@dev.fast/whiteboard 0.5.1 → 0.5.2-preview.20261104.146

package/dist/{headless-host-B4r0s1ks.js → headless-host-cLipIufH.js}

@@ -1,2 +1,2 @@
-import { i as withHeadlessServerLock, n as runHeadlessServer, r as takeOverServerHome, t as HeadlessServerBusyError } from "./headless-host-Dl2KZ9IT.js";
+import { i as withHeadlessServerLock, n as runHeadlessServer, r as takeOverServerHome, t as HeadlessServerBusyError } from "./headless-host-FAlbekFD.js";
 export { HeadlessServerBusyError, runHeadlessServer, takeOverServerHome, withHeadlessServerLock };

package/dist/{import-YAIU6rB0.js → import-CZ1958L4.js}

@@ -1,8 +1,8 @@
 import { f as gitAt } from "./src-Y30gweiK.js";
 import { u as parseJsonText } from "./src-X9phtB2j.js";
-import { $ as comparisonKey, A as parseMarkdown, B as lensSchema, E as sourceReferences, L as UNCATEGORIZED_LENS_ID, M as checkReferences, O as markdownNodes, Q as anchorSelection, T as selectionReferences, V as lensSelections, Z as SelectionUnavailableError, _ as readsAtBoardPins, at as unionIntervals, c as documentSchema, h as pinsSchema, it as sourceAnchors, n as anchorPins, nt as resolveDiffSelection, o as boardRepositoryId, ot as ReviewInputError, q as fileLineRangeSchema, rt as selectionKey, u as elements, v as resourceReference, y as resourceReferences } from "./src-B2b8cCoI.js";
-import { s as safeStorageSegment } from "./review-home-paths-LdGS4SpR.js";
-import { D as scopedCoverage, O as sourcesForFile, T as emptyCoverage, b as textIncludesQuote, c as traceSchema, k as subtractIntervals, n as migrateStoredDocument, r as migrateStoredLenses, s as softwareModelDataSchema, t as liftFileLenses, u as pullRequestUrl, w as coverageSources, x as textualRows } from "./stored-document-migration-iwIQ4l5G.js";
+import { $ as comparisonKey, A as parseMarkdown, B as lensSchema, E as sourceReferences, L as UNCATEGORIZED_LENS_ID, M as checkReferences, O as markdownNodes, Q as anchorSelection, T as selectionReferences, V as lensSelections, Z as SelectionUnavailableError, _ as readsAtBoardPins, at as unionIntervals, c as documentSchema, h as pinsSchema, it as sourceAnchors, n as anchorPins, nt as resolveDiffSelection, o as boardRepositoryId, ot as ReviewInputError, q as fileLineRangeSchema, rt as selectionKey, u as elements, v as resourceReference, y as resourceReferences } from "./src-BQDlJXkG.js";
+import { s as safeStorageSegment } from "./review-home-paths-BmZX2qiz.js";
+import { D as scopedCoverage, O as sourcesForFile, T as emptyCoverage, b as textIncludesQuote, c as traceSchema, k as subtractIntervals, n as migrateStoredDocument, r as migrateStoredLenses, s as softwareModelDataSchema, t as liftFileLenses, u as pullRequestUrl, w as coverageSources, x as textualRows } from "./stored-document-migration-D1wK4yID.js";
 import { N as devReviewHome } from "./s3-config-CjcLyFV5.js";
 import { createHash, randomUUID } from "node:crypto";
 import { z } from "zod";
@@ -36,51 +36,93 @@ const gitHubRepositoryUrlSchema = z.string().refine((value) => {
 const commitSchema = z.string().regex(/^[a-f0-9]{40}([a-f0-9]{24})?$/);
 const sideSchema = z.enum(["base", "head"]);
 /** An excerpt is the lines a board references. */
-const shareSourceSchema = z.discriminatedUnion("kind", [z.strictObject({
+const shareSourceSchema = z.discriminatedUnion("kind", [z.object({
 	kind: z.literal("excerpt"),
 	file: sharePathSchema,
 	commit: commitSchema,
 	fromLine: z.number().int().positive(),
 	lines: z.array(z.string()).min(1)
 })]);
-const lineRangeSchema = z.strictObject({
+const lineRangeSchema = z.object({
 	side: sideSchema,
 	file: sharePathSchema,
 	fromLine: z.number().int().positive(),
 	toLine: z.number().int().positive(),
-	pins: z.strictObject({
+	pins: z.object({
 		repositoryId: z.string(),
 		head: z.string(),
 		base: z.string().optional()
 	}).optional()
 });
-const shareBundleSchema = z.strictObject({
+/** 1-based base and head lines; null when a side lacks the line. */
+const alignmentRowSchema = z.tuple([z.number().int().positive().nullable(), z.number().int().positive().nullable()]);
+const shareAlignmentSchema = z.object({
+	file: sharePathSchema,
+	previousFile: sharePathSchema.optional(),
+	head: z.string(),
+	base: z.string().optional(),
+	rows: z.array(alignmentRowSchema).min(1)
+});
+/** Unknown fields drop, so a reader opens bundles from newer sharers. */
+const shareBundleSchema = z.object({
 	format: z.literal(SHARE_FORMAT),
 	reviewId: z.string().min(1).max(256),
 	version: z.number().int().nonnegative(),
 	title: z.string().max(4096),
 	/** Validated against the document schema by the reader. */
 	snapshot: z.record(z.string(), z.unknown()),
-	images: z.record(z.string(), z.strictObject({ png: z.base64() })),
+	images: z.record(z.string(), z.object({ png: z.base64() })),
 	traces: z.record(z.string(), z.unknown()),
 	maps: z.record(z.string(), z.unknown()),
 	commits: z.array(z.unknown()),
 	/** Each reference's lines, resolved where the board was shared. */
