@dev.fast/whiteboard 0.4.1-preview.20261027.141 → 0.4.1-preview.20261028.142

package/dist/{headless-host-Cn6WDmaL.js → headless-host-CWuFw-CO.js}

@@ -1,23 +1,22 @@
-import { b as resolveRepoContext, d as git, r as defaultBranch, w as runVcs } from "./src-BTCRHmRM.js";
+import { b as resolveRepoContext, d as git, r as defaultBranch, w as runVcs } from "./src-Y30gweiK.js";
 import { c as jsonString, m as isStringValue, n as isJsonObject, p as isObjectValue, u as parseJsonText } from "./src-X9phtB2j.js";
-import { _ as readBoundedStream, a as verifyShareRepository, c as exportShare, d as legacyModeSchema, f as lensReport, g as StreamLimitError, h as uncategorizedReport, i as readShareRepository, l as referenceCommits, m as reviewProgress, n as sharedReviewId, o as ShareAuthError, p as progressUpdateSchema, s as ShareClient, u as validateShareSources, v as parseShareLink, y as shareIdSchema } from "./import-CUNdl3NP.js";
-import { d as invalidateStructuralComparisons, f as diffrExecutable, i as inspectSnapshot, m as readGitHubPullRequests, p as diffrMissingError, r as commandSchema } from "./local-data-DxkQXCNG.js";
-import { I as decodeStructuralDiffEvent, N as reviewDiffrLoginsSchema, O as ReviewFeedbackContactSchema, P as reviewDiffrSummarizerInputSchema, a as parseReviewVerbRequest, c as boardIconKind, i as parseReviewDesktopVerbResult, j as ReviewOnboardingRunRequestSchema, k as ReviewFeedbackSchema, l as boardTitle, m as REVIEW_CLIENT_REMOTE, p as REVIEW_CLIENT_HEADER, y as REVIEW_HOST_HEADER } from "./src-BJ_MeEmN.js";
-import { $ as runStoreLogin, M as selectTraceStorage, N as TraceStorageDeniedError, Q as readStoreAuth, X as DEFAULT_STORE_ORIGIN, Z as clearStoreAuth, b as listReviewTraceSessions, j as resolveTraceStorage, k as isTraceStorageConfigured, q as shellQuote, v as traceMachineEnabled, x as loadReviewAgentTrace } from "./src-KTjWplV9.js";
-import { _ as scopedCoverage, s as formatAnchor, u as selectionKey } from "./lens-selection-BQxqiuWY.js";
-import { N as elements, O as boardLinks, Q as stepSources, f as sourceBranchName, k as boardRepositoryId, l as pullRequestKey, p as pullRequestProvider, q as selectionReferences, w as anchorPins } from "./stored-document-migration-fQWLDqDx.js";
+import { _ as parseShareLink, a as readShareRepository, c as exportShare, d as lensReport, f as progressUpdateSchema, g as readBoundedStream, h as StreamLimitError, i as forgetSharedCommits, l as validateShareSources, m as uncategorizedReport, n as shareKey, o as ShareAuthError, p as reviewProgress, s as ShareClient, t as importShare, u as legacyModeSchema, v as shareIdSchema } from "./import-FOpJL22V.js";
+import { d as invalidateStructuralComparisons, f as diffrExecutable, i as inspectSnapshot, m as readGitHubPullRequests, p as diffrMissingError, r as commandSchema } from "./local-data-BhNZ1Yep.js";
+import { I as decodeStructuralDiffEvent, N as reviewDiffrLoginsSchema, O as ReviewFeedbackContactSchema, P as reviewDiffrSummarizerInputSchema, a as parseReviewVerbRequest, c as boardIconKind, i as parseReviewDesktopVerbResult, j as ReviewOnboardingRunRequestSchema, k as ReviewFeedbackSchema, l as boardTitle, m as REVIEW_CLIENT_REMOTE, p as REVIEW_CLIENT_HEADER, y as REVIEW_HOST_HEADER } from "./src-Bew3mW9I.js";
+import { B as TraceStorageDeniedError, D as listReviewTraceSessions, I as isTraceStorageConfigured, O as loadReviewAgentTrace, R as resolveTraceStorage, T as traceMachineEnabled, at as readStoreAuth, et as shellQuote, it as clearStoreAuth, ot as runStoreLogin, rt as DEFAULT_STORE_ORIGIN, z as selectTraceStorage } from "./review-home-paths-LdGS4SpR.js";
+import { _ as scopedCoverage, s as formatAnchor, u as selectionKey } from "./lens-selection-B_LTVyTB.js";
+import { K as selectionReferences, M as elements, O as boardRepositoryId, Z as stepSources, f as sourceBranchName, l as pullRequestKey, p as pullRequestProvider, w as anchorPins } from "./stored-document-migration-CZe65mkx.js";
 import { t as ReviewInputError } from "./input-error-OLgB_h31.js";
 import { A as processStartIdentity, L as writePrivateJsonAtomic, N as devReviewHome, h as TraceConfigurationError, i as isS3MockMode, j as withFileLock } from "./s3-config-CjcLyFV5.js";
 import { t as errorMessage } from "./error-message-OtiDonty.js";
-import { i as readReviewPackageVersion, n as readBuildCommit, t as findReviewPackageRoot } from "./package-paths-LcO6HNp_.js";
-import "./review-home-paths-CjHB5c8m.js";
-import { _ as reviewInstanceIdentity, n as desktopOwnsHome, o as reviewServerDiscoveryPath, p as desktopUsesHome, r as headlessServerLockPath, t as DESKTOP_TAKEOVER_SIGNAL } from "./server-discovery-Dj_xSDSa.js";
