@01.works/visual-review 0.1.0

package/LICENSE

@@ -0,0 +1,10 @@
+Copyright (c) 2026 01.works. All rights reserved.
+
+This package and the original 01.works Visual Review product code are
+proprietary and are not offered under an open-source license. No permission is
+granted to copy, modify, redistribute, sublicense, or create derivative works
+except under a separate written agreement with 01.works.
+
+Third-party components remain governed by their respective licenses. Their
+copyright and license notices are provided in THIRD_PARTY_NOTICES.md and the
+LICENSES directory.

package/LICENSES/Apache-2.0.txt

@@ -0,0 +1,187 @@
+Apache License
+
+Version 2.0, January 2004
+
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and
+distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the
+copyright owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other
+entities that control, are controlled by, or are under common control with
+that entity. For the purposes of this definition, "control" means (i) the
+power, direct or indirect, to cause the direction or management of such
+entity, whether by contract or otherwise, or (ii) ownership of fifty percent
+(50%) or more of the outstanding shares, or (iii) beneficial ownership of
+such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising
+permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications,
+including but not limited to software source code, documentation source, and
+configuration files.
+
+"Object" form shall mean any form resulting from mechanical transformation
+or translation of a Source form, including but not limited to compiled object
+code, generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form,
+made available under the License, as indicated by a copyright notice that is
+included in or attached to the work.
+
+"Derivative Works" shall mean any work, whether in Source or Object form,
+that is based on (or derived from) the Work and for which the editorial
+revisions, annotations, elaborations, or other modifications represent, as a
+whole, an original work of authorship. For the purposes of this License,
+Derivative Works shall not include works that remain separable from, or
+merely link (or bind by name) to the interfaces of, the Work and Derivative
+Works thereof.
+
+"Contribution" shall mean any work of authorship, including the original
+version of the Work and any modifications or additions to that Work or
+Derivative Works thereof, that is intentionally submitted to Licensor for
+inclusion in the Work by the copyright owner or by an individual or Legal
+Entity authorized to submit on behalf of the copyright owner. For the
+purposes of this definition, "submitted" means any form of electronic,
+verbal, or written communication sent to the Licensor or its representatives,
+including but not limited to communication on electronic mailing lists,
+source code control systems, and issue tracking systems that are managed by,
+or on behalf of, the Licensor for the purpose of discussing and improving the
+Work, but excluding communication that is conspicuously marked or otherwise
+designated in writing by the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on
+behalf of whom a Contribution has been received by Licensor and subsequently
+incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of this
+License, each Contributor hereby grants to You a perpetual, worldwide,
+non-exclusive, no-charge, royalty-free, irrevocable copyright license to
+reproduce, prepare Derivative Works of, publicly display, publicly perform,
+sublicense, and distribute the Work and such Derivative Works in Source or
+Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of this
+License, each Contributor hereby grants to You a perpetual, worldwide,
+non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this
+section) patent license to make, have made, use, offer to sell, sell, import,
+and otherwise transfer the Work, where such license applies only to those
+patent claims licensable by such Contributor that are necessarily infringed
+by their Contribution(s) alone or by combination of their Contribution(s)
+with the Work to which such Contribution(s) was submitted. If You institute
+patent litigation against any entity (including a cross-claim or counterclaim
+in a lawsuit) alleging that the Work or a Contribution incorporated within
+the Work constitutes direct or contributory patent infringement, then any
+patent licenses granted to You under this License for that Work shall
+terminate as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the Work or
+Derivative Works thereof in any medium, with or without modifications, and in
+Source or Object form, provided that You meet the following conditions:
+
+(a) You must give any other recipients of the Work or Derivative Works a copy
+    of this License; and
+
+(b) You must cause any modified files to carry prominent notices stating that
+    You changed the files; and
+
+(c) You must retain, in the Source form of any Derivative Works that You
+    distribute, all copyright, patent, trademark, and attribution notices from
+    the Source form of the Work, excluding those notices that do not pertain
+    to any part of the Derivative Works; and
+
+(d) If the Work includes a "NOTICE" text file as part of its distribution,
+    then any Derivative Works that You distribute must include a readable copy
+    of the attribution notices contained within such NOTICE file, excluding
+    those notices that do not pertain to any part of the Derivative Works, in
+    at least one of the following places: within a NOTICE text file distributed
+    as part of the Derivative Works; within the Source form or documentation,
+    if provided along with the Derivative Works; or, within a display generated
+    by the Derivative Works, if and wherever such third-party notices normally
+    appear. The contents of the NOTICE file are for informational purposes only
+    and do not modify the License. You may add Your own attribution notices
+    within Derivative Works that You distribute, alongside or as an addendum to
+    the NOTICE text from the Work, provided that such additional attribution
+    notices cannot be construed as modifying the License.
