@dev.fast/whiteboard 0.5.0 → 0.5.2-preview.20261104.146

package/dist/{headless-host-Dl2KZ9IT.js → headless-host-FAlbekFD.js}

@@ -1,21 +1,21 @@
 import { b as resolveRepoContext, d as git, r as defaultBranch, w as runVcs } from "./src-Y30gweiK.js";
 import { c as jsonString, m as isStringValue, n as isJsonObject, p as isObjectValue, u as parseJsonText } from "./src-X9phtB2j.js";
-import { _ as readBoundedStream, a as forgetSharedCommits, b as shareBundleSchema, c as ShareClient, d as legacyModeSchema, f as lensReport, g as StreamLimitError, h as uncategorizedReport, l as exportShare, m as reviewProgress, n as needsRepository, o as readShareRepository, p as progressUpdateSchema, r as shareKey, s as ShareAuthError, t as importShare, u as validateShareSources, x as shareIdSchema, y as parseShareLink } from "./import-YAIU6rB0.js";
-import { I as stepSources, T as selectionReferences, U as animationCode, et as formatAnchor, n as anchorPins, o as boardRepositoryId, ot as ReviewInputError, rt as selectionKey, u as elements } from "./src-B2b8cCoI.js";
-import { c as invalidateStructuralComparisons, d as readGitHubPullRequests, i as inspectSnapshot, l as diffrExecutable, r as commandSchema, u as diffrMissingError } from "./local-data-C58vzLZR.js";
-import { I as decodeStructuralDiffEvent, N as reviewDiffrLoginsSchema, O as ReviewFeedbackContactSchema, P as reviewDiffrSummarizerInputSchema, a as parseReviewVerbRequest, c as boardIconKind, i as parseReviewDesktopVerbResult, j as ReviewOnboardingRunRequestSchema, k as ReviewFeedbackSchema, l as boardTitle, m as REVIEW_CLIENT_REMOTE, p as REVIEW_CLIENT_HEADER, y as REVIEW_HOST_HEADER } from "./src-DLWol7GZ.js";
-import { B as TraceStorageDeniedError, D as listReviewTraceSessions, I as isTraceStorageConfigured, O as loadReviewAgentTrace, R as resolveTraceStorage, T as traceMachineEnabled, at as readStoreAuth, et as shellQuote, it as clearStoreAuth, ot as runStoreLogin, rt as DEFAULT_STORE_ORIGIN, z as selectTraceStorage } from "./review-home-paths-LdGS4SpR.js";
-import { D as scopedCoverage, f as sourceBranchName, l as pullRequestKey, p as pullRequestProvider } from "./stored-document-migration-iwIQ4l5G.js";
+import { C as StreamLimitError, D as shareIdSchema, E as shareBundleSchema, S as uncategorizedReport, T as parseShareLink, _ as validateShareSources, a as shareKey, b as progressUpdateSchema, c as readShareRepository, d as ShareRequestError, f as parseWhiteboardFile, g as exportShare, h as whiteboardFileText, i as receiveShare, l as ShareAuthError, m as whiteboardFileName, n as needsRepository, p as whiteboardFileKey, r as planShareCopy, s as forgetSharedCommits, t as importShare, u as ShareClient, v as legacyModeSchema, w as readBoundedStream, x as reviewProgress, y as lensReport } from "./import-CZ1958L4.js";
+import { I as stepSources, T as selectionReferences, U as animationCode, et as formatAnchor, n as anchorPins, o as boardRepositoryId, ot as ReviewInputError, rt as selectionKey, u as elements } from "./src-BQDlJXkG.js";
+import { c as invalidateStructuralComparisons, d as readGitHubPullRequests, i as inspectSnapshot, l as diffrExecutable, r as commandSchema, u as diffrMissingError } from "./local-data-DdFkxFK_.js";
+import { A as ReviewFeedbackSchema, F as reviewDiffrSummarizerInputSchema, L as decodeStructuralDiffEvent, M as ReviewOnboardingRunRequestSchema, P as reviewDiffrLoginsSchema, a as parseReviewVerbRequest, c as boardIconKind, i as parseReviewDesktopVerbResult, k as ReviewFeedbackContactSchema, l as boardTitle, m as REVIEW_CLIENT_REMOTE, p as REVIEW_CLIENT_HEADER, y as REVIEW_HOST_HEADER } from "./src-CrrW7lcY.js";
+import { B as TraceStorageDeniedError, D as listReviewTraceSessions, I as isTraceStorageConfigured, O as loadReviewAgentTrace, R as resolveTraceStorage, T as traceMachineEnabled, at as readStoreAuth, et as shellQuote, it as clearStoreAuth, ot as runStoreLogin, rt as DEFAULT_STORE_ORIGIN, z as selectTraceStorage } from "./review-home-paths-BmZX2qiz.js";
+import { D as scopedCoverage, f as sourceBranchName, l as pullRequestKey, p as pullRequestProvider } from "./stored-document-migration-D1wK4yID.js";
 import { A as processStartIdentity, L as writePrivateJsonAtomic, N as devReviewHome, h as TraceConfigurationError, i as isS3MockMode, j as withFileLock } from "./s3-config-CjcLyFV5.js";
 import { t as errorMessage } from "./error-message-OtiDonty.js";
-import { i as readReviewPackageVersion, n as readBuildCommit, t as findReviewPackageRoot } from "./package-paths-Cg6fnaGp.js";
-import { _ as reviewInstanceIdentity, n as desktopOwnsHome, o as reviewServerDiscoveryPath, p as desktopUsesHome, r as headlessServerLockPath, t as DESKTOP_TAKEOVER_SIGNAL } from "./server-discovery-WmuFl2S3.js";
-import { c as askPicksSchema, d as selectionMarkdown, l as askQuestionSchema, n as askAgentIds, r as askChoiceKinds, s as askPermissionsSchema, t as applyAskChange, u as AgentSelectionSchema } from "./thread-state-B7L1mpN_.js";
-import { t as openReviewProfile } from "./profile--BYIjPkc.js";
-import { c as REVIEW_APP_SESSION_ID_HEADER, d as sanitizeUiTelemetryEvent, f as cleanTelemetryText, o as reviewRequestOrigin, r as REVIEW_PERSON_HEADER, s as BUNDLE_FRAME_PATTERN, t as ASK_THREAD_ENV, u as isReportableCleanedMessage } from "./request-origin-B3_XI2VA.js";
-import { a as defaultAskPermissions, i as askAgents, l as launchAskAgent, n as askAgentSettings, o as detectAskAgents, r as askAgentTakesMcp, t as fuzzyRank } from "./fuzzy-match-DZjeOaPY.js";
-import { a as inspectQuerySchema, i as renderInstructions, o as queryAnchor, r as instructionsQuerySchema, s as readQuerySchemas, t as authoringTools } from "./authoring-tools-CiLy46kh.js";
-import { a as headlessServerOwner, c as stopBackgroundServer, o as recordedBackgroundServer } from "./background-server-eZWXoVcI.js";
+import { i as readReviewPackageVersion, n as readBuildCommit, t as findReviewPackageRoot } from "./package-paths-Dk7MOXxN.js";
+import { _ as reviewInstanceIdentity, n as desktopOwnsHome, o as reviewServerDiscoveryPath, p as desktopUsesHome, r as headlessServerLockPath, t as DESKTOP_TAKEOVER_SIGNAL } from "./server-discovery-CV5qf1J8.js";
+import { c as askPicksSchema, d as selectionMarkdown, l as askQuestionSchema, n as askAgentIds, r as askChoiceKinds, s as askPermissionsSchema, t as applyAskChange, u as AgentSelectionSchema } from "./thread-state-WTqSborE.js";
+import { t as openReviewProfile } from "./profile-Bsgzi9PA.js";
+import { c as REVIEW_APP_SESSION_ID_HEADER, d as sanitizeUiTelemetryEvent, f as cleanTelemetryText, o as reviewRequestOrigin, r as REVIEW_PERSON_HEADER, s as BUNDLE_FRAME_PATTERN, t as ASK_THREAD_ENV, u as isReportableCleanedMessage } from "./request-origin-D6B-zrL8.js";
+import { a as defaultAskPermissions, i as askAgents, l as launchAskAgent, n as askAgentSettings, o as detectAskAgents, r as askAgentTakesMcp, t as fuzzyRank } from "./fuzzy-match-CxcsLQGx.js";
+import { a as inspectQuerySchema, i as renderInstructions, o as queryAnchor, r as instructionsQuerySchema, s as readQuerySchemas, t as authoringTools } from "./authoring-tools-CkfxTVJm.js";
+import { a as headlessServerOwner, c as stopBackgroundServer, o as recordedBackgroundServer } from "./background-server-BraP8pJ9.js";
 import crypto$1, { createHash, randomBytes, randomUUID } from "node:crypto";
 import { z } from "zod";
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
@@ -28,9 +28,9 @@ import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { promisify } from "node:util";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { PROTOCOL_VERSION, RequestError, client, methods } from "@agentclientprotocol/sdk";
+import { getRequestListener } from "@hono/node-server";
 import { Hono } from "hono";
 import { stringify } from "smol-toml";
-import { getRequestListener } from "@hono/node-server";
 import { createServer } from "node:http";
 import { streamSSE } from "hono/streaming";
 import { once } from "node:events";
@@ -1404,6 +1404,399 @@ var AskThreads = class {
 	}
 };
 //#endregion
+//#region src/review-preferences.ts
+/**
+* Machine-wide Review preferences the server itself needs. Workbench settings
+* do not work here: the review server never reads the workbench
+* configuration.