-import { c as askPicksSchema, d as selectionMarkdown, l as askQuestionSchema, n as askAgentIds, r as askChoiceKinds, s as askPermissionsSchema, t as applyAskChange, u as AgentSelectionSchema } from "./thread-state-BburMvgn.js";
-import { t as openReviewProfile } from "./profile-hC1iAoRB.js";
-import { c as REVIEW_APP_SESSION_ID_HEADER, d as sanitizeUiTelemetryEvent, f as cleanTelemetryText, o as reviewRequestOrigin, r as REVIEW_PERSON_HEADER, s as BUNDLE_FRAME_PATTERN, t as ASK_THREAD_ENV, u as isReportableCleanedMessage } from "./request-origin-BnA7Nnca.js";
-import { a as defaultAskPermissions, i as askAgents, l as launchAskAgent, n as askAgentSettings, o as detectAskAgents, r as askAgentTakesMcp, t as fuzzyRank } from "./fuzzy-match-rWIeloqo.js";
-import { a as inspectQuerySchema, i as renderInstructions, o as queryAnchor, r as instructionsQuerySchema, s as readQuerySchemas, t as authoringTools } from "./authoring-tools-B9MhiKw4.js";
-import { a as headlessServerOwner, c as stopBackgroundServer, o as recordedBackgroundServer } from "./background-server-DlgbnDVt.js";
+import { i as readReviewPackageVersion, n as readBuildCommit, t as findReviewPackageRoot } from "./package-paths-Cg6fnaGp.js";
+import { _ as reviewInstanceIdentity, n as desktopOwnsHome, o as reviewServerDiscoveryPath, p as desktopUsesHome, r as headlessServerLockPath, t as DESKTOP_TAKEOVER_SIGNAL } from "./server-discovery-D-2vz5gG.js";
+import { c as askPicksSchema, d as selectionMarkdown, l as askQuestionSchema, n as askAgentIds, r as askChoiceKinds, s as askPermissionsSchema, t as applyAskChange, u as AgentSelectionSchema } from "./thread-state-XgVKaQ3-.js";
+import { t as openReviewProfile } from "./profile-DnwIJvlh.js";
+import { c as REVIEW_APP_SESSION_ID_HEADER, d as sanitizeUiTelemetryEvent, f as cleanTelemetryText, o as reviewRequestOrigin, r as REVIEW_PERSON_HEADER, s as BUNDLE_FRAME_PATTERN, t as ASK_THREAD_ENV, u as isReportableCleanedMessage } from "./request-origin-DEQd09Db.js";
+import { a as defaultAskPermissions, i as askAgents, l as launchAskAgent, n as askAgentSettings, o as detectAskAgents, r as askAgentTakesMcp, t as fuzzyRank } from "./fuzzy-match-CTvayutE.js";
+import { a as inspectQuerySchema, i as renderInstructions, o as queryAnchor, r as instructionsQuerySchema, s as readQuerySchemas, t as authoringTools } from "./authoring-tools-B-OyXmtR.js";
+import { a as headlessServerOwner, c as stopBackgroundServer, o as recordedBackgroundServer } from "./background-server-CesuMV6N.js";
 import crypto$1, { createHash, randomBytes, randomUUID } from "node:crypto";
 import { z } from "zod";
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
@@ -2610,18 +2609,30 @@ const publishSchema = z.strictObject({
 	requestId: z.uuid().optional()
 });
 /** Mounted behind local host authentication. Account credentials never enter the renderer. */
-function mountSharingHost(app, store, data, shared, options = {}) {
+function mountSharingHost(app, store, data, options = {}) {
 	const startLogin = options.login ?? runStoreLogin;
 	let login = { pending: false };
-	app.get("/sharing/account", async (context) => {
+	let warmedAt = 0;
+	const readAccount = async () => {
 		const account = await readStoreAuth();
-		return context.json({
+		if (account && Date.now() - warmedAt > 6e4) {
+			warmedAt = Date.now();
+			new ShareClient(account.origin, account.token, options.fetch).warm().catch(() => {});
+		}
+		return {
 			account: account ? {
 				login: account.login,
-				origin: account.origin
+				origin: account.origin,
+				email: account.email,
+				githubLogin: account.githubLogin
 			} : null,
 			...login
-		});
+		};
+	};
+	app.get("/sharing/account", async (context) => context.json(await readAccount()));
+	app.post("/sharing/logout", async (context) => {
+		await clearStoreAuth();
+		return context.json(await readAccount());
 	});
 	app.post("/sharing/login", async (context) => {
 		if (!login.pending) {
@@ -2654,52 +2665,61 @@ function mountSharingHost(app, store, data, shared, options = {}) {
 	});
 	mountSharingPublisher(app, store, data, options);
 	const imports = /* @__PURE__ */ new Map();
+	let importing = Promise.resolve();
 	app.get("/sharing/import/:id", (context) => {
 		const id = context.req.param("id");
-		const status = shared.status(id);
-		const result = {
-			reviewId: id,
-			...status
+		const { reviewId = id, ...status } = imports.get(id) ?? {
+			stage: "error",
+			error: "Shared review is not available."