 	selections: z.record(z.string(), z.array(lineRangeSchema)),
 	sources: z.array(shareSourceSchema),
-	repository: z.strictObject({ cloneUrl: gitHubRepositoryUrlSchema }).optional()
+	/** The sharer's diff over the selections, since 0.4. */
+	alignments: z.array(shareAlignmentSchema).optional(),
+	repository: z.object({ cloneUrl: gitHubRepositoryUrlSchema }).optional(),
+	/** Quotes uncommitted changes: view only, never imported. Since 0.6. */
+	frozen: z.literal(true).optional()
 });
-z.strictObject({
+z.object({
 	requestId: z.uuid(),
 	bundle: shareBundleSchema
 });
+const shareCreatedSchema = z.strictObject({
+	shareId: shareIdSchema,
+	url: z.url()
+});
+const shareSizeSchema = z.number().int().positive().max(MAX_SHARE_BYTES);
+const shareRevisionRefSchema = z.object({
+	id: shareIdSchema,
+	version: z.number().int().nonnegative(),
+	createdAt: z.number()
+});
+const shareRevisionSchema = shareRevisionRefSchema.extend({
+	size: shareSizeSchema,
+	url: z.url()
+});
+const shareRevisionsSchema = z.object({
+	latest: shareIdSchema,
+	items: z.array(shareRevisionSchema)
+});
+const sharedMetaSchema = z.object({
+	sender: z.strictObject({ login: z.string().min(1).max(256) }),
+	sharedAt: z.number(),
+	size: shareSizeSchema,
+	revision: shareRevisionRefSchema,
+	latest: shareIdSchema
+});
 function parseShareLink(value) {
 	const url = new URL(value);
-	if (url.protocol !== "https:" || url.username || url.password || url.hash || [...url.searchParams.keys()].some((key) => key !== "app")) throw new Error("Use an HTTPS Whiteboard share link.");
-	return {
+	if (url.protocol !== "https:" || url.username || url.password || url.hash || [...url.searchParams.keys()].some((key) => key !== "app" && key !== "rev")) throw new Error("Use an HTTPS Whiteboard share link.");
+	const link = {
 		origin: url.origin,
 		capability: capabilitySchema.parse(/^\/s\/([^/]+)$/.exec(url.pathname)?.[1])
 	};
+	const revision = url.searchParams.get("rev");
+	if (revision !== null) link.revision = shareIdSchema.parse(revision);
+	return link;
 }
 //#endregion
 //#region src/server/bounded-stream.ts
@@ -425,7 +467,11 @@ async function exportShare(input) {
 	const stored = structuredClone(input.store.read(input.reviewId, input.version));
 	const repositoryId = boardRepositoryId(stored);
 	const { target, staleSources: _staleSources, sourceUnavailable: _sourceUnavailable, lastEdit: _lastEdit, trashedAt: _trashedAt, personEdit: _personEdit, ...snapshot } = stored;
-	if (target?.kind === "worktree") throw new ReviewInputError("Pin this review to commits before sharing it.");
+	const live = target?.kind === "worktree" ? await input.data.sourcePins(stored) : void 0;
+	if (live) {
+		const { worktreeRevision: _worktreeRevision, ...committed } = live;
+		snapshot.pins = committed;
+	}
 	const pullRequestUrl = snapshot.origin?.pullRequestUrl;
 	const baseBranch = pullRequestUrl && !snapshot.origin?.baseBranch && (snapshot.origin?.pullRequestBaseBranch ?? input.data.pullRequestBaseBranch(pullRequestUrl));
 	if (baseBranch) snapshot.origin = {
@@ -439,7 +485,7 @@ async function exportShare(input) {
 		if (block.type !== "markdown") continue;
 		for (const node of markdownNodes(parseMarkdown(block.markdown))) if (node.type === "image") throw new ReviewInputError("Convert Markdown images to managed image blocks before sharing.");
 	}
-	const pins = snapshot.pins;
+	const pins = live ?? snapshot.pins;
 	const references = [...sourceReferences(snapshot.document, { repositoryId }), ...lensSelections(snapshot.lenses ?? []).flatMap((selection) => sourceAnchors(selection.source).map((source) => ({ source })))];
 	const traces = /* @__PURE__ */ new Map();
 	const maps = /* @__PURE__ */ new Map();
@@ -480,7 +526,16 @@ async function exportShare(input) {
 		fromLine,
 		toLine
 	}));
-	return {
+	let frozen = false;
+	const sources = await cutExcerpts({ async quote(at, range) {
+		const quote = await input.data.quote(at, range);
+		if (at.worktreeRevision && range.side === "head" && !frozen) {
+			const { worktreeRevision: _worktreeRevision, ...committed } = at;
+			if (await input.data.quote(committed, range).then((head) => head.text !== quote.text, () => true)) frozen = true;
+		}
+		return quote;
+	} }, excerpts);
+	const bundle = {
 		format: SHARE_FORMAT,
 		reviewId: snapshot.reviewId,
 		version: snapshot.version,
@@ -491,9 +546,49 @@ async function exportShare(input) {
 		maps: Object.fromEntries(maps),
 		commits: pins ? await input.data.commits((await input.data.resolveSource(stored)).pins) : [],
 		selections,
-		sources: await cutExcerpts(input.data, excerpts),
+		sources,
 		...input.repository && { repository: input.repository }
 	};
+	if (frozen) bundle.frozen = true;
+	return bundle;
+}
+//#endregion
+//#region src/slug.ts
+/** Lowercase ASCII slug: runs of anything but `a-z0-9` become one `-`, outer
+* dashes go. Empty input, or input with no letters or digits, yields `""`;
+* callers choose their own fallback (`"section"`, `"diagram"`, `"database"`).
