@imgly/codesign-mcp 0.1.0

package/dist/viewer/listener.d.ts

@@ -0,0 +1,16 @@
+import type { Server } from 'node:http';
+import type { Router } from 'express';
+import { type Express } from 'express';
+export interface ViewerListener {
+    app: Express;
+    server: Server;
+    base: string;
+    close(): Promise<void>;
+}
+export interface StartViewerListenerOptions {
+    router: Router;
+    host?: string;
+    port?: number;
+}
+export declare function startViewerListener(opts: StartViewerListenerOptions): Promise<ViewerListener>;
+//# sourceMappingURL=listener.d.ts.map

package/dist/viewer/listener.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"listener.d.ts","sourceRoot":"","sources":["../../src/viewer/listener.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACtC,OAAgB,EAAE,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAEhD,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,0BAA0B,GAC/B,OAAO,CAAC,cAAc,CAAC,CAuBzB"}

package/dist/viewer/listener.js

@@ -0,0 +1,30 @@
+//
+// Ephemeral localhost HTTP listener used by stdio mode. Mounts the viewer
+// router; selects an OS-assigned free port (port: 0); reports the base URL.
+// In http mode the same router mounts onto the transport's express app —
+// no listener needed.
+import express from 'express';
+export async function startViewerListener(opts) {
+    const host = opts.host ?? '127.0.0.1';
+    const app = express();
+    app.use(opts.router);
+    const server = app.listen(opts.port ?? 0, host);
+    await new Promise((resolve, reject) => {
+        server.once('listening', () => resolve());
+        server.once('error', (err) => reject(err));
+    });
+    const addr = server.address();
+    if (!addr || typeof addr === 'string')
+        throw new Error('viewer listener: failed to read bound address');
+    const base = `http://${host}:${addr.port}`;
+    return {
+        app,
+        server,
+        base,
+        close: () => new Promise((resolve) => {
+            server.close(() => resolve());
+            server.closeAllConnections?.();
+        })
+    };
+}
+//# sourceMappingURL=listener.js.map

package/dist/viewer/listener.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listener.js","sourceRoot":"","sources":["../../src/viewer/listener.ts"],"names":[],"mappings":"AAAA,EAAE;AACF,0EAA0E;AAC1E,4EAA4E;AAC5E,yEAAyE;AACzE,sBAAsB;AAItB,OAAO,OAAyB,MAAM,SAAS,CAAC;AAehD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAgC;IAEhC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;IACtC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAChD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QACnC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,UAAU,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;IAC3C,OAAO;QACL,GAAG;QACH,MAAM;QACN,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC5B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9B,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACjC,CAAC,CAAC;KACL,CAAC;AACJ,CAAC","sourcesContent":["//\n// Ephemeral localhost HTTP listener used by stdio mode. Mounts the viewer\n// router; selects an OS-assigned free port (port: 0); reports the base URL.\n// In http mode the same router mounts onto the transport's express app —\n// no listener needed.\n\nimport type { Server } from 'node:http';\nimport type { Router } from 'express';\nimport express, { type Express } from 'express';\n\nexport interface ViewerListener {\n  app: Express;\n  server: Server;\n  base: string;\n  close(): Promise<void>;\n}\n\nexport interface StartViewerListenerOptions {\n  router: Router;\n  host?: string;\n  port?: number;\n}\n\nexport async function startViewerListener(\n  opts: StartViewerListenerOptions\n): Promise<ViewerListener> {\n  const host = opts.host ?? '127.0.0.1';\n  const app = express();\n  app.use(opts.router);\n  const server = app.listen(opts.port ?? 0, host);\n  await new Promise<void>((resolve, reject) => {\n    server.once('listening', () => resolve());\n    server.once('error', (err) => reject(err));\n  });\n  const addr = server.address();\n  if (!addr || typeof addr === 'string')\n    throw new Error('viewer listener: failed to read bound address');\n  const base = `http://${host}:${addr.port}`;\n  return {\n    app,\n    server,\n    base,\n    close: () =>\n      new Promise<void>((resolve) => {\n        server.close(() => resolve());\n        server.closeAllConnections?.();\n      })\n  };\n}\n"]}

package/dist/viewer/presigned-r2-url-builder.d.ts

@@ -0,0 +1,30 @@
+import { type S3Client } from '@aws-sdk/client-s3';
+import { LocalViewerUrlBuilder, type LocalUrlBuilderOptions } from './url-builder.js';
+export interface PresignedR2UrlBuilderOptions extends LocalUrlBuilderOptions {
+    client: S3Client;
+    bucket: string;
+    /** The session's workspace id — the R2 key is `workspaces/<workspaceId>/<relpath>`. */
+    workspaceId: string;
+    /** Presigned URL lifetime in seconds. Default 3600. */
+    expiresIn?: number;
+}
+/**
+ * URL builder for S3/R2-backed hosted deployments.
+ *
+ * Inherits all sync viewer URL methods from LocalViewerUrlBuilder
+ * (forDesign / forPinnedRevision / forStudio / forResource), so the
+ * synchronous CE.SDK `workspace://` URI resolver callback continues to work
+ * unchanged. Only `forDownload` is overridden to return a presigned GET URL
+ * so the MCP client can download artifacts directly from R2 rather than
+ * going through the `/r/` Express route (which is not mounted on the hosted
+ * Cloudflare deployment).
+ */
+export declare class PresignedR2UrlBuilder extends LocalViewerUrlBuilder {
+    private readonly client;
+    private readonly bucket;
+    private readonly workspaceId;
+    private readonly expiresIn;
+    constructor(opts: PresignedR2UrlBuilderOptions);
+    forDownload(relpath: string): Promise<string>;
+}
+//# sourceMappingURL=presigned-r2-url-builder.d.ts.map