 		};
-		if (status.stage === "ready") return context.json({
-			...result,
-			title: shared.get(id).snapshot.title
+		return context.json({
+			reviewId,
+			...status,
+			...status.stage === "ready" && { title: store.read(reviewId).title }
 		});
-		return context.json(result);
 	});
 	app.post("/sharing/import", async (context) => {
 		const { url } = z.strictObject({ url: z.string().max(2048) }).parse(await readBoundedRequestJson(context.req.raw));
 		const parsed = parseShareLink(url);
 		const account = await readStoreAuth();
 		if (parsed.origin !== DEFAULT_STORE_ORIGIN && parsed.origin !== account?.origin) throw new ReviewInputError("This share uses an untrusted service. Sign in to that service before opening its links.", 400);
-		const id = sharedReviewId(parsed.origin, parsed.capability);
-		if (!imports.has(id)) {
-			shared.setStatus(id, "downloading");
-			const job = (async () => {
-				if (shared.has(id)) {
-					await shared.prepare(id);
-					return;
-				}
+		const id = shareKey(parsed.origin, parsed.capability);
+		const known = imports.get(id)?.stage;
+		if (!known || known === "ready" || known === "error") {
+			const copy = store.copyOf(id);
+			const status = copy ? {
+				stage: "ready",
+				reviewId: copy
+			} : { stage: "downloading" };
+			imports.set(id, status);
+			if (!copy) importing = importing.then(async () => {
 				const { bundle, attribution } = await new ShareClient(parsed.origin).download(parsed.capability);
-				await shared.import(parsed.origin, parsed.capability, bundle, attribution);
-			})().catch((error) => {
-				shared.setStatus(id, "error", error instanceof ReviewInputError ? error.message : "This share is unavailable, revoked, or needs a newer Whiteboard version.");
-			}).finally(() => imports.delete(id));
-			imports.set(id, job);
-			shared.trackImport(job);
+				status.reviewId = await importShare({
+					store,
+					data,
+					fetchRepository: options.fetchRepository,
+					cloneRepository: options.cloneRepository,
+					onStage: (stage) => {
+						status.stage = stage;
+					}
+				}, id, bundle, attribution);
+				status.stage = "ready";
+			}).catch((error) => {
+				status.stage = "error";
+				status.error = error instanceof ReviewInputError ? error.message : "This share is unavailable, revoked, or needs a newer Whiteboard version.";
+			});
 		}
+		const { reviewId: _reviewId, ...status } = imports.get(id);
 		return context.json({
 			reviewId: id,
-			...shared.status(id)
+			...status
 		}, 202);
 	});
 }
 /** Publishing needs only an authored store, never Desktop or recipient workspaces. */
 function mountSharingPublisher(app, store, data, options = {}) {
-	const verifyRepository = options.verifyRepository ?? verifyShareRepository;
 	app.post("/sharing/publish", async (context) => {
 		const input = publishSchema.parse(await readBoundedRequestJson(context.req.raw));
-		if (input.reviewId.startsWith("shared-")) throw new ReviewInputError("Only the authoring review can be shared.", 409);
 		const snapshot = store.read(input.reviewId, input.version);
 		if (snapshot.target?.kind === "worktree") throw new ReviewInputError("Pin this review to commits before sharing it.");
 		validateShareSources(snapshot);
@@ -2707,18 +2727,7 @@ function mountSharingPublisher(app, store, data, options = {}) {
 		if (!account) throw new ReviewInputError("Set DEV_REVIEW_SHARE_TOKEN for CI, or run whiteboard login before sharing.", 409);
 		const repositoryId = snapshot.pins?.repositoryId ?? snapshot.target?.repositoryId;
 		const root = repositoryId ? store.repositoryPath(repositoryId) : void 0;
-		const readRepository = options.readRepository ?? readShareRepository;
-		const commits = referenceCommits(snapshot);
-		const repository = (async () => {
-			if (!root) return void 0;
-			try {
-				const repository = await readRepository(root);
-				if (snapshot.pins || commits.length) await verifyRepository(root, snapshot.pins, commits);
-				return repository;
-			} catch {
-				return;
-			}
-		})();
+		const repository = root ? (options.readRepository ?? readShareRepository)(root).catch(() => void 0) : void 0;
 		const bundle = await exportShare({
 			store,
 			data,
@@ -2762,32 +2771,6 @@ function mountSharingPublisher(app, store, data, options = {}) {
 	});
 }
 //#endregion
-//#region src/sharing/routes.ts
-/** Snapshot-backed reads used by the same HTTP routes as local reviews. */
-var SharedReviewData = class {
-	store;
-	constructor(store) {
-		this.store = store;
-	}
-	map(id, resourceId) {
-		const { maps } = this.store.get(id);
-		if (!Object.hasOwn(maps, resourceId)) throw new ReviewInputError("Map is not included in this share.", 404);
-		return maps[resourceId];
-	}
-	async resource(id, resourceId) {
-		const { bundle } = this.store.get(id);
-		if (Object.hasOwn(bundle.images, resourceId)) return {
-			data: Buffer.from(bundle.images[resourceId].png, "base64"),
-			mimeType: "image/png"
-		};
-		if (Object.hasOwn(bundle.traces, resourceId)) return {
-			data: Buffer.from(JSON.stringify(bundle.traces[resourceId])),
-			mimeType: "application/json"
-		};
-		throw new ReviewInputError("Resource is not included in this share.", 404);
-	}
-};
-//#endregion
 //#region src/review-api/anchor-quotes.ts
 const QUOTE_LIMIT = 20;
 const clip = (line) => line.trim() === "" ? "(blank line)" : line.length > 120 ? `${line.slice(0, 119)}…` : line;
@@ -3494,7 +3477,7 @@ const PERSON_EDIT_MAX_BYTES = 16777216;