+*/
+function reviewPreferencesPath(devHome = devReviewHome()) {
+	return path.join(devHome, "preferences.json");
+}
+/** Whether agents are offered animation authoring; existing animations
+* always render. A missing or unreadable file means off; it never throws. */
+async function readAnimationsEnabled(devHome) {
+	try {
+		const raw = parseJsonText(await readFile(reviewPreferencesPath(devHome), "utf8"));
+		return isJsonObject(raw) && raw.animationsEnabled === true;
+	} catch {
+		return false;
+	}
+}
+async function writeAnimationsEnabled(enabled, devHome) {
+	await writePrivateJsonAtomic(reviewPreferencesPath(devHome), { animationsEnabled: enabled });
+	return enabled;
+}
+//#endregion
+//#region src/server/http-json.ts
+const DEFAULT_MAX_REQUEST_BYTES = 1048576;
+var HttpJsonError = class extends Error {
+	statusCode;
+	constructor(message, statusCode) {
+		super(message);
+		this.statusCode = statusCode;
+		this.name = "HttpJsonError";
+	}
+};
+/** An error whose status and machine code the JSON routes hand straight back. */
+var ReviewServerError = class extends Error {
+	statusCode;
+	code;
+	name = "ReviewServerError";
+	constructor(message, statusCode, code) {
+		super(message);
+		this.statusCode = statusCode;
+		this.code = code;
+	}
+};
+//#endregion
+//#region src/server/hono-http.ts
+const H2_FORBIDDEN_HEADERS = [
+	"connection",
+	"keep-alive",
+	"proxy-connection",
+	"transfer-encoding",
+	"upgrade"
+];
+function createNodeRequestListener(app) {
+	return getRequestListener(async (request, env) => {
+		const response = await app.fetch(request, env);
+		if (env.incoming.httpVersionMajor !== 2 || !H2_FORBIDDEN_HEADERS.some((name) => response.headers.has(name))) return response;
+		const stripped = new Response(response.body, response);
+		for (const name of H2_FORBIDDEN_HEADERS) stripped.headers.delete(name);
+		return stripped;
+	});
+}
+function jsonResponse(body, status, options = {}) {
+	const headers = new Headers({ "content-type": options.contentType ?? "application/json; charset=utf-8" });
+	if (options.cacheControl) headers.set("cache-control", options.cacheControl);
+	const serialized = JSON.stringify(body);
+	return new Response(options.newline === false ? serialized : `${serialized}\n`, {
+		status,
+		headers
+	});
+}
+function applyCorsHeaders(request, response) {
+	const origin = request.headers.get("origin");
+	if (origin) {
+		response.headers.set("access-control-allow-origin", origin);
+		const vary = response.headers.get("vary");
+		const varyFields = vary?.split(",").map((field) => field.trim().toLowerCase());
+		if (!varyFields?.includes("*") && !varyFields?.includes("origin")) response.headers.set("vary", vary ? `${vary}, Origin` : "Origin");
+	}
+	response.headers.set("access-control-allow-headers", `content-type, x-review-token, ${REVIEW_PERSON_HEADER}, ${REVIEW_APP_SESSION_ID_HEADER}`);
+	response.headers.set("access-control-allow-methods", "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS");
+	response.headers.set("access-control-allow-private-network", "true");
+	response.headers.set("access-control-expose-headers", REVIEW_HOST_HEADER);
+	return response;
+}
+/** The allowed origin, headers and methods hold for the server's lifetime, so
+* the client may reuse a preflight. Chromium otherwise keeps one for 5 s, and
+* nearly every request paid a second round trip. Two hours is Chromium's cap. */
+const PREFLIGHT_MAX_AGE_SECONDS = 7200;
+function corsPreflightResponse(request) {
+	const response = applyCorsHeaders(request, new Response(null, { status: 204 }));
+	response.headers.set("access-control-max-age", String(PREFLIGHT_MAX_AGE_SECONDS));
+	return response;
+}
+function isAuthorizedRequest(request, expectedToken) {
+	const supplied = request.headers.get("x-review-token") ?? new URL(request.url).searchParams.get("token");
+	if (!supplied) return false;
+	const expected = Buffer.from(expectedToken);
+	const actual = Buffer.from(supplied);
+	return expected.length === actual.length && crypto$1.timingSafeEqual(expected, actual);
+}
+async function readBoundedRequestJson(request, maxBytes = DEFAULT_MAX_REQUEST_BYTES, emptyValue, options = {}) {
+	assertJsonContentType(request, options);
+	const contentLength = Number(request.headers.get("content-length"));
+	if (Number.isFinite(contentLength) && contentLength > maxBytes) throw requestTooLarge(maxBytes);
+	let body;
+	try {
+		body = request.body ? (await readBoundedStream(request.body, maxBytes)).toString("utf8") : "";
+	} catch (error) {
+		if (error instanceof StreamLimitError) throw requestTooLarge(maxBytes);
+		throw error;
+	}
+	if (!body && emptyValue !== void 0) return emptyValue;
+	try {
+		return parseJsonText(body);
+	} catch {
+		throw new HttpJsonError("Invalid JSON body.", 400);
+	}
+}
+function assertJsonContentType(request, options) {
+	const mediaType = request.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+	if (mediaType !== "application/json" && !mediaType?.endsWith("+json") && !(options.allowTextPlain && mediaType === "text/plain")) throw new HttpJsonError("Content-Type must be application/json.", 415);
+}
+function requestTooLarge(maxBytes) {
+	return new HttpJsonError(`Request body exceeds ${maxBytes === 1048576 ? "1 MiB" : `${maxBytes} bytes`}.`, 413);
+}
+//#endregion
+//#region src/sharing/auth.ts
+/** CI credentials stay in the server environment and are never persisted to a profile. */
+async function readSharingAuth(env = process.env) {
+	if (env.DEV_REVIEW_SHARE_TOKEN === void 0) {
+		if (env.DEV_REVIEW_SHARE_ORIGIN !== void 0) throw new ReviewInputError("DEV_REVIEW_SHARE_ORIGIN requires DEV_REVIEW_SHARE_TOKEN.");
+		return readStoreAuth(env);
+	}
+	const token = env.DEV_REVIEW_SHARE_TOKEN.trim();
+	if (!token) throw new ReviewInputError("DEV_REVIEW_SHARE_TOKEN is empty.");
+	let url;
+	try {
+		url = new URL(env.DEV_REVIEW_SHARE_ORIGIN ?? DEFAULT_STORE_ORIGIN);
+	} catch {
+		throw new ReviewInputError("DEV_REVIEW_SHARE_ORIGIN must be a bare HTTPS origin.");
+	}
+	if (url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash) throw new ReviewInputError("DEV_REVIEW_SHARE_ORIGIN must be a bare HTTPS origin.");
+	return {
+		origin: url.origin,
+		token
+	};
+}
+//#endregion
+//#region src/sharing/host.ts
+const publishSchema = z.strictObject({
+	reviewId: z.string().min(1),
+	version: z.number().int().nonnegative().optional(),
+	requestId: z.uuid().optional()
+});
+const importSchema = z.union([z.strictObject({ url: z.string().max(2048) }), z.strictObject({ path: z.string().min(1).max(4096) })]);
+/** Mounted behind local host authentication. Account credentials never enter the renderer. */
