path;
+		}
+	}
+}
+function deniedFiles(root, stateDir, dbPath) {
+	const base = onDisk(root);
+	const inside = (path) => {
+		const rel = relative(base, path);
+		return rel === "" || rel.startsWith("..") || isAbsolute(rel) ? null : rel.split(sep).join("/");
+	};
+	const state = inside(onDisk(stateDir));
+	const given = inside(join(onDisk(dirname(dbPath)), basename(dbPath)));
+	const dbs = [.../* @__PURE__ */ new Set([given, inside(onDisk(dbPath))])].filter((db) => db !== null);
+	return [
+		...DENIED_FILES,
+		...state === null ? [] : [`${state}/`],
+		...dbs.flatMap((db) => [
+			db,
+			`${db}-wal`,
+			`${db}-shm`,
+			`${db}-journal`
+		])
+	];
+}
 function displayPath$1(root, path) {
 	const rel = relative(root, path);
 	return rel === "" || rel.startsWith("..") ? path : rel;
@@ -4324,6 +4449,14 @@ var EventHub = class {
 		};
 		for (const res of this.clients.keys()) this.send(res, event.type, event);
 	}
+	filesChanged(paths) {
+		const event = {
+			type: "files",
+			at: now(),
+			paths
+		};
+		for (const res of this.clients.keys()) this.send(res, event.type, event);
+	}
 	stream(signal) {
 		let ctrl;
 		const drop = () => {
@@ -4942,17 +5075,13 @@ const rowRoutes = (router, ctx) => {
 		const key = params.key;
 		const b = objectBody(body, "body");
 		const values = objectBody(b.values, "values");
-		const base = objectBody(b.base, "base");
+		const base = baseOf$1(b.base);
 		noKeyIn(spec, values, "rename the record instead");
 		const { store } = ctx;
 		writeTx(store, () => {
 			const current = readRecord(store, spec, key);
 			if (!current) throw new HttpError(404, `no record "${key}" in ${spec.name}`);
-			const stale = Object.keys(values).filter((f) => canonical(own$1(current, f) ?? null) !== canonical(own$1(base, f) ?? null));
-			if (stale.length > 0) throw new HttpError(409, `changed since it was loaded: ${stale.join(", ")}`, {
-				current,
-				stale
-			});
+			if (base) assertFresh(current, base, Object.keys(values));
 			updateRecord(store, spec, key, values);
 		});
 		return { ok: true };
@@ -4973,13 +5102,31 @@ const rowRoutes = (router, ctx) => {
 		});
 		return { key: to };
 	});
-	router.add("DELETE", "/api/tables/:table/rows/:key", ({ params }) => {
+	router.add("DELETE", "/api/tables/:table/rows/:key", ({ params, body }) => {
 		ctx.proposals.assertIdle();
 		const spec = tableSpec(ctx, params.table);
-		writeTx(ctx.store, () => deleteRecord(ctx.store, spec, params.key));
+		const key = params.key;
+		const base = baseOf$1(body?.base);
+		const { store } = ctx;
+		writeTx(store, () => {
+			if (base) {
+				const current = readRecord(store, spec, key);
+				if (!current) throw new HttpError(404, `no record "${key}" in ${spec.name}`);
+				assertFresh(current, base, Object.keys(base));
+			}
+			deleteRecord(store, spec, key);
+		});
 		return { ok: true };
 	});
 };
+const baseOf$1 = (value) => value === void 0 ? null : objectBody(value, "base");
+function assertFresh(current, base, fields) {
+	const stale = fields.filter((f) => canonical(own$1(current, f) ?? null) !== canonical(own$1(base, f) ?? null));
+	if (stale.length > 0) throw new HttpError(409, `changed since it was loaded: ${stale.join(", ")}`, {
+		current,
+		stale
+	});
+}
 //#endregion
 //#region src/serve/routes/history.ts
 const CURSOR = /^\d+$/;
@@ -5603,7 +5750,7 @@ async function gitStatus(repo) {
 }
 async function gitDiff(repo, paths = []) {
 	const scope = paths.map((p) => {
-		const top = insideRoot(repo, p);
+		const top = insideRoot$1(repo, p);
 		if (top === null) throw new Error(`${p} must be inside the data folder`);
 		return top;
 	});
@@ -5664,7 +5811,7 @@ async function ghReady(env = process.env) {
 		return false;
