yamlite 0.40.0 → 0.41.0

package/README.md

@@ -255,28 +255,29 @@ pages:
     access: { tasks: write, people: read } # tables and views; nothing else is reachable
     sql: false # true allows SELECT over the names in access
     network: [] # origins the page may load scripts, styles, images and fonts from, and connect to
-    files: [.images/] # files the page may read with yamlite.file; a folder ends in /
+    files: { .images/: read, .uploads/: write } # files the page may read (yamlite.files.read) or also write (yamlite.files.write); a folder ends in /
     ai: true # lets the page call the host's AI model; { maxOutputTokens: 2048 } raises the default 1024 (at most 8192)
 ```
 
-Start from [`examples/pages/kanban.html`](examples/pages/kanban.html): copy it into `.pages/`, set `TABLE`, `KEY`, `GROUP` and `TITLE` at the top, and declare it as above. [`examples/pages/summary.html`](examples/pages/summary.html) shows a page that asks AI to summarize a record. [`examples/pages/gallery.html`](examples/pages/gallery.html) lists a table's `image` column and shows each file with `yamlite.file`.
+Start from [`examples/pages/kanban.html`](examples/pages/kanban.html): copy it into `.pages/`, set `TABLE`, `KEY`, `GROUP` and `TITLE` at the top, and declare it as above. [`examples/pages/summary.html`](examples/pages/summary.html) shows a page that asks AI to summarize a record. [`examples/pages/gallery.html`](examples/pages/gallery.html) lists a table's `image` column and shows each file with `yamlite.files.read`.
 
 To share a page with people who should see only that page, open it and click **Copy app link**. The link ends in `/-/apps/<name>/` and shows the page alone, with its own title and look: no sidebar, tables, SQL console, command menu or links into other records. Once there are edits, a bar at the bottom shows their count and **Send for review**; an embedding host can add its own controls at the left of that bar with the `appFooter` mount option. The part after `#` is where the page stands inside itself, which it sets with `yamlite.history`, so a reload, the back button and a copied address return there; changing it does not leave the app. It leaves the editor out of sight; it does not take it away, so anyone who removes `-/apps/<name>/` from the address can still reach the rest of the UI. With `serve`, the copied link has no token, and the login cookie is not sent when a link is opened from another site such as mail or chat: share `/-/apps/<name>/?token=…` instead, on the origin of the URL `serve` printed and with its token. `serve` is meant for trying an app out; to share one with a team, use a host that gives each viewer their own branch. An `export` has the same entry at `-/apps/<name>/` for each page it includes; open it with the trailing slash (static hosts add it), since without it the page's relative paths resolve one folder too high.
 
-| Call                                                                                             | Does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| ------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `await yamlite.ready`                                                                            | `{ page, title, access, sql, network, files, readOnly, ai }`; `ai` is `{ provider, models }` when the page has `ai` and the host holds a key, else `null`                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| `yamlite.rows(table, { filter, sort, search, limit, offset })`                                   | `{ rows, total }`, reads tables and views, same filters and search as the table screen; `limit` ≤ 500                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| `yamlite.get(table, key)`                                                                        | `{ row, file }`; tables only, a view gives 400                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| `yamlite.create(table, key, values)` / `update(table, key, values, base)` / `remove(table, key)` | needs `write`; `update` fails with status 409, `extra.stale` (the fields) and `extra.current` (their values now), if a field changed since `base`                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| `yamlite.sql(select)`                                                                            | needs `sql: true`; one SELECT over the names in `access`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| `await yamlite.file(path)`                                                                       | needs `path` to match one of the page's `files` and not be a denied path; resolves to a `Blob` typed by extension (`image/png`, `image/jpeg`, `image/webp`, `image/gif`, `image/svg+xml`, `application/pdf`, `text/plain`, otherwise `application/octet-stream`), for `URL.createObjectURL`. Files on the branch or commit the viewer has open, at most 10 MB; 403 when `path` matches no entry, 404 when there is no such file, 413 over the limit                                                                                                                                       |
-| `yamlite.on("change", ({ tables }) => …)`                                                        | called after a sync changes a table or view the page can read                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| `yamlite.theme` / `yamlite.on("theme", ({ theme }) => …)`                                        | the current theme (`light` or `dark`), and a call when it changes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| `yamlite.ai.generate({ system, prompt, schema, model, maxOutputTokens })`                        | needs `ai` (a page without it gets 403); `{ text }`, or `{ object }` matching `schema` (a JSON Schema). `prompt` is a string or a list of `{ role: "user" \| "assistant", content }`; `model` is one of `ready`'s `ai.models`, the first by default; `maxOutputTokens` may lower the page's limit. Runs on the host's key, never one from the page. Fails with 503 and `extra.code: "no_key"` when the host has no key, 429 with `extra.retryAfter` (seconds) when busy, and 502 when the provider fails: `extra.provider` is the provider id and the provider's own text is in `message` |
-| `yamlite.ai.stream({ system, prompt, model })`                                                   | the same without `schema`, as an async iterable of text deltas: `for await (const text of yamlite.ai.stream(…))`; leaving the loop early cancels the call                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| `yamlite.open(table, key)`                                                                       | opens the record in YAMLite's own form; tables only, a view gives 400                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| `yamlite.history`                                                                                | where the page stands inside itself, with the `history` package's shape (`location`, `push`, `replace`, `go`, `back`, `forward`, `listen`, `createHref`) that routers take; in an app it is kept after the `#` of the address, and `back` and `go` stay within the app. `push(to, state)` and `replace(to, state)` throw for a path outside the page or longer than 2048 characters; `state` must be structured-cloneable, and comes back as `location.state` on back and forward, and as JSON after a reload                                                                             |