+function mountSharingHost(app, store, data, options = {}) {
+	const startLogin = options.login ?? runStoreLogin;
+	let login = { pending: false };
+	let warmedAt = 0;
+	const readAccount = async () => {
+		const account = await readStoreAuth();
+		if (account && Date.now() - warmedAt > 6e4) {
+			warmedAt = Date.now();
+			new ShareClient(account.origin, account.token, options.fetch).warm().catch(() => {});
+		}
+		return {
+			account: account ? {
+				login: account.login,
+				origin: account.origin,
+				email: account.email,
+				githubLogin: account.githubLogin
+			} : null,
+			...login
+		};
+	};
+	app.get("/sharing/account", async (context) => context.json(await readAccount()));
+	app.post("/sharing/logout", async (context) => {
+		await clearStoreAuth();
+		return context.json(await readAccount());
+	});
+	app.post("/sharing/login", async (context) => {
+		if (!login.pending) {
+			login = { pending: true };
+			options.onLogin?.("started");
+			const discard = new Writable({ write(_chunk, _encoding, done) {
+				done();
+			} });
+			startLogin({
+				traces: false,
+				stdout: discard,
+				stderr: discard,
+				openUrl: options.openUrl,
+				onDeviceCode: (device) => {
+					Object.assign(login, device);
+				}
+			}).then((code) => {
+				login = { pending: false };
+				if (code) login.error = "Sign-in did not finish. Try again.";
+				options.onLogin?.(code ? "failed" : "succeeded", code ? "did_not_finish" : void 0);
+			}).catch(() => {
+				login = {
+					pending: false,
+					error: "Sign-in failed. Try again."
+				};
+				options.onLogin?.("failed", "error");
+			});
+		}
+		return context.json(login);
+	});
+	mountSharingPublisher(app, store, data, options);
+	const imports = /* @__PURE__ */ new Map();
+	let importing = Promise.resolve();
+	const serially = (task) => {
+		const run = importing.then(task);
+		importing = run.then(() => {}, () => {});
+		return run;
+	};
+	app.get("/sharing/import/:id", (context) => {
+		const id = context.req.param("id");
+		const { reviewId = id, ...status } = imports.get(id) ?? {
+			stage: "error",
+			error: "Shared review is not available."
+		};
+		return context.json({
+			reviewId,
+			...status,
+			...status.stage === "ready" && { title: store.read(reviewId).title }
+		});
+	});
+	const shareInput = (onStage) => ({
+		store,
+		data,
+		fetchRepository: options.fetchRepository,
+		cloneRepository: options.cloneRepository,
+		onStage
+	});
+	const startImport = (id, initial, receive) => {
+		const known = imports.get(id)?.stage;
+		if (!known || known === "ready" || known === "error") {
+			const status = { stage: initial };
+			imports.set(id, status);
+			receive((stage) => {
+				status.stage = stage;
+			}).then((reviewId) => {
+				status.reviewId = reviewId;
+				status.stage = "ready";
+			}).catch((error) => {
+				status.stage = "error";
+				status.error = error instanceof ReviewInputError || error instanceof ShareRequestError && error.status !== 404 ? error.message : "This share is unavailable, revoked, or could not be read.";
+			});
+		}
+		const { reviewId: _reviewId, ...status } = imports.get(id);
+		return {
+			reviewId: id,
+			...status
+		};
+	};
+	app.post("/sharing/import", async (context) => {
+		const input = importSchema.parse(await readBoundedRequestJson(context.req.raw));
+		if ("path" in input) {
+			if (!path.isAbsolute(input.path)) throw new ReviewInputError("Use an absolute file path.", 400);
+			const text = await readFile(input.path, "utf8").catch(() => {
+				throw new ReviewInputError(`Could not read ${path.basename(input.path)}. Check that the file still exists and Whiteboard can open it.`, 400);
+			});
+			const key = whiteboardFileKey(text);
+			const copy = () => store.copiesOf(key)[0]?.reviewId;
+			return context.json(startImport(key, "reading", async (onStage) => copy() ?? serially(async () => copy() ?? importShare(shareInput(onStage), key, parseWhiteboardFile(text)))), 202);
+		}
+		const parsed = parseShareLink(input.url);
+		const account = await readStoreAuth();
+		if (parsed.origin !== DEFAULT_STORE_ORIGIN && parsed.origin !== account?.origin) throw new ReviewInputError("This share uses an untrusted service. Sign in to that service before opening its links.", 400);
+		const { origin, capability, revision } = parsed;
+		const key = shareKey(origin, capability);
+		const client = new ShareClient(origin, void 0, options.fetch);
+		return context.json(startImport(revision ? `${key}-${revision}` : key, "downloading", async (onStage) => {
+			let meta;
+			try {
+				meta = await client.shared(capability, revision);
+			} catch (error) {
+				const copies = store.copiesOf(key);
+				const copy = copies.find(({ shared }) => revision ? shared.revisionId === revision : !shared.pinned) ?? copies[0];
+				if (!copy) throw error;
+				return copy.reviewId;
+			}
+			const pinned = revision !== void 0;
+			const plan = planShareCopy(store.copiesOf(key), meta, pinned);
+			return plan.kind === "open" ? plan.reviewId : serially(() => receiveShare(shareInput(onStage), key, meta, () => client.download(capability, meta.revision.id), pinned));
+		}), 202);
+	});
+}
+const preparedShareSchema = z.strictObject({
+	title: z.string(),
+	version: z.number().int().nonnegative(),
+	bundle: shareBundleSchema,
+	needsRepository: z.boolean()
+});
+function remoteShare(isRemote, fetch) {
+	return ({ reviewId, version }) => isRemote(reviewId) ? (async () => {
+		const response = await fetch(new Request(`http://whiteboard/reviews-api/${encodeURIComponent(reviewId)}/share-bundle`, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({ version })
+		}));
+		const body = await response.json().catch(() => void 0);
+		if (!response.ok) throw new ReviewInputError(z.object({ error: z.string() }).safeParse(body).data?.error ?? "Could not read the board from its host.", response.status === 400 ? 400 : 409);
+		return preparedShareSchema.parse(body);
+	})() : void 0;
+}
+/** Publishing needs only an authored store, never Desktop or recipient workspaces. */
+function mountSharingPublisher(app, store, data, options = {}) {
+	const prepareLocal = async (input) => {
+		const snapshot = store.read(input.reviewId, input.version);
+		if (snapshot.target?.kind !== "worktree") validateShareSources(snapshot);
+		const repositoryId = snapshot.pins?.repositoryId ?? snapshot.target?.repositoryId;
+		const root = repositoryId ? store.repositoryPath(repositoryId) : void 0;
+		const repository = root ? (options.readRepository ?? readShareRepository)(root).catch(() => void 0) : void 0;
+		const bundle = await exportShare({
+			store,
+			data,
+			reviewId: snapshot.reviewId,