 	}
 }
-function insideRoot(repo, path) {
+function insideRoot$1(repo, path) {
 	const abs = resolve(repo.root, path);
 	const rel = relative(repo.root, abs);
 	if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) return null;
@@ -5782,7 +5929,7 @@ async function branchName(repo, v, i) {
 }
 async function commitPath(repo, v, i) {
 	const p = text$1(v, "path", i);
-	const top = insideRoot(repo, p);
+	const top = insideRoot$1(repo, p);
 	if (top === null) throw new Error(`step ${i + 1}: ${p} must be inside the data folder`);
 	if (existsSync(resolve(repo.root, p))) return p;
 	try {
@@ -5930,7 +6077,7 @@ async function runOne(repo, s, gh) {
 			await g(["switch", s.branch]);
 			break;
 		case "commit": {
-			const tops = s.paths.map((p) => insideRoot(repo, p));
+			const tops = s.paths.map((p) => insideRoot$1(repo, p));
 			await g([
 				"add",
 				"-A",
@@ -6168,7 +6315,7 @@ async function localDriver(root, gh) {
 				changes: []
 			};
 			const s = await gitStatus(f.repo);
-			const changes = s.changes.filter((c) => insideRoot(f.repo, c.path) !== null).map((c) => ({
+			const changes = s.changes.filter((c) => insideRoot$1(f.repo, c.path) !== null).map((c) => ({
 				path: c.path,
 				status: changeStatus(c.status)
 			}));
@@ -6181,7 +6328,7 @@ async function localDriver(root, gh) {
 		defaultBranch: defaultName,
 		async baseContent(rootPath) {
 			const { repo } = await need();
-			const top = insideRoot(repo, rootPath);
+			const top = insideRoot$1(repo, rootPath);
 			if (top === null) return null;
 			try {
 				return await runGit(repo.top, ["show", `HEAD:${top}`]);
@@ -6269,7 +6416,7 @@ async function defaultRef(repo, name) {
 	throw new GitError(`the default branch ${name} is not in this clone`);
 }
 async function blobAt(repo, rev, rootPath) {
-	const top = insideRoot(repo, rootPath);
+	const top = insideRoot$1(repo, rootPath);
 	if (top === null) throw new GitError(`${rootPath} is outside the repository`);
 	let entry;
 	try {
@@ -6520,11 +6667,171 @@ function pageSpec(ctx, name) {
 	if (!page) throw new HttpError(404, `unknown page: ${name}`);
 	return page;
 }
+const FILE_HEADERS = {
+	"cache-control": "no-store",
+	"x-content-type-options": "nosniff",
+	"content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; sandbox"
+};
+const tooLarge = (path) => new HttpError(413, `${path} is larger than 10 MB`);
+const missing = (path) => new HttpError(404, `file not found: ${path}`);
+function grantedFile(root, files, denied, path) {
+	let real;
+	let size;
+	try {
+		real = realpathSync.native(join(root, path));
+		const st = statSync(real);
+		if (!st.isFile()) throw missing(path);
+		size = st.size;
+	} catch (e) {
+		if (e instanceof HttpError) throw e;
+		throw missing(path);
+	}
+	const rel = relative(realpathSync.native(root), real);
+	const shown = rel.split(sep).join("/");
+	if (rel.startsWith("..") || isAbsolute(rel) || !fileGranted(files, shown) || deniedFile(shown, denied)) throw new HttpError(403, `${path} leads outside this page's files`);
+	if (size > 10485760) throw tooLarge(path);
+	return {
+		real,
+		size
+	};
+}
+const MAX_WRITE_BODY = Math.ceil(MAX_PAGE_FILE_BYTES / 3) * 4 + 4096;
+const BASE64 = /^[A-Za-z0-9+/]*={0,2}$/;
+const insideRoot = (rel) => rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+function writeTarget(root, page, denied, path) {
+	const realRoot = realpathSync.native(root);
+	const parts = path.split("/");
+	let at = realRoot;
+	let i = 0;
+	for (; i < parts.length - 1; i++) {
+		const next = join(at, parts[i]);
+		try {
+			at = realpathSync.native(next);
+		} catch {
+			if (lstatOrNull(next)) throw new HttpError(409, `${parts.slice(0, i + 1).join("/")} is not a folder`);