+| Call                                                                                                           | Does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| -------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `await yamlite.ready`                                                                                          | `{ page, title, access, sql, network, files, readOnly, ai }`; `ai` is `{ provider, models }` when the page has `ai` and the host holds a key, else `null`                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| `yamlite.rows(table, { filter, sort, search, limit, offset })`                                                 | `{ rows, total }`, reads tables and views, same filters and search as the table screen; `limit` ≤ 500                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `yamlite.get(table, key)`                                                                                      | `{ row, file }`; tables only, a view gives 400                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `yamlite.create(table, key, values)` / `update(table, key, values, { base })` / `remove(table, key, { base })` | needs `write`; `base` is the record as the page last read it, or the fields of it the page relies on. `update` fails with status 409, `extra.stale` (the fields) and `extra.current` (the record now) if a field it saves changed since `base`; `remove` does if any field in `base` changed. Leaving `base` out skips the check                                                                                                                                                                                                                                                          |
+| `yamlite.sql(select)`                                                                                          | needs `sql: true`; one SELECT over the names in `access`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `await yamlite.files.read(path)`                                                                               | needs `path` to match one of the page's `files` entries (`read` or `write`) and not be a denied path; resolves to a `Blob` typed by extension (`image/png`, `image/jpeg`, `image/webp`, `image/gif`, `image/svg+xml`, `application/pdf`, `text/plain`, otherwise `application/octet-stream`), for `URL.createObjectURL`. Files on the branch or commit the viewer has open, at most 10 MB; 403 when `path` matches no entry, 404 when there is no such file, 413 over the limit                                                                                                           |
+| `await yamlite.files.write(path, blob, { base })` / `files.delete(path, { base })`                             | needs `path` to fall under a `write` entry; `write` stores a PNG, JPEG, GIF, WebP or PDF file (the bytes must match the extension, at most 10 MB), creating its folders, and resolves to `{ sha256 }`; `delete` removes the file. `base` is the `Blob` the page last got from `files.read`, the `sha256` its last `files.write` returned, or `null` when it expects no file there; when the file has changed since, the call fails with status 409 and `extra.current` (the SHA-256 of the content now; absent when the file is over 10 MB). Leaving `base` out skips the check           |
+| `yamlite.on("change", ({ tables, files }) => …)`                                                               | called after a sync changes a table or view the page can read (`tables`), or after a file under the page's `files` changes on disk (`files`, root-relative paths), whoever changed it                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `yamlite.theme` / `yamlite.on("theme", ({ theme }) => …)`                                                      | the current theme (`light` or `dark`), and a call when it changes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| `yamlite.ai.generate({ system, prompt, schema, model, maxOutputTokens })`                                      | needs `ai` (a page without it gets 403); `{ text }`, or `{ object }` matching `schema` (a JSON Schema). `prompt` is a string or a list of `{ role: "user" \| "assistant", content }`; `model` is one of `ready`'s `ai.models`, the first by default; `maxOutputTokens` may lower the page's limit. Runs on the host's key, never one from the page. Fails with 503 and `extra.code: "no_key"` when the host has no key, 429 with `extra.retryAfter` (seconds) when busy, and 502 when the provider fails: `extra.provider` is the provider id and the provider's own text is in `message` |
+| `yamlite.ai.stream({ system, prompt, model })`                                                                 | the same without `schema`, as an async iterable of text deltas: `for await (const text of yamlite.ai.stream(…))`; leaving the loop early cancels the call                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| `yamlite.open(table, key)`                                                                                     | opens the record in YAMLite's own form; tables only, a view gives 400                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `yamlite.history`                                                                                              | where the page stands inside itself, with the `history` package's shape (`location`, `push`, `replace`, `go`, `back`, `forward`, `listen`, `createHref`) that routers take; in an app it is kept after the `#` of the address, and `back` and `go` stay within the app. `push(to, state)` and `replace(to, state)` throw for a path outside the page or longer than 2048 characters; `state` must be structured-cloneable, and comes back as `location.state` on back and forward, and as JSON after a reload                                                                             |
 
 Errors reject with `yamlite.YamliteError` (`status`, `message`, `extra`).
 
@@ -305,7 +306,8 @@ The variable and class names are part of the page API: renaming one is a breakin
 - `network` is enforced with a Content Security Policy. It limits what the page loads and where it connects. Declaring an origin lets the page send data, including anything it can read through `access`, off your machine to that origin.
 - `ai` lets the page send anything it can read through `access` to the host's AI provider, billed to the host's key.
 - Every page, even with `network: []`, can leak data by navigating its own frame to another site with the data in the URL. YAMLite then disconnects the page, but the data has already left. Only declare pages you trust, as you would any script you run.
-- `files` is a read grant like `access`: the page can read every file under a declared folder, and anything a page can read can leave through navigation, as for records. An entry ending in `/` is a folder, any other entry one exact file; `..`, absolute paths and entries inside `.yamlite/` or naming `yamlite.yaml` are config errors. A page cannot read YAMLite's state folder, the database (and its `-wal`, `-shm` and `-journal` files) or the config files, whatever `files` says: a broad folder entry still gets 403 for them. Symlinks are followed and must stay inside a granted path.