 /** A request the gateway forwarded from another machine. */
 const remoteCaller = (context) => context.req.header(REVIEW_CLIENT_HEADER) === REVIEW_CLIENT_REMOTE;
 /** Both hosts mount this behind their token authentication. */
-function createReviewApi(store, data, open, shared, capabilities = () => ({
+function createReviewApi(store, data, open, sharing = false, capabilities = () => ({
 	desktopAvailable: Boolean(open),
 	softwareMapEnabled: false
 }), traceEnabled = async () => false, status = () => ({}), hooks = {}, ask, animationsEnabled = () => false) {
@@ -3513,38 +3496,12 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 		if (context.req.method === "GET" && !context.req.query("version")) await store.refreshWorktrees();
 		await next();
 	});
-	const sharedData = shared ? new SharedReviewData(shared) : void 0;
-	const isShared = (id) => id.startsWith("shared-");
-	const assertWritable = (id) => {
-		if (isShared(id)) shared?.assertWritable(id);
-		else store.assertWritable(id);
-	};
-	const reviewAccess = (access) => async (context, next) => {
-		const id = context.req.param("id");
-		if (access !== "read") assertWritable(id);
-		if (access === "edit" && isShared(id)) throw new ReviewInputError("Shared reviews are read-only.", 409);
+	const writable = async (context, next) => {
+		store.assertWritable(context.req.param("id"));
 		await next();
 	};
-	const sharedCommandSchema = z.object({ operation: z.object({ reviewId: z.string().optional() }) });
-	const sharedGuard = async (context, next) => {
-		const id = context.req.param("id");
-		if (!id || !isShared(id)) return next();
-		const query = readQuerySchemas.get.parse({ version: context.req.query("version") });
-		readReview(id, query.version);
-		return next();
-	};
-	app.use("/:id", sharedGuard);
-	app.use("/:id/*", sharedGuard);
-	if (shared && data) {
-		shared.connect(store, data);
-		mountSharingHost(app, store, data, shared, hooks.sharing);
-	}
-	const readReview = (id, version) => {
-		if (!id.startsWith("shared-")) return store.read(id, version);
-		const snapshot = shared?.get(id).snapshot;
-		if (!snapshot || version !== void 0 && version !== snapshot.version) throw new ReviewInputError("Shared review version is unavailable.", 404);
-		return snapshot;
-	};
+	if (sharing && data) mountSharingHost(app, store, data, hooks.sharing);
+	const readReview = (id, version) => store.read(id, version);
 	/** Adds a PR board's state, as this host last read it from GitHub. */
 	const withPullRequestState = (board) => {
 		const state = data?.pullRequestState(board.origin?.pullRequestUrl ?? board.pullRequestUrl);
@@ -3553,11 +3510,11 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			pullRequestState: state
 		} : board;
 	};
-	const catalog = () => [...store.list().map(withPullRequestState), ...shared?.list() ?? []];
+	const catalog = () => store.list().map(withPullRequestState);
 	/** Where a board sits among its project's, and its PR's facts, for the
 	* board's header. */
 	const placeOf = (id) => {
-		if (isShared(id) || !store.has(id)) return { siblings: [] };
+		if (!store.has(id)) return { siblings: [] };
 		const { board, parent, siblings, children } = store.place(id);
 		const url = board.origin?.pullRequestUrl;
 		const state = data?.pullRequestState(url);
@@ -3614,7 +3571,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 		}
 		return context.json(await reviewProgress(store, data, snapshot, context.req.raw.signal));
 	});
-	app.post("/:id/progress", reviewAccess("edit"), async (context) => {
+	app.post("/:id/progress", writable, async (context) => {
 		if (!data) throw new ReviewInputError("Source data is unavailable.", 409);
 		const input = progressUpdateSchema.parse(await readBoundedRequestJson(context.req.raw));
 		const id = context.req.param("id");
@@ -3655,16 +3612,13 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 	app.get("/:id/activity", (context) => {
 		const id = context.req.param("id");
 		readReview(id);
-		return context.json(isShared(id) ? {
-			workingCount: 0,
-			expiresAt: null
-		} : store.activity.read(id));
+		return context.json(store.activity.read(id));
 	});
 	for (const action of [
 		"begin",
 		"update",
 		"end"
-	]) app.post(`/:id/activity/${action}`, reviewAccess("edit"), async (context) => {
+	]) app.post(`/:id/activity/${action}`, writable, async (context) => {
 		const input = await readBoundedRequestJson(context.req.raw);
 		const id = context.req.param("id");
 		store.assertExists(id);
@@ -3694,13 +3648,13 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 		let sentList;
 		const linksRevision = /* @__PURE__ */ new Map();
 		const linksKey = (id) => {
-			if (!data || isShared(id) || !store.has(id)) return "";
+			if (!data || !store.has(id)) return "";
 			const { outgoing, backlinks } = store.links(id);
 			return JSON.stringify([...outgoing, ...backlinks].map((link) => link.pullRequestUrl && data.pullRequestState(link.pullRequestUrl, { seen: false })));
 		};
 		const linksKeys = new Map([...reviewIds].map((reviewId) => [reviewId, linksKey(reviewId)]));
 		const placeKey = (id) => {
-			const project = !isShared(id) && store.summary(id)?.project;
+			const project = store.summary(id)?.project;
 			const branches = project ? store.listProject(project.id).filter(({ origin }) => origin?.branch).map(({ reviewId, origin, trashedAt }) => [
 				reviewId,
 				origin,
@@ -3800,9 +3754,6 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 					}