+			version: snapshot.version
+		});
+		const verified = await repository;
+		if (verified) bundle.repository = verified;
+		return {
+			title: snapshot.title,
+			version: snapshot.version,
+			bundle,
+			needsRepository: needsRepository(bundle, snapshot)
+		};
+	};
+	const prepare = (input) => options.remoteShare?.(input) ?? prepareLocal(input);
+	app.post("/:id/share-bundle", async (context) => {
+		const { version } = publishSchema.pick({ version: true }).parse(await readBoundedRequestJson(context.req.raw));
+		return context.json(await prepareLocal({
+			reviewId: context.req.param("id"),
+			version
+		}));
+	});
+	app.post("/sharing/export", async (context) => {
+		const { title, bundle, needsRepository } = await prepare(publishSchema.parse(await readBoundedRequestJson(context.req.raw)));
+		if (bundle.frozen) throw new ReviewInputError("Commit your changes to export this whiteboard as a file.");
+		else if (!bundle.repository && needsRepository) throw new ReviewInputError("Exporting pinned code needs a GitHub remote the file's reader can fetch from.");
+		return context.json({
+			filename: whiteboardFileName(title),
+			text: whiteboardFileText(bundle)
+		});
+	});
+	app.post("/sharing/publish", async (context) => {
+		const input = publishSchema.parse(await readBoundedRequestJson(context.req.raw));
+		const account = await readSharingAuth();
+		if (!account) throw new ReviewInputError("Set DEV_REVIEW_SHARE_TOKEN for CI, or run whiteboard login before sharing.", 409);
+		const { bundle, version } = await prepare(input);
+		try {
+			const result = await new ShareClient(account.origin, account.token, options.fetch).create(bundle, input.requestId ?? randomUUID());
+			const url = new URL(result.url);
+			if (process.env.DEV_FAST_REVIEW_APP_URL_PROTOCOL === "dev-fast-review-preview") url.searchParams.set("app", "preview");
+			options.onPublished?.({
+				reviewId: input.reviewId,
+				version
+			});
+			return context.json({
+				...result,
+				url: url.href,
+				version
+			});
+		} catch (error) {
+			if (error instanceof ReviewInputError) throw error;
+			if (error instanceof ShareRequestError) throw new ReviewInputError(error.message, 409);
+			if (error instanceof ShareAuthError) {
+				if (process.env.DEV_REVIEW_SHARE_TOKEN === void 0) await clearStoreAuth();
+				throw new ReviewInputError("Your sign-in has expired. Sign in again to share.", 401);
+			}
+			if (error instanceof DOMException && (error.name === "TimeoutError" || error.name === "AbortError")) throw new ReviewInputError("The sharing request timed out. Please retry.", 409);
+			throw new ReviewInputError(error instanceof TypeError ? "Could not reach the sharing service. Check your connection, then retry." : "The sharing service returned an unexpected response. Update Whiteboard or report this issue.", 409);
+		}
+	});
+	app.post("/sharing/revoke", async (context) => {
+		const { shareId } = z.strictObject({ shareId: shareIdSchema }).parse(await readBoundedRequestJson(context.req.raw));
+		const account = await readSharingAuth();
+		if (!account) throw new ReviewInputError("Set DEV_REVIEW_SHARE_TOKEN for CI, or run whiteboard login first.", 409);
+		await new ShareClient(account.origin, account.token, options.fetch).revoke(shareId);
+		options.onRevoked?.({ shareId });
+		return context.json({
+			shareId,
+			revoked: true
+		});
+	});
+}
+//#endregion
 //#region src/server/diffr-config.ts
 const execFileAsync = promisify(execFile);
 let writes = Promise.resolve();
@@ -1839,130 +2232,26 @@ var GlobalReviewDesktopVerbRelay = class {
 		const listener = this.clients.get(writer);
 		if (!listener) return;
 		writer.signal.removeEventListener("abort", listener);
-		this.clients.delete(writer);
-		for (const [id, verb] of [...this.pending]) if (verb.waiting.get(id) === writer) this.stopWaiting(verb, id);
-		if (this.clients.size === 0) this.notifyAttached();
-	}
-	/** Drops one client's id; with nobody left to answer, the verb fails. */
-	stopWaiting(verb, id) {
-		verb.waiting.delete(id);
-		this.pending.delete(id);
-		if (verb.waiting.size === 0) this.settle(verb, verb.lastFailure ?? {
-			ok: false,
-			error: NOT_ATTACHED
-		});
-	}
-	settle(verb, response) {
-		for (const id of verb.waiting.keys()) this.pending.delete(id);
-		verb.waiting.clear();
-		clearTimeout(verb.timer);
-		verb.resolve(response);
-	}
-};
-//#endregion
-//#region src/server/http-json.ts
-const DEFAULT_MAX_REQUEST_BYTES = 1048576;
-var HttpJsonError = class extends Error {
-	statusCode;
-	constructor(message, statusCode) {
-		super(message);
-		this.statusCode = statusCode;
-		this.name = "HttpJsonError";
-	}
-};
-/** An error whose status and machine code the JSON routes hand straight back. */
-var ReviewServerError = class extends Error {
-	statusCode;
-	code;
-	name = "ReviewServerError";
-	constructor(message, statusCode, code) {
-		super(message);
-		this.statusCode = statusCode;
-		this.code = code;
-	}
-};
-//#endregion
-//#region src/server/hono-http.ts
-const H2_FORBIDDEN_HEADERS = [
-	"connection",
-	"keep-alive",
-	"proxy-connection",
-	"transfer-encoding",
-	"upgrade"
-];
-function createNodeRequestListener(app) {
-	return getRequestListener(async (request, env) => {
-		const response = await app.fetch(request, env);
-		if (env.incoming.httpVersionMajor !== 2 || !H2_FORBIDDEN_HEADERS.some((name) => response.headers.has(name))) return response;
-		const stripped = new Response(response.body, response);
-		for (const name of H2_FORBIDDEN_HEADERS) stripped.headers.delete(name);
-		return stripped;
-	});
-}
-function jsonResponse(body, status, options = {}) {
-	const headers = new Headers({ "content-type": options.contentType ?? "application/json; charset=utf-8" });
-	if (options.cacheControl) headers.set("cache-control", options.cacheControl);
-	const serialized = JSON.stringify(body);
-	return new Response(options.newline === false ? serialized : `${serialized}\n`, {
-		status,
-		headers
-	});
-}
-function applyCorsHeaders(request, response) {
-	const origin = request.headers.get("origin");
-	if (origin) {
-		response.headers.set("access-control-allow-origin", origin);
-		const vary = response.headers.get("vary");
-		const varyFields = vary?.split(",").map((field) => field.trim().toLowerCase());
-		if (!varyFields?.includes("*") && !varyFields?.includes("origin")) response.headers.set("vary", vary ? `${vary}, Origin` : "Origin");
-	}
-	response.headers.set("access-control-allow-headers", `content-type, x-review-token, ${REVIEW_PERSON_HEADER}, ${REVIEW_APP_SESSION_ID_HEADER}`);
-	response.headers.set("access-control-allow-methods", "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS");