+- `files` is a grant like `access`: each entry is `read` or `write`, the page can read every file under a declared folder, and anything a page can read can leave through navigation, as for records. An entry ending in `/` is a folder, any other entry one exact file; `..`, absolute paths and entries inside `.yamlite/` or naming `yamlite.yaml` are config errors, as is any level but `read` or `write`. A page cannot read YAMLite's state folder, the database (and its `-wal`, `-shm` and `-journal` files) or the config files, whatever `files` says: a broad folder entry still gets 403 for them. Symlinks are followed and must stay inside a granted path.
+- A `write` entry lets the page add, replace and delete files under it, but only pictures and PDFs whose bytes match their extension: never HTML, SVG or anything else that could run script where the files are later served. A page cannot write YAMLite's own files, or through a symlinked file; a symlinked folder must lead to a path the page may write. Written files land in the working tree like any other edit, so **Send for review** lists them. Grant `write` only on folders that hold nothing but what the page should manage.
 - `serve` reads the working tree, so a `files` entry also covers files git does not track, such as a local `.env` or build output. Declare folders that hold only what the page should show.
 - In an [export](#export) pages are read-only, and `access` does not hide data: the exported `db.sqlite` is downloadable, and `sql: true` reads every exported table. Pages whose `access` names a table left out of the export are skipped with a warning. An export also copies the files a page declares into `data/files/`, each stored with a `.bin` suffix so a host serves it as a download rather than as a page; deploying the export makes them public; a file over 10 MB is skipped with a warning.
 

package/dist/cli.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { B as check, I as createHandler, R as isLoopback, a as query, c as exportSite, i as formatTable, n as formatCsv, o as generateConfig, r as formatJson, s as init, t as open, z as loopbackHosts } from "./src-NOJw_gTE.mjs";
-import { n as guide, r as envKeys, t as createWorkspace } from "./workspace-Cp5-yHYp.mjs";
+import { B as check, I as createHandler, R as isLoopback, a as query, c as exportSite, i as formatTable, n as formatCsv, o as generateConfig, r as formatJson, s as init, t as open, z as loopbackHosts } from "./src-ChJZPkg9.mjs";
+import { n as guide, r as envKeys, t as createWorkspace } from "./workspace-D7xHlBPc.mjs";
 import { createRequire } from "node:module";
 import { relative, resolve } from "node:path";
 import { homedir } from "node:os";

package/dist/core.d.mts

@@ -1,4 +1,4 @@
-import { A as parseConfig, B as HistoryEntry, C as Decision, D as OpenOptions, E as DeclaredTable, F as ColumnType, G as Rec, H as IndexSpec, I as ConflictInfo, J as ViewRecord, K as SchemaChange, L as DbRow, M as Capture, N as Change, O as TableInput, P as ChangeOp, R as DbValue, S as BaseHashes, T as Config, U as PageAccess, V as HistoryPage, W as PageSpec, _ as check, a as formatCsv, b as Watcher, c as query, d as init, f as ExportOptions, g as CheckTable, h as CheckResult, i as QueryResult, j as readsFile, k as TableLocation, l as InitOptions, m as exportSite, n as open, o as formatJson, p as ExportResult, q as TableSpec, r as QueryOptions, s as formatTable, t as Yamlite, u as generateConfig, v as WatchHandlers, w as CONFIG_NAMES, x as TableResult, y as WatchOptions, z as FieldChange } from "./index-CDLxve55.mjs";
+import { A as parseConfig, B as HistoryEntry, C as Decision, D as OpenOptions, E as DeclaredTable, F as ColumnType, G as Rec, H as IndexSpec, I as ConflictInfo, J as ViewRecord, K as SchemaChange, L as DbRow, M as Capture, N as Change, O as TableInput, P as ChangeOp, R as DbValue, S as BaseHashes, T as Config, U as PageAccess, V as HistoryPage, W as PageSpec, _ as check, a as formatCsv, b as Watcher, c as query, d as init, f as ExportOptions, g as CheckTable, h as CheckResult, i as QueryResult, j as readsFile, k as TableLocation, l as InitOptions, m as exportSite, n as open, o as formatJson, p as ExportResult, q as TableSpec, r as QueryOptions, s as formatTable, t as Yamlite, u as generateConfig, v as WatchHandlers, w as CONFIG_NAMES, x as TableResult, y as WatchOptions, z as FieldChange } from "./index-Bd2ctbJm.mjs";
 import { DatabaseSync } from "node:sqlite";
 import { LanguageModel, ModelMessage } from "ai";
 //#region src/store.d.ts
@@ -59,7 +59,7 @@ interface PageRules {
   access: Record<string, PageAccess>;
   sql: boolean;
   network: string[];
-  files: string[];
+  files: Record<string, PageAccess>;
   ai: {
     maxOutputTokens: number;
   } | null;
@@ -67,7 +67,7 @@ interface PageRules {
 export declare const DENIED_FILES: string[];
 export declare const MAX_PAGE_FILE_BYTES = 10485760;