 					if (marked) notify();
 				}) ?? (() => {}),
-				shared?.subscribe(() => {
-					if (markLists()) notify();
-				}) ?? (() => {}),
 				store.subscribeCatalog(() => {
 					const marked = refreshPlaces();
 					if (markLists() || marked) notify();
@@ -3820,7 +3771,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 		});
 		let environmentIssues;
 		try {
-			if (review.target?.kind === "commits" && review.pins) data?.workspaces.open(review.reviewId, review.pins).catch(() => {});
+			if (review.target?.kind === "commits" && review.pins) data?.workspaces.source(review.reviewId, review.pins).catch(() => {});
 			environmentIssues = data?.currentEnvironmentIssues(review);
 		} catch (error) {
 			environmentIssues = [{ message: `Could not check language checkouts: ${errorMessage(error)}. Recheck with review_environment.` }];
@@ -3848,12 +3799,10 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			};
 		}
 	};
-	app.post("/:id/open", reviewAccess("active"), async (context) => {
-		const id = context.req.param("id");
-		if (isShared(id)) await shared?.assertReady(id);
+	app.post("/:id/open", writable, async (context) => {
 		return context.json({
 			ok: true,
-			...await openReview(readReview(id))
+			...await openReview(readReview(context.req.param("id")))
 		});
 	});
 	if (data) {
@@ -3880,9 +3829,8 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			}, result.status);
 			return context.json(result);
 		});
-		app.post("/:id/navigator", reviewAccess("edit"), async (context) => {
-			const input = readQuerySchemas.file.extend({
-				side: z.enum(["base", "head"]).default("head"),
+		app.post("/:id/navigator", writable, async (context) => {
+			const input = readQuerySchemas.file.omit({ side: true }).extend({
 				file: z.string().min(1).optional(),
 				empty: z.literal("true").optional()
 			}).parse(context.req.query());
@@ -3908,7 +3856,6 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 		app.get("/:id/maps/:resourceId", async (context) => {
 			const query = readQuerySchemas.maps.parse(context.req.query());
 			const id = context.req.param("id");
-			if (id && isShared(id)) return context.json(sharedData.map(id, z.string().parse(context.req.param("resourceId"))));
 			return context.json(await data.map(await data.sourcePins(readReview(id, query.version)), z.string().parse(context.req.param("resourceId"))));
 		});
 		app.post("/repositories", async (context) => {
@@ -3928,10 +3875,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 		app.get("/:id/resources/:resourceId", async (context) => {
 			const id = context.req.param("id");
 			const snapshot = readReview(id);
-			const resource = id && isShared(id) ? {
-				...await sharedData.resource(id, z.string().parse(context.req.param("resourceId"))),
-				repositoryId: snapshot.pins?.repositoryId ?? ""
-			} : store.resource(z.string().parse(context.req.param("resourceId")));
+			const resource = store.resource(z.string().parse(context.req.param("resourceId")));
 			if (snapshot.pins && resource.repositoryId !== snapshot.pins.repositoryId) throw new ReviewInputError("Resource is outside this repository.", 404);
 			return new Response(Buffer.from(resource.data), { headers: {
 				"content-type": resource.mimeType,
@@ -3940,14 +3884,13 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 		});
 		app.get("/:id/language-context", async (context) => {
 			const input = readQuerySchemas.maps.extend({
-				side: z.enum(["base", "head"]).default("head"),
 				commit: z.string().optional(),
 				repositoryId: z.string().optional(),
 				head: z.string().optional(),
 				base: z.string().optional()
 			}).parse(context.req.query());
 			const snapshot = readReview(context.req.param("id"), input.version);
-			const environment = await data.languageEnvironment(snapshot, input.side, input.commit, false, queryAnchor(input));
+			const environment = await data.languageEnvironment(snapshot, input.commit, false, queryAnchor(input));
 			if (context.req.header("x-review-client") !== "remote") return context.json(environment);
 			const { rootPath, ...rest } = environment;
 			return context.json({
@@ -3956,7 +3899,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 				serverId: store.serverId()
 			});
 		});
-		app.post("/:id/environment", reviewAccess("active"), async (context) => {
+		app.post("/:id/environment", writable, async (context) => {
 			const input = z.strictObject({ retry: z.boolean().optional() }).parse(await readBoundedRequestJson(context.req.raw));
 			return context.json({ issues: await data.environmentIssues(readReview(context.req.param("id")), input.retry) });
 		});
@@ -3969,7 +3912,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			readReview(context.req.param("id"));
 			return context.json(data.workspaces.list(context.req.param("id")));
 		});
-		app.post("/:id/workspaces/:workspaceId/retry", reviewAccess("active"), async (context) => {
+		app.post("/:id/workspaces/:workspaceId/retry", writable, async (context) => {
 			return context.json(await data.workspaces.retry(context.req.param("id"), context.req.param("workspaceId")));
 		});
 		app.get("/:id/file", async (context) => {
@@ -4041,7 +3984,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			return context.json(await data.commits((await data.resolveSource(readReview(context.req.param("id"), input.version))).pins));
 		});
 	}
-	app.post("/:id/copy-context", reviewAccess("read"), async (context) => {