+
+You may add Your own copyright statement to Your modifications and may
+provide additional or different license terms and conditions for use,
+reproduction, or distribution of Your modifications, or for any such
+Derivative Works as a whole, provided Your use, reproduction, and distribution
+of the Work otherwise complies with the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise, any
+Contribution intentionally submitted for inclusion in the Work by You to the
+Licensor shall be under the terms and conditions of this License, without any
+additional terms or conditions. Notwithstanding the above, nothing herein
+shall supersede or modify the terms of any separate license agreement you may
+have executed with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade names,
+trademarks, service marks, or product names of the Licensor, except as required
+for reasonable and customary use in describing the origin of the Work and
+reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or agreed to in
+writing, Licensor provides the Work (and each Contributor provides its
+Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied, including, without limitation, any warranties
+or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+PARTICULAR PURPOSE. You are solely responsible for determining the
+appropriateness of using or redistributing the Work and assume any risks
+associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory, whether in
+tort (including negligence), contract, or otherwise, unless required by
+applicable law (such as deliberate and grossly negligent acts) or agreed to in
+writing, shall any Contributor be liable to You for damages, including any
+direct, indirect, special, incidental, or consequential damages of any
+character arising as a result of this License or out of the use or inability
+to use the Work (including but not limited to damages for loss of goodwill,
+work stoppage, computer failure or malfunction, or any and all other
+commercial damages or losses), even if such Contributor has been advised of
+the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing the Work
+or Derivative Works thereof, You may choose to offer, and charge a fee for,
+acceptance of support, warranty, indemnity, or other liability obligations
+and/or rights consistent with this License. However, in accepting such
+obligations, You may act only on Your own behalf and on Your sole
+responsibility, not on behalf of any other Contributor, and only if You agree
+to indemnify, defend, and hold each Contributor harmless for any liability
+incurred by, or claims asserted against, such Contributor by reason of your
+accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+To apply the Apache License to your work, attach the following boilerplate
+notice, with the fields enclosed by brackets "[]" replaced with your own
+identifying information. (Don't include the brackets!) The text should be
+enclosed in the appropriate comment syntax for the file format. We also
+recommend that a file or class name and description of purpose be included on
+the same "printed page" as the copyright notice for easier identification
+within third-party archives.
+
+Copyright [yyyy] [name of copyright owner]
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+this file except in compliance with the License. You may obtain a copy of the
+License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+License for the specific language governing permissions and limitations under
+the License.

package/README.md

@@ -0,0 +1,212 @@
+# @01.works/visual-review
+
+01.works가 호스팅하는 초대 전용 staging visual feedback widget입니다. 설치한
+project는 InstantDB App ID나 admin credential을 설정하지 않습니다.
+
+> Release status: package metadata와 React/Vite/Next 호환성 검증은 끝났지만
+> `@01.works/visual-review`은 아직 npm에 publish하지 않았습니다.
+> `visual-review.01.works`도 DNS/TLS 검증 전입니다. 아래 설치 예시는 최초 release
+> 후의 public API입니다.
+
+Package metadata의 consumer engine 선언은 Node `>=18.18`입니다. Release CI는
+Node `24.18.0`에서 실행합니다.
+
+### Build adapter 의존성
+
+`@babel/core`, `@babel/parser`, JSX/TypeScript transform plugin과 `magic-string`은
+Vite/Next production build에서 source marker와 private-map index를 만드는 Node 전용
+build adapter 의존성입니다. 브라우저 entry는 이 패키지들을 import하지 않으며,
+release verifier가 dormant root의 정적 import 경계와 6 KB gzip 상한을 별도로
+검사합니다.