+* This is the rule sequence and lens ids were already published with, so it
+* must not change. */
+function slugify(text) {
+	return text.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+//#endregion
+//#region src/sharing/file.ts
+const WHITEBOARD_FILE_EXTENSION = ".whiteboard";
+const WHITEBOARD_UPGRADE_REQUIRED_MESSAGE = "This action requires a newer version of Whiteboard. Use Check for Updates, then try again.";
+const headerSchema = z.looseObject({ format: z.string() });
+function whiteboardFileName(title) {
+	return `${slugify(title) || "untitled"}${WHITEBOARD_FILE_EXTENSION}`;
+}
+function whiteboardFileText(bundle) {
+	return JSON.stringify(bundle, null, 2) + "\n";
+}
+function parseWhiteboardFile(text) {
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		parsed = void 0;
+	}
+	const header = headerSchema.safeParse(parsed);
+	if (!header.success) throw new ReviewInputError("This is not a Whiteboard file.", 400);
+	const version = /^review-share\/([1-9]\d*)$/.exec(header.data.format);
+	if (version && Number(version[1]) > Number("review-share/2".split("/")[1])) throw new ReviewInputError(WHITEBOARD_UPGRADE_REQUIRED_MESSAGE, 400);
+	if (header.data.format !== "review-share/2") throw new ReviewInputError("This file needs a different Whiteboard version.", 400);
+	return shareBundleSchema.parse(parsed);
+}
+function whiteboardFileKey(text) {
+	return createHash("sha256").update("whiteboard-file\0").update(text).digest("hex");
 }
 //#endregion
 //#region src/sharing/client.ts
@@ -512,15 +607,6 @@ const pooledFetch = (input, init) => {
 const jwtSchema = z.object({ token: z.string().min(1) });
 const jwtPayloadSchema = z.object({ exp: z.number() });
 const bearers = /* @__PURE__ */ new Map();
-const linkSchema = z.strictObject({
-	shareId: z.uuid(),
-	url: z.url()
-});
-const receivedSchema = z.object({
-	sender: z.strictObject({ login: z.string().min(1).max(256) }),
-	sharedAt: z.number(),
-	size: z.number().int().positive().max(MAX_SHARE_BYTES)
-});
 /** Size is checked while reading, even if Content-Length is absent or false. */
 async function readBoundedBytes(response, limit) {
 	if (!response.ok || !response.body) throw new Error(`Download failed (${response.status}).`);
@@ -543,6 +629,44 @@ var ShareAuthError = class extends Error {
 		this.name = "ShareAuthError";
 	}
 };
+var ShareRequestError = class extends Error {
+	status;
+	constructor(status, message) {
+		super(message);
+		this.status = status;
+		this.name = "ShareRequestError";
+	}
+};
+const errorSchema = z.object({ error: z.object({ code: z.string() }) });
+async function errorCode(response) {
+	if (!response.body) return void 0;
+	if (!response.headers.get("content-type")?.includes("application/json")) {
+		await response.body.cancel();
+		return;
+	}
+	try {
+		const bytes = await readBoundedStream(response.body, 16384);
+		return errorSchema.safeParse(parseJsonText(bytes.toString())).data?.error.code;
+	} catch {
+		return;
+	}
+}
+function requestErrorMessage(response, code) {
+	const { status, headers } = response;
+	if (status === 426 || code === "upgrade_required") return WHITEBOARD_UPGRADE_REQUIRED_MESSAGE;
+	if (status === 403 && headers.get("content-type")?.includes("text/html") && headers.get("server")?.toLowerCase() === "cloudflare") return "The sharing service's security filter blocked this request. Please report this issue.";
+	if (status === 413) return "This review is too large to share. Remove large resources, then retry.";
+	if (status === 429) return code === "share_quota_exceeded" ? "Your sharing storage limit has been reached. Please contact support." : "Too many sharing requests. Wait a moment, then retry.";
+	if (status === 400 && code === "invalid_request") return "The sharing service could not accept this review. Update Whiteboard or report this issue.";
+	if (status >= 500) return `The sharing service is temporarily unavailable (HTTP ${status}). Try again shortly.`;
+	return `The sharing service refused this request (HTTP ${status}). Please report this issue.`;
+}
+async function requestError(response) {
+	const message = requestErrorMessage(response, await errorCode(response));
+	const ray = response.headers.get("cf-ray");
+	const reference = ray && /^[a-f0-9]{16}(?:-[a-z]{3})?$/i.test(ray) ? ` Reference: ${ray}.` : "";
+	return new ShareRequestError(response.status, message + reference);
+}
 /** Account tokens go only to the configured API origin. */
 var ShareClient = class {
 	token;
@@ -570,9 +694,11 @@ var ShareClient = class {
 		if (body !== void 0) init.body = body;
 		const response = await this.send(this.origin + route, init);
 		if (!response.ok) {
-			await response.body?.cancel();
-			if (response.status === 401 && !anonymous) throw new ShareAuthError();