package/dist/viewer/presigned-r2-url-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presigned-r2-url-builder.d.ts","sourceRoot":"","sources":["../../src/viewer/presigned-r2-url-builder.ts"],"names":[],"mappings":"AAMA,OAAO,EAAoB,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAErE,OAAO,EACL,qBAAqB,EACrB,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,MAAM,WAAW,4BAA6B,SAAQ,sBAAsB;IAC1E,MAAM,EAAE,QAAQ,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,qBAAa,qBAAsB,SAAQ,qBAAqB;IAC9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,IAAI,EAAE,4BAA4B;IAQ/B,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAc7D"}

package/dist/viewer/presigned-r2-url-builder.js

@@ -0,0 +1,40 @@
+// packages/codesign-mcp/src/viewer/presigned-r2-url-builder.ts
+//
+// Node-only. NOT exported from viewer/index.ts or the main package entrypoint
+// — keeps @aws-sdk/client-s3 and @aws-sdk/s3-request-presigner out of the
+// browser bundle (mirrors the pattern used by S3WorkspaceFS in workspace/s3.ts).
+// Imported directly by cli/http.ts for the S3/R2 hosted deployment.
+import { GetObjectCommand } from '@aws-sdk/client-s3';
+import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
+import { LocalViewerUrlBuilder } from './url-builder.js';
+/**
+ * URL builder for S3/R2-backed hosted deployments.
+ *
+ * Inherits all sync viewer URL methods from LocalViewerUrlBuilder
+ * (forDesign / forPinnedRevision / forStudio / forResource), so the
+ * synchronous CE.SDK `workspace://` URI resolver callback continues to work
+ * unchanged. Only `forDownload` is overridden to return a presigned GET URL
+ * so the MCP client can download artifacts directly from R2 rather than
+ * going through the `/r/` Express route (which is not mounted on the hosted
+ * Cloudflare deployment).
+ */
+export class PresignedR2UrlBuilder extends LocalViewerUrlBuilder {
+    constructor(opts) {
+        super(opts);
+        this.client = opts.client;
+        this.bucket = opts.bucket;
+        this.workspaceId = opts.workspaceId;
+        this.expiresIn = opts.expiresIn ?? 3600;
+    }
+    async forDownload(relpath) {
+        // workspaceId is used raw (no sanitize here) on purpose: it is the SAME id
+        // ScopedWorkspaceFS used to store the artifact, and ScopedWorkspaceFS already
+        // sanitised it (rejecting traversal) before any bytes were written. So a key
+        // we can presign always corresponds to a stored object, and sanitize is an
+        // identity on accepted ids — re-sanitising here would only risk drift from
+        // the storage key.
+        const key = `workspaces/${this.workspaceId}/${relpath}`;
+        return getSignedUrl(this.client, new GetObjectCommand({ Bucket: this.bucket, Key: key }), { expiresIn: this.expiresIn });
+    }
+}
+//# sourceMappingURL=presigned-r2-url-builder.js.map

