yamlite 0.40.0 → 0.41.1

package/dist/cli.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { B as check, I as createHandler, R as isLoopback, a as query, c as exportSite, i as formatTable, n as formatCsv, o as generateConfig, r as formatJson, s as init, t as open, z as loopbackHosts } from "./src-NOJw_gTE.mjs";
-import { n as guide, r as envKeys, t as createWorkspace } from "./workspace-Cp5-yHYp.mjs";
+import { B as check, I as createHandler, R as isLoopback, a as query, c as exportSite, i as formatTable, n as formatCsv, o as generateConfig, r as formatJson, s as init, t as open, z as loopbackHosts } from "./src-ChJZPkg9.mjs";
+import { n as guide, r as envKeys, t as createWorkspace } from "./workspace-D7xHlBPc.mjs";
 import { createRequire } from "node:module";
 import { relative, resolve } from "node:path";
 import { homedir } from "node:os";

package/dist/core.d.mts

@@ -1,4 +1,4 @@
-import { A as parseConfig, B as HistoryEntry, C as Decision, D as OpenOptions, E as DeclaredTable, F as ColumnType, G as Rec, H as IndexSpec, I as ConflictInfo, J as ViewRecord, K as SchemaChange, L as DbRow, M as Capture, N as Change, O as TableInput, P as ChangeOp, R as DbValue, S as BaseHashes, T as Config, U as PageAccess, V as HistoryPage, W as PageSpec, _ as check, a as formatCsv, b as Watcher, c as query, d as init, f as ExportOptions, g as CheckTable, h as CheckResult, i as QueryResult, j as readsFile, k as TableLocation, l as InitOptions, m as exportSite, n as open, o as formatJson, p as ExportResult, q as TableSpec, r as QueryOptions, s as formatTable, t as Yamlite, u as generateConfig, v as WatchHandlers, w as CONFIG_NAMES, x as TableResult, y as WatchOptions, z as FieldChange } from "./index-CDLxve55.mjs";
+import { A as parseConfig, B as HistoryEntry, C as Decision, D as OpenOptions, E as DeclaredTable, F as ColumnType, G as Rec, H as IndexSpec, I as ConflictInfo, J as ViewRecord, K as SchemaChange, L as DbRow, M as Capture, N as Change, O as TableInput, P as ChangeOp, R as DbValue, S as BaseHashes, T as Config, U as PageAccess, V as HistoryPage, W as PageSpec, _ as check, a as formatCsv, b as Watcher, c as query, d as init, f as ExportOptions, g as CheckTable, h as CheckResult, i as QueryResult, j as readsFile, k as TableLocation, l as InitOptions, m as exportSite, n as open, o as formatJson, p as ExportResult, q as TableSpec, r as QueryOptions, s as formatTable, t as Yamlite, u as generateConfig, v as WatchHandlers, w as CONFIG_NAMES, x as TableResult, y as WatchOptions, z as FieldChange } from "./index-Bd2ctbJm.mjs";
 import { DatabaseSync } from "node:sqlite";
 import { LanguageModel, ModelMessage } from "ai";
 //#region src/store.d.ts
@@ -59,7 +59,7 @@ interface PageRules {
   access: Record<string, PageAccess>;
   sql: boolean;
   network: string[];
-  files: string[];
+  files: Record<string, PageAccess>;
   ai: {
     maxOutputTokens: number;
   } | null;
@@ -67,7 +67,7 @@ interface PageRules {
 export declare const DENIED_FILES: string[];
 export declare const MAX_PAGE_FILE_BYTES = 10485760;
 export declare function normalizeFilePath(path: string): string | null;
-export declare const fileGranted: (files: string[], path: string) => boolean;
+export declare const fileGranted: (files: Record<string, PageAccess>, path: string) => boolean;
 //#endregion
 //#region src/agent/providers.d.ts
 interface Credentials {
@@ -349,6 +349,10 @@ type ServeEvent = {
   type: "page";
   at: string;
   pages: string[];
+} | {
+  type: "files";
+  at: string;
+  paths: string[];
 };
 //#endregion
 //#region src/serve/events.d.ts
@@ -364,6 +368,7 @@ declare class EventHub {
   warnings(): Record<string, string[]>;
   configError(): string | null;
   pagesChanged(pages: string[]): void;
+  filesChanged(paths: string[]): void;
   stream(signal: AbortSignal): ReadableStream<Uint8Array>;
   close(): void;
   private onSync;
@@ -520,10 +525,13 @@ interface ApiRequest {
 type Handler = (req: ApiRequest) => unknown;
 declare class Router {
   private readonly routes;
-  add(method: string, pattern: string, handler: Handler): this;
+  add(method: string, pattern: string, handler: Handler, opts?: {
+    maxBody?: number;
+  }): this;
   match(method: string, pathname: string): {
     handler: Handler;
     params: Record<string, string>;
+    maxBody: number;
   } | "method" | null;
   dispatch(request: Request): Promise<Response>;
 }

package/dist/core.mjs

@@ -1,3 +1,3 @@
-import { B as check, C as describeChange, J as fileGranted, K as DENIED_FILES, L as HttpError, T as worthShowing, U as parseConfig, V as CONFIG_NAMES, W as readsFile, Y as normalizeFilePath, a as query, c as exportSite, f as ReviewRefused, h as templatePath, i as formatTable, n as formatCsv, o as generateConfig, q as MAX_PAGE_FILE_BYTES, r as formatJson, s as init, t as open, w as fieldChanges } from "./src-NOJw_gTE.mjs";
-import { t as createWorkspace } from "./workspace-Cp5-yHYp.mjs";
+import { B as check, C as describeChange, K as DENIED_FILES, L as HttpError, T as worthShowing, U as parseConfig, V as CONFIG_NAMES, W as readsFile, X as fileGranted, Z as normalizeFilePath, a as query, c as exportSite, f as ReviewRefused, h as templatePath, i as formatTable, n as formatCsv, o as generateConfig, q as MAX_PAGE_FILE_BYTES, r as formatJson, s as init, t as open, w as fieldChanges } from "./src-ChJZPkg9.mjs";
+import { t as createWorkspace } from "./workspace-D7xHlBPc.mjs";
 export { CONFIG_NAMES, DENIED_FILES, HttpError, MAX_PAGE_FILE_BYTES, ReviewRefused, check, createWorkspace, describeChange, exportSite, fieldChanges, fileGranted, formatCsv, formatJson, formatTable, generateConfig, init, normalizeFilePath, open, parseConfig, query, readsFile, templatePath, worthShowing };

package/dist/{index-CDLxve55.d.mts → index-Bd2ctbJm.d.mts}

@@ -81,7 +81,7 @@ interface PageSpec {
   access: Record<string, PageAccess>;
   sql: boolean;
   network: string[];
-  files: string[];
+  files: Record<string, PageAccess>;
   ai: {
     maxOutputTokens: number;
   } | null;

package/dist/index.d.mts

@@ -1,2 +1,2 @@
-import { C as Decision, D as OpenOptions, F as ColumnType, H as IndexSpec, I as ConflictInfo, K as SchemaChange, N as Change, O as TableInput, P as ChangeOp, W as PageSpec, _ as check, a as formatCsv, b as Watcher, c as query, d as init, f as ExportOptions, g as CheckTable, h as CheckResult, i as QueryResult, l as InitOptions, m as exportSite, n as open, o as formatJson, p as ExportResult, q as TableSpec, r as QueryOptions, s as formatTable, t as Yamlite, u as generateConfig, v as WatchHandlers, x as TableResult, y as WatchOptions } from "./index-CDLxve55.mjs";
+import { C as Decision, D as OpenOptions, F as ColumnType, H as IndexSpec, I as ConflictInfo, K as SchemaChange, N as Change, O as TableInput, P as ChangeOp, W as PageSpec, _ as check, a as formatCsv, b as Watcher, c as query, d as init, f as ExportOptions, g as CheckTable, h as CheckResult, i as QueryResult, l as InitOptions, m as exportSite, n as open, o as formatJson, p as ExportResult, q as TableSpec, r as QueryOptions, s as formatTable, t as Yamlite, u as generateConfig, v as WatchHandlers, x as TableResult, y as WatchOptions } from "./index-Bd2ctbJm.mjs";
 export { type Change, type ChangeOp, type CheckResult, type CheckTable, type ColumnType, type ConflictInfo, type Decision, type ExportOptions, type ExportResult, type IndexSpec, type InitOptions, type OpenOptions, type PageSpec, type QueryOptions, type QueryResult, type SchemaChange, type TableInput, type TableResult, type TableSpec, type WatchHandlers, type WatchOptions, type Watcher, Yamlite, check, exportSite, formatCsv, formatJson, formatTable, generateConfig, init, open, query };

package/dist/index.mjs

@@ -1 +1 @@
-export { B as check, c as exportSite, n as formatCsv, r as formatJson, i as formatTable, o as generateConfig, s as init, t as open, a as query } from "./src-NOJw_gTE.mjs";
+export { B as check, c as exportSite, n as formatCsv, r as formatJson, i as formatTable, o as generateConfig, s as init, t as open, a as query } from "./src-ChJZPkg9.mjs";

package/dist/{src-NOJw_gTE.mjs → src-ChJZPkg9.mjs}

@@ -1129,8 +1129,10 @@ function normalizeFilePath(path) {
 	if (kept.length === 0) return null;
 	return kept.join("/") + (path.endsWith("/") ? "/" : "");
 }
-const fileGranted = (files, path) => files.some((entry) => entry.endsWith("/") ? path.startsWith(entry) : path === entry);
-const deniedFile = (path, denied) => fileGranted(denied.map((d) => d.toLowerCase()), path.toLowerCase());
+const entryCovers = (entry, path) => entry.endsWith("/") ? path.startsWith(entry) : path === entry;
+const fileGranted = (files, path) => Object.keys(files).some((entry) => entryCovers(entry, path));
+const fileWritable = (files, path) => Object.entries(files).some(([entry, level]) => level === "write" && entryCovers(entry, path));
+const deniedFile = (path, denied) => denied.some((d) => entryCovers(d.toLowerCase(), path.toLowerCase()));
 const CONTENT_TYPES = {
 	png: "image/png",
 	jpg: "image/jpeg",
@@ -1141,6 +1143,50 @@ const CONTENT_TYPES = {
 	pdf: "application/pdf",
 	txt: "text/plain"
 };
+const starts = (b, magic) => magic.every((m, i) => b[i] === m);
+const WRITABLE_TYPES = {
+	"image/png": (b) => starts(b, [
+		137,
+		80,
+		78,
+		71,
+		13,
+		10,
+		26,
+		10
+	]),
+	"image/jpeg": (b) => starts(b, [
+		255,
+		216,
+		255
+	]),
+	"image/gif": (b) => starts(b, [
+		71,
+		73,
+		70,
+		56
+	]),
+	"image/webp": (b) => starts(b, [
+		82,
+		73,
+		70,
+		70
+	]) && starts(b.subarray(8), [
+		87,
+		69,
+		66,
+		80
+	]),
+	"application/pdf": (b) => starts(b, [
+		37,
+		80,
+		68,
+		70,
+		45
+	])
+};
+const writableType = (path) => Object.hasOwn(WRITABLE_TYPES, contentTypeOf(path));
+const bytesMatchType = (path, bytes) => WRITABLE_TYPES[contentTypeOf(path)]?.(bytes) ?? false;
 function contentTypeOf(path) {
 	const ext = path.slice(path.lastIndexOf(".") + 1).toLowerCase();
 	return path.includes(".") && Object.hasOwn(CONTENT_TYPES, ext) ? CONTENT_TYPES[ext] : "application/octet-stream";
@@ -1686,14 +1732,18 @@ function toOrigin(where, raw) {
 	return url.origin;
 }
 function toFiles(where, raw) {
-	if (raw === void 0 || raw === null) return [];
-	if (!Array.isArray(raw)) throw new Error(`${where}files must be a list of root-relative files and folders`);
-	return raw.map((entry) => {
+	if (raw === void 0 || raw === null) return {};
+	if (typeof raw !== "object" || Array.isArray(raw)) throw new Error(`${where}files must map root-relative files and folders to read or write`);
+	const out = {};
+	for (const [entry, level] of Object.entries(raw)) {
 		const invalid = (why) => /* @__PURE__ */ new Error(`${where}files entry ${JSON.stringify(entry)} ${why}`);
-		if (typeof entry !== "string" || normalizeFilePath(entry) !== entry) throw invalid("must be a root-relative path without .., . or empty segments");
+		if (normalizeFilePath(entry) !== entry) throw invalid("must be a root-relative path without .., . or empty segments");
 		if (deniedFile(entry, DENIED_FILES)) throw invalid("is YAMLite's own and cannot be granted");
-		return entry;
-	});
+		if (level !== "read" && level !== "write") throw invalid("must be read or write");
+		if (level === "write" && !entry.endsWith("/") && !writableType(entry)) throw invalid("cannot be write: a page may write only PNG, JPEG, GIF, WebP or PDF files");
+		out[entry] = level;
+	}
+	return out;
 }
 function toPageAi(where, raw) {
 	if (raw === void 0 || raw === null || raw === false) return null;
@@ -3624,13 +3674,15 @@ var Reply = class {
 		this.body = body;
 	}
 };
+const MAX_BODY = 1048576;
 var Router = class {
 	routes = [];
-	add(method, pattern, handler) {
+	add(method, pattern, handler, opts = {}) {
 		this.routes.push({
 			method,
 			parts: pattern.split("/").filter(Boolean),
-			handler
+			handler,
+			maxBody: opts.maxBody ?? MAX_BODY
 		});
 		return this;
 	}
@@ -3656,7 +3708,8 @@ var Router = class {
 			}
 			return {
 				handler: route.handler,
-				params
+				params,
+				maxBody: route.maxBody
 			};
 		}
 		return wrongMethod ? "method" : null;
@@ -3670,7 +3723,7 @@ var Router = class {
 			let body;
 			if (request.method !== "GET" && request.method !== "HEAD") {
 				if (!/^application\/json\s*(;|$)/i.test(request.headers.get("content-type") ?? "")) throw new HttpError(415, "content-type must be application/json");
-				body = await readBody(request);
+				body = await readBody(request, match.maxBody);
 			}
 			const out = await match.handler({
 				params: match.params,
@@ -3707,10 +3760,9 @@ function sendJson(res, status, body) {
 	});
 	res.end(JSON.stringify(body, jsonReplacer$1));
 }
-const MAX_BODY = 1048576;
-async function readBody(request) {
+async function readBody(request, max) {
 	const tooLarge = () => new HttpError(413, "request body is too large");
-	if (Number(request.headers.get("content-length")) > MAX_BODY) throw tooLarge();
+	if (Number(request.headers.get("content-length")) > max) throw tooLarge();
 	const chunks = [];
 	let size = 0;
 	if (request.body) {
@@ -3719,7 +3771,7 @@ async function readBody(request) {
 			const { value, done } = await reader.read();
 			if (done) break;
 			size += value.length;
-			if (size > MAX_BODY) {
+			if (size > max) {
 				await reader.cancel().catch(() => {});
 				throw tooLarge();
 			}
@@ -4397,6 +4449,14 @@ var EventHub = class {
 		};
 		for (const res of this.clients.keys()) this.send(res, event.type, event);
 	}
+	filesChanged(paths) {
+		const event = {
+			type: "files",
+			at: now(),
+			paths
+		};
+		for (const res of this.clients.keys()) this.send(res, event.type, event);
+	}
 	stream(signal) {
 		let ctrl;
 		const drop = () => {
@@ -5015,17 +5075,13 @@ const rowRoutes = (router, ctx) => {
 		const key = params.key;
 		const b = objectBody(body, "body");
 		const values = objectBody(b.values, "values");
-		const base = objectBody(b.base, "base");
+		const base = baseOf$1(b.base);
 		noKeyIn(spec, values, "rename the record instead");
 		const { store } = ctx;
 		writeTx(store, () => {
 			const current = readRecord(store, spec, key);
 			if (!current) throw new HttpError(404, `no record "${key}" in ${spec.name}`);
-			const stale = Object.keys(values).filter((f) => canonical(own$1(current, f) ?? null) !== canonical(own$1(base, f) ?? null));
-			if (stale.length > 0) throw new HttpError(409, `changed since it was loaded: ${stale.join(", ")}`, {
-				current,
-				stale
-			});
+			if (base) assertFresh(current, base, Object.keys(values));
 			updateRecord(store, spec, key, values);
 		});
 		return { ok: true };
@@ -5046,13 +5102,31 @@ const rowRoutes = (router, ctx) => {
 		});
 		return { key: to };
 	});
-	router.add("DELETE", "/api/tables/:table/rows/:key", ({ params }) => {
+	router.add("DELETE", "/api/tables/:table/rows/:key", ({ params, body }) => {
 		ctx.proposals.assertIdle();
 		const spec = tableSpec(ctx, params.table);
-		writeTx(ctx.store, () => deleteRecord(ctx.store, spec, params.key));
+		const key = params.key;
+		const base = baseOf$1(body?.base);
+		const { store } = ctx;
+		writeTx(store, () => {
+			if (base) {
+				const current = readRecord(store, spec, key);
+				if (!current) throw new HttpError(404, `no record "${key}" in ${spec.name}`);
+				assertFresh(current, base, Object.keys(base));
+			}
+			deleteRecord(store, spec, key);
+		});
 		return { ok: true };
 	});
 };
+const baseOf$1 = (value) => value === void 0 ? null : objectBody(value, "base");
+function assertFresh(current, base, fields) {
+	const stale = fields.filter((f) => canonical(own$1(current, f) ?? null) !== canonical(own$1(base, f) ?? null));
+	if (stale.length > 0) throw new HttpError(409, `changed since it was loaded: ${stale.join(", ")}`, {
+		current,
+		stale
+	});
+}
 //#endregion
 //#region src/serve/routes/history.ts
 const CURSOR = /^\d+$/;
@@ -5676,7 +5750,7 @@ async function gitStatus(repo) {
 }
 async function gitDiff(repo, paths = []) {
 	const scope = paths.map((p) => {
-		const top = insideRoot(repo, p);
+		const top = insideRoot$1(repo, p);
 		if (top === null) throw new Error(`${p} must be inside the data folder`);
 		return top;
 	});
@@ -5737,7 +5811,7 @@ async function ghReady(env = process.env) {
 		return false;
 	}
 }
-function insideRoot(repo, path) {
+function insideRoot$1(repo, path) {
 	const abs = resolve(repo.root, path);
 	const rel = relative(repo.root, abs);
 	if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) return null;
@@ -5855,7 +5929,7 @@ async function branchName(repo, v, i) {
 }
 async function commitPath(repo, v, i) {
 	const p = text$1(v, "path", i);
-	const top = insideRoot(repo, p);
+	const top = insideRoot$1(repo, p);
 	if (top === null) throw new Error(`step ${i + 1}: ${p} must be inside the data folder`);
 	if (existsSync(resolve(repo.root, p))) return p;
 	try {
@@ -6003,7 +6077,7 @@ async function runOne(repo, s, gh) {
 			await g(["switch", s.branch]);
 			break;
 		case "commit": {
-			const tops = s.paths.map((p) => insideRoot(repo, p));
+			const tops = s.paths.map((p) => insideRoot$1(repo, p));
 			await g([
 				"add",
 				"-A",
@@ -6241,7 +6315,7 @@ async function localDriver(root, gh) {
 				changes: []
 			};
 			const s = await gitStatus(f.repo);
-			const changes = s.changes.filter((c) => insideRoot(f.repo, c.path) !== null).map((c) => ({
+			const changes = s.changes.filter((c) => insideRoot$1(f.repo, c.path) !== null).map((c) => ({
 				path: c.path,
 				status: changeStatus(c.status)
 			}));
@@ -6254,7 +6328,7 @@ async function localDriver(root, gh) {
 		defaultBranch: defaultName,
 		async baseContent(rootPath) {
 			const { repo } = await need();
-			const top = insideRoot(repo, rootPath);
+			const top = insideRoot$1(repo, rootPath);
 			if (top === null) return null;
 			try {
 				return await runGit(repo.top, ["show", `HEAD:${top}`]);
@@ -6342,7 +6416,7 @@ async function defaultRef(repo, name) {
 	throw new GitError(`the default branch ${name} is not in this clone`);
 }
 async function blobAt(repo, rev, rootPath) {
-	const top = insideRoot(repo, rootPath);
+	const top = insideRoot$1(repo, rootPath);
 	if (top === null) throw new GitError(`${rootPath} is outside the repository`);
 	let entry;
 	try {
@@ -6621,7 +6695,90 @@ function grantedFile(root, files, denied, path) {
 		size
 	};
 }
-const readGranted = (ctx, page, path) => readFileSync(grantedFile(ctx.root, page.files, ctx.deniedFiles, path).real);
+const MAX_WRITE_BODY = Math.ceil(MAX_PAGE_FILE_BYTES / 3) * 4 + 4096;
+const BASE64 = /^[A-Za-z0-9+/]*={0,2}$/;
+const insideRoot = (rel) => rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+function writeTarget(root, page, denied, path) {
+	const realRoot = realpathSync.native(root);
+	const parts = path.split("/");
+	let at = realRoot;
+	let i = 0;
+	for (; i < parts.length - 1; i++) {
+		const next = join(at, parts[i]);
+		try {
+			at = realpathSync.native(next);
+		} catch {
+			if (lstatOrNull(next)) throw new HttpError(409, `${parts.slice(0, i + 1).join("/")} is not a folder`);
+			break;
+		}
+		if (!statSync(at).isDirectory()) throw new HttpError(409, `${parts.slice(0, i + 1).join("/")} is not a folder`);
+	}
+	const target = join(at, ...parts.slice(i));
+	const rel = relative(realRoot, target);
+	const shown = rel.split(sep).join("/");
+	if (!insideRoot(rel) || !fileWritable(page.files, shown) || deniedFile(shown, denied)) throw new HttpError(403, `${path} leads outside the files this page may write`);
+	let isLink = false;
+	try {
+		const st = lstatSync(target);
+		isLink = st.isSymbolicLink();
+		if (!isLink && !st.isFile()) throw new HttpError(409, `${path} is not a file`);
+	} catch (e) {
+		if (e instanceof HttpError) throw e;
+	}
+	if (isLink) throw new HttpError(403, `${path} is a symlink; a page may not write through it`);
+	return target;
+}
+const lstatOrNull = (path) => lstatSync(path, { throwIfNoEntry: false }) ?? null;
+function readIfFile(path) {
+	const st = lstatOrNull(path);
+	if (!st?.isFile()) return null;
+	if (st.size > 10485760) return "too-large";
+	return readFileSync(path);
+}
+function baseOf(body) {
+	const base = body?.base;
+	if (base === void 0 || base === null) return base;
+	if (typeof base !== "string" || !/^[0-9a-f]{64}$/.test(base)) throw new HttpError(400, "base must be a SHA-256 hex digest or null");
+	return base;
+}
+async function hostedFile(ctx, target, path, signal) {
+	if (existsSync(target)) return null;
+	const hosted = await ctx.pageFiles?.(path, signal);
+	return hosted === void 0 || hosted === "missing" ? null : hosted;
+}
+function checkBase(target, path, base, hosted) {
+	const disk = readIfFile(target);
+	const current = disk ?? hosted;
+	const from = disk !== null ? "disk" : hosted !== null ? "host" : null;
+	if (base === void 0) return from;
+	if (current === "too-large") throw new HttpError(409, `${path} changed since the page read it`);
+	const now = current === null ? null : hashContent(current);
+	if (now !== base) throw new HttpError(409, `${path} changed since the page read it`, { current: now });
+	return from;
+}
+function writableRequest(ctx, params, query) {
+	const page = pageSpec(ctx, params.page);
+	const asked = query.get("path");
+	if (!asked) throw new HttpError(400, "path is required");
+	const path = normalizeFilePath(asked);
+	if (path === null || path.endsWith("/") || !fileWritable(page.files, path)) throw new HttpError(403, `${asked} is not in the files this page may write`);
+	if (deniedFile(path, ctx.deniedFiles)) throw new HttpError(403, `${asked} is YAMLite's own and no page may write it`);
+	return {
+		page,
+		path
+	};
+}
+function replaceFile(target, bytes) {
+	mkdirSync(dirname(target), { recursive: true });
+	const tmp = join(dirname(target), `.yamlite-${crypto.randomUUID()}.tmp`);
+	try {
+		writeFileSync(tmp, bytes);
+		renameSync(tmp, target);
+	} catch (e) {
+		rmSync(tmp, { force: true });
+		throw e;
+	}
+}
 const pageRoutes = (router, ctx) => {
 	router.add("GET", "/api/pages/:page/html", ({ params }) => {
 		const page = pageSpec(ctx, params.page);
@@ -6634,15 +6791,47 @@ const pageRoutes = (router, ctx) => {
 		const path = normalizeFilePath(asked);
 		if (path === null || !fileGranted(page.files, path)) throw new HttpError(403, `${asked} is not in this page's files`);
 		if (deniedFile(path, ctx.deniedFiles)) throw new HttpError(403, `${asked} is YAMLite's own and no page may read it`);
-		let bytes = await ctx.pageFiles?.(path, signal);
-		if (bytes === "missing") throw missing(path);
-		if (bytes === "too-large" || bytes !== void 0 && bytes.length > 10485760) throw tooLarge(path);
-		bytes ??= readGranted(ctx, page, path);
+		let bytes;
+		try {
+			bytes = readFileSync(grantedFile(ctx.root, page.files, ctx.deniedFiles, path).real);
+		} catch (e) {
+			if (!(e instanceof HttpError) || e.status !== 404) throw e;
+			const hosted = await ctx.pageFiles?.(path, signal);
+			if (hosted === void 0 || hosted === "missing") throw missing(path);
+			if (hosted === "too-large" || hosted.length > 10485760) throw tooLarge(path);
+			bytes = hosted;
+		}
 		return new Response(bytes, { headers: {
 			...FILE_HEADERS,
 			"content-type": contentTypeOf(path)
 		} });
 	});
+	router.add("PUT", "/api/pages/:page/file", async ({ params, query, body, signal }) => {
+		const { page, path } = writableRequest(ctx, params, query);
+		if (!writableType(path)) throw new HttpError(415, `${path}: a page may write only PNG, JPEG, GIF, WebP or PDF files`);
+		const data = body?.data;
+		if (typeof data !== "string" || !BASE64.test(data)) throw new HttpError(400, "data must be base64");
+		const bytes = Buffer.from(data, "base64");
+		if (bytes.length > 10485760) throw tooLarge(path);
+		if (!bytesMatchType(path, bytes)) throw new HttpError(415, `${path}: the content is not ${contentTypeOf(path)}`);
+		const base = baseOf(body);
+		const hosted = await hostedFile(ctx, writeTarget(ctx.root, page, ctx.deniedFiles, path), path, signal);
+		const target = writeTarget(ctx.root, page, ctx.deniedFiles, path);
+		checkBase(target, path, base, hosted);
+		replaceFile(target, bytes);
+		return { sha256: hashContent(bytes) };
+	}, { maxBody: MAX_WRITE_BODY });
+	router.add("DELETE", "/api/pages/:page/file", async ({ params, query, body, signal }) => {
+		const { page, path } = writableRequest(ctx, params, query);
+		const base = baseOf(body);
+		const hosted = await hostedFile(ctx, writeTarget(ctx.root, page, ctx.deniedFiles, path), path, signal);
+		const target = writeTarget(ctx.root, page, ctx.deniedFiles, path);
+		const from = checkBase(target, path, base, hosted);
+		if (from === null) throw missing(path);
+		if (from === "host") throw new HttpError(409, `${path} is kept by the host and cannot be deleted here`);
+		unlinkSync(target);
+		return { ok: true };
+	});
 };
 //#endregion
 //#region src/serve/routes/pageai.ts
@@ -7725,7 +7914,7 @@ function grantedCandidates(root, entries) {
 	return found;
 }
 function copyPageFiles(root, dir, grants, denied, skipped) {
-	for (const path of new Set(grantedCandidates(root, grants))) {
+	for (const path of new Set(grantedCandidates(root, Object.keys(grants)))) {
 		if (deniedFile(path, denied)) continue;
 		let real;
 		try {
@@ -7808,7 +7997,7 @@ async function writeSnapshotData(opts) {
 				}
 			}
 			const kept = new Set(pages.map(([name]) => name));
-			copyPageFiles(root, opts.dir, y.pages.filter((p) => kept.has(p.name)).flatMap((p) => p.files), ctx.deniedFiles, skippedFiles);
+			copyPageFiles(root, opts.dir, Object.assign({}, ...y.pages.filter((p) => kept.has(p.name)).map((p) => p.files)), ctx.deniedFiles, skippedFiles);
 			meta = {
 				...served,
 				root: basename(root),
@@ -8574,4 +8763,4 @@ async function open(options) {
 	};
 }
 //#endregion
-export { deniedFiles as A, check as B, describeChange as C, isRead as D, PageSql as E, Router as F, resolveConfig as G, configPath as H, createHandler as I, fileGranted as J, DENIED_FILES as K, HttpError as L, readRecord as M, assertSynced as N, statementCount as O, toWire as P, COLUMN_TYPES as Q, isLoopback as R, which as S, worthShowing as T, parseConfig as U, CONFIG_NAMES as V, readsFile as W, declaredViews as X, normalizeFilePath as Y, Store as Z, ghReady as _, query as a, gitLog as b, exportSite as c, validateNewTable as d, ReviewRefused as f, DIFF_LIMIT as g, templatePath as h, formatTable as i, ProposalStore as j, EventHub as k, ROUTES as l, STEP_KINDS as m, formatCsv as n, generateConfig as o, localDriver as p, MAX_PAGE_FILE_BYTES as q, formatJson as r, init as s, open as t, createTable as u, gitBranches as v, fieldChanges as w, gitStatus as x, gitDiff as y, loopbackHosts as z };
+export { Store as $, deniedFiles as A, check as B, describeChange as C, isRead as D, PageSql as E, Router as F, resolveConfig as G, configPath as H, createHandler as I, deniedFile as J, DENIED_FILES as K, HttpError as L, readRecord as M, assertSynced as N, statementCount as O, toWire as P, declaredViews as Q, isLoopback as R, which as S, worthShowing as T, parseConfig as U, CONFIG_NAMES as V, readsFile as W, fileGranted as X, entryCovers as Y, normalizeFilePath as Z, ghReady as _, query as a, gitLog as b, exportSite as c, validateNewTable as d, COLUMN_TYPES as et, ReviewRefused as f, DIFF_LIMIT as g, templatePath as h, formatTable as i, ProposalStore as j, EventHub as k, ROUTES as l, STEP_KINDS as m, formatCsv as n, generateConfig as o, localDriver as p, MAX_PAGE_FILE_BYTES as q, formatJson as r, init as s, open as t, createTable as u, gitBranches as v, fieldChanges as w, gitStatus as x, gitDiff as y, loopbackHosts as z };