+
+manifest의 caret 범위는 지원 가능한 adapter patch 범위를 의도적으로 표현합니다.
+실제 설치 버전은 consumer lockfile이 고정하므로 애플리케이션의 lockfile을 함께
+커밋해야 합니다. Release 검증은 빈 consumer 프로젝트에 tarball만 설치한 뒤 이
+범위에 맞는 resolved dependency tree와 `npm audit --omit=dev
+--audit-level=moderate`를 검사합니다. 이 의존성이나 source-map token, InstantDB
+credential을 browser 설정으로 전달하지 않습니다.
+
+`@instantdb/core`는 hosted realtime/auth 경계에 필요한 직접 runtime dependency이며
+`npm install @01.works/visual-review` 때 자동 설치됩니다. Consumer가 App ID를 넣는
+구조가 아니라, 활성 초대의 hosted bootstrap 응답으로 public App ID를 받습니다.
+
+## 설치
+
+```bash
+npm install @01.works/visual-review
+```
+
+### React / Vite
+
+Vite config에 build identity plugin을 한 번 추가하면 CI deployment metadata 또는
+clean Git HEAD가 widget의 source provenance에 자동으로 기록됩니다. 브라우저에
+주입하는 build identity는 공개 build ID와 full commit SHA 두 값뿐입니다. provider deployment ID가 없는
+same-commit rebuild에는 `git:<sha>:deploy:<public-random-variant>` 형식의 서로 다른
+build ID를 발급합니다. 이 public variant는 private marker salt와 upload token에서
+독립적으로 생성되므로 token 회전 시에도 현재 build identity가 바뀌지 않습니다.
+
+```ts
+// vite.config.ts
+import { defineConfig } from 'vite';
+import react from '@vitejs/plugin-react';
+import { visualReview } from '@01.works/visual-review/vite';
+
+export default defineConfig({
+  plugins: [react(), visualReview()],
+});
+```
+
+Vite와 Next.js의 production build는 upload token이 없어도 per-build HMAC opaque
+marker와 generated-asset locator index를 기본 생성합니다. 공개 산출물에는 raw
+repository source path/line, marker salt, upload token을 넣지 않습니다.
+`sourceMetadata: false`를 명시한 경우에만 marker/index adapter를 끄고 공개 build
+identity만 남깁니다. 이 설정은 private source-map upload를 활성화하거나 비활성화하지
+않으며 upload는 아래 `sourceMaps`/token gate를 그대로 따릅니다.
+
+CI에 project-scoped `VISUAL_REVIEW_SOURCE_MAP_TOKEN`을 설정하면 같은 plugin이
+browser build에 hidden source map을 만들고 기본 서비스
+`https://visual-review.01.works`로 비공개 업로드합니다. 업로드가 완료되거나 실패한
+뒤에는 배포 `outDir`의 `.map`을 모두 제거하며, 업로드 또는 정리에 실패하면 build도
+실패합니다. token은 Vite config의 Node process에서만 읽고 browser `define`이나
+runtime bundle에 넣지 않습니다. `inline` source map은 활성 상태에서 거부합니다.
+
+Vite와 Next.js adapter, private upload API, 저장소, retention 경계는 package
+verifier에서 함께 검증합니다. 다만 01.works production backend는 전용 PostgreSQL
+runtime role, private Blob/OIDC gate가 provision되기 전까지
+`VISUAL_REVIEW_SOURCE_MAP_BACKEND=disabled`로 명시적으로 닫아 둡니다. 해당 capability가
+활성화되기 전에는 production consumer에 source-map token을 설정하지 마세요.
+
+local/self-hosted upload API를 검증할 때만 Node config에서 service origin을 바꿉니다.
+
+```ts
+visualReview({
+  sourceMaps: {
+    serviceUrl: 'http://localhost:8787',
+  },
+})
+```
+
+`sourceMaps: false`는 CI environment에 token이 있어도 이 build의 업로드를 명시적으로
+끕니다. `sourceMaps: true`는 업로드를 명시적으로 요구하므로 token이 없으면 fail
+closed합니다.