 export declare function normalizeFilePath(path: string): string | null;
-export declare const fileGranted: (files: string[], path: string) => boolean;
+export declare const fileGranted: (files: Record<string, PageAccess>, path: string) => boolean;
 //#endregion
 //#region src/agent/providers.d.ts
 interface Credentials {
@@ -349,6 +349,10 @@ type ServeEvent = {
   type: "page";
   at: string;
   pages: string[];
+} | {
+  type: "files";
+  at: string;
+  paths: string[];
 };
 //#endregion
 //#region src/serve/events.d.ts
@@ -364,6 +368,7 @@ declare class EventHub {
   warnings(): Record<string, string[]>;
   configError(): string | null;
   pagesChanged(pages: string[]): void;
+  filesChanged(paths: string[]): void;
   stream(signal: AbortSignal): ReadableStream<Uint8Array>;
   close(): void;
   private onSync;
@@ -520,10 +525,13 @@ interface ApiRequest {
 type Handler = (req: ApiRequest) => unknown;
 declare class Router {
   private readonly routes;
-  add(method: string, pattern: string, handler: Handler): this;
+  add(method: string, pattern: string, handler: Handler, opts?: {
+    maxBody?: number;
+  }): this;
   match(method: string, pathname: string): {
     handler: Handler;
     params: Record<string, string>;
+    maxBody: number;
   } | "method" | null;
   dispatch(request: Request): Promise<Response>;
 }

package/dist/core.mjs

@@ -1,3 +1,3 @@
-import { B as check, C as describeChange, J as fileGranted, K as DENIED_FILES, L as HttpError, T as worthShowing, U as parseConfig, V as CONFIG_NAMES, W as readsFile, Y as normalizeFilePath, a as query, c as exportSite, f as ReviewRefused, h as templatePath, i as formatTable, n as formatCsv, o as generateConfig, q as MAX_PAGE_FILE_BYTES, r as formatJson, s as init, t as open, w as fieldChanges } from "./src-NOJw_gTE.mjs";
-import { t as createWorkspace } from "./workspace-Cp5-yHYp.mjs";
+import { B as check, C as describeChange, K as DENIED_FILES, L as HttpError, T as worthShowing, U as parseConfig, V as CONFIG_NAMES, W as readsFile, X as fileGranted, Z as normalizeFilePath, a as query, c as exportSite, f as ReviewRefused, h as templatePath, i as formatTable, n as formatCsv, o as generateConfig, q as MAX_PAGE_FILE_BYTES, r as formatJson, s as init, t as open, w as fieldChanges } from "./src-ChJZPkg9.mjs";
+import { t as createWorkspace } from "./workspace-D7xHlBPc.mjs";
 export { CONFIG_NAMES, DENIED_FILES, HttpError, MAX_PAGE_FILE_BYTES, ReviewRefused, check, createWorkspace, describeChange, exportSite, fieldChanges, fileGranted, formatCsv, formatJson, formatTable, generateConfig, init, normalizeFilePath, open, parseConfig, query, readsFile, templatePath, worthShowing };

package/dist/{index-CDLxve55.d.mts → index-Bd2ctbJm.d.mts}

@@ -81,7 +81,7 @@ interface PageSpec {
   access: Record<string, PageAccess>;
   sql: boolean;
   network: string[];
-  files: string[];
+  files: Record<string, PageAccess>;
   ai: {
     maxOutputTokens: number;
   } | null;

package/dist/index.d.mts

@@ -1,2 +1,2 @@
-import { C as Decision, D as OpenOptions, F as ColumnType, H as IndexSpec, I as ConflictInfo, K as SchemaChange, N as Change, O as TableInput, P as ChangeOp, W as PageSpec, _ as check, a as formatCsv, b as Watcher, c as query, d as init, f as ExportOptions, g as CheckTable, h as CheckResult, i as QueryResult, l as InitOptions, m as exportSite, n as open, o as formatJson, p as ExportResult, q as TableSpec, r as QueryOptions, s as formatTable, t as Yamlite, u as generateConfig, v as WatchHandlers, x as TableResult, y as WatchOptions } from "./index-CDLxve55.mjs";
+import { C as Decision, D as OpenOptions, F as ColumnType, H as IndexSpec, I as ConflictInfo, K as SchemaChange, N as Change, O as TableInput, P as ChangeOp, W as PageSpec, _ as check, a as formatCsv, b as Watcher, c as query, d as init, f as ExportOptions, g as CheckTable, h as CheckResult, i as QueryResult, l as InitOptions, m as exportSite, n as open, o as formatJson, p as ExportResult, q as TableSpec, r as QueryOptions, s as formatTable, t as Yamlite, u as generateConfig, v as WatchHandlers, x as TableResult, y as WatchOptions } from "./index-Bd2ctbJm.mjs";
 export { type Change, type ChangeOp, type CheckResult, type CheckTable, type ColumnType, type ConflictInfo, type Decision, type ExportOptions, type ExportResult, type IndexSpec, type InitOptions, type OpenOptions, type PageSpec, type QueryOptions, type QueryResult, type SchemaChange, type TableInput, type TableResult, type TableSpec, type WatchHandlers, type WatchOptions, type Watcher, Yamlite, check, exportSite, formatCsv, formatJson, formatTable, generateConfig, init, open, query };

package/dist/index.mjs

@@ -1 +1 @@
-export { B as check, c as exportSite, n as formatCsv, r as formatJson, i as formatTable, o as generateConfig, s as init, t as open, a as query } from "./src-NOJw_gTE.mjs";