package/dist/viewer/presigned-r2-url-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presigned-r2-url-builder.js","sourceRoot":"","sources":["../../src/viewer/presigned-r2-url-builder.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,iFAAiF;AACjF,oEAAoE;AACpE,OAAO,EAAE,gBAAgB,EAAiB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EACL,qBAAqB,EAEtB,MAAM,kBAAkB,CAAC;AAW1B;;;;;;;;;;GAUG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAM9D,YAAY,IAAkC;QAC5C,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IAC1C,CAAC;IAEQ,KAAK,CAAC,WAAW,CAAC,OAAe;QACxC,2EAA2E;QAC3E,8EAA8E;QAC9E,6EAA6E;QAC7E,2EAA2E;QAC3E,2EAA2E;QAC3E,mBAAmB;QACnB,MAAM,GAAG,GAAG,cAAc,IAAI,CAAC,WAAW,IAAI,OAAO,EAAE,CAAC;QACxD,OAAO,YAAY,CACjB,IAAI,CAAC,MAAM,EACX,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EACvD,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAC9B,CAAC;IACJ,CAAC;CACF","sourcesContent":["// packages/codesign-mcp/src/viewer/presigned-r2-url-builder.ts\n//\n// Node-only. NOT exported from viewer/index.ts or the main package entrypoint\n// — keeps @aws-sdk/client-s3 and @aws-sdk/s3-request-presigner out of the\n// browser bundle (mirrors the pattern used by S3WorkspaceFS in workspace/s3.ts).\n// Imported directly by cli/http.ts for the S3/R2 hosted deployment.\nimport { GetObjectCommand, type S3Client } from '@aws-sdk/client-s3';\nimport { getSignedUrl } from '@aws-sdk/s3-request-presigner';\nimport {\n  LocalViewerUrlBuilder,\n  type LocalUrlBuilderOptions\n} from './url-builder.js';\n\nexport interface PresignedR2UrlBuilderOptions extends LocalUrlBuilderOptions {\n  client: S3Client;\n  bucket: string;\n  /** The session's workspace id — the R2 key is `workspaces/<workspaceId>/<relpath>`. */\n  workspaceId: string;\n  /** Presigned URL lifetime in seconds. Default 3600. */\n  expiresIn?: number;\n}\n\n/**\n * URL builder for S3/R2-backed hosted deployments.\n *\n * Inherits all sync viewer URL methods from LocalViewerUrlBuilder\n * (forDesign / forPinnedRevision / forStudio / forResource), so the\n * synchronous CE.SDK `workspace://` URI resolver callback continues to work\n * unchanged. Only `forDownload` is overridden to return a presigned GET URL\n * so the MCP client can download artifacts directly from R2 rather than\n * going through the `/r/` Express route (which is not mounted on the hosted\n * Cloudflare deployment).\n */\nexport class PresignedR2UrlBuilder extends LocalViewerUrlBuilder {\n  private readonly client: S3Client;\n  private readonly bucket: string;\n  private readonly workspaceId: string;\n  private readonly expiresIn: number;\n\n  constructor(opts: PresignedR2UrlBuilderOptions) {\n    super(opts);\n    this.client = opts.client;\n    this.bucket = opts.bucket;\n    this.workspaceId = opts.workspaceId;\n    this.expiresIn = opts.expiresIn ?? 3600;\n  }\n\n  override async forDownload(relpath: string): Promise<string> {\n    // workspaceId is used raw (no sanitize here) on purpose: it is the SAME id\n    // ScopedWorkspaceFS used to store the artifact, and ScopedWorkspaceFS already\n    // sanitised it (rejecting traversal) before any bytes were written. So a key\n    // we can presign always corresponds to a stored object, and sanitize is an\n    // identity on accepted ids — re-sanitising here would only risk drift from\n    // the storage key.\n    const key = `workspaces/${this.workspaceId}/${relpath}`;\n    return getSignedUrl(\n      this.client,\n      new GetObjectCommand({ Bucket: this.bucket, Key: key }),\n      { expiresIn: this.expiresIn }\n    );\n  }\n}\n"]}

package/dist/viewer/resource-route.d.ts

@@ -0,0 +1,9 @@
+import { Router } from 'express';
+import type { WorkspaceFS } from '../workspace/types.js';
+export interface CreateResourceRouteOptions {
+    fs: WorkspaceFS;
+    /** Absolute workspace root for the disk-streaming fast path. Empty on object-store backends. */
+    workspaceRoot: string;
+}
+export declare function createResourceRoute(opts: CreateResourceRouteOptions): Router;
+//# sourceMappingURL=resource-route.d.ts.map

package/dist/viewer/resource-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-route.d.ts","sourceRoot":"","sources":["../../src/viewer/resource-route.ts"],"names":[],"mappings":"AAOA,OAAO,EAAuB,MAAM,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAkBzD,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,WAAW,CAAC;IAChB,gGAAgG;IAChG,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,MAAM,CAoC5E"}

package/dist/viewer/resource-route.js

@@ -0,0 +1,59 @@
+//
+// GET /r/<relpath> — serves workspace binary (generated assets, exports) over
+// HTTP: CE.SDK fetching an asset, or a human opening an export. Prefix-
+// allowlisted to assets/ and exports/ — nothing else is reachable, so the
+// route cannot be used to browse the workspace. Local streams from disk
+// (Range requests work); object-store backends fall back to a buffered send.
+import { normalize } from 'node:path';
+import { Router } from 'express';
+const ALLOWED_PREFIXES = ['assets/', 'exports/'];
+const CONTENT_TYPES = {
+    png: 'image/png',
+    jpg: 'image/jpeg',
+    jpeg: 'image/jpeg',
+    webp: 'image/webp',
+    pdf: 'application/pdf',
+    mp4: 'video/mp4'
+};
+function contentTypeFor(name) {
+    const ext = name.split('.').pop() ?? '';
+    return CONTENT_TYPES[ext] ?? 'application/octet-stream';
+}
+export function createResourceRoute(opts) {
+    const router = Router();
+    // Wildcard param `0` is Express 4's capture for `*` in a route pattern.
+    const handler = (req, res) => {
+        // Normalising collapses any `..`; an escaping path then fails the
+        // allowlist check below, so traversal and allowlist are one guard.
+        const relpath = normalize(req.params['0'] ?? '');
+        if (!ALLOWED_PREFIXES.some((p) => relpath.startsWith(p))) {
+            res.status(404).type('text').send('not found');
+            return;
+        }
+        if (opts.workspaceRoot) {
+            // Local: stream from disk. `root` confines sendFile to the workspace
+            // and rejects `..`; res.sendFile honours Range headers (HTTP 206).
+            res.sendFile(relpath, { root: opts.workspaceRoot }, (err) => {
+                if (err && !res.headersSent)
+                    res.status(404).type('text').send('not found');
+            });
+            return;
+        }
+        // Object-store backend (and tests): buffered send, no Range support.
+        opts.fs
+            .readFile(relpath)
+            .then((bytes) => {
+            res.type(contentTypeFor(relpath)).send(Buffer.from(bytes));
+        })
+            .catch((err) => {
+            const enoent = err.code === 'ENOENT';
+            res
+                .status(enoent ? 404 : 500)
+                .type('text')
+                .send(enoent ? 'not found' : 'error');
+        });
+    };
+    router.get('/r/*', handler);
+    return router;
+}
+//# sourceMappingURL=resource-route.js.map