+
+```tsx
+import { VisualReview } from '@01.works/visual-review/react';
+
+export function App() {
+  return (
+    <VisualReview
+      enabled={import.meta.env.VITE_VISUAL_REVIEW_ENABLED === 'true'}
+      build={{ mode: 'preview' }}
+    />
+  );
+}
+```
+
+### Next.js App Router
+
+지원 검증 범위는 Next.js 15.5와 16입니다. `/next` entry가 client boundary를
+포함하므로 server layout에서 import할 수 있습니다. `next.config` wrapper는
+object와 sync/async config factory를 보존합니다. 기존 webpack/Turbopack 설정을
+유지하면서 실제 CLI가 선택한 bundler에 opaque source marker loader를 추가하고,
+build identity로는 같은 공개 provenance 두 값만 추가합니다.
+Next가 config를 다시 평가하는 compiler worker에는 main build가 확정한 공개
+`buildId`/`gitCommit`만 process-local record로 전달합니다. 이 record는 엄격히
+검증되며 source-map token과 private marker salt를 포함하거나 산출물에 내보내지
+않습니다.
+
+```ts
+// next.config.mjs
+import { withVisualReview } from '@01.works/visual-review/next-config';
+
+export default withVisualReview({
+  reactStrictMode: true,
+});
+```
+
+```tsx
+import { VisualReview } from '@01.works/visual-review/next';
+
+export default function RootLayout({ children }: { children: React.ReactNode }) {
+  return (
+    <html lang="ko">
+      <body>
+        {children}
+        <VisualReview
+          enabled={process.env.NEXT_PUBLIC_VISUAL_REVIEW_ENABLED === 'true'}
+          build={{ mode: 'preview' }}
+        />
+      </body>
+    </html>
+  );
+}
+```
+
+### Vanilla TypeScript
+
+```ts
+import { installVisualReview } from '@01.works/visual-review';
+
+const review = installVisualReview({
+  enabled: import.meta.env.VITE_VISUAL_REVIEW_ENABLED === 'true',
+});
+
+// History API navigation is observed automatically.
+// 필요한 경우 await review.refresh();
+```
+
+지원되는 deployment commit 환경변수가 없으면 clean consumer Git HEAD를 사용합니다.
+dirty worktree, Git 미설치, 유효하지 않은 SHA에서는 commit을 추측하지 않고
+`unversioned`/`null`로 남깁니다. 명시적 release identity가 필요하면 build config에서
+`visualReview({ buildId, gitCommit })` 또는
+`withVisualReview(config, { buildId, gitCommit })`을 사용합니다. `gitCommit: null`은
+자동 탐색을 명시적으로 끕니다. 명시한 `buildId`는 서로 다른 deployment output에
+재사용하면 immutable source-map release가 fail closed하므로 배포마다 고유해야 합니다.
+commit은 full 40/64자리 SHA만 허용합니다.
+build adapter는 staging/production mode를 추측하지 않으므로 review deployment의
+component에는 `build={{ mode: 'preview' }}`를 명시합니다.
+
+## Activation
+
+`enabled`가 생략됐거나 정확히 `true`가 아니면 DOM, storage, auth, dynamic runtime
+import와 network bootstrap을 시작하지 않습니다. production에는 flag를 설정하지
+말고 Preview/Staging environment에만 설정합니다.
+
+처음에는 `?visual-review=<invitation-id>` 초대 링크로 접근합니다. hosted service가
+정확한 origin/path와 invitation을 activation gate로 확인하고, magic-code login 뒤
+browser가 accept endpoint에 refresh token을 보냅니다. Server는
+`db.asUser({ token })`으로 user-scoped claim을 실행하며 완료된 뒤에만 client가
+정확한 page를 선택해 Instant subscription과 overlay를 mount합니다. `revokedAt`,
+expiry와 claim 시 membership/project mismatch는 fail closed합니다.
+
+public `enabled` flag는 load gate이고 registered origin/path는 hosted
+activation/page-selection gate입니다. 지속 InstantDB data capability는 active,
+accepted, unexpired, non-tombstoned invitation이 선택한 project 범위입니다.