-	response.headers.set("access-control-allow-private-network", "true");
-	response.headers.set("access-control-expose-headers", REVIEW_HOST_HEADER);
-	return response;
-}
-/** The allowed origin, headers and methods hold for the server's lifetime, so
-* the client may reuse a preflight. Chromium otherwise keeps one for 5 s, and
-* nearly every request paid a second round trip. Two hours is Chromium's cap. */
-const PREFLIGHT_MAX_AGE_SECONDS = 7200;
-function corsPreflightResponse(request) {
-	const response = applyCorsHeaders(request, new Response(null, { status: 204 }));
-	response.headers.set("access-control-max-age", String(PREFLIGHT_MAX_AGE_SECONDS));
-	return response;
-}
-function isAuthorizedRequest(request, expectedToken) {
-	const supplied = request.headers.get("x-review-token") ?? new URL(request.url).searchParams.get("token");
-	if (!supplied) return false;
-	const expected = Buffer.from(expectedToken);
-	const actual = Buffer.from(supplied);
-	return expected.length === actual.length && crypto$1.timingSafeEqual(expected, actual);
-}
-async function readBoundedRequestJson(request, maxBytes = DEFAULT_MAX_REQUEST_BYTES, emptyValue, options = {}) {
-	assertJsonContentType(request, options);
-	const contentLength = Number(request.headers.get("content-length"));
-	if (Number.isFinite(contentLength) && contentLength > maxBytes) throw requestTooLarge(maxBytes);
-	let body;
-	try {
-		body = request.body ? (await readBoundedStream(request.body, maxBytes)).toString("utf8") : "";
-	} catch (error) {
-		if (error instanceof StreamLimitError) throw requestTooLarge(maxBytes);
-		throw error;
+		this.clients.delete(writer);
+		for (const [id, verb] of [...this.pending]) if (verb.waiting.get(id) === writer) this.stopWaiting(verb, id);
+		if (this.clients.size === 0) this.notifyAttached();
 	}
-	if (!body && emptyValue !== void 0) return emptyValue;
-	try {
-		return parseJsonText(body);
-	} catch {
-		throw new HttpJsonError("Invalid JSON body.", 400);
+	/** Drops one client's id; with nobody left to answer, the verb fails. */
+	stopWaiting(verb, id) {
+		verb.waiting.delete(id);
+		this.pending.delete(id);
+		if (verb.waiting.size === 0) this.settle(verb, verb.lastFailure ?? {
+			ok: false,
+			error: NOT_ATTACHED
+		});
 	}
-}
-function assertJsonContentType(request, options) {
-	const mediaType = request.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
-	if (mediaType !== "application/json" && !mediaType?.endsWith("+json") && !(options.allowTextPlain && mediaType === "text/plain")) throw new HttpJsonError("Content-Type must be application/json.", 415);
-}
-function requestTooLarge(maxBytes) {
-	return new HttpJsonError(`Request body exceeds ${maxBytes === 1048576 ? "1 MiB" : `${maxBytes} bytes`}.`, 413);
-}
+	settle(verb, response) {
+		for (const id of verb.waiting.keys()) this.pending.delete(id);
+		verb.waiting.clear();
+		clearTimeout(verb.timer);
+		verb.resolve(response);
+	}
+};
 //#endregion
 //#region src/error-telemetry.ts
 /**
@@ -2225,6 +2514,52 @@ async function captureSanitizedUiTelemetry(telemetry, request, name, properties,
 	}
 }
 //#endregion
+//#region src/review-api/animation-render.ts
+const renderQuerySchema = z.object({
+	targetId: z.string().min(1),
+	/** A frame key, or a clip's marker key; omitted, the first stop. */
+	frame: z.string().min(1).optional()
+});
+/** What the Desktop answers: the stop it showed, and the figure's PNG. */
+const renderedFrameSchema = z.object({
+	frame: z.object({
+		key: z.string(),
+		title: z.string(),
+		position: z.number().int().nonnegative(),
+		count: z.number().int().positive()
+	}),
+	scenario: z.string().optional(),
+	/** The figure ran past the window, so the capture cuts it. */
+	clipped: z.boolean(),
+	/** The error the stage reported, if its script threw. */
+	error: z.string().nullable(),
+	/** The capture, base64. */
+	png: z.string().min(1)
+});
+const isStageBlock = (element) => element.type === "animation" || element.type === "clip";
+/** The stop to render: `frame` checked against the block's frames or markers, or
+* the first stop of the first scenario when omitted. */
+function renderTarget(snapshot, targetId, frame) {
+	const target = elements(snapshot.document).find((element) => element.id === targetId);
+	if (!target) throw new ReviewInputError("Target not found in this version.", 404);
+	if (!isStageBlock(target)) throw new ReviewInputError(`${targetId} is a ${target.type}; only an animation or a clip renders a frame.`);
+	const noun = target.type === "clip" ? "marker" : "frame";
+	const keys = target.type === "clip" ? target.markers.map((marker) => marker.key) : target.frames.map((item) => item.key);
+	if (frame === void 0) {
+		const first = target.type === "animation" ? target.scenarios?.[0]?.frames[0] ?? keys[0] : keys[0];
+		if (first === void 0) throw new ReviewInputError(`${targetId} has no ${noun}s to render.`);
+		return {
+			type: target.type,
+			key: first
+		};
+	}
+	if (!keys.includes(frame)) throw new ReviewInputError(`${frame} is not a ${noun} of ${targetId}. Its ${noun}s: ${keys.join(", ")}.`);
+	return {
+		type: target.type,
+		key: frame
+	};
+}
+//#endregion
 //#region src/ask/checkout-files.ts
 /** The checkout's files relative to its root: tracked ones, and new ones git
 * does not ignore. None where git cannot list them. */
@@ -2579,259 +2914,6 @@ async function defaultRunGitHubApi(host, endpoint) {
 	return stdout;
 }
 //#endregion
-//#region src/sharing/auth.ts
-/** CI credentials stay in the server environment and are never persisted to a profile. */
-async function readSharingAuth(env = process.env) {
-	if (env.DEV_REVIEW_SHARE_TOKEN === void 0) {
-		if (env.DEV_REVIEW_SHARE_ORIGIN !== void 0) throw new ReviewInputError("DEV_REVIEW_SHARE_ORIGIN requires DEV_REVIEW_SHARE_TOKEN.");
-		return readStoreAuth(env);
-	}
-	const token = env.DEV_REVIEW_SHARE_TOKEN.trim();
-	if (!token) throw new ReviewInputError("DEV_REVIEW_SHARE_TOKEN is empty.");
-	let url;
-	try {
-		url = new URL(env.DEV_REVIEW_SHARE_ORIGIN ?? DEFAULT_STORE_ORIGIN);
-	} catch {
-		throw new ReviewInputError("DEV_REVIEW_SHARE_ORIGIN must be a bare HTTPS origin.");
-	}
-	if (url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash) throw new ReviewInputError("DEV_REVIEW_SHARE_ORIGIN must be a bare HTTPS origin.");
-	return {
-		origin: url.origin,
-		token
-	};
-}
-//#endregion
-//#region src/slug.ts
-/** Lowercase ASCII slug: runs of anything but `a-z0-9` become one `-`, outer
-* dashes go. Empty input, or input with no letters or digits, yields `""`;
-* callers choose their own fallback (`"section"`, `"diagram"`, `"database"`).