+export { B as check, c as exportSite, n as formatCsv, r as formatJson, i as formatTable, o as generateConfig, s as init, t as open, a as query } from "./src-ChJZPkg9.mjs";

package/dist/{src-NOJw_gTE.mjs → src-ChJZPkg9.mjs}

@@ -1129,8 +1129,10 @@ function normalizeFilePath(path) {
 	if (kept.length === 0) return null;
 	return kept.join("/") + (path.endsWith("/") ? "/" : "");
 }
-const fileGranted = (files, path) => files.some((entry) => entry.endsWith("/") ? path.startsWith(entry) : path === entry);
-const deniedFile = (path, denied) => fileGranted(denied.map((d) => d.toLowerCase()), path.toLowerCase());
+const entryCovers = (entry, path) => entry.endsWith("/") ? path.startsWith(entry) : path === entry;
+const fileGranted = (files, path) => Object.keys(files).some((entry) => entryCovers(entry, path));
+const fileWritable = (files, path) => Object.entries(files).some(([entry, level]) => level === "write" && entryCovers(entry, path));
+const deniedFile = (path, denied) => denied.some((d) => entryCovers(d.toLowerCase(), path.toLowerCase()));
 const CONTENT_TYPES = {
 	png: "image/png",
 	jpg: "image/jpeg",
@@ -1141,6 +1143,50 @@ const CONTENT_TYPES = {
 	pdf: "application/pdf",
 	txt: "text/plain"
 };
+const starts = (b, magic) => magic.every((m, i) => b[i] === m);
+const WRITABLE_TYPES = {
+	"image/png": (b) => starts(b, [
+		137,
+		80,
+		78,
+		71,
+		13,
+		10,
+		26,
+		10
+	]),
+	"image/jpeg": (b) => starts(b, [
+		255,
+		216,
+		255
+	]),
+	"image/gif": (b) => starts(b, [
+		71,
+		73,
+		70,
+		56
+	]),
+	"image/webp": (b) => starts(b, [
+		82,
+		73,
+		70,
+		70
+	]) && starts(b.subarray(8), [
+		87,
+		69,
+		66,
+		80
+	]),
+	"application/pdf": (b) => starts(b, [
+		37,
+		80,
+		68,
+		70,
+		45
+	])
+};
+const writableType = (path) => Object.hasOwn(WRITABLE_TYPES, contentTypeOf(path));
+const bytesMatchType = (path, bytes) => WRITABLE_TYPES[contentTypeOf(path)]?.(bytes) ?? false;
 function contentTypeOf(path) {
 	const ext = path.slice(path.lastIndexOf(".") + 1).toLowerCase();
 	return path.includes(".") && Object.hasOwn(CONTENT_TYPES, ext) ? CONTENT_TYPES[ext] : "application/octet-stream";
@@ -1686,14 +1732,18 @@ function toOrigin(where, raw) {
 	return url.origin;
 }
 function toFiles(where, raw) {
-	if (raw === void 0 || raw === null) return [];
-	if (!Array.isArray(raw)) throw new Error(`${where}files must be a list of root-relative files and folders`);
-	return raw.map((entry) => {
+	if (raw === void 0 || raw === null) return {};
+	if (typeof raw !== "object" || Array.isArray(raw)) throw new Error(`${where}files must map root-relative files and folders to read or write`);
+	const out = {};
+	for (const [entry, level] of Object.entries(raw)) {
 		const invalid = (why) => /* @__PURE__ */ new Error(`${where}files entry ${JSON.stringify(entry)} ${why}`);
-		if (typeof entry !== "string" || normalizeFilePath(entry) !== entry) throw invalid("must be a root-relative path without .., . or empty segments");
+		if (normalizeFilePath(entry) !== entry) throw invalid("must be a root-relative path without .., . or empty segments");
 		if (deniedFile(entry, DENIED_FILES)) throw invalid("is YAMLite's own and cannot be granted");
-		return entry;
-	});
+		if (level !== "read" && level !== "write") throw invalid("must be read or write");
+		if (level === "write" && !entry.endsWith("/") && !writableType(entry)) throw invalid("cannot be write: a page may write only PNG, JPEG, GIF, WebP or PDF files");
+		out[entry] = level;
+	}
+	return out;
 }
 function toPageAi(where, raw) {
 	if (raw === void 0 || raw === null || raw === false) return null;
@@ -3624,13 +3674,15 @@ var Reply = class {
 		this.body = body;
 	}
 };
+const MAX_BODY = 1048576;
 var Router = class {
 	routes = [];
-	add(method, pattern, handler) {
+	add(method, pattern, handler, opts = {}) {
 		this.routes.push({
 			method,
 			parts: pattern.split("/").filter(Boolean),
-			handler
+			handler,
+			maxBody: opts.maxBody ?? MAX_BODY
 		});
 		return this;
 	}
@@ -3656,7 +3708,8 @@ var Router = class {
 			}
 			return {
 				handler: route.handler,
-				params
+				params,
+				maxBody: route.maxBody
 			};
 		}
 		return wrongMethod ? "method" : null;
@@ -3670,7 +3723,7 @@ var Router = class {
 			let body;
 			if (request.method !== "GET" && request.method !== "HEAD") {
 				if (!/^application\/json\s*(;|$)/i.test(request.headers.get("content-type") ?? "")) throw new HttpError(415, "content-type must be application/json");
-				body = await readBody(request);
+				body = await readBody(request, match.maxBody);
 			}
 			const out = await match.handler({
 				params: match.params,
@@ -3707,10 +3760,9 @@ function sendJson(res, status, body) {
 	});
 	res.end(JSON.stringify(body, jsonReplacer$1));
 }
-const MAX_BODY = 1048576;
-async function readBody(request) {
+async function readBody(request, max) {
 	const tooLarge = () => new HttpError(413, "request body is too large");