+reviewer membership은 claim 검증과 comment/reply author identity에 사용되며,
+접근 철회는 invitation revoke로 수행합니다. admin token은 browser로 전달되지
+않습니다.
+
+정식 default service는 `https://visual-review.01.works`입니다. DNS 전 repository
+검증에서는 local service를 사용할 수 있습니다. 현재 public Vercel alias는 exact
+`DASHBOARD_ORIGIN`과 달라 실제 owner workflow의 대체 URL이 아닙니다.
+
+```tsx
+<VisualReview
+  enabled
+  serviceUrl="http://localhost:8787"
+/>
+```
+
+`serviceUrl`은 local/self-hosted integration test용입니다. DNS/TLS 전환 뒤의
+normal consumer는 이 override를 제거합니다.
+
+strict CSP host는 response의 style nonce를 `styleNonce`로 전달할 수 있습니다.
+생략하면 document의 nonce가 있는 script/style에서 감지합니다. nonce는 Visual
+Review auth/error surface와 widget stylesheet에만 적용됩니다.
+
+## 라이선스
+
+01.works 제품 코드는 `UNLICENSED`, All rights reserved입니다. public registry에
+package가 노출되더라도 허가된 계약 범위 밖의 사용권을 부여하지 않습니다.
+포함된 Pindrop.js, React Grab, InstantDB 등 제3자 코드는 package와 함께 배포되는
+[`THIRD_PARTY_NOTICES.md`](./THIRD_PARTY_NOTICES.md)의 각 라이선스를 따릅니다.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,160 @@
+# Third-Party Notices
+
+The notices below apply only to the identified third-party portions. They do
+not change the proprietary license of the original 01.works product code.
+
+## Pindrop.js
+
+Portions of the bundled annotation core and review widget are derived from a
+one-time source snapshot of Pindrop.js.
+
+- Repository: https://github.com/huangdun/pindrop.js
+- Snapshot commit: `23d7be3cc3fcfaf29a02931b3537382a0e0f6aeb`
+- Snapshot version: `0.1.30`
+- Author: Dun Huang
+- License: MIT
+
+This product is not an upstream-compatible fork.
+
+### MIT License
+
+Copyright (c) 2026 Dun Huang
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+## React Grab
+
+The bundled selection engine uses `react-grab/primitives`, and the widget UI
+adapts interface elements from the source snapshot below.
+
+- Repository: https://github.com/aidenybai/react-grab
+- Version first integrated: `0.1.50`
+- Source snapshot commit: `2a39bc29e5f8bdbd69095cf1d33d91634576cd20`
+- License: MIT
+
+### MIT License
+
+Copyright (c) 2025 Aiden Bai
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+## Bippy
+
+React Grab includes portions of Bippy.
+
+- Repository: https://github.com/aidenybai/bippy
+- Version bundled: `0.6.1`
+- License: MIT
+
+Copyright 2024 Aiden Bai
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+## InstantDB JavaScript SDK
+
+The browser runtime bundles `@instantdb/core` and `@instantdb/version`, first
+integrated at version `1.0.52`.
