@nodetool-ai/websocket 0.7.0-rc.23 → 0.8.2

package/dist/routes/timeline-fonts.js

@@ -0,0 +1,195 @@
+/**
+ * The bundled typefaces, streamed to the browser —
+ * `GET /api/assets/packages/timeline/fonts/<file>`.
+ *
+ * Node hosts register these files with `@napi-rs/canvas`; a browser has no
+ * such call and loads them through the `@font-face` rules in
+ * `web/src/components/timeline/fonts.css`, which point here. Same files, so
+ * the editor preview and a server render draw the same glyphs (D8, F15).
+ *
+ * A path under `/api/assets/packages/` rather than a route of its own because
+ * that prefix is already public (`lib/public-routes.ts`) — a stylesheet's font
+ * request carries no auth header — and because these are constant files a
+ * package ships, which is exactly what that prefix means. It is a static
+ * route, so Fastify's router prefers it to the `:packageName/*` wildcard next
+ * door, which resolves against the node packages' own asset roots and knows
+ * nothing about this directory.
+ *
+ * Only the catalog's own file names are served. The wildcard route's
+ * traversal guards are careful, and an allowlist of sixteen known names needs
+ * no guards at all.
+ *
+ * This file also serves a family the bundled catalog does not carry, resolved
+ * from Google Fonts at request time and cached on disk
+ * (`@nodetool-ai/timeline/fonts/google-fetch`):
+ * `GET .../fonts/google/:family/css` answers the `@font-face` stylesheet (or
+ * 404 when the family cannot be resolved — offline, or not on Google Fonts),
+ * and `GET .../fonts/google/:slug/:file` streams one cached face. The route
+ * calls no canvas library: resolution is the same network+cache code the
+ * server render and the agent's frame preview register faces from, minus the
+ * registration step, so this process never needs `@napi-rs/canvas` just to
+ * answer a stylesheet request.
+ */
+import { createReadStream } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { statSync } from "node:fs";
+import { join, resolve, sep } from "node:path";
+import { BUNDLED_FONT_FILES, googleFontFaceCss, googleFontsSlug } from "@nodetool-ai/timeline";
+import { googleFontsCacheDir, resolveGoogleFontFamily } from "@nodetool-ai/timeline/fonts/google-fetch";
+import { bridge } from "../lib/bridge.js";
+/**
+ * The default a caller that names no weights gets — regular, bold and their
+ * italics. `web/src/components/timeline/preview/fontLoading.ts` names the
+ * document's actual weights through `?weights=`, so this only covers a
+ * caller that resolves a family before it knows what will be drawn in it
+ * (or an older client). A fixed guess set misses a real weight a document
+ * uses (a display face at 800 or 900, common for kinetic type) and falls
+ * back to whichever nearby weight *did* get fetched — `pickGoogleFontFile`'s
+ * nearest-match, silently wrong rather than the exact face.
+ */
+const STANDARD_WEB_REQUESTS = [
+    { weight: 400, style: "normal" },
+    { weight: 700, style: "normal" },
+    { weight: 400, style: "italic" },
+    { weight: 700, style: "italic" }
+];
+/**
+ * Parse `?weights=400,800,900i` — a comma-separated list of weights, each
+ * optionally suffixed `i` for italic — into face requests. Returns null on
+ * anything unparseable or empty, so the caller falls back to the standard
+ * set rather than resolving zero faces for a typo'd query string.