+	app.post("/:id/copy-context", async (context) => {
 		const query = readQuerySchemas.get.pick({ version: true }).extend({ mode: legacyModeSchema }).parse(context.req.query());
 		const selection = AgentSelectionSchema.parse(await readBoundedRequestJson(context.req.raw));
 		return context.json({ text: await selectionContext(context.req.param("id"), selection, query.version) });
@@ -4083,7 +4026,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 		].join("\n");
 	}
 	if (ask && data) {
-		const projectOf = (reviewId) => isShared(reviewId) || !store.has(reviewId) ? void 0 : store.projectOf(reviewId);
+		const projectOf = (reviewId) => store.has(reviewId) ? store.projectOf(reviewId) : void 0;
 		const readThread = (reviewId, threadId) => {
 			const thread = ask.threads.get(threadId);
 			if (!thread) throw new ReviewInputError("This conversation has ended.", 404);
@@ -4179,7 +4122,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			const files = fuzzyRank(query, await mentionableFiles(cwd), (file) => [file, file.slice(file.lastIndexOf("/") + 1)]);
 			return context.json({ paths: files.slice(0, MENTION_LIMIT) });
 		});
-		app.post("/:id/ask", reviewAccess("edit"), async (context) => {
+		app.post("/:id/ask", writable, async (context) => {
 			const reviewId = context.req.param("id");
 			const { version } = readQuerySchemas.get.pick({ version: true }).parse(context.req.query());
 			const input = askStartSchema.parse(await readBoundedRequestJson(context.req.raw, ASK_REQUEST_MAX_BYTES));
@@ -4190,7 +4133,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			const createdAt = (/* @__PURE__ */ new Date()).toISOString();
 			const permissions = input.permissions ?? defaultAskPermissions(input.agent);
 			const initialContext = await askContext(id, input.agent, snapshot, checkout, input.selection, version);
-			assertWritable(reviewId);
+			store.assertWritable(reviewId);
 			store.askHistory.markViewed(id, createdAt);
 			const thread = ask.threads.open({
 				id,
@@ -4308,7 +4251,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 				board: reviewId
 			});
 		});
-		app.post("/:id/ask/watch", reviewAccess("read"), async (context) => {
+		app.post("/:id/ask/watch", async (context) => {
 			const reviewId = context.req.param("id");
 			readReview(reviewId);
 			const { threads } = askWatchSchema.parse(await readBoundedRequestJson(context.req.raw));
@@ -4343,7 +4286,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 				entries: record.entries ?? []
 			});
 		});
-		app.post("/:id/ask/:threadId/open", reviewAccess("edit"), async (context) => {
+		app.post("/:id/ask/:threadId/open", writable, async (context) => {
 			const reviewId = context.req.param("id");
 			const threadId = context.req.param("threadId");
 			if (ask.threads.get(threadId)) return context.json({ threadId });
@@ -4355,7 +4298,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			const checkout = await data.agentCheckout(snapshot);
 			const target = record.selection.target;
 			const initialContext = await askContext(record.id, record.agent, snapshot, checkout, record.selection, record.version);
-			assertWritable(reviewId);
+			store.assertWritable(reviewId);
 			ask.threads.open({
 				id: record.id,
 				reviewId: anchor,
@@ -4377,7 +4320,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			});
 			return context.json({ threadId: record.id });
 		});
-		app.post("/:id/ask/:threadId/prompt", reviewAccess("edit"), async (context) => {
+		app.post("/:id/ask/:threadId/prompt", writable, async (context) => {
 			const thread = readThread(context.req.param("id"), context.req.param("threadId"));
 			const { question } = askFollowUpSchema.parse(await readBoundedRequestJson(context.req.raw, ASK_REQUEST_MAX_BYTES));
 			const refusal = thread.askRefusal();
@@ -4385,13 +4328,13 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			thread.ask(question);
 			return context.json({ ok: true });
 		});
-		app.post("/:id/ask/:threadId/permission", reviewAccess("edit"), async (context) => {
+		app.post("/:id/ask/:threadId/permission", writable, async (context) => {
 			const thread = readThread(context.req.param("id"), context.req.param("threadId"));
 			const decision = askDecisionSchema.parse(await readBoundedRequestJson(context.req.raw));
 			if (!thread.decide(decision.permissionId, decision.optionId)) throw new ReviewInputError("This request was already answered.", 409);
 			return context.json({ ok: true });
 		});
-		app.post("/:id/ask/:threadId/files", reviewAccess("edit"), async (context) => {
+		app.post("/:id/ask/:threadId/files", writable, async (context) => {
 			const thread = readThread(context.req.param("id"), context.req.param("threadId"));
 			const { paths } = askFilesSchema.parse(await readBoundedRequestJson(context.req.raw));
 			const { cwd, entries } = thread.read();
@@ -4402,7 +4345,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 				file
 			})) });
 		});
-		app.post("/:id/ask/:threadId/choice", reviewAccess("edit"), async (context) => {
+		app.post("/:id/ask/:threadId/choice", writable, async (context) => {
 			const thread = readThread(context.req.param("id"), context.req.param("threadId"));
 			const { kind, value } = askChoiceSchema.parse(await readBoundedRequestJson(context.req.raw));
 			if (thread.read().status !== "idle") throw new ReviewInputError("Settings can change once the agent finishes answering.", 409);