-			throw new Error(`Share request failed (${response.status}).`);
+			if (response.status === 401 && !anonymous) {
+				await response.body?.cancel();
+				throw new ShareAuthError();
+			}
+			throw await requestError(response);
 		}
 		return readBoundedBytes(response, maxBytes);
 	}
@@ -595,13 +721,18 @@ var ShareClient = class {
 			headers: { authorization: `Bearer ${token}` }
 		});
 		if (!response.ok) {
-			await response.body?.cancel();
-			if (response.status === 404 || response.status === 405) return {
-				bearer: token,
-				until: Date.now() + 6e5
-			};
-			if (response.status === 401) throw new ShareAuthError();
-			throw new Error(`Share request failed (${response.status}).`);
+			if (response.status === 404 || response.status === 405) {
+				await response.body?.cancel();
+				return {
+					bearer: token,
+					until: Date.now() + 6e5
+				};
+			}
+			if (response.status === 401) {
+				await response.body?.cancel();
+				throw new ShareAuthError();
+			}
+			throw await requestError(response);
 		}
 		const { token: jwt } = jwtSchema.parse(parseJsonText(Buffer.from(await readBoundedBytes(response, 65536)).toString()));
 		const { exp } = jwtPayloadSchema.parse(parseJsonText(Buffer.from(jwt.split(".")[1] ?? "", "base64url").toString()));
@@ -618,29 +749,38 @@ var ShareClient = class {
 		})).body?.cancel();
 	}
 	async create(bundle, requestId = randomUUID()) {
-		return linkSchema.parse(await this.api("/api/v2/shares", "POST", shareRequestBody(bundle, requestId)));
+		return shareCreatedSchema.parse(await this.api("/api/v2/shares", "POST", shareRequestBody(bundle, requestId)));
 	}
 	async list(cursor) {
 		const query = cursor ? `?cursor=${z.uuid().parse(cursor)}` : "";
 		return this.api(`/api/v2/shares${query}`);
 	}
 	async recoverLink(shareId) {
-		return linkSchema.parse(await this.api(`/api/v2/shares/${z.uuid().parse(shareId)}/link`));
+		return shareCreatedSchema.parse(await this.api(`/api/v2/shares/${z.uuid().parse(shareId)}/link`));
 	}
 	async revoke(shareId) {
 		return this.api(`/api/v2/shares/${z.uuid().parse(shareId)}`, "DELETE");
 	}
-	/** The bundle and who shared it, read with the link's capability. */
-	async download(capability) {
-		const route = `/api/v2/shared/${capabilitySchema.parse(capability)}`;
-		const received = receivedSchema.parse(await this.api(route, "GET", void 0, true));
-		const bytes = await this.request(`${route}/bundle`, "GET", void 0, true, MAX_SHARE_BYTES);
+	async revisions(shareId) {
+		return shareRevisionsSchema.parse(await this.api(`/api/v2/shares/${shareIdSchema.parse(shareId)}/revisions`));
+	}
+	/** Who shared a link's revision, and which revision is its latest. */
+	async shared(capability, revision) {
+		const query = revision === void 0 ? "" : `?rev=${shareIdSchema.parse(revision)}`;
+		return sharedMetaSchema.parse(await this.api(`/api/v2/shared/${capabilitySchema.parse(capability)}${query}`, "GET", void 0, true));
+	}
+	/** The bundle of the revision the meta names, and who shared it. */
+	async download(capability, revision) {
+		const meta = await this.shared(capability, revision);
+		const bytes = await this.request(`/api/v2/shared/${capability}/bundle?rev=${meta.revision.id}`, "GET", void 0, true, MAX_SHARE_BYTES);
 		return {
-			bundle: shareBundleSchema.parse(parseJsonText(new TextDecoder().decode(bytes))),
+			bundle: parseWhiteboardFile(new TextDecoder().decode(bytes)),
 			attribution: {
-				login: received.sender.login,
-				sharedAt: received.sharedAt
-			}
+				login: meta.sender.login,
+				sharedAt: meta.sharedAt
+			},
+			revision: meta.revision,
+			latest: meta.latest
 		};
 	}
 };
@@ -847,7 +987,7 @@ async function readShareRepository(root) {
 }
 //#endregion
 //#region src/sharing/import.ts
-const sharedSnapshotSchema = z.strictObject({
+const sharedSnapshotSchema = z.object({
 	reviewId: z.string().min(1),
 	version: z.number().int().nonnegative(),
 	/** Empty for a board never named; it reads "Untitled". */
@@ -859,7 +999,7 @@ const sharedSnapshotSchema = z.strictObject({
 	document: documentSchema,
 	lenses: z.array(lensSchema).optional(),
 	createdAt: z.string(),
-	origin: z.strictObject({
+	origin: z.object({
 		branch: z.string().optional(),
 		baseRef: z.string().optional(),
 		baseBranch: z.string().optional(),
@@ -871,7 +1011,7 @@ const sharedSnapshotSchema = z.strictObject({
 	}).optional()
 });
 const count = z.number().int().nonnegative();
-const counts = z.strictObject({
+const counts = z.object({
 	additions: count,
 	deletions: count
 });
@@ -881,9 +1021,9 @@ const mapSchema = softwareModelDataSchema.extend({
 	countsByElementPath: z.record(z.string(), counts),
 	unmappedByElementPath: z.record(z.string(), counts.extend({ files: z.array(counts.extend({