package/dist/viewer/resource-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-route.js","sourceRoot":"","sources":["../../src/viewer/resource-route.ts"],"names":[],"mappings":"AAAA,EAAE;AACF,8EAA8E;AAC9E,wEAAwE;AACxE,0EAA0E;AAC1E,wEAAwE;AACxE,6EAA6E;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAuB,MAAM,EAAE,MAAM,SAAS,CAAC;AAGtD,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAEjD,MAAM,aAAa,GAA2B;IAC5C,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,iBAAiB;IACtB,GAAG,EAAE,WAAW;CACjB,CAAC;AAEF,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IACxC,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;AAC1D,CAAC;AAQD,MAAM,UAAU,mBAAmB,CAAC,IAAgC;IAClE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,wEAAwE;IACxE,MAAM,OAAO,GAAoC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5D,kEAAkE;QAClE,mEAAmE;QACnE,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,qEAAqE;YACrE,mEAAmE;YACnE,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC1D,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW;oBACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACnD,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,qEAAqE;QACrE,IAAI,CAAC,EAAE;aACJ,QAAQ,CAAC,OAAO,CAAC;aACjB,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACd,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7D,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,MAAM,MAAM,GAAI,GAAyB,CAAC,IAAI,KAAK,QAAQ,CAAC;YAC5D,GAAG;iBACA,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;iBAC1B,IAAI,CAAC,MAAM,CAAC;iBACZ,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["//\n// GET /r/<relpath> — serves workspace binary (generated assets, exports) over\n// HTTP: CE.SDK fetching an asset, or a human opening an export. Prefix-\n// allowlisted to assets/ and exports/ — nothing else is reachable, so the\n// route cannot be used to browse the workspace. Local streams from disk\n// (Range requests work); object-store backends fall back to a buffered send.\nimport { normalize } from 'node:path';\nimport { type RequestHandler, Router } from 'express';\nimport type { WorkspaceFS } from '../workspace/types.js';\n\nconst ALLOWED_PREFIXES = ['assets/', 'exports/'];\n\nconst CONTENT_TYPES: Record<string, string> = {\n  png: 'image/png',\n  jpg: 'image/jpeg',\n  jpeg: 'image/jpeg',\n  webp: 'image/webp',\n  pdf: 'application/pdf',\n  mp4: 'video/mp4'\n};\n\nfunction contentTypeFor(name: string): string {\n  const ext = name.split('.').pop() ?? '';\n  return CONTENT_TYPES[ext] ?? 'application/octet-stream';\n}\n\nexport interface CreateResourceRouteOptions {\n  fs: WorkspaceFS;\n  /** Absolute workspace root for the disk-streaming fast path. Empty on object-store backends. */\n  workspaceRoot: string;\n}\n\nexport function createResourceRoute(opts: CreateResourceRouteOptions): Router {\n  const router = Router();\n  // Wildcard param `0` is Express 4's capture for `*` in a route pattern.\n  const handler: RequestHandler<{ '0': string }> = (req, res) => {\n    // Normalising collapses any `..`; an escaping path then fails the\n    // allowlist check below, so traversal and allowlist are one guard.\n    const relpath = normalize(req.params['0'] ?? '');\n    if (!ALLOWED_PREFIXES.some((p) => relpath.startsWith(p))) {\n      res.status(404).type('text').send('not found');\n      return;\n    }\n    if (opts.workspaceRoot) {\n      // Local: stream from disk. `root` confines sendFile to the workspace\n      // and rejects `..`; res.sendFile honours Range headers (HTTP 206).\n      res.sendFile(relpath, { root: opts.workspaceRoot }, (err) => {\n        if (err && !res.headersSent)\n          res.status(404).type('text').send('not found');\n      });\n      return;\n    }\n    // Object-store backend (and tests): buffered send, no Range support.\n    opts.fs\n      .readFile(relpath)\n      .then((bytes) => {\n        res.type(contentTypeFor(relpath)).send(Buffer.from(bytes));\n      })\n      .catch((err: unknown) => {\n        const enoent = (err as { code?: string }).code === 'ENOENT';\n        res\n          .status(enoent ? 404 : 500)\n          .type('text')\n          .send(enoent ? 'not found' : 'error');\n      });\n  };\n  router.get('/r/*', handler);\n  return router;\n}\n"]}