-	if (Number(request.headers.get("content-length")) > MAX_BODY) throw tooLarge();
+	if (Number(request.headers.get("content-length")) > max) throw tooLarge();
 	const chunks = [];
 	let size = 0;
 	if (request.body) {
@@ -3719,7 +3771,7 @@ async function readBody(request) {
 			const { value, done } = await reader.read();
 			if (done) break;
 			size += value.length;
-			if (size > MAX_BODY) {
+			if (size > max) {
 				await reader.cancel().catch(() => {});
 				throw tooLarge();
 			}
@@ -4397,6 +4449,14 @@ var EventHub = class {
 		};
 		for (const res of this.clients.keys()) this.send(res, event.type, event);
 	}
+	filesChanged(paths) {
+		const event = {
+			type: "files",
+			at: now(),
+			paths
+		};
+		for (const res of this.clients.keys()) this.send(res, event.type, event);
+	}
 	stream(signal) {
 		let ctrl;
 		const drop = () => {
@@ -5015,17 +5075,13 @@ const rowRoutes = (router, ctx) => {
 		const key = params.key;
 		const b = objectBody(body, "body");
 		const values = objectBody(b.values, "values");
-		const base = objectBody(b.base, "base");
+		const base = baseOf$1(b.base);
 		noKeyIn(spec, values, "rename the record instead");
 		const { store } = ctx;
 		writeTx(store, () => {
 			const current = readRecord(store, spec, key);
 			if (!current) throw new HttpError(404, `no record "${key}" in ${spec.name}`);
-			const stale = Object.keys(values).filter((f) => canonical(own$1(current, f) ?? null) !== canonical(own$1(base, f) ?? null));
-			if (stale.length > 0) throw new HttpError(409, `changed since it was loaded: ${stale.join(", ")}`, {
-				current,
-				stale
-			});
+			if (base) assertFresh(current, base, Object.keys(values));
 			updateRecord(store, spec, key, values);
 		});
 		return { ok: true };
@@ -5046,13 +5102,31 @@ const rowRoutes = (router, ctx) => {
 		});
 		return { key: to };
 	});
-	router.add("DELETE", "/api/tables/:table/rows/:key", ({ params }) => {
+	router.add("DELETE", "/api/tables/:table/rows/:key", ({ params, body }) => {
 		ctx.proposals.assertIdle();
 		const spec = tableSpec(ctx, params.table);
-		writeTx(ctx.store, () => deleteRecord(ctx.store, spec, params.key));
+		const key = params.key;
+		const base = baseOf$1(body?.base);
+		const { store } = ctx;
+		writeTx(store, () => {
+			if (base) {
+				const current = readRecord(store, spec, key);
+				if (!current) throw new HttpError(404, `no record "${key}" in ${spec.name}`);
+				assertFresh(current, base, Object.keys(base));
+			}
+			deleteRecord(store, spec, key);
+		});
 		return { ok: true };
 	});
 };
+const baseOf$1 = (value) => value === void 0 ? null : objectBody(value, "base");
+function assertFresh(current, base, fields) {
+	const stale = fields.filter((f) => canonical(own$1(current, f) ?? null) !== canonical(own$1(base, f) ?? null));
+	if (stale.length > 0) throw new HttpError(409, `changed since it was loaded: ${stale.join(", ")}`, {
+		current,
+		stale
+	});
+}
 //#endregion
 //#region src/serve/routes/history.ts
 const CURSOR = /^\d+$/;
@@ -5676,7 +5750,7 @@ async function gitStatus(repo) {
 }
 async function gitDiff(repo, paths = []) {
 	const scope = paths.map((p) => {
-		const top = insideRoot(repo, p);
+		const top = insideRoot$1(repo, p);
 		if (top === null) throw new Error(`${p} must be inside the data folder`);
 		return top;
 	});
@@ -5737,7 +5811,7 @@ async function ghReady(env = process.env) {
 		return false;
 	}
 }
-function insideRoot(repo, path) {
+function insideRoot$1(repo, path) {
 	const abs = resolve(repo.root, path);
 	const rel = relative(repo.root, abs);
 	if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) return null;
@@ -5855,7 +5929,7 @@ async function branchName(repo, v, i) {
 }
 async function commitPath(repo, v, i) {
 	const p = text$1(v, "path", i);
-	const top = insideRoot(repo, p);
+	const top = insideRoot$1(repo, p);
 	if (top === null) throw new Error(`step ${i + 1}: ${p} must be inside the data folder`);
 	if (existsSync(resolve(repo.root, p))) return p;
 	try {
@@ -6003,7 +6077,7 @@ async function runOne(repo, s, gh) {
 			await g(["switch", s.branch]);
 			break;
 		case "commit": {
-			const tops = s.paths.map((p) => insideRoot(repo, p));
+			const tops = s.paths.map((p) => insideRoot$1(repo, p));
 			await g([
 				"add",
 				"-A",
@@ -6241,7 +6315,7 @@ async function localDriver(root, gh) {
 				changes: []
 			};
 			const s = await gitStatus(f.repo);
-			const changes = s.changes.filter((c) => insideRoot(f.repo, c.path) !== null).map((c) => ({
+			const changes = s.changes.filter((c) => insideRoot$1(f.repo, c.path) !== null).map((c) => ({
 				path: c.path,
 				status: changeStatus(c.status)
 			}));
@@ -6254,7 +6328,7 @@ async function localDriver(root, gh) {
 		defaultBranch: defaultName,
 		async baseContent(rootPath) {
 			const { repo } = await need();
-			const top = insideRoot(repo, rootPath);
+			const top = insideRoot$1(repo, rootPath);
 			if (top === null) return null;
 			try {
 				return await runGit(repo.top, ["show", `HEAD:${top}`]);
@@ -6342,7 +6416,7 @@ async function defaultRef(repo, name) {
 	throw new GitError(`the default branch ${name} is not in this clone`);
 }
 async function blobAt(repo, rev, rootPath) {
-	const top = insideRoot(repo, rootPath);
+	const top = insideRoot$1(repo, rootPath);
 	if (top === null) throw new GitError(`${rootPath} is outside the repository`);
 	let entry;
 	try {
@@ -6621,7 +6695,90 @@ function grantedFile(root, files, denied, path) {
 		size
 	};
 }
-const readGranted = (ctx, page, path) => readFileSync(grantedFile(ctx.root, page.files, ctx.deniedFiles, path).real);
+const MAX_WRITE_BODY = Math.ceil(MAX_PAGE_FILE_BYTES / 3) * 4 + 4096;
+const BASE64 = /^[A-Za-z0-9+/]*={0,2}$/;
+const insideRoot = (rel) => rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+function writeTarget(root, page, denied, path) {
+	const realRoot = realpathSync.native(root);
+	const parts = path.split("/");
+	let at = realRoot;
+	let i = 0;
+	for (; i < parts.length - 1; i++) {
+		const next = join(at, parts[i]);
+		try {
+			at = realpathSync.native(next);
+		} catch {
+			if (lstatOrNull(next)) throw new HttpError(409, `${parts.slice(0, i + 1).join("/")} is not a folder`);
+			break;
+		}
+		if (!statSync(at).isDirectory()) throw new HttpError(409, `${parts.slice(0, i + 1).join("/")} is not a folder`);
+	}
+	const target = join(at, ...parts.slice(i));
+	const rel = relative(realRoot, target);
+	const shown = rel.split(sep).join("/");
+	if (!insideRoot(rel) || !fileWritable(page.files, shown) || deniedFile(shown, denied)) throw new HttpError(403, `${path} leads outside the files this page may write`);
+	let isLink = false;
+	try {
+		const st = lstatSync(target);
+		isLink = st.isSymbolicLink();
+		if (!isLink && !st.isFile()) throw new HttpError(409, `${path} is not a file`);
+	} catch (e) {
+		if (e instanceof HttpError) throw e;
+	}
+	if (isLink) throw new HttpError(403, `${path} is a symlink; a page may not write through it`);
+	return target;
+}
+const lstatOrNull = (path) => lstatSync(path, { throwIfNoEntry: false }) ?? null;
+function readIfFile(path) {
+	const st = lstatOrNull(path);
+	if (!st?.isFile()) return null;
+	if (st.size > 10485760) return "too-large";
+	return readFileSync(path);
+}
+function baseOf(body) {
+	const base = body?.base;
+	if (base === void 0 || base === null) return base;
+	if (typeof base !== "string" || !/^[0-9a-f]{64}$/.test(base)) throw new HttpError(400, "base must be a SHA-256 hex digest or null");
+	return base;
+}
+async function hostedFile(ctx, target, path, signal) {
+	if (existsSync(target)) return null;
+	const hosted = await ctx.pageFiles?.(path, signal);
+	return hosted === void 0 || hosted === "missing" ? null : hosted;
+}
+function checkBase(target, path, base, hosted) {
+	const disk = readIfFile(target);
+	const current = disk ?? hosted;
+	const from = disk !== null ? "disk" : hosted !== null ? "host" : null;
+	if (base === void 0) return from;
+	if (current === "too-large") throw new HttpError(409, `${path} changed since the page read it`);
+	const now = current === null ? null : hashContent(current);
+	if (now !== base) throw new HttpError(409, `${path} changed since the page read it`, { current: now });
+	return from;
+}
+function writableRequest(ctx, params, query) {
+	const page = pageSpec(ctx, params.page);
+	const asked = query.get("path");
+	if (!asked) throw new HttpError(400, "path is required");
+	const path = normalizeFilePath(asked);
+	if (path === null || path.endsWith("/") || !fileWritable(page.files, path)) throw new HttpError(403, `${asked} is not in the files this page may write`);
+	if (deniedFile(path, ctx.deniedFiles)) throw new HttpError(403, `${asked} is YAMLite's own and no page may write it`);
+	return {
+		page,
+		path
+	};
+}
+function replaceFile(target, bytes) {
+	mkdirSync(dirname(target), { recursive: true });
+	const tmp = join(dirname(target), `.yamlite-${crypto.randomUUID()}.tmp`);
+	try {
+		writeFileSync(tmp, bytes);
+		renameSync(tmp, target);
+	} catch (e) {
+		rmSync(tmp, { force: true });
+		throw e;
+	}
+}
 const pageRoutes = (router, ctx) => {
 	router.add("GET", "/api/pages/:page/html", ({ params }) => {
 		const page = pageSpec(ctx, params.page);
@@ -6634,15 +6791,47 @@ const pageRoutes = (router, ctx) => {
 		const path = normalizeFilePath(asked);
 		if (path === null || !fileGranted(page.files, path)) throw new HttpError(403, `${asked} is not in this page's files`);
 		if (deniedFile(path, ctx.deniedFiles)) throw new HttpError(403, `${asked} is YAMLite's own and no page may read it`);
-		let bytes = await ctx.pageFiles?.(path, signal);
-		if (bytes === "missing") throw missing(path);
-		if (bytes === "too-large" || bytes !== void 0 && bytes.length > 10485760) throw tooLarge(path);
-		bytes ??= readGranted(ctx, page, path);
+		let bytes;
+		try {
+			bytes = readFileSync(grantedFile(ctx.root, page.files, ctx.deniedFiles, path).real);
+		} catch (e) {
+			if (!(e instanceof HttpError) || e.status !== 404) throw e;
+			const hosted = await ctx.pageFiles?.(path, signal);
+			if (hosted === void 0 || hosted === "missing") throw missing(path);
+			if (hosted === "too-large" || hosted.length > 10485760) throw tooLarge(path);
+			bytes = hosted;
+		}
 		return new Response(bytes, { headers: {
 			...FILE_HEADERS,
 			"content-type": contentTypeOf(path)
 		} });
 	});
+	router.add("PUT", "/api/pages/:page/file", async ({ params, query, body, signal }) => {
+		const { page, path } = writableRequest(ctx, params, query);
+		if (!writableType(path)) throw new HttpError(415, `${path}: a page may write only PNG, JPEG, GIF, WebP or PDF files`);
+		const data = body?.data;
+		if (typeof data !== "string" || !BASE64.test(data)) throw new HttpError(400, "data must be base64");
+		const bytes = Buffer.from(data, "base64");
+		if (bytes.length > 10485760) throw tooLarge(path);
+		if (!bytesMatchType(path, bytes)) throw new HttpError(415, `${path}: the content is not ${contentTypeOf(path)}`);
+		const base = baseOf(body);
+		const hosted = await hostedFile(ctx, writeTarget(ctx.root, page, ctx.deniedFiles, path), path, signal);
+		const target = writeTarget(ctx.root, page, ctx.deniedFiles, path);
+		checkBase(target, path, base, hosted);
+		replaceFile(target, bytes);
+		return { sha256: hashContent(bytes) };
+	}, { maxBody: MAX_WRITE_BODY });
+	router.add("DELETE", "/api/pages/:page/file", async ({ params, query, body, signal }) => {
+		const { page, path } = writableRequest(ctx, params, query);
+		const base = baseOf(body);
+		const hosted = await hostedFile(ctx, writeTarget(ctx.root, page, ctx.deniedFiles, path), path, signal);
+		const target = writeTarget(ctx.root, page, ctx.deniedFiles, path);
+		const from = checkBase(target, path, base, hosted);
+		if (from === null) throw missing(path);
+		if (from === "host") throw new HttpError(409, `${path} is kept by the host and cannot be deleted here`);
+		unlinkSync(target);
+		return { ok: true };
+	});
 };
 //#endregion
 //#region src/serve/routes/pageai.ts
@@ -7725,7 +7914,7 @@ function grantedCandidates(root, entries) {
 	return found;
 }
 function copyPageFiles(root, dir, grants, denied, skipped) {
-	for (const path of new Set(grantedCandidates(root, grants))) {
+	for (const path of new Set(grantedCandidates(root, Object.keys(grants)))) {
 		if (deniedFile(path, denied)) continue;
 		let real;
 		try {
@@ -7808,7 +7997,7 @@ async function writeSnapshotData(opts) {
 				}
 			}
 			const kept = new Set(pages.map(([name]) => name));
-			copyPageFiles(root, opts.dir, y.pages.filter((p) => kept.has(p.name)).flatMap((p) => p.files), ctx.deniedFiles, skippedFiles);
+			copyPageFiles(root, opts.dir, Object.assign({}, ...y.pages.filter((p) => kept.has(p.name)).map((p) => p.files)), ctx.deniedFiles, skippedFiles);
 			meta = {
 				...served,
 				root: basename(root),
@@ -8574,4 +8763,4 @@ async function open(options) {
 	};
 }
 //#endregion
-export { deniedFiles as A, check as B, describeChange as C, isRead as D, PageSql as E, Router as F, resolveConfig as G, configPath as H, createHandler as I, fileGranted as J, DENIED_FILES as K, HttpError as L, readRecord as M, assertSynced as N, statementCount as O, toWire as P, COLUMN_TYPES as Q, isLoopback as R, which as S, worthShowing as T, parseConfig as U, CONFIG_NAMES as V, readsFile as W, declaredViews as X, normalizeFilePath as Y, Store as Z, ghReady as _, query as a, gitLog as b, exportSite as c, validateNewTable as d, ReviewRefused as f, DIFF_LIMIT as g, templatePath as h, formatTable as i, ProposalStore as j, EventHub as k, ROUTES as l, STEP_KINDS as m, formatCsv as n, generateConfig as o, localDriver as p, MAX_PAGE_FILE_BYTES as q, formatJson as r, init as s, open as t, createTable as u, gitBranches as v, fieldChanges as w, gitStatus as x, gitDiff as y, loopbackHosts as z };
+export { Store as $, deniedFiles as A, check as B, describeChange as C, isRead as D, PageSql as E, Router as F, resolveConfig as G, configPath as H, createHandler as I, deniedFile as J, DENIED_FILES as K, HttpError as L, readRecord as M, assertSynced as N, statementCount as O, toWire as P, declaredViews as Q, isLoopback as R, which as S, worthShowing as T, parseConfig as U, CONFIG_NAMES as V, readsFile as W, fileGranted as X, entryCovers as Y, normalizeFilePath as Z, ghReady as _, query as a, gitLog as b, exportSite as c, validateNewTable as d, COLUMN_TYPES as et, ReviewRefused as f, DIFF_LIMIT as g, templatePath as h, formatTable as i, ProposalStore as j, EventHub as k, ROUTES as l, STEP_KINDS as m, formatCsv as n, generateConfig as o, localDriver as p, MAX_PAGE_FILE_BYTES as q, formatJson as r, init as s, open as t, createTable as u, gitBranches as v, fieldChanges as w, gitStatus as x, gitDiff as y, loopbackHosts as z };