 		file: z.string(),
-		hunks: z.array(z.strictObject({
+		hunks: z.array(z.object({
 			startLine: count,
-			lines: z.array(z.strictObject({
+			lines: z.array(z.object({
 				kind: z.enum(["add", "remove"]),
 				oldLine: count.nullable(),
 				newLine: count.nullable(),
@@ -892,13 +1032,14 @@ const mapSchema = softwareModelDataSchema.extend({
 		}))
 	})) }))
 });
-z.strictObject({ maps: z.record(z.string(), mapSchema) });
+z.object({ maps: z.record(z.string(), mapSchema) });
 /** Commits and traces live in a checkout; a document alone needs none. */
 function needsRepository(bundle, snapshot) {
 	return Boolean(snapshot.pins || referenceCommits(snapshot).length || Object.keys(bundle.traces).length);
 }
 function validateShareBundle(input) {
 	const bundle = shareBundleSchema.parse(input);
+	if (bundle.frozen) throw new ReviewInputError("This whiteboard is a read-only snapshot of uncommitted changes. View it in the browser.", 409);
 	const stored = bundle.snapshot;
 	const snapshot = sharedSnapshotSchema.parse(stored.document === void 0 ? stored : liftSharedLenses(stored, migrateStoredDocument(stored.document)));
 	if (snapshot.reviewId !== bundle.reviewId || snapshot.version !== bundle.version || snapshot.title !== bundle.title) throw new Error("Shared snapshot does not match its bundle.");
@@ -948,12 +1089,41 @@ function shareKey(origin, capability) {
 	capabilitySchema.parse(capability);
 	return createHash("sha256").update(JSON.stringify([url.origin, capability])).digest("hex");
 }
-/** Imports a share as an ordinary board, once per link: the link's copy
-* comes back while it exists, even from Trash. */
-async function importShare(input, key, received, attribution) {
+/** Which copy a served revision opens or refreshes in place; otherwise a new copy. */
+function planShareCopy(copies, served, pinned = false) {
+	const same = copies.find(({ shared }) => shared.revisionId === void 0 ? shared.sharedAt === served.revision.createdAt : shared.revisionId === served.revision.id);
+	if (same) return {
+		kind: "open",
+		reviewId: same.reviewId
+	};
+	const unedited = !pinned && served.revision.id === served.latest && copies.find((copy) => !copy.shared.pinned && copy.version === (copy.shared.importedVersion ?? 0));
+	return unedited ? {
+		kind: "refresh",
+		reviewId: unedited.reviewId,
+		version: unedited.version
+	} : { kind: "import" };
+}
+/** Opens, refreshes or copies a link's board by the revision it serves. */
+async function receiveShare(input, key, served, download, pinned = false) {
+	const plan = planShareCopy(input.store.copiesOf(key), served, pinned);
+	if (plan.kind === "open") return plan.reviewId;
+	const { bundle, attribution } = await download();
+	const provenance = {
+		...attribution,
+		revisionId: served.revision.id,
+		...pinned && { pinned }
+	};
+	if (plan.kind === "import") return importShare(input, key, bundle, provenance);
+	try {
+		return await importShare(input, key, bundle, provenance, plan);
+	} catch (error) {
+		if (error instanceof ReviewInputError && (error.status === 409 || error.status === 404)) return importShare(input, key, bundle, provenance);
+		throw error;
+	}
+}
+/** Imports a share as an ordinary board, or into a copy of its link. */
+async function importShare(input, key, received, provenance, into) {
 	const { store, data } = input;
-	const existing = store.copyOf(key);
-	if (existing) return existing;
 	const { bundle, snapshot, maps } = validateShareBundle(received);
 	const cloneUrl = bundle.repository?.cloneUrl;
 	let repositoryId;
@@ -988,7 +1158,7 @@ async function importShare(input, key, received, attribution) {
 	}
 	let document = JSON.stringify(snapshot.document);
 	for (const [id, copy] of ids) document = document.replaceAll(id, copy);
-	const { reviewId } = await store.execute({ operation: {
+	const create = { operation: {
 		type: "create",
 		...snapshot.title && { title: snapshot.title },
 		...pins ? { target: {
@@ -998,17 +1168,19 @@ async function importShare(input, key, received, attribution) {
 			kind: "project",
 			repositoryId
 		} }
-	} }, {
+	} };
+	const seed = {
 		document: JSON.parse(document),
 		lenses: snapshot.lenses,
 		origin: snapshot.origin,
 		shared: {
-			...attribution,
+			...provenance,
 			cloneUrl,
 			key
 		},
 		copiedFrom: snapshot.reviewId
-	}, { kind: "person" });
+	};
+	const { reviewId } = into ? await store.refreshCopy(into.reviewId, into.version, create, seed) : await store.execute(create, seed, { kind: "person" });
 	return reviewId;
 }
 /** A checkout of the share's repository with every commit it reads at: the
@@ -1050,4 +1222,4 @@ async function shareRepository({ store, data, ...git }, cloneUrl, pins, commits,
 	return repositoryId;
 }
 //#endregion