+ */
+export function parseWeightsParam(raw) {
+    if (raw === undefined || raw.trim() === "")
+        return null;
+    const requests = [];
+    for (const token of raw.split(",")) {
+        const trimmed = token.trim();
+        if (trimmed === "")
+            continue;
+        const match = /^(\d{1,3})(i)?$/.exec(trimmed);
+        if (!match)
+            return null;
+        const weight = Number(match[1]);
+        if (!Number.isInteger(weight) || weight < 1 || weight > 1000)
+            return null;
+        requests.push({ weight, style: match[2] ? "italic" : "normal" });
+    }
+    return requests.length > 0 ? requests : null;
+}
+/** A year, immutable: a face's bytes never change under a given file name. */
+const CACHE_CONTROL = "public, max-age=31536000, immutable";
+const CONTENT_TYPES = {
+    ttf: "font/ttf",
+    otf: "font/otf",
+    txt: "text/plain; charset=utf-8"
+};
+const SERVED_BUNDLED_FONTS = new Set(BUNDLED_FONT_FILES);
+export async function handleBundledTimelineFont(file, options) {
+    if (!options.bundledFontsDir || !SERVED_BUNDLED_FONTS.has(file)) {
+        return Response.json({ error: "Not found" }, { status: 404 });
+    }
+    const path = join(options.bundledFontsDir, file);
+    try {
+        const data = await readFile(path);
+        const extension = file.slice(file.lastIndexOf(".") + 1).toLowerCase();
+        return new Response(new Uint8Array(data), {
+            headers: {
+                "content-type": CONTENT_TYPES[extension] ?? "application/octet-stream",
+                "content-length": String(data.length),
+                "cache-control": CACHE_CONTROL
+            }
+        });
+    }
+    catch {
+        return Response.json({ error: "Not found" }, { status: 404 });
+    }
+}
+const timelineFontRoutes = async (app, opts) => {
+    const { apiOptions } = opts;
+    app.get("/api/assets/packages/timeline/fonts/:file", async (req, reply) => {
+        await bridge(req, reply, () => handleBundledTimelineFont(req.params.file, apiOptions));
+    });
+    app.get("/api/assets/packages/timeline/fonts/google/:family/css", async (req, reply) => {
+        const family = decodeURIComponent(req.params.family).trim();
+        if (family === "") {
+            await reply.status(404).send({ error: "Not found" });
+            return;
+        }
+        const requested = parseWeightsParam(req.query.weights) ?? STANDARD_WEB_REQUESTS;
+        let resolution;
+        try {
+            resolution = await resolveGoogleFontFamily(family, requested);
+        }
+        catch {
+            // Network error, refused host, or a malformed cache entry — the
+            // browser gets the same "not available" answer it gets when the
+            // family is simply not on Google Fonts, and falls back to the
+            // bundled default rather than surfacing a 500 for a font name.
+            resolution = null;
+        }
+        if (resolution === null) {
+            await reply.status(404).send({ error: "Not found", available: false });
+            return;
+        }
+        const slug = googleFontsSlug(family);
+        const css = googleFontFaceCss(resolution.family, resolution.faces.map((face) => ({
+            style: face.style,
+            weights: face.weights,
+            file: face.file.slice(face.file.lastIndexOf("/") + 1)
+        })), `/api/assets/packages/timeline/fonts/google/${encodeURIComponent(slug)}`);
+        await reply
+            .header("content-type", "text/css; charset=utf-8")
+            .header("cache-control", CACHE_CONTROL)
+            .send(css);
+    });
+    app.get("/api/assets/packages/timeline/fonts/google/:slug/:file", async (req, reply) => {
+        const { slug, file } = req.params;
+        if (!/^[a-z0-9]+$/.test(slug)) {
+            await reply.status(404).send({ error: "Not found" });
+            return;
+        }
+        const familyDirectory = resolve(googleFontsCacheDir(), slug);
+        const path = resolve(familyDirectory, file);
+        if (!path.startsWith(familyDirectory + sep) || file.includes("\\")) {
+            await reply.status(404).send({ error: "Not found" });
+            return;
+        }
+        const manifestFile = join(familyDirectory, "manifest.json");
+        let manifest;
+        try {
+            manifest = JSON.parse(await readFile(manifestFile, "utf8"));
+        }
+        catch {
+            await reply.status(404).send({ error: "Not found" });
+            return;
+        }
+        // Only a file this family's own resolved manifest names — the manifest
+        // is written by `resolveGoogleFontFamily`, never by a request, so this
+        // is an allowlist check, not a traversal guard doing double duty.