+			break;
+		}
+		if (!statSync(at).isDirectory()) throw new HttpError(409, `${parts.slice(0, i + 1).join("/")} is not a folder`);
+	}
+	const target = join(at, ...parts.slice(i));
+	const rel = relative(realRoot, target);
+	const shown = rel.split(sep).join("/");
+	if (!insideRoot(rel) || !fileWritable(page.files, shown) || deniedFile(shown, denied)) throw new HttpError(403, `${path} leads outside the files this page may write`);
+	let isLink = false;
+	try {
+		const st = lstatSync(target);
+		isLink = st.isSymbolicLink();
+		if (!isLink && !st.isFile()) throw new HttpError(409, `${path} is not a file`);
+	} catch (e) {
+		if (e instanceof HttpError) throw e;
+	}
+	if (isLink) throw new HttpError(403, `${path} is a symlink; a page may not write through it`);
+	return target;
+}
+const lstatOrNull = (path) => lstatSync(path, { throwIfNoEntry: false }) ?? null;
+function readIfFile(path) {
+	const st = lstatOrNull(path);
+	if (!st?.isFile()) return null;
+	if (st.size > 10485760) return "too-large";
+	return readFileSync(path);
+}
+function baseOf(body) {
+	const base = body?.base;
+	if (base === void 0 || base === null) return base;
+	if (typeof base !== "string" || !/^[0-9a-f]{64}$/.test(base)) throw new HttpError(400, "base must be a SHA-256 hex digest or null");
+	return base;
+}
+async function hostedFile(ctx, target, path, signal) {
+	if (existsSync(target)) return null;
+	const hosted = await ctx.pageFiles?.(path, signal);
+	return hosted === void 0 || hosted === "missing" ? null : hosted;
+}
+function checkBase(target, path, base, hosted) {
+	const disk = readIfFile(target);
+	const current = disk ?? hosted;
+	const from = disk !== null ? "disk" : hosted !== null ? "host" : null;
+	if (base === void 0) return from;
+	if (current === "too-large") throw new HttpError(409, `${path} changed since the page read it`);
+	const now = current === null ? null : hashContent(current);
+	if (now !== base) throw new HttpError(409, `${path} changed since the page read it`, { current: now });
+	return from;
+}
+function writableRequest(ctx, params, query) {
+	const page = pageSpec(ctx, params.page);
+	const asked = query.get("path");
+	if (!asked) throw new HttpError(400, "path is required");
+	const path = normalizeFilePath(asked);
+	if (path === null || path.endsWith("/") || !fileWritable(page.files, path)) throw new HttpError(403, `${asked} is not in the files this page may write`);
+	if (deniedFile(path, ctx.deniedFiles)) throw new HttpError(403, `${asked} is YAMLite's own and no page may write it`);
+	return {
+		page,
+		path
+	};
+}
+function replaceFile(target, bytes) {
+	mkdirSync(dirname(target), { recursive: true });
+	const tmp = join(dirname(target), `.yamlite-${crypto.randomUUID()}.tmp`);
+	try {
+		writeFileSync(tmp, bytes);
+		renameSync(tmp, target);
+	} catch (e) {
+		rmSync(tmp, { force: true });
+		throw e;
+	}
+}
 const pageRoutes = (router, ctx) => {
 	router.add("GET", "/api/pages/:page/html", ({ params }) => {
 		const page = pageSpec(ctx, params.page);
 		return { html: readPageHtml(page.path, displayPath$1(ctx.root, page.path)) };
 	});
+	router.add("GET", "/api/pages/:page/file", async ({ params, query, signal }) => {
+		const page = pageSpec(ctx, params.page);
+		const asked = query.get("path");
+		if (!asked) throw new HttpError(400, "path is required");
+		const path = normalizeFilePath(asked);
+		if (path === null || !fileGranted(page.files, path)) throw new HttpError(403, `${asked} is not in this page's files`);
+		if (deniedFile(path, ctx.deniedFiles)) throw new HttpError(403, `${asked} is YAMLite's own and no page may read it`);
+		let bytes;
+		try {