package/dist/viewer/router.d.ts

@@ -0,0 +1,20 @@
+import { Router } from 'express';
+import type { RevisionStore } from '../revisions/store.js';
+import type { WorkspaceFS } from '../workspace/types.js';
+import type { SseBroadcaster } from './broadcaster.js';
+export interface CreateViewerRouterOptions {
+    store: RevisionStore;
+    fs: WorkspaceFS;
+    broadcaster: SseBroadcaster;
+    /**
+     * CE.SDK license served to the browser viewer via `/api/config`.
+     * Without it, the SPA can't initialise CreativeEditorSDK and shows a
+     * license error. The viewer requires a browser-shape license (which may
+     * be a separate SKU from the @cesdk/node license used by the agent).
+     */
+    cesdkLicense?: string;
+    /** Absolute workspace root, forwarded to the `/r/` route for disk streaming. Empty on object-store backends. */
+    workspaceRoot?: string;
+}
+export declare function createViewerRouter(opts: CreateViewerRouterOptions): Router;
+//# sourceMappingURL=router.d.ts.map

package/dist/viewer/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/viewer/router.ts"],"names":[],"mappings":"AAKA,OAAO,EAIL,MAAM,EACP,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAIvD,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,aAAa,CAAC;IACrB,EAAE,EAAE,WAAW,CAAC;IAChB,WAAW,EAAE,cAAc,CAAC;IAC5B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gHAAgH;IAChH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,yBAAyB,GAAG,MAAM,CAgJ1E"}

package/dist/viewer/router.js

@@ -0,0 +1,142 @@
+//
+// Express router serving the read-only viewer + mini-studio + JSON snapshot
+// API + SSE channel. Stateless: every request reads through the supplied
+// store/fs. Same router mounts on the stdio listener and on the HTTP
+// transport's express app (one impl, no fork).
+import { Router } from 'express';
+import { createResourceRoute } from './resource-route.js';
+import { SPA_ASSETS } from './spa-assets.generated.js';
+export function createViewerRouter(opts) {
+    const { store, fs, broadcaster } = opts;
+    const router = Router();
+    // The SPA is mounted at root on the stdio listener (req.baseUrl === "") and
+    // under "/viewer" on the HTTP transport (req.baseUrl === "/viewer"). Its
+    // HTML/JS address assets and API routes by path, so we inject the live mount
+    // prefix at serve time: the `{{VIEWER_BASE}}` token in the HTML becomes
+    // req.baseUrl, and the inline `window.__VIEWER_BASE__` global it sets lets
+    // the SPA's JS build matching URLs at runtime. Without this the absolute
+    // paths resolve against the origin root and 404 under "/viewer".
+    const renderHtml = (html, baseUrl) => html.replaceAll('{{VIEWER_BASE}}', baseUrl);
+    router.get('/api/config', (req, res) => {
+        // `resourceBase` is where the browser viewer resolves workspace:// asset
+        // URIs. `req.baseUrl` is "" on the stdio listener, "/viewer" on HTTP.
+        res.json({
+            license: opts.cesdkLicense ?? '',
+            resourceBase: `${req.baseUrl}/r/`
+        });
+    });
+    router.use(createResourceRoute({ fs, workspaceRoot: opts.workspaceRoot ?? '' }));
+    router.get('/', (req, res) => {
+        res.type('html').send(renderHtml(SPA_ASSETS['studio.html'], req.baseUrl));
+    });
+    // `/d/<root>` (LIVE) and `/d/<root>/<rev>` (PINNED) both serve the viewer
+    // SPA; viewer.js reads the path depth to choose the mode. The old
+    // per-revision `/s/<rev>` route is gone — `open_editor` hands out `/d/`.
+    const serveViewer = (req, res) => {
+        res.type('html').send(renderHtml(SPA_ASSETS['index.html'], req.baseUrl));
+    };
+    router.get('/d/:root', serveViewer);
+    router.get('/d/:root/:rev', serveViewer);
+    router.get('/static/:name', (req, res, next) => {
+        const body = SPA_ASSETS[req.params.name];
+        if (!body)
+            return next();
+        const ext = req.params.name.split('.').pop();
+        const ctype = ext === 'html'
+            ? 'text/html'
+            : ext === 'js'
+                ? 'application/javascript'
+                : 'text/plain';
+        res.type(ctype).send(body);
+    });
+    // NOTE: thumbnail MUST be registered before /snapshot/:rev so Express
+    // matches it first (route registration order is resolution order).
+    router.get('/snapshot/:rev/thumbnail', async (req, res, next) => {
+        try {
+            const rev = req.params.rev;
+            const shard = rev.slice(0, 2);
+            const rest = rev.slice(2);
+            const relPath = `exports/${shard}/${rest}/preview.webp`;
+            if (!(await fs.exists(relPath)))
+                return next();
+            const bytes = await fs.readFile(relPath);
+            res.type('image/webp').send(Buffer.from(bytes));
+        }
+        catch (err) {
+            next(err);
+        }
+    });
+    router.get('/snapshot/:rev', async (req, res, next) => {
+        try {
+            const revision = await store.read(req.params.rev);
+            const chain = await store.historyOf(req.params.rev);
+            const rootRevision = chain[0].id;
+            res.json({
+                revision: revision.id,
+                rootRevision,
+                scene: revision.scene,
+                title: await store.currentTitle(rootRevision),
+                note: revision.meta.note,
+                createdAt: revision.meta.createdAt
+            });
+        }
+        catch (err) {
+            if (err.code === 'ENOENT') {
+                res.status(404).json({ error: 'unknown revision' });
+                return;
+            }
+            // Non-ENOENT errors carry fs paths in their message — hand to the
+            // sanitising error handler rather than echoing err.message.
+            next(err);
+        }
+    });
+    router.get('/sse/:root', (req, res) => {
+        broadcaster.subscribe(req.params.root, res);
+    });
+    router.get('/api/designs', async (_req, res, next) => {
+        try {
+            res.json(await store.listRoots());
+        }
+        catch (err) {
+            next(err);
+        }
+    });
+    router.get('/api/design/:root', async (req, res, next) => {
+        try {
+            const roots = await store.listRoots();
+            const design = roots.find((d) => d.rootRevision === req.params.root);
+            if (!design) {
+                res.status(404).json({ error: 'unknown design' });
+                return;
+            }
+            res.json(design);
+        }
+        catch (err) {
+            next(err);
+        }
+    });
+    router.get('/api/design/:root/revisions', async (req, res, next) => {
+        try {
+            const tree = await store.treeOf(req.params.root);
+            if (tree.length === 0) {
+                res.status(404).json({ error: 'unknown design' });
+                return;
+            }
+            res.json(tree);
+        }
+        catch (err) {
+            next(err);
+        }
+    });
+    // Sanitising error handler — fs errors embed the absolute workspace path in
+    // their message; convert every error to a generic response so the path
+    // never reaches a client. MUST be last, and MUST take all four args for
+    // Express to recognise it as an error handler.
+    router.use((_err, _req, res, _next) => {
+        if (res.headersSent)
+            return;
+        res.status(500).type('text').send('internal error');
+    });
+    return router;
+}
+//# sourceMappingURL=router.js.map