-* This is the rule sequence and lens ids were already published with, so it
-* must not change. */
-function slugify(text) {
-	return text.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-}
-//#endregion
-//#region src/sharing/file.ts
-const WHITEBOARD_FILE_EXTENSION = ".whiteboard";
-const headerSchema = z.looseObject({ format: z.string() });
-function whiteboardFileName(title) {
-	return `${slugify(title) || "untitled"}${WHITEBOARD_FILE_EXTENSION}`;
-}
-function whiteboardFileText(bundle) {
-	return JSON.stringify(bundle, null, 2) + "\n";
-}
-function parseWhiteboardFile(text) {
-	let parsed;
-	try {
-		parsed = JSON.parse(text);
-	} catch {
-		parsed = void 0;
-	}
-	const header = headerSchema.safeParse(parsed);
-	if (!header.success) throw new ReviewInputError("This is not a Whiteboard file.", 400);
-	if (header.data.format !== "review-share/2") throw new ReviewInputError("This file needs a different Whiteboard version.", 400);
-	return shareBundleSchema.parse(parsed);
-}
-function whiteboardFileKey(text) {
-	return createHash("sha256").update("whiteboard-file\0").update(text).digest("hex");
-}
-//#endregion
-//#region src/sharing/host.ts
-const publishSchema = z.strictObject({
-	reviewId: z.string().min(1),
-	version: z.number().int().nonnegative().optional(),
-	requestId: z.uuid().optional()
-});
-const importSchema = z.union([z.strictObject({ url: z.string().max(2048) }), z.strictObject({ path: z.string().min(1).max(4096) })]);
-/** Mounted behind local host authentication. Account credentials never enter the renderer. */
-function mountSharingHost(app, store, data, options = {}) {
-	const startLogin = options.login ?? runStoreLogin;
-	let login = { pending: false };
-	let warmedAt = 0;
-	const readAccount = async () => {
-		const account = await readStoreAuth();
-		if (account && Date.now() - warmedAt > 6e4) {
-			warmedAt = Date.now();
-			new ShareClient(account.origin, account.token, options.fetch).warm().catch(() => {});
-		}
-		return {
-			account: account ? {
-				login: account.login,
-				origin: account.origin,
-				email: account.email,
-				githubLogin: account.githubLogin
-			} : null,
-			...login
-		};
-	};
-	app.get("/sharing/account", async (context) => context.json(await readAccount()));
-	app.post("/sharing/logout", async (context) => {
-		await clearStoreAuth();
-		return context.json(await readAccount());
-	});
-	app.post("/sharing/login", async (context) => {
-		if (!login.pending) {
-			login = { pending: true };
-			options.onLogin?.("started");
-			const discard = new Writable({ write(_chunk, _encoding, done) {
-				done();
-			} });
-			startLogin({
-				traces: false,
-				stdout: discard,
-				stderr: discard,
-				openUrl: options.openUrl,
-				onDeviceCode: (device) => {
-					Object.assign(login, device);
-				}
-			}).then((code) => {
-				login = { pending: false };
-				if (code) login.error = "Sign-in did not finish. Try again.";
-				options.onLogin?.(code ? "failed" : "succeeded", code ? "did_not_finish" : void 0);
-			}).catch(() => {
-				login = {
-					pending: false,
-					error: "Sign-in failed. Try again."
-				};
-				options.onLogin?.("failed", "error");
-			});
-		}
-		return context.json(login);
-	});
-	mountSharingPublisher(app, store, data, options);
-	const imports = /* @__PURE__ */ new Map();
-	let importing = Promise.resolve();
-	app.get("/sharing/import/:id", (context) => {
-		const id = context.req.param("id");
-		const { reviewId = id, ...status } = imports.get(id) ?? {
-			stage: "error",
-			error: "Shared review is not available."
-		};
-		return context.json({
-			reviewId,
-			...status,
-			...status.stage === "ready" && { title: store.read(reviewId).title }
-		});
-	});
-	const startImport = (id, initial, load) => {
-		const known = imports.get(id)?.stage;
-		if (!known || known === "ready" || known === "error") {
-			const copy = store.copyOf(id);
-			const status = copy ? {
-				stage: "ready",
-				reviewId: copy
-			} : { stage: initial };
-			imports.set(id, status);
-			if (!copy) importing = importing.then(async () => {
-				const { bundle, attribution } = await load();
-				status.reviewId = await importShare({
-					store,
-					data,
-					fetchRepository: options.fetchRepository,
-					cloneRepository: options.cloneRepository,
-					onStage: (stage) => {
-						status.stage = stage;
-					}
-				}, id, bundle, attribution);
-				status.stage = "ready";
-			}).catch((error) => {
-				status.stage = "error";
-				status.error = error instanceof ReviewInputError ? error.message : "This share is unavailable, revoked, or needs a newer Whiteboard version.";
-			});
-		}
-		const { reviewId: _reviewId, ...status } = imports.get(id);
-		return {
-			reviewId: id,
-			...status
-		};
-	};
-	app.post("/sharing/import", async (context) => {
-		const input = importSchema.parse(await readBoundedRequestJson(context.req.raw));
-		if ("path" in input) {
-			if (!path.isAbsolute(input.path)) throw new ReviewInputError("Use an absolute file path.", 400);
-			const text = await readFile(input.path, "utf8").catch(() => {
-				throw new ReviewInputError(`Could not read ${path.basename(input.path)}. Check that the file still exists and Whiteboard can open it.`, 400);
-			});
-			return context.json(startImport(whiteboardFileKey(text), "reading", async () => ({ bundle: parseWhiteboardFile(text) })), 202);
-		}
-		const parsed = parseShareLink(input.url);
-		const account = await readStoreAuth();
-		if (parsed.origin !== DEFAULT_STORE_ORIGIN && parsed.origin !== account?.origin) throw new ReviewInputError("This share uses an untrusted service. Sign in to that service before opening its links.", 400);
-		return context.json(startImport(shareKey(parsed.origin, parsed.capability), "downloading", () => new ShareClient(parsed.origin).download(parsed.capability)), 202);
-	});
-}
-/** Publishing needs only an authored store, never Desktop or recipient workspaces. */
-function mountSharingPublisher(app, store, data, options = {}) {
-	const shareable = (input) => {
-		const snapshot = store.read(input.reviewId, input.version);
-		if (snapshot.target?.kind === "worktree") throw new ReviewInputError("Pin this review to commits before sharing it.");
-		validateShareSources(snapshot);
-		return snapshot;
-	};
-	const shareBundle = async (snapshot) => {
-		const repositoryId = snapshot.pins?.repositoryId ?? snapshot.target?.repositoryId;
-		const root = repositoryId ? store.repositoryPath(repositoryId) : void 0;
-		const repository = root ? (options.readRepository ?? readShareRepository)(root).catch(() => void 0) : void 0;
-		const bundle = await exportShare({
-			store,
-			data,
-			reviewId: snapshot.reviewId,
-			version: snapshot.version
-		});
-		const verified = await repository;
-		if (verified) bundle.repository = verified;
-		return bundle;
-	};
-	app.post("/sharing/export", async (context) => {
-		const snapshot = shareable(publishSchema.parse(await readBoundedRequestJson(context.req.raw)));
-		const bundle = await shareBundle(snapshot);
-		if (!bundle.repository && needsRepository(bundle, snapshot)) throw new ReviewInputError("Exporting pinned code needs a GitHub remote the file's reader can fetch from.");
-		return context.json({
-			filename: whiteboardFileName(snapshot.title),