-export { readBoundedStream as _, forgetSharedCommits as a, shareBundleSchema as b, ShareClient as c, legacyModeSchema as d, lensReport as f, StreamLimitError as g, uncategorizedReport as h, validateShareBundle as i, exportShare as l, reviewProgress as m, needsRepository as n, readShareRepository as o, progressUpdateSchema as p, shareKey as r, ShareAuthError as s, importShare as t, validateShareSources as u, SHARE_FORMAT as v, shareIdSchema as x, parseShareLink as y };
+export { StreamLimitError as C, shareIdSchema as D, shareBundleSchema as E, uncategorizedReport as S, parseShareLink as T, validateShareSources as _, shareKey as a, progressUpdateSchema as b, readShareRepository as c, ShareRequestError as d, parseWhiteboardFile as f, exportShare as g, whiteboardFileText as h, receiveShare as i, ShareAuthError as l, whiteboardFileName as m, needsRepository as n, validateShareBundle as o, whiteboardFileKey as p, planShareCopy as r, forgetSharedCommits as s, importShare as t, ShareClient as u, legacyModeSchema as v, readBoundedStream as w, reviewProgress as x, lensReport as y };

package/dist/{local-data-C58vzLZR.js → local-data-DdFkxFK_.js}

@@ -1,12 +1,12 @@
 import { S as splitGitPatchFiles, T as runVcsSync, _ as listTrackedFilesAtCommit, a as diff, b as resolveRepoContext, c as diffFileSummariesWorkingTree, d as git, f as gitAt, g as listCommitRange, h as jjRevisionIsConflicted, i as detectLocalVcs, l as diffTrees, m as gitCommonDirSync, n as createBlobBatchReader, p as gitCommonDir, s as diffFileSummariesTrees, t as LocalVcsToolsMissingError, u as diffWorkingTree, v as parseGitRemote, w as runVcs, x as resolveRevision, y as readFileAtCommit } from "./src-Y30gweiK.js";
 import { c as jsonString, m as isStringValue, n as isJsonObject, o as jsonObject, u as parseJsonText } from "./src-X9phtB2j.js";
-import { A as parseMarkdown, B as lensSchema, D as summarizeEdit, E as sourceReferences, G as SourceRangeError, J as requireVisibleSource, K as checkSourcePath, M as checkReferences, O as markdownNodes, P as documentAdvice, R as applyLensEdit, S as respellEditLinks, V as lensSelections, Y as sliceSourceRange, a as boardLinks, at as unionIntervals, b as respellCommitLinks, c as documentSchema, ct as activityEndSchema, d as explicitPins, h as pinsSchema, i as assignMissingIds, it as sourceAnchors, k as markdownText, l as editSchema, lt as activityUpdateSchema, m as pinnedRepositoryIds, n as anchorPins, o as boardRepositoryId, ot as ReviewInputError, p as pinDocumentReferences, q as fileLineRangeSchema, r as applyEdit, s as commitLinkCommits, st as activityBeginSchema, t as adoptFlowUnits, tt as parseAnchor, u as elements, ut as focusSchema, v as resourceReference, w as reviewTargetSchema, x as respellDocumentLinks, y as resourceReferences, z as lensEditSchema } from "./src-B2b8cCoI.js";
-import { F as applyStructuralUpdate, I as decodeStructuralDiffEvent, L as structuralChangeCounts, c as boardIconKind, l as boardTitle } from "./src-DLWol7GZ.js";
-import { s as safeStorageSegment } from "./review-home-paths-LdGS4SpR.js";
-import { A as updateCoverage, C as coverageSchema, E as intersectIntervals, S as parseUnifiedPatch, T as emptyCoverage, _ as fetchPullRequest, a as SoftwareModelValidationError, b as textIncludesQuote, c as traceSchema, d as setPullRequest, f as sourceBranchName, g as defaultPullRequestDeps, h as GitHubRefusedRead, i as readStoredDocument, k as subtractIntervals, l as pullRequestKey, m as resolvePullRequest, n as migrateStoredDocument, o as defineSoftwareMap, r as migrateStoredLenses, u as pullRequestUrl, v as remoteUrls, x as textualRows, y as azureRepositoryOf } from "./stored-document-migration-iwIQ4l5G.js";
+import { A as parseMarkdown, B as lensSchema, D as summarizeEdit, E as sourceReferences, G as SourceRangeError, J as requireVisibleSource, K as checkSourcePath, M as checkReferences, O as markdownNodes, P as documentAdvice, R as applyLensEdit, S as respellEditLinks, V as lensSelections, Y as sliceSourceRange, a as boardLinks, at as unionIntervals, b as respellCommitLinks, c as documentSchema, ct as activityEndSchema, d as explicitPins, h as pinsSchema, i as assignMissingIds, it as sourceAnchors, k as markdownText, l as editSchema, lt as activityUpdateSchema, m as pinnedRepositoryIds, n as anchorPins, o as boardRepositoryId, ot as ReviewInputError, p as pinDocumentReferences, q as fileLineRangeSchema, r as applyEdit, s as commitLinkCommits, st as activityBeginSchema, t as adoptFlowUnits, tt as parseAnchor, u as elements, ut as focusSchema, v as resourceReference, w as reviewTargetSchema, x as respellDocumentLinks, y as resourceReferences, z as lensEditSchema } from "./src-BQDlJXkG.js";