package/dist/viewer/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/viewer/router.ts"],"names":[],"mappings":"AAAA,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,qEAAqE;AACrE,+CAA+C;AAC/C,OAAO,EAIL,MAAM,EACP,MAAM,SAAS,CAAC;AAIjB,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAiBvD,MAAM,UAAU,kBAAkB,CAAC,IAA+B;IAChE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,OAAe,EAAU,EAAE,CAC3D,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAE9C,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACrC,yEAAyE;QACzE,sEAAsE;QACtE,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;YAChC,YAAY,EAAE,GAAG,GAAG,CAAC,OAAO,KAAK;SAClC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CACR,mBAAmB,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC,CACrE,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,kEAAkE;IAClE,yEAAyE;IACzE,MAAM,WAAW,GAAG,CAAC,GAAY,EAAE,GAAa,EAAQ,EAAE;QACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IAEzC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC7C,MAAM,KAAK,GACT,GAAG,KAAK,MAAM;YACZ,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,GAAG,KAAK,IAAI;gBACZ,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,YAAY,CAAC;QACrB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;YAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,OAAO,GAAG,WAAW,KAAK,IAAI,IAAI,eAAe,CAAC;YACxD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACzC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,QAAQ,CAAC,EAAE;gBACrB,YAAY;gBACZ,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,KAAK,EAAE,MAAM,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC;gBAC7C,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI;gBACxB,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS;aACnC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAAyB,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YACD,kEAAkE;YAClE,4DAA4D;YAC5D,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACpC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACnD,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACvD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,6BAA6B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACjE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,uEAAuE;IACvE,wEAAwE;IACxE,+CAA+C;IAC/C,MAAM,CAAC,GAAG,CACR,CAAC,IAAa,EAAE,IAAa,EAAE,GAAa,EAAE,KAAmB,EAAE,EAAE;QACnE,IAAI,GAAG,CAAC,WAAW;YAAE,OAAO;QAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACtD,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["//\n// Express router serving the read-only viewer + mini-studio + JSON snapshot\n// API + SSE channel. Stateless: every request reads through the supplied\n// store/fs. Same router mounts on the stdio listener and on the HTTP\n// transport's express app (one impl, no fork).\nimport {\n  type NextFunction,\n  type Request,\n  type Response,\n  Router\n} from 'express';\nimport type { RevisionStore } from '../revisions/store.js';\nimport type { WorkspaceFS } from '../workspace/types.js';\nimport type { SseBroadcaster } from './broadcaster.js';\nimport { createResourceRoute } from './resource-route.js';\nimport { SPA_ASSETS } from './spa-assets.generated.js';\n\nexport interface CreateViewerRouterOptions {\n  store: RevisionStore;\n  fs: WorkspaceFS;\n  broadcaster: SseBroadcaster;\n  /**\n   * CE.SDK license served to the browser viewer via `/api/config`.\n   * Without it, the SPA can't initialise CreativeEditorSDK and shows a\n   * license error. The viewer requires a browser-shape license (which may\n   * be a separate SKU from the @cesdk/node license used by the agent).\n   */\n  cesdkLicense?: string;\n  /** Absolute workspace root, forwarded to the `/r/` route for disk streaming. Empty on object-store backends. */\n  workspaceRoot?: string;\n}\n\nexport function createViewerRouter(opts: CreateViewerRouterOptions): Router {\n  const { store, fs, broadcaster } = opts;\n  const router = Router();\n\n  // The SPA is mounted at root on the stdio listener (req.baseUrl === \"\") and\n  // under \"/viewer\" on the HTTP transport (req.baseUrl === \"/viewer\"). Its\n  // HTML/JS address assets and API routes by path, so we inject the live mount\n  // prefix at serve time: the `{{VIEWER_BASE}}` token in the HTML becomes\n  // req.baseUrl, and the inline `window.__VIEWER_BASE__` global it sets lets\n  // the SPA's JS build matching URLs at runtime. Without this the absolute\n  // paths resolve against the origin root and 404 under \"/viewer\".