@@ -4413,7 +4356,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			}
 			return context.json({ ok: true });
 		});
-		app.post("/:id/ask/:threadId/permissions", reviewAccess("edit"), async (context) => {
+		app.post("/:id/ask/:threadId/permissions", writable, async (context) => {
 			const thread = readThread(context.req.param("id"), context.req.param("threadId"));
 			const { permissions } = askPermitSchema.parse(await readBoundedRequestJson(context.req.raw));
 			if (thread.read().status !== "idle") throw new ReviewInputError("Settings can change once the agent finishes answering.", 409);
@@ -4424,13 +4367,13 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			}
 			return context.json({ ok: true });
 		});
-		app.post("/:id/ask/:threadId/retry", reviewAccess("edit"), (context) => {
+		app.post("/:id/ask/:threadId/retry", writable, (context) => {
 			const thread = readThread(context.req.param("id"), context.req.param("threadId"));
 			if (thread.read().status !== "failed") throw new ReviewInputError("Only a conversation that failed can try again.", 409);
 			thread.retry();
 			return context.json({ ok: true });
 		});
-		app.post("/:id/ask/:threadId/cancel", reviewAccess("read"), async (context) => {
+		app.post("/:id/ask/:threadId/cancel", async (context) => {
 			await readThread(context.req.param("id"), context.req.param("threadId")).cancel();
 			return context.json({ ok: true });
 		});
@@ -4440,12 +4383,12 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			store.askHistory.markViewed(threadId);
 			return context.json({ ok: true });
 		});
-		app.post("/:id/ask/:threadId/close", reviewAccess("read"), (context) => {
+		app.post("/:id/ask/:threadId/close", (context) => {
 			readThread(context.req.param("id"), context.req.param("threadId"));
 			ask.threads.close(context.req.param("threadId"), !readReview(context.req.param("id")).trashedAt);
 			return context.json({ ok: true });
 		});
-		app.delete("/:id/ask/:threadId", reviewAccess("edit"), (context) => {
+		app.delete("/:id/ask/:threadId", writable, (context) => {
 			context.req.param("id");
 			const threadId = context.req.param("threadId");
 			if (!store.askHistory.get(threadId)) throw new ReviewInputError("This conversation was not found.", 404);
@@ -4456,14 +4399,14 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 	}
 	app.get("/:id/place", (context) => {
 		const id = context.req.param("id");
-		if (!isShared(id)) store.assertExists(id);
+		store.assertExists(id);
 		return context.json(placeOf(id));
 	});
 	app.get("/:id/stack", async (context) => {
 		const query = readQuerySchemas.get.parse(context.req.query());
 		const id = context.req.param("id");
 		let snapshot = readReview(id, query.version);
-		if (isShared(id) || !snapshot.pins) return context.json({ layers: [] });
+		if (!snapshot.pins) return context.json({ layers: [] });
 		if (data) snapshot = await data.discoverPullRequest(snapshot);
 		const repositoryPath = store.repositories().find((repository) => repository.id === snapshot.pins.repositoryId)?.path;
 		const layers = await resolveReviewStackLayers(snapshot, store.list(), { repositoryPath });
@@ -4481,10 +4424,6 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 	});
 	app.get("/:id/project", (context) => {
 		const id = context.req.param("id");
-		if (isShared(id)) return context.json({
-			project: null,
-			boards: []
-		});
 		const project = store.summary(id)?.project ?? null;
 		return context.json({
 			project,
@@ -4493,15 +4432,6 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 	});
 	app.get("/:id/links", (context) => {
 		const id = context.req.param("id");
-		if (isShared(id)) return context.json({
-			outgoing: boardLinks(id, readReview(id).document).map(({ from, to }) => ({
-				from,
-				to,
-				missing: true,
-				elsewhere: true
-			})),
-			backlinks: []
-		});
 		const { version } = readQuerySchemas.get.pick({ version: true }).parse({ version: context.req.query("version") });
 		const { outgoing, backlinks } = store.links(id, version);
 		return context.json({
@@ -4511,7 +4441,6 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 	});
 	app.get("/:id/links/peek", (context) => {
 		const id = context.req.param("id");
-		if (isShared(id)) return context.json({});
 		const { version } = readQuerySchemas.get.pick({ version: true }).parse({ version: context.req.query("version") });
 		const board = context.req.query("board");
 		const block = context.req.query("block");
@@ -4522,15 +4451,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 		}, version));
 	});
 	app.get("/:id/history", (context) => {
-		const id = context.req.param("id");
-		if (!isShared(id)) return context.json(store.history(id));
-		const snapshot = readReview(id);
-		return context.json([{
-			version: snapshot.version,
-			title: snapshot.title,
-			createdAt: snapshot.createdAt,
-			author: "agent"
-		}]);
+		return context.json(store.history(context.req.param("id")));
 	});
 	/** A board's relations as session_list reports them: only those it has. */
 	const listedRelations = ({ parentId, children, dependsOn }) => {
@@ -4557,15 +4478,15 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 		const query = inspectQuerySchema.parse(context.req.query());
 		const id = context.req.param("id");
 		const snapshot = readReview(id, query.version);
-		return context.json(query.format === "text" ? documentText(snapshot, query.targetId, Boolean(query.full), isShared(id) ? void 0 : relatedBoards(id)) : query.targetId !== void 0 ? inspectSnapshot(snapshot, query.targetId) : {