+import { I as applyStructuralUpdate, L as decodeStructuralDiffEvent, R as structuralChangeCounts, c as boardIconKind, l as boardTitle } from "./src-CrrW7lcY.js";
+import { s as safeStorageSegment } from "./review-home-paths-BmZX2qiz.js";
+import { A as updateCoverage, C as coverageSchema, E as intersectIntervals, S as parseUnifiedPatch, T as emptyCoverage, _ as fetchPullRequest, a as SoftwareModelValidationError, b as textIncludesQuote, c as traceSchema, d as setPullRequest, f as sourceBranchName, g as defaultPullRequestDeps, h as GitHubRefusedRead, i as readStoredDocument, k as subtractIntervals, l as pullRequestKey, m as resolvePullRequest, n as migrateStoredDocument, o as defineSoftwareMap, r as migrateStoredLenses, u as pullRequestUrl, v as remoteUrls, x as textualRows, y as azureRepositoryOf } from "./stored-document-migration-D1wK4yID.js";
 import { A as processStartIdentity, L as writePrivateJsonAtomic, O as pidReused, j as withFileLock, k as processIsAlive } from "./s3-config-CjcLyFV5.js";
 import { t as errorMessage } from "./error-message-OtiDonty.js";
-import { a as askHistoryEntrySchema, i as askEntrySchema, m as isMissingFileError, o as askOfferSchema, s as askPermissionsSchema } from "./thread-state-B7L1mpN_.js";
+import { a as askHistoryEntrySchema, i as askEntrySchema, m as isMissingFileError, o as askOfferSchema, s as askPermissionsSchema } from "./thread-state-WTqSborE.js";
 import { createRequire } from "node:module";
 import crypto, { createHash, randomUUID } from "node:crypto";
 import { z } from "zod";
@@ -3095,11 +3095,16 @@ var ReviewStore = class {
 		this.pending = run.catch(() => {});
 		return run;
 	}
-	/** The board copied from a share link, until it is deleted. */
-	copyOf(key) {
-		const row = this.db.prepare(`SELECT reviews.id FROM reviews JOIN versions ON versions.review_id=reviews.id AND versions.version=reviews.version
-        WHERE CASE WHEN json_valid(versions.snapshot) THEN json_extract(versions.snapshot,'$.shared.key') END=?`).get(key);
-		return row && String(row.id);
+	/** The boards copied from a share link, newest first, until each is deleted. */
+	copiesOf(key) {
+		return this.db.prepare(`SELECT reviews.id, reviews.version, json_extract(versions.snapshot,'$.shared') AS shared
+        FROM reviews JOIN versions ON versions.review_id=reviews.id AND versions.version=reviews.version
+        WHERE CASE WHEN json_valid(versions.snapshot) THEN json_extract(versions.snapshot,'$.shared.key') END=?
+        ORDER BY reviews.rowid DESC`).all(key).map((row) => ({
+			reviewId: String(row.id),
+			version: Number(row.version),
+			shared: JSON.parse(String(row.shared))
+		}));
 	}
 	/** Checkouts whose remote is cloneUrl, most recently used first. */
 	checkoutsOf(cloneUrl) {
@@ -3361,6 +3366,21 @@ var ReviewStore = class {
 		pullRequest?.catch(() => {});
 		const pullRequestTitle = pullRequest ? pullRequest.then(({ title }) => title || void 0, () => void 0) : this.startPullRequestTitle(command);
 		const prepared = this.prepareCommand(command, pullRequest, pullRequestTitle, author).then((source) => this.applyPreparedCommand(source, initial, author));
+		return this.track(prepared);
+	}
+	/** Replaces a share copy's content under the same board id; 409 once it moved past `baseVersion`. */
+	refreshCopy(reviewId, baseVersion, create, seed) {
+		if (this.closing) return Promise.reject(/* @__PURE__ */ new Error("Review store is closing."));
+		const command = commandSchema.parse(create);
+		const op = command.operation;
+		if (op.type !== "create" || op.pullRequestUrl || op.parentId || op.dependsOn || op.projectId) throw new ReviewInputError("A refresh takes a create command with a title and target alone.");
+		const person = { kind: "person" };
+		return this.track(this.prepareCommand(command, void 0, Promise.resolve(void 0), person).then((source) => this.applyPreparedCommand(source, seed, person, {
+			reviewId,
+			baseVersion
+		})));
+	}
+	track(prepared) {
 		this.preparing.add(prepared);
 		prepared.finally(() => this.preparing.delete(prepared)).catch(() => {});
 		return prepared;
@@ -3389,10 +3409,10 @@ var ReviewStore = class {
 			resolvedTitle: await pullRequestTitle
 		};
 	}
-	applyPreparedCommand(prepared, initial, author) {
+	applyPreparedCommand(prepared, initial, author, into) {
 		const { op, requestedTarget, fromPullRequest, resolvedTarget, resolvedBranch, discoveredPullRequest, resolvedTitle } = prepared;
 		return this.enqueue(async () => {
-			if (op.type === "create" && (op.pullRequestUrl ? op.reuseExisting !== false : op.reuseExisting && resolvedTarget?.pins)) {
+			if (!into && op.type === "create" && (op.pullRequestUrl ? op.reuseExisting !== false : op.reuseExisting && resolvedTarget?.pins)) {
 				const known = op.pullRequestUrl ? this.reviewsForPullRequest(op.pullRequestUrl) : [];