-			text: whiteboardFileText(bundle)
-		});
-	});
-	app.post("/sharing/publish", async (context) => {
-		const input = publishSchema.parse(await readBoundedRequestJson(context.req.raw));
-		const snapshot = shareable(input);
-		const account = await readSharingAuth();
-		if (!account) throw new ReviewInputError("Set DEV_REVIEW_SHARE_TOKEN for CI, or run whiteboard login before sharing.", 409);
-		const bundle = await shareBundle(snapshot);
-		try {
-			const result = await new ShareClient(account.origin, account.token, options.fetch).create(bundle, input.requestId ?? randomUUID());
-			const url = new URL(result.url);
-			if (process.env.DEV_FAST_REVIEW_APP_URL_PROTOCOL === "dev-fast-review-preview") url.searchParams.set("app", "preview");
-			options.onPublished?.({
-				reviewId: input.reviewId,
-				version: snapshot.version
-			});
-			return context.json({
-				...result,
-				url: url.href,
-				version: snapshot.version
-			});
-		} catch (error) {
-			if (error instanceof ReviewInputError) throw error;
-			if (error instanceof ShareAuthError) {
-				if (process.env.DEV_REVIEW_SHARE_TOKEN === void 0) await clearStoreAuth();
-				throw new ReviewInputError("Your sign-in has expired. Sign in again to share.", 401);
-			}
-			throw new ReviewInputError("Sharing failed. Check your connection and login, then retry.", 409);
-		}
-	});
-	app.post("/sharing/revoke", async (context) => {
-		const { shareId } = z.strictObject({ shareId: shareIdSchema }).parse(await readBoundedRequestJson(context.req.raw));
-		const account = await readSharingAuth();
-		if (!account) throw new ReviewInputError("Set DEV_REVIEW_SHARE_TOKEN for CI, or run whiteboard login first.", 409);
-		await new ShareClient(account.origin, account.token).revoke(shareId);
-		options.onRevoked?.({ shareId });
-		return context.json({
-			shareId,
-			revoked: true
-		});
-	});
-}
-//#endregion
 //#region src/review-api/anchor-quotes.ts
 const QUOTE_LIMIT = 20;
 const clip = (line) => line.trim() === "" ? "(blank line)" : line.length > 120 ? `${line.slice(0, 119)}…` : line;
@@ -2971,12 +3053,21 @@ function documentText(snapshot, targetId, full = false, relations, runs) {
 				for (const edge of element.edges) detail(`[${edge.id}] ${edge.from} → ${edge.to}${edge.label ? `: ${edge.label}` : ""}`);
 				break;
 			case "animation":
-				for (const [index, frame] of element.frames.entries()) {
-					detail(`Frame ${index + 1} [${frame.key}]: ${frame.title}${frame.caption ? ` — ${frame.caption}` : ""}`);
-					if (frame.code) write(depth + 2, `Code: ${frame.code.join(", ")}`);
-					if (detailed && frame.data !== void 0) write(depth + 2, `Data: ${JSON.stringify(frame.data)}`);
+			case "clip":
+				if (element.type === "animation") {
+					for (const [index, frame] of element.frames.entries()) {
+						detail(`Frame ${index + 1} [${frame.key}]: ${frame.title}${frame.caption ? ` — ${frame.caption}` : ""}`);
+						if (frame.code) write(depth + 2, `Code: ${frame.code.join(", ")}`);
+						if (detailed && frame.data !== void 0) write(depth + 2, `Data: ${JSON.stringify(frame.data)}`);
+					}
+					for (const scenario of element.scenarios ?? []) detail(`Scenario [${scenario.key}] ${scenario.label}: ${scenario.frames.join(" → ")}`);
+				} else {
+					for (const [index, marker] of element.markers.entries()) {
+						detail(`Marker ${index + 1} [${marker.key}]: ${marker.title}${marker.caption ? ` — ${marker.caption}` : ""}`);
+						if (marker.code) write(depth + 2, `Code: ${marker.code.join(", ")}`);
+					}
+					for (const scenario of element.scenarios ?? []) detail(`Scenario [${scenario.key}] ${scenario.label}`);
 				}
-				for (const scenario of element.scenarios ?? []) detail(`Scenario [${scenario.key}] ${scenario.label}: ${scenario.frames.join(" → ")}`);
 				if (runs) {
 					const run = element.id === void 0 ? void 0 : runs.get(element.id);
 					write(depth + 1, run?.error ? `Script error: ${run.error}` : run ? "Ran in an open whiteboard without a script error." : "Not run yet: its script runs only where the whiteboard is open.");
@@ -3553,7 +3644,7 @@ const remoteCaller = (context) => context.req.header(REVIEW_CLIENT_HEADER) === R
 function createReviewApi(store, data, open, sharing = false, capabilities = () => ({
 	desktopAvailable: Boolean(open),
 	softwareMapEnabled: false
-}), traceEnabled = async () => false, status = () => ({}), hooks = {}, ask, animationsEnabled = () => false) {
+}), traceEnabled = async () => false, status = () => ({}), hooks = {}, ask, animationsEnabled = () => false, render) {
 	const app = new Hono();
 	app.onError((error, context) => {
 		if (error instanceof HttpJsonError) return context.json({ error: error.message }, error.statusCode);
@@ -4561,6 +4652,23 @@ function createReviewApi(store, data, open, sharing = false, capabilities = () =
 			...listedRelations(store.relations(id))
 		});
 	});
+	app.get("/:id/render", async (context) => {
+		const query = renderQuerySchema.parse(context.req.query());
+		const id = context.req.param("id");
+		const target = renderTarget(readReview(id), query.targetId, query.frame);
+		if (!render) throw new ReviewInputError("Rendering a frame needs Whiteboard Desktop, which this server cannot reach.", 409);
+		const rendered = await render({
+			reviewId: id,
+			targetId: query.targetId,
+			frame: target.key
+		});
+		return context.json({
+			reviewId: id,
+			targetId: query.targetId,
+			type: target.type,
+			...rendered
+		});
+	});
 	app.get("/:id", async (context) => {
 		const query = readQuerySchemas.get.parse(context.req.query());
 		let snapshot = { ...readReview(context.req.param("id"), query.version) };
@@ -4594,7 +4702,8 @@ function createReviewApi(store, data, open, sharing = false, capabilities = () =
 			const { edit, reviewId } = input.operation;
 			const incoming = "content" in edit ? elements([edit.content]) : [];
 			const target = "targetId" in edit ? elements(readReview(reviewId).document).find((element) => element.id === edit.targetId) : void 0;
-			if (incoming.some((element) => element.type === "animation") || target?.type === "animation") throw new ReviewInputError("Animation authoring is disabled. Enable Animations in Settings under Experimental Features to edit animations. Existing animations can still be viewed.", 409);
+			const animated = (type) => type === "animation" || type === "clip";
+			if (incoming.some((element) => animated(element.type)) || animated(target?.type)) throw new ReviewInputError("Animation authoring is disabled. Enable Animations in Settings under Experimental Features to edit animations and clips. Existing ones can still be viewed.", 409);
 		}
 		const threadId = remoteCaller(context) ? void 0 : context.req.header("x-review-thread")?.trim() || void 0;
 		const author = !remoteCaller(context) && context.req.header("x-review-person") !== void 0 ? { kind: "person" } : {
@@ -4605,7 +4714,7 @@ function createReviewApi(store, data, open, sharing = false, capabilities = () =
 		const result = await store.execute(input, void 0, author);
 		const key = copy?.shared?.key;
 		const kept = copy && boardRepositoryId(copy);
-		if (result.deleted && key && kept) await Promise.resolve().then(() => forgetSharedCommits(store.repositoryPath(kept), key)).catch((error) => console.error("Could not drop a copy's kept commits:", error));