+		return context.json(query.format === "text" ? documentText(snapshot, query.targetId, Boolean(query.full), relatedBoards(id)) : query.targetId !== void 0 ? inspectSnapshot(snapshot, query.targetId) : {
 			...query.full ? snapshot : inspectSnapshot(snapshot),
-			...!isShared(id) && listedRelations(store.relations(id))
+			...listedRelations(store.relations(id))
 		});
 	});
 	app.get("/:id", async (context) => {
 		const query = readQuerySchemas.get.parse(context.req.query());
 		let snapshot = { ...readReview(context.req.param("id"), query.version) };
-		if (data && query.full && query.version === void 0 && !isShared(snapshot.reviewId)) snapshot = await data.discoverPullRequest(snapshot);
+		if (data && query.full && query.version === void 0) snapshot = await data.discoverPullRequest(snapshot);
 		if (data && query.full) try {
 			const pins = await data.sourcePins(snapshot);
 			if (pins) snapshot.pins = pins;
@@ -4597,35 +4518,16 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			const target = "targetId" in edit ? elements(readReview(reviewId).document).find((element) => element.id === edit.targetId) : void 0;
 			if (incoming.some((element) => element.type === "animation") || target?.type === "animation") throw new ReviewInputError("Animation authoring is disabled. Enable Animations in Settings under Experimental Features to edit animations. Existing animations can still be viewed.", 409);
 		}
-		const command = sharedCommandSchema.safeParse(input);
-		if (command.success && command.data.operation.reviewId?.startsWith("shared-")) {
-			const parsed = commandSchema.parse(input);
-			if (shared && parsed.operation.type === "delete") {
-				if (!shared.get(parsed.operation.reviewId).snapshot.trashedAt) throw new ReviewInputError("Move this whiteboard to Trash before deleting it.", 409);
-				await shared.removeLocal(parsed.operation.reviewId);
-				return context.json({
-					reviewId: parsed.operation.reviewId,
-					version: 0,
-					deleted: true
-				});
-			}
-			if (shared && (parsed.operation.type === "attention" || parsed.operation.type === "lifecycle")) {
-				if (parsed.operation.type === "lifecycle") await shared.setLifecycle(parsed.operation.reviewId, parsed.operation.state);
-				else await shared.setAttention(parsed.operation.reviewId);
-				return context.json({
-					reviewId: parsed.operation.reviewId,
-					version: shared.get(parsed.operation.reviewId).snapshot.version,
-					attention: true
-				});
-			}
-			throw new ReviewInputError("Shared reviews are read-only.", 409);
-		}
 		const threadId = remoteCaller(context) ? void 0 : context.req.header("x-review-thread")?.trim() || void 0;
 		const author = !remoteCaller(context) && context.req.header("x-review-person") !== void 0 ? { kind: "person" } : {
 			kind: "agent",
 			...threadId && { threadId }
 		};
+		const copy = input.operation.type === "delete" && store.has(input.operation.reviewId) ? store.read(input.operation.reviewId) : void 0;
 		const result = await store.execute(input, void 0, author);
+		const key = copy?.shared?.key;
+		const kept = copy && boardRepositoryId(copy);
+		if (result.deleted && key && kept) await Promise.resolve().then(() => forgetSharedCommits(store.repositoryPath(kept), key)).catch((error) => console.error("Could not drop a copy's kept commits:", error));
 		if (input.operation.type === "edit" && data && !result.deleted) {
 			const { quotes, unquoted } = await anchorQuotes(result.version > 0 ? store.read(result.reviewId, result.version - 1) : void 0, store.read(result.reviewId, result.version), async (pins, side, file) => (await data.file(pins, side, file)).text);
 			return context.json({
@@ -4947,7 +4849,7 @@ function answerErrorsAsJson(app) {
 	});
 }
 function createWhiteboardCore(input) {
-	const { store, data, shared } = input.profile;
+	const { store, data } = input.profile;
 	const app = createReviewServerApp({
 		token: input.token,
 		instanceId: input.instanceId,
@@ -4964,22 +4866,20 @@ function createWhiteboardCore(input) {
 		takesMcp: async (agent) => askAgentTakesMcp(agent, await ask.env),
 		...ask.tools
 	});
-	const closeDeletedThreads = () => askThreads?.closeDeletedReviews((id) => id.startsWith("shared-") ? !shared?.has(id) || Boolean(shared.get(id).snapshot.trashedAt) : !store.has(id) || Boolean(store.read(id).trashedAt));
+	const closeDeletedThreads = () => askThreads?.closeDeletedReviews((id) => !store.has(id) || Boolean(store.read(id).trashedAt));
 	const stopLocal = askThreads && store.subscribe((result) => {
 		if (result.deleted || result.lifecycle) closeDeletedThreads();
 	});
-	const stopShared = askThreads && shared?.subscribe(closeDeletedThreads);
-	const api = createReviewApi(store, data, callbacks.open, shared, callbacks.capabilities, () => traceMachineEnabled(), input.status, input.hooks, askThreads && {
+	const api = createReviewApi(store, data, callbacks.open, input.sharing, callbacks.capabilities, () => traceMachineEnabled(), input.status, input.hooks, askThreads && {
 		threads: askThreads,
 		agents: async () => detectAskAgents(await ask?.env)
 	}, input.animations);
-	if (!shared) mountSharingPublisher(api, store, data);
+	if (!input.sharing) mountSharingPublisher(api, store, data);
 	return {
 		app,
 		api,
 		close: () => {
 			stopLocal?.();
-			stopShared?.();
 			closeDeletedThreads();
 			askThreads?.closeAll();
 		}