 				const branch = fromPullRequest?.branch ?? resolvedBranch;
 				const repository = resolvedTarget?.target.repositoryId;
@@ -3410,8 +3430,9 @@ var ReviewStore = class {
 			if (op.type === "lifecycle") return this.commitBoardFacts(op.reviewId, author, { state: op.state });
 			if (op.type === "attention") return this.commitBoardFacts(op.reviewId, author, { viewed: true });
 			if (op.type === "delete") return this.deleteBoard(this.read(op.reviewId), author, { fromTrash: true });
-			const id = op.type === "create" ? randomUUID() : op.reviewId;
-			const previous = op.type === "create" ? void 0 : this.read(id);
+			const id = into?.reviewId ?? (op.type === "create" ? randomUUID() : op.reviewId);
+			const previous = op.type === "create" && !into ? void 0 : this.read(id);
+			if (into && (!previous?.shared?.key || previous.shared.key !== initial?.shared?.key)) throw new ReviewInputError("Only a copy of the same share link refreshes in place.");
 			let snapshot = op.type === "create" ? createdSnapshot(id, op, resolvedTarget, fromPullRequest && (fromPullRequest.title || `PR #${op.pullRequestUrl.split("/").at(-1)}`), author.kind === "person") : structuredClone(previous);
 			delete snapshot.trashedAt;
 			delete snapshot.sourceUnavailable;
@@ -3520,9 +3541,11 @@ var ReviewStore = class {
 				restore: op.type === "restore",
 				repin: op.type === "set_target",
 				copied: initial !== void 0,
+				inPlace: into !== void 0,
+				baseVersion: into?.baseVersion,
 				projectLive: op.type !== "restore" && !resolvedTarget,
 				result: {
-					...op.type === "create" && { created: true },
+					...op.type === "create" && !into && { created: true },
 					targetId: applied?.targetId ?? lensTarget?.targetId,
 					...applied && { type: applied.type },
 					...lensTarget && { type: lensTarget.type },
@@ -3590,6 +3613,7 @@ var ReviewStore = class {
 			person: author.kind === "person"
 		}));
 		warnings = [...change.warnings ?? [], ...warnings];
+		if (change.copied && snapshot.shared) snapshot.shared.importedVersion = snapshot.version;
 		const result = {
 			...change.result,
 			reviewId: id,
@@ -3611,7 +3635,8 @@ var ReviewStore = class {
 			if (change.relations?.dependsOn) this.setDependencies(id, change.relations.dependsOn);
 			if (previous && projectId !== previousProject && this.dropRelationsOutside(id, projectId)) result.warnings = [...result.warnings ?? [], "Its parent, children and dependencies were in its old project, so they were dropped: whiteboards relate only within a project."];
 		}, previous ? () => {
-			this.assertWritable(id);
+			if (change.inPlace) this.assertExists(id);
+			else this.assertWritable(id);
 			if (change.baseVersion !== void 0) assertBaseVersion(change.baseVersion, this.currentVersion(id));
 			else this.assertMutation(id, previous.version);
 			holds();

package/dist/{mcp-COYWiGVn.js → mcp-Claiy9xE.js}

@@ -1,8 +1,8 @@
 import { n as isJsonObject } from "./src-X9phtB2j.js";
-import { ot as ReviewInputError } from "./src-B2b8cCoI.js";
-import { a as toolResultText, s as ReviewApiError, t as ToolText } from "./agent-client-CMacGbMp.js";
-import { n as REVIEW_STATUS_TOOL, t as authoringTools } from "./authoring-tools-CiLy46kh.js";
-import { i as publicTool, n as RECOVERY, r as callPublicTool, t as toolFailure } from "./tool-failure-RLR8m9hq.js";
+import { ot as ReviewInputError } from "./src-BQDlJXkG.js";
+import { a as toolResultText, s as ReviewApiError, t as ToolText } from "./agent-client-BCEbSPWU.js";
+import { n as REVIEW_STATUS_TOOL, t as authoringTools } from "./authoring-tools-CkfxTVJm.js";
+import { a as renderedImage, i as publicTool, n as RECOVERY, r as callPublicTool, t as toolFailure } from "./tool-failure-YOFGHJCZ.js";
 import { Server } from "@modelcontextprotocol/server";
 import { StdioServerTransport } from "@modelcontextprotocol/server/stdio";
 //#region src/review-api/mcp-client-agent.ts
@@ -118,10 +118,13 @@ async function serveReviewMcp(connect, stdin, stdout, stderr = process.stderr, t
 			phase = "call";
 			tool = tools.find((tool) => tool.name === request.params.name);
 			if (!tool) throw new ReviewInputError(`Unknown Whiteboard tool: ${request.params.name}`);
-			const result = await callPublicTool(client, tool, request.params.arguments ?? {}, ctx.mcpReq.signal);
+			const { image, result } = renderedImage(tool, await callPublicTool(client, tool, request.params.arguments ?? {}, ctx.mcpReq.signal));
 			const text = toolResultText(tool, result);
 			report();
-			const response = { content: [{
+			const response = { content: [...image ? [{
+				type: "image",
+				...image
+			}] : [], {
 				type: "text",
 				text: listedWhileDown && tool.name === instructionsTool.name ? `${RELOAD_TOOLS}\n\n${text}` : text
 			}] };