\n  const renderHtml = (html: string, baseUrl: string): string =>\n    html.replaceAll('{{VIEWER_BASE}}', baseUrl);\n\n  router.get('/api/config', (req, res) => {\n    // `resourceBase` is where the browser viewer resolves workspace:// asset\n    // URIs. `req.baseUrl` is \"\" on the stdio listener, \"/viewer\" on HTTP.\n    res.json({\n      license: opts.cesdkLicense ?? '',\n      resourceBase: `${req.baseUrl}/r/`\n    });\n  });\n\n  router.use(\n    createResourceRoute({ fs, workspaceRoot: opts.workspaceRoot ?? '' })\n  );\n\n  router.get('/', (req, res) => {\n    res.type('html').send(renderHtml(SPA_ASSETS['studio.html'], req.baseUrl));\n  });\n\n  // `/d/<root>` (LIVE) and `/d/<root>/<rev>` (PINNED) both serve the viewer\n  // SPA; viewer.js reads the path depth to choose the mode. The old\n  // per-revision `/s/<rev>` route is gone — `open_editor` hands out `/d/`.\n  const serveViewer = (req: Request, res: Response): void => {\n    res.type('html').send(renderHtml(SPA_ASSETS['index.html'], req.baseUrl));\n  };\n  router.get('/d/:root', serveViewer);\n  router.get('/d/:root/:rev', serveViewer);\n\n  router.get('/static/:name', (req, res, next) => {\n    const body = SPA_ASSETS[req.params.name];\n    if (!body) return next();\n    const ext = req.params.name.split('.').pop();\n    const ctype =\n      ext === 'html'\n        ? 'text/html'\n        : ext === 'js'\n          ? 'application/javascript'\n          : 'text/plain';\n    res.type(ctype).send(body);\n  });\n\n  // NOTE: thumbnail MUST be registered before /snapshot/:rev so Express\n  // matches it first (route registration order is resolution order).\n  router.get('/snapshot/:rev/thumbnail', async (req, res, next) => {\n    try {\n      const rev = req.params.rev;\n      const shard = rev.slice(0, 2);\n      const rest = rev.slice(2);\n      const relPath = `exports/${shard}/${rest}/preview.webp`;\n      if (!(await fs.exists(relPath))) return next();\n      const bytes = await fs.readFile(relPath);\n      res.type('image/webp').send(Buffer.from(bytes));\n    } catch (err) {\n      next(err);\n    }\n  });\n\n  router.get('/snapshot/:rev', async (req, res, next) => {\n    try {\n      const revision = await store.read(req.params.rev);\n      const chain = await store.historyOf(req.params.rev);\n      const rootRevision = chain[0].id;\n      res.json({\n        revision: revision.id,\n        rootRevision,\n        scene: revision.scene,\n        title: await store.currentTitle(rootRevision),\n        note: revision.meta.note,\n        createdAt: revision.meta.createdAt\n      });\n    } catch (err) {\n      if ((err as { code?: string }).code === 'ENOENT') {\n        res.status(404).json({ error: 'unknown revision' });\n        return;\n      }\n      // Non-ENOENT errors carry fs paths in their message — hand to the\n      // sanitising error handler rather than echoing err.message.\n      next(err);\n    }\n  });\n\n  router.get('/sse/:root', (req, res) => {\n    broadcaster.subscribe(req.params.root, res);\n  });\n\n  router.get('/api/designs', async (_req, res, next) => {\n    try {\n      res.json(await store.listRoots());\n    } catch (err) {\n      next(err);\n    }\n  });\n\n  router.get('/api/design/:root', async (req, res, next) => {\n    try {\n      const roots = await store.listRoots();\n      const design = roots.find((d) => d.rootRevision === req.params.root);\n      if (!design) {\n        res.status(404).json({ error: 'unknown design' });\n        return;\n      }\n      res.json(design);\n    } catch (err) {\n      next(err);\n    }\n  });\n\n  router.get('/api/design/:root/revisions', async (req, res, next) => {\n    try {\n      const tree = await store.treeOf(req.params.root);\n      if (tree.length === 0) {\n        res.status(404).json({ error: 'unknown design' });\n        return;\n      }\n      res.json(tree);\n    } catch (err) {\n      next(err);\n    }\n  });\n\n  // Sanitising error handler — fs errors embed the absolute workspace path in\n  // their message; convert every error to a generic response so the path\n  // never reaches a client. MUST be last, and MUST take all four args for\n  // Express to recognise it as an error handler.\n  router.use(\n    (_err: unknown, _req: Request, res: Response, _next: NextFunction) => {\n      if (res.headersSent) return;\n      res.status(500).type('text').send('internal error');\n    }\n  );\n\n  return router;\n}\n"]}