+        const known = manifest.faces.some((face) => face.file.slice(face.file.lastIndexOf("/") + 1) === file);
+        if (!known) {
+            await reply.status(404).send({ error: "Not found" });
+            return;
+        }
+        let size;
+        try {
+            const stat = statSync(path);
+            if (!stat.isFile())
+                throw new Error("not a file");
+            size = stat.size;
+        }
+        catch {
+            await reply.status(404).send({ error: "Not found" });
+            return;
+        }
+        const extension = file.slice(file.lastIndexOf(".") + 1).toLowerCase();
+        await reply
+            .header("content-type", CONTENT_TYPES[extension] ?? "application/octet-stream")
+            .header("content-length", String(size))
+            .header("cache-control", CACHE_CONTROL)
+            .send(createReadStream(path));
+    });
+};
+export default timelineFontRoutes;
+//# sourceMappingURL=timeline-fonts.js.map

package/dist/routes/timeline-fonts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timeline-fonts.js","sourceRoot":"","sources":["../../src/routes/timeline-fonts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EAChB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,0CAA0C,CAAC;AAElD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAM1C;;;;;;;;;GASG;AACH,MAAM,qBAAqB,GACzB;IACE,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE;IAChC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE;IAChC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE;IAChC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE;CACjC,CAAC;AAEJ;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAuB;IAEvB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,QAAQ,GAAqD,EAAE,CAAC;IACtE,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,KAAK,EAAE;YAAE,SAAS;QAC7B,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,IAAI;YAAE,OAAO,IAAI,CAAC;QAC1E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAYD,8EAA8E;AAC9E,MAAM,aAAa,GAAG,qCAAqC,CAAC;AAE5D,MAAM,aAAa,GAA2B;IAC5C,GAAG,EAAE,UAAU;IACf,GAAG,EAAE,UAAU;IACf,GAAG,EAAE,2BAA2B;CACjC,CAAC;AAEF,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAS,kBAAkB,CAAC,CAAC;AAEjE,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAY,EACZ,OAAuB;IAEvB,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACtE,OAAO,IAAI,QAAQ,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE;YACxC,OAAO,EAAE;gBACP,cAAc,EAAE,aAAa,CAAC,SAAS,CAAC,IAAI,0BAA0B;gBACtE,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;gBACrC,eAAe,EAAE,aAAa;aAC/B;SACF,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,kBAAkB,GAAqC,KAAK,EAChE,GAAG,EACH,IAAI,EACJ,EAAE;IACF,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,GAAG,CACL,2CAA2C,EAC3C,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAC5B,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CACvD,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,wDAAwD,EACxD,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5D,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GACb,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,qBAAqB,CAAC;QAChE,IAAI,UAAU,CAAC;QACf,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;YAChE,gEAAgE;YAChE,8DAA8D;YAC9D,+DAA+D;YAC/D,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,iBAAiB,CAC3B,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;SACtD,CAAC,CAAC,EACH,8CAA8C,kBAAkB,CAAC,IAAI,CAAC,EAAE,CACzE,CAAC;QACF,MAAM,KAAK;aACR,MAAM,CAAC,cAAc,EAAE,yBAAyB,CAAC;aACjD,MAAM,CAAC,eAAe,EAAE,aAAa,CAAC;aACtC,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,wDAAwD,EACxD,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAClC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,eAAe,GAAG,OAAO,CAAC,mBAAmB,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACnE,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;QAC5D,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CACnB,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CACf,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,uEAAuE;QACvE,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAC/B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CACnE,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;YAClD,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACtE,MAAM,KAAK;aACR,MAAM,CACL,cAAc,EACd,aAAa,CAAC,SAAS,CAAC,IAAI,0BAA0B,CACvD;aACA,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;aACtC,MAAM,CAAC,eAAe,EAAE,aAAa,CAAC;aACtC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;AACJ,CAAC,CAAC;AAEF,eAAe,kBAAkB,CAAC"}

package/dist/routes/timeline-isolate-subject.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Subject isolation — `POST /api/timelines/:id/isolate-subject`.
+ *
+ * The inspector's "Isolate subject" button posts here. Nothing is generated or
+ * written in the browser: the route hands the body to the `isolate_subject`
+ * capability, which reads the stored document, marks the clip's matte in
+ * flight, runs the provider, stores the mask it returns as an asset, and
+ * persists the result. The client reloads the document the capability saved,
+ * so the agent path and the inspector path write the same bytes.
+ *
+ * Unlike the audio bake, this capability calls a provider through a node, so
+ * the run carries the server's node registry. Everything else — the body being
+ * this route's own schema rather than the capability's JSON Schema, the
+ * timeline id coming off the path, a refusal being a 400 — matches
+ * `timeline-audio-bake.ts`, because a browser request is untrusted input at an
+ * HTTP boundary either way.
+ */
+import type { FastifyPluginAsync } from "fastify