+
+- Repository: https://github.com/instantdb/instant
+- License: Apache License 2.0
+- License text: `LICENSES/Apache-2.0.txt`
+
+## Mutative
+
+- Repository: https://github.com/unadlib/mutative
+- Version bundled: `1.3.0`
+- License: MIT
+
+Copyright (c) 2022 Michael Lin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+## UUID
+
+- Repository: https://github.com/uuidjs/uuid
+- Version bundled: `11.1.1`
+- License: MIT
+
+Copyright (c) 2010-2020 Robert Kieffer and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/build-identity-CgoY3-jy.js

@@ -0,0 +1,114 @@
+import { randomBytes } from "node:crypto";
+import { execFileSync } from "node:child_process";
+//#region src/build-identity.ts
+const FULL_GIT_COMMIT = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i;
+const PUBLIC_BUILD_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+const DEPLOYMENT_VARIANT = /^[0-9a-f]{32}$/;
+const hasOwn = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+function resolveVisualReviewBuildIdentity(options = {}, context = {
+	cwd: process.cwd(),
+	env: process.env
+}) {
+	const explicitCommit = resolveExplicitCommit(options);
+	const gitCommit = explicitCommit.configured ? explicitCommit.value : resolveProviderCommit(context.env) ?? resolveCleanGitHead(context.cwd, context.runGit ?? runGit);
+	return {
+		buildId: resolveBuildId(options, context.env, gitCommit, context.createDeploymentVariant ?? createDeploymentVariant),
+		gitCommit
+	};
+}
+function resolveExplicitCommit(options) {
+	if (!hasOwn(options, "gitCommit") || options.gitCommit === void 0) return {
+		configured: false,
+		value: null
+	};
+	if (options.gitCommit === null) return {
+		configured: true,
+		value: null
+	};
+	const commit = normalizeFullCommit(options.gitCommit);
+	if (!commit) throw new TypeError("visual-review gitCommit must be a full 40 or 64 character Git SHA");
+	return {
+		configured: true,
+		value: commit
+	};
+}
+function resolveProviderCommit(env) {
+	const candidates = [
+		env.VERCEL_GIT_COMMIT_SHA,
+		env.CF_PAGES_COMMIT_SHA,
+		env.NETLIFY === "true" ? env.COMMIT_REF : void 0,
+		env.RENDER_GIT_COMMIT,
+		env.RAILWAY_GIT_COMMIT_SHA,
+		env.GITHUB_ACTIONS === "true" ? env.GITHUB_SHA : void 0
+	];
+	for (const candidate of candidates) {
+		const commit = normalizeFullCommit(candidate);
+		if (commit) return commit;
+	}
+	return null;
+}
+function resolveBuildId(options, env, gitCommit, createVariant) {
+	if (hasOwn(options, "buildId") && options.buildId !== void 0) {
+		if (!isPublicBuildId(options.buildId)) throw new TypeError("visual-review buildId must be 1-128 characters using letters, numbers, dot, underscore, colon, or hyphen");
+		return options.buildId;
+	}
+	const providerBuildId = [
+		prefixedProviderBuildId("vercel", env.VERCEL_DEPLOYMENT_ID),
+		env.NETLIFY === "true" ? prefixedProviderBuildId("netlify", env.DEPLOY_ID) : null,
+		prefixedProviderBuildId("railway", env.RAILWAY_DEPLOYMENT_ID)
+	].find((value) => value !== null);
+	if (providerBuildId) return providerBuildId;
+	return gitCommit ? gitDeploymentBuildId(gitCommit, createVariant()) : "unversioned";
+}
+function gitDeploymentBuildId(gitCommit, variant) {
+	if (!DEPLOYMENT_VARIANT.test(variant)) throw new Error("visual-review generated an invalid deployment build variant");
+	return `git:${gitCommit}:deploy:${variant}`;
+}
+function createDeploymentVariant() {
+	return randomBytes(16).toString("hex");
+}
+function prefixedProviderBuildId(provider, value) {
+	if (!value) return null;
+	const buildId = `${provider}:${value}`;
+	return isPublicBuildId(buildId) ? buildId : null;
+}
+function normalizeFullCommit(value) {
+	if (typeof value !== "string") return null;
+	const normalized = value.trim().toLowerCase();
+	return FULL_GIT_COMMIT.test(normalized) ? normalized : null;
+}
+function isPublicBuildId(value) {
+	return typeof value === "string" && PUBLIC_BUILD_ID.test(value);
+}
+function resolveCleanGitHead(cwd, runner) {
+	try {
+		if (runner([
+			"status",
+			"--porcelain=v1",
+			"--untracked-files=all"
+		], cwd).trim().length > 0) return null;
+		return normalizeFullCommit(runner([
+			"rev-parse",
+			"--verify",
+			"HEAD"
+		], cwd));
+	} catch {
+		return null;
+	}
+}
+function runGit(arguments_, cwd) {
+	return execFileSync("git", arguments_, {
+		cwd,
+		encoding: "utf8",
+		maxBuffer: 64 * 1024,
+		stdio: [
+			"ignore",
+			"pipe",
+			"ignore"
+		],
+		timeout: 2e3,
+		windowsHide: true
+	}).trim();
+}
+//#endregion
+export { resolveVisualReviewBuildIdentity as t };