+		if (result.deleted && key && kept && !store.copiesOf(key).some(({ reviewId }) => boardRepositoryId(store.read(reviewId)) === kept)) await Promise.resolve().then(() => forgetSharedCommits(store.repositoryPath(kept), key)).catch((error) => console.error("Could not drop a copy's kept commits:", error));
 		if (input.operation.type === "edit" && data && !result.deleted) {
 			const { quotes, unquoted } = await anchorQuotes(result.version > 0 ? store.read(result.reviewId, result.version - 1) : void 0, store.read(result.reviewId, result.version), async (pins, side, file) => (await data.file(pins, side, file)).text);
 			return context.json({
@@ -4902,7 +5011,7 @@ function createReviewServerApp(input) {
 	app.get("/control", (context) => openControlEvents(context, input.relay));
 	mountFeedback(app);
 	app.post("/control/result", async (context) => {
-		const accepted = input.relay.acceptResult(await readBoundedRequestJson(context.req.raw));
+		const accepted = input.relay.acceptResult(await readBoundedRequestJson(context.req.raw, VERB_RESULT_MAX_BYTES));
 		return serverJson(accepted ? 200 : 404, { ok: accepted });
 	});
 	answerErrorsAsJson(app);
@@ -4926,6 +5035,9 @@ function answerErrorsAsJson(app) {
 		});
 	});
 }
+/** A verb result may carry a captured frame: a PNG of up to 1600 pixels on
+* its longest edge, base64. */
+const VERB_RESULT_MAX_BYTES = 16777216;
 function createWhiteboardCore(input) {
 	const { store, data } = input.profile;
 	const app = createReviewServerApp({
@@ -4934,7 +5046,7 @@ function createWhiteboardCore(input) {
 		serverId: store.serverId(),
 		relay: input.relay
 	});
-	const callbacks = relayReviewCallbacks(input.relay, input.softwareMapEnabled);
+	const callbacks = relayReviewCallbacks(input.relay, input.softwareMapEnabled, input.animations);
 	const { ask } = input;
 	const launch = ask?.launch ?? launchAskAgent;
 	const askThreads = ask && new AskThreads(async (agent, cwd, options) => launch(agent, cwd, {
@@ -4951,21 +5063,54 @@ function createWhiteboardCore(input) {
 	const api = createReviewApi(store, data, callbacks.open, input.sharing, callbacks.capabilities, () => traceMachineEnabled(), input.status, input.hooks, askThreads && {
 		threads: askThreads,
 		agents: async () => detectAskAgents(await ask?.env)
-	}, input.animations);
+	}, callbacks.animations, callbacks.render);
 	if (!input.sharing) mountSharingPublisher(api, store, data);
 	return {
 		app,
 		api,
 		close: () => {
+			callbacks.close();
 			stopLocal?.();
 			closeDeletedThreads();
 			askThreads?.closeAll();
 		}
 	};
 }
-/** The Desktop callbacks `createReviewApi` takes, answered over the relay. */
-function relayReviewCallbacks(relay, softwareMapEnabled = false) {
+const capabilitiesAnswerSchema = z.object({
+	softwareMapEnabled: z.boolean(),
+	animationsEnabled: z.boolean().optional()
+});
+/**
+* The Desktop callbacks `createReviewApi` takes, answered over the relay.
+* `animations` never asks Desktop: it is the last answer while one is
+* attached, else the host's own.
+*/
+function relayReviewCallbacks(relay, softwareMapEnabled = false, animations = () => false) {
+	let desktopAnimations;
+	const capabilities = async () => {
+		if (!relay.attached) return {
+			desktopAvailable: false,
+			softwareMapEnabled
+		};
+		const result = await relay.dispatch({
+			name: "authoringCapabilities",
+			args: {}
+		});
+		if (!result.ok) throw new ReviewInputError(result.error, 409);
+		const answer = capabilitiesAnswerSchema.parse(result.result);
+		desktopAnimations = answer.animationsEnabled;
+		return {
+			desktopAvailable: true,
+			softwareMapEnabled: answer.softwareMapEnabled
+		};
+	};
 	return {
+		capabilities,
+		animations: () => desktopAnimations ?? animations(),
+		close: relay.onAttachedChange(() => {
+			desktopAnimations = void 0;
+			if (relay.attached) capabilities().catch(() => {});
+		}),
 		async open(review) {
 			const result = await relay.dispatch({
 				name: "openApiReview",
@@ -4974,20 +5119,19 @@ function relayReviewCallbacks(relay, softwareMapEnabled = false) {
 			if (!result.ok) throw new ReviewInputError(result.error, 409);
 			return z.object({ softwareMapEnabled: z.boolean() }).parse(result.result);
 		},
-		async capabilities() {
-			if (!relay.attached) return {
-				desktopAvailable: false,
-				softwareMapEnabled
-			};
+		async render(request) {
+			if (!relay.attached) throw new ReviewInputError("No Whiteboard Desktop is attached, so nothing can show the animation. Open the whiteboard in Desktop and render again.", 409);
+			const { reviewId, targetId, frame } = request;
 			const result = await relay.dispatch({
-				name: "authoringCapabilities",
-				args: {}
+				name: "renderAnimation",
+				args: {
+					reviewId,
+					targetId,
+					frame
+				}
 			});
 			if (!result.ok) throw new ReviewInputError(result.error, 409);
-			return {
-				desktopAvailable: true,
-				...z.object({ softwareMapEnabled: z.boolean() }).parse(result.result)
-			};
+			return renderedFrameSchema.parse(result.result);
 		}
 	};
 }
@@ -5220,6 +5364,7 @@ async function serve(input) {
 	await migrateDiffrConfig(input.signal);
 	if (input.telemetry) await drainServerCrashReport(input.telemetry);
 	const local = await openReviewProfile(input.stateDir, { manageWorkspaces: true });
+	const animationsEnabled = await readAnimationsEnabled(input.stateDir);
 	const discovery = {
 		version: 1,
 		instanceId: randomUUID(),
@@ -5236,6 +5381,7 @@ async function serve(input) {
 		token: discovery.token,
 		instanceId: discovery.instanceId,
 		softwareMapEnabled: input.softwareMapEnabled,
+		animations: () => animationsEnabled,
 		status: () => ({
 			key: "headless",
 			home: input.stateDir
@@ -5285,4 +5431,4 @@ async function serve(input) {
 	}
 }
 //#endregion
-export { setDiffrConfigValue as C, saveDiffrSummarizer as S, cliAskTools as T, HttpJsonError as _, drainServerCrashReport as a, migrateDiffrConfig as b, answerErrorsAsJson as c, captureSanitizedUiTelemetry as d, clientErrorsForSession as f, DEFAULT_MAX_REQUEST_BYTES as g, readBoundedRequestJson as h, withHeadlessServerLock as i, createWhiteboardCore as l, createNodeRequestListener as m, runHeadlessServer as n, installProcessErrorTelemetry as o, recordClientError as p, takeOverServerHome as r, serverCrashReportPath as s, HeadlessServerBusyError as t, serverJson as u, ReviewServerError as v, testDiffrSummarizer as w, readDiffrConfig as x, GlobalReviewDesktopVerbRelay as y };
+export { DEFAULT_MAX_REQUEST_BYTES as C, writeAnimationsEnabled as D, readAnimationsEnabled as E, cliAskTools as O, readBoundedRequestJson as S, ReviewServerError as T, saveDiffrSummarizer as _, drainServerCrashReport as a, remoteShare as b, answerErrorsAsJson as c, captureSanitizedUiTelemetry as d, clientErrorsForSession as f, readDiffrConfig as g, migrateDiffrConfig as h, withHeadlessServerLock as i, createWhiteboardCore as l, GlobalReviewDesktopVerbRelay as m, runHeadlessServer as n, installProcessErrorTelemetry as o, recordClientError as p, takeOverServerHome as r, serverCrashReportPath as s, HeadlessServerBusyError as t, serverJson as u, setDiffrConfigValue as v, HttpJsonError as w, createNodeRequestListener as x, testDiffrSummarizer as y };