package/dist/viewer/session-mount.d.ts

@@ -0,0 +1,10 @@
+import type { Express } from 'express';
+import type { WorkspaceFS } from '../workspace/types.js';
+import type { SseBroadcaster } from './broadcaster.js';
+export interface MountSessionViewerOptions {
+    rawFs: WorkspaceFS;
+    broadcaster: SseBroadcaster;
+    cesdkLicense: string | undefined;
+}
+export declare function mountSessionViewer(app: Express, opts: MountSessionViewerOptions): void;
+//# sourceMappingURL=session-mount.d.ts.map

package/dist/viewer/session-mount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-mount.d.ts","sourceRoot":"","sources":["../../src/viewer/session-mount.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAmC,MAAM,SAAS,CAAC;AAGxE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGvD,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,WAAW,CAAC;IACnB,WAAW,EAAE,cAAc,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAED,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,yBAAyB,GAC9B,IAAI,CAkBN"}

package/dist/viewer/session-mount.js

@@ -0,0 +1,24 @@
+import { RevisionStore } from '../revisions/store.js';
+import { ScopedWorkspaceFS } from '../workspace/scoped.js';
+import { createViewerRouter } from './router.js';
+export function mountSessionViewer(app, opts) {
+    app.use('/v/:sid', (req, res, next) => {
+        let scopedFs;
+        try {
+            scopedFs = new ScopedWorkspaceFS(opts.rawFs, `s/${req.params.sid}`);
+        }
+        catch {
+            // sanitizeWorkspaceId rejected the sid (traversal / control chars).
+            res.status(404).type('text').send('not found');
+            return;
+        }
+        const router = createViewerRouter({
+            store: new RevisionStore(scopedFs),
+            fs: scopedFs,
+            broadcaster: opts.broadcaster,
+            ...(opts.cesdkLicense ? { cesdkLicense: opts.cesdkLicense } : {})
+        });
+        router(req, res, next);
+    });
+}
+//# sourceMappingURL=session-mount.js.map

package/dist/viewer/session-mount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-mount.js","sourceRoot":"","sources":["../../src/viewer/session-mount.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAG3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAQjD,MAAM,UAAU,kBAAkB,CAChC,GAAY,EACZ,IAA+B;IAE/B,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACrE,IAAI,QAA2B,CAAC;QAChC,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,kBAAkB,CAAC;YAChC,KAAK,EAAE,IAAI,aAAa,CAAC,QAAQ,CAAC;YAClC,EAAE,EAAE,QAAQ;YACZ,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["// packages/codesign-mcp/src/viewer/session-mount.ts\n//\n// Multi-tenant viewer mount for `session` workspace mode: GET /v/<sid>/...\n// serves the same read-only viewer router, scoped to that session's workspace\n// `s/<sid>` — the SAME derivation makeWorkspaceResolver applies on /mcp, so a\n// session always finds its own designs. The sid in the URL is a bearer\n// capability mirroring the /mcp trust posture (unguessable session id); real\n// authentication is a follow-up. The router is built per request: construction\n// is cheap and stateless, and caching by sid would be an unbounded,\n// attacker-fillable map on a public endpoint.\nimport type { Express, NextFunction, Request, Response } from 'express';\nimport { RevisionStore } from '../revisions/store.js';\nimport { ScopedWorkspaceFS } from '../workspace/scoped.js';\nimport type { WorkspaceFS } from '../workspace/types.js';\nimport type { SseBroadcaster } from './broadcaster.js';\nimport { createViewerRouter } from './router.js';\n\nexport interface MountSessionViewerOptions {\n  rawFs: WorkspaceFS;\n  broadcaster: SseBroadcaster;\n  cesdkLicense: string | undefined;\n}\n\nexport function mountSessionViewer(\n  app: Express,\n  opts: MountSessionViewerOptions\n): void {\n  app.use('/v/:sid', (req: Request, res: Response, next: NextFunction) => {\n    let scopedFs: ScopedWorkspaceFS;\n    try {\n      scopedFs = new ScopedWorkspaceFS(opts.rawFs, `s/${req.params.sid}`);\n    } catch {\n      // sanitizeWorkspaceId rejected the sid (traversal / control chars).\n      res.status(404).type('text').send('not found');\n      return;\n    }\n    const router = createViewerRouter({\n      store: new RevisionStore(scopedFs),\n      fs: scopedFs,\n      broadcaster: opts.broadcaster,\n      ...(opts.cesdkLicense ? { cesdkLicense: opts.cesdkLicense } : {})\n    });\n    router(req, res, next);\n  });\n}\n"]}

package/dist/viewer/spa-assets.generated.d.ts

@@ -0,0 +1,2 @@
+export declare const SPA_ASSETS: Record<string, string>;
+//# sourceMappingURL=spa-assets.generated.d.ts.map

package/dist/viewer/spa-assets.generated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spa-assets.generated.d.ts","sourceRoot":"","sources":["../../src/viewer/spa-assets.generated.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CA09B7C,CAAC"}