+			bytes = readFileSync(grantedFile(ctx.root, page.files, ctx.deniedFiles, path).real);
+		} catch (e) {
+			if (!(e instanceof HttpError) || e.status !== 404) throw e;
+			const hosted = await ctx.pageFiles?.(path, signal);
+			if (hosted === void 0 || hosted === "missing") throw missing(path);
+			if (hosted === "too-large" || hosted.length > 10485760) throw tooLarge(path);
+			bytes = hosted;
+		}
+		return new Response(bytes, { headers: {
+			...FILE_HEADERS,
+			"content-type": contentTypeOf(path)
+		} });
+	});
+	router.add("PUT", "/api/pages/:page/file", async ({ params, query, body, signal }) => {
+		const { page, path } = writableRequest(ctx, params, query);
+		if (!writableType(path)) throw new HttpError(415, `${path}: a page may write only PNG, JPEG, GIF, WebP or PDF files`);
+		const data = body?.data;
+		if (typeof data !== "string" || !BASE64.test(data)) throw new HttpError(400, "data must be base64");
+		const bytes = Buffer.from(data, "base64");
+		if (bytes.length > 10485760) throw tooLarge(path);
+		if (!bytesMatchType(path, bytes)) throw new HttpError(415, `${path}: the content is not ${contentTypeOf(path)}`);
+		const base = baseOf(body);
+		const hosted = await hostedFile(ctx, writeTarget(ctx.root, page, ctx.deniedFiles, path), path, signal);
+		const target = writeTarget(ctx.root, page, ctx.deniedFiles, path);
+		checkBase(target, path, base, hosted);
+		replaceFile(target, bytes);
+		return { sha256: hashContent(bytes) };
+	}, { maxBody: MAX_WRITE_BODY });
+	router.add("DELETE", "/api/pages/:page/file", async ({ params, query, body, signal }) => {
+		const { page, path } = writableRequest(ctx, params, query);
+		const base = baseOf(body);
+		const hosted = await hostedFile(ctx, writeTarget(ctx.root, page, ctx.deniedFiles, path), path, signal);
+		const target = writeTarget(ctx.root, page, ctx.deniedFiles, path);
+		const from = checkBase(target, path, base, hosted);
+		if (from === null) throw missing(path);
+		if (from === "host") throw new HttpError(409, `${path} is kept by the host and cannot be deleted here`);
+		unlinkSync(target);
+		return { ok: true };
+	});
 };
 //#endregion
 //#region src/serve/routes/pageai.ts
@@ -7077,6 +7384,7 @@ const metaRoutes = (router, ctx) => {
 			access: p.access,
 			sql: p.sql,
 			network: p.network,
+			files: p.files,
 			ai: p.ai
 		})),
 		views: ctx.y.tables.flatMap((t) => declaredViews(t).map(({ spec, parent, depth, path }) => {
@@ -7586,6 +7894,40 @@ function warningScrubber(root, specPaths) {
 		return name === "" ? out : out.split(root).join(name);
 	};
 }
+function grantedCandidates(root, entries) {
+	const found = [];
+	const walk = (rel) => {
+		let items;
+		try {
+			items = readdirSync(join(root, rel), { withFileTypes: true });
+		} catch {
+			return;
+		}
+		for (const item of items) {
+			const path = `${rel}${item.name}`;
+			if (item.isDirectory()) walk(`${path}/`);
+			else found.push(path);
+		}
+	};
+	for (const entry of entries) if (entry.endsWith("/")) walk(entry);
+	else found.push(entry);
+	return found;
+}
+function copyPageFiles(root, dir, grants, denied, skipped) {
+	for (const path of new Set(grantedCandidates(root, Object.keys(grants)))) {
+		if (deniedFile(path, denied)) continue;
+		let real;
+		try {
+			real = grantedFile(root, grants, denied, path).real;
+		} catch (e) {
+			if (e instanceof HttpError && e.status === 413) skipped[path] = "is larger than 10 MB";
+			continue;
+		}
+		const dest = join(dir, "data", "files", `${path}.bin`);
+		mkdirSync(dirname(dest), { recursive: true });
+		copyFileSync(real, dest);
+	}
+}
 const writeJson = (path, value) => writeFileSync(path, JSON.stringify(value));
 async function writeSnapshotData(opts) {
 	const root = resolve(opts.root);
@@ -7597,6 +7939,7 @@ async function writeSnapshotData(opts) {
 		const yaml = [];
 		const pages = [];
 		const skippedPages = {};
+		const skippedFiles = {};
 		const all = y.tables.map((t) => t.name);
 		const unknown = (opts.tables ?? []).filter((n) => !all.includes(n));
 		if (unknown.length > 0) throw new Error(`unknown table: ${unknown.join(", ")}`);
@@ -7621,6 +7964,8 @@ async function writeSnapshotData(opts) {
 				agent: null,
 				git: null,
 				reloadConfig: () => {},
+				pageFiles: null,
+				deniedFiles: deniedFiles(root, stateDir, dbPath),
 				proposals: new ProposalStore({
 					store,
 					dry: store,
@@ -7652,6 +7997,7 @@ async function writeSnapshotData(opts) {
 				}
 			}
 			const kept = new Set(pages.map(([name]) => name));
+			copyPageFiles(root, opts.dir, Object.assign({}, ...y.pages.filter((p) => kept.has(p.name)).map((p) => p.files)), ctx.deniedFiles, skippedFiles);
 			meta = {
 				...served,
 				root: basename(root),
@@ -7722,7 +8068,8 @@ async function writeSnapshotData(opts) {
 			tables: selected,
 			warnings,
 			pages: pages.map(([name]) => name),
-			skippedPages
+			skippedPages,
+			skippedFiles
 		};
 	});
 }
@@ -7810,7 +8157,7 @@ async function exportSite(opts) {
 		if (!html.includes("<head>")) throw new Error(`${indexPath} has no <head>`);
 		const index = html.replace("<head>", `<head>\n    ${STATIC_META}\n    ${FILE_GUARD}`);
 		writeFileSync(join(staging, "index.html"), index);
-		const { tables, warnings, pages, skippedPages } = await writeSnapshotData({
+		const { tables, warnings, pages, skippedPages, skippedFiles } = await writeSnapshotData({
 			root: opts.root,
 			tables: opts.tables,
 			dir: staging,
@@ -7839,7 +8186,8 @@ async function exportSite(opts) {
 			tables,
 			warnings,
 			pages,
-			skippedPages
+			skippedPages,
+			skippedFiles
 		};
 	} catch (e) {
 		rmSync(staging, {
@@ -8415,4 +8763,4 @@ async function open(options) {
 	};
 }
 //#endregion
-export { ProposalStore as A, CONFIG_NAMES as B, describeChange as C, isRead as D, PageSql as E, createHandler as F, declaredViews as G, parseConfig as H, HttpError as I, Store as K, isLoopback as L, assertSynced as M, toWire as N, statementCount as O, Router as P, loopbackHosts as R, which as S, worthShowing as T, readsFile as U, configPath as V, resolveConfig as W, ghReady as _, query as a, gitLog as b, exportSite as c, validateNewTable as d, ReviewRefused as f, DIFF_LIMIT as g, templatePath as h, formatTable as i, readRecord as j, EventHub as k, ROUTES as l, STEP_KINDS as m, formatCsv as n, generateConfig as o, localDriver as p, COLUMN_TYPES as q, formatJson as r, init as s, open as t, createTable as u, gitBranches as v, fieldChanges as w, gitStatus as x, gitDiff as y, check as z };
+export { Store as $, deniedFiles as A, check as B, describeChange as C, isRead as D, PageSql as E, Router as F, resolveConfig as G, configPath as H, createHandler as I, deniedFile as J, DENIED_FILES as K, HttpError as L, readRecord as M, assertSynced as N, statementCount as O, toWire as P, declaredViews as Q, isLoopback as R, which as S, worthShowing as T, parseConfig as U, CONFIG_NAMES as V, readsFile as W, fileGranted as X, entryCovers as Y, normalizeFilePath as Z, ghReady as _, query as a, gitLog as b, exportSite as c, validateNewTable as d, COLUMN_TYPES as et, ReviewRefused as f, DIFF_LIMIT as g, templatePath as h, formatTable as i, ProposalStore as j, EventHub as k, ROUTES as l, STEP_KINDS as m, formatCsv as n, generateConfig as o, localDriver as p, MAX_PAGE_FILE_BYTES as q, formatJson as r, init as s, open as t, createTable as u, gitBranches as v, fieldChanges as w, gitStatus as x, gitDiff as y, loopbackHosts as z };