Refresh script library with batch uploads and beta handoff

src/routes/api/scripts/+server.ts

@@ -36,8 +36,13 @@ export async function GET({ url }: { url: URL }) {
             ? serversMatchingScope(s.scope_type as ScopeType, s.scope_value)
             : [];
         const runningBeta = findRunningBetaForScript(s.id);
+        const current = versions.find(v => v.id === s.current_version_id);
         return {
             ...s,
+            currentVersion: current ? {
+                id: current.id, version: current.version, sha256: current.sha256,
+                size: current.size, state: current.state, uploaded_at: current.uploaded_at
+            } : null,
             latestVersion: versions[0]
                 ? {
                       id: versions[0].id,

src/routes/api/scripts/[id]/versions/+server.ts

@@ -1,5 +1,8 @@
 import { json } from '@sveltejs/kit';
 import { uploadNewVersion, getScript, ScriptError } from '$lib/server/fleet/scripts.js';
+import { createHash } from 'node:crypto';
+import { db } from '$lib/server/db/index.js';
+import { findRunningBetaForScript } from '$lib/server/fleet/beta.js';
 
 function parseId(idRaw: string): number | null {
     const n = Number.parseInt(idRaw, 10);
@@ -21,6 +24,15 @@ export async function POST({ params, request }: { params: { id: string }; reques
     if (!(file instanceof File)) return json({ ok: false, error: 'content file is required' }, { status: 400 });
 
     const content = Buffer.from(await file.arrayBuffer());
+    if (script.kind === 'script' && form.get('reuseExisting') === 'true') {
+        if (!content.length) return json({ ok: false, error: 'Choose a non-empty script file.' }, { status: 400 });
+        if (findRunningBetaForScript(scriptId)) {
+            return json({ ok: false, error: 'Finish the active beta before uploading a version.' }, { status: 409 });
+        }
+        const sha = createHash('sha256').update(content).digest('hex');
+        const existing = db().prepare('SELECT id, version, sha256, size FROM script_versions WHERE script_id = ? AND sha256 = ? ORDER BY version DESC LIMIT 1').get(scriptId, sha);
+        if (existing) return json({ ok: true, version: existing, reused: true });
+    }
     try {
         const releaseVersion = form.has('releaseVersion') ? String(form.get('releaseVersion')) : undefined;
         const version = uploadNewVersion(scriptId, content, notes, releaseVersion);

src/routes/api/scripts/inspect/+server.ts

@@ -0,0 +1,17 @@
+import { json } from '@sveltejs/kit';
+import { createHash } from 'node:crypto';
+import { db } from '$lib/server/db/index.js';
+
+// Read-only inspection works on HTTP fleet consoles as well as secure origins.
+export async function POST({ request }: { request: Request }) {
+    const form = await request.formData();
+    const file = form.get('content');
+    if (!(file instanceof File) || file.size === 0) {
+        return json({ error: 'Choose a non-empty script file.' }, { status: 400 });
+    }
+    const sha256 = createHash('sha256').update(Buffer.from(await file.arrayBuffer())).digest('hex');
+    const duplicates = db().prepare(`SELECT v.script_id AS scriptId, v.id AS versionId, v.version
+        FROM script_versions v JOIN scripts s ON s.id = v.script_id
+        WHERE s.kind = 'script' AND v.sha256 = ? ORDER BY v.version DESC`).all(sha256);
+    return json({ sha256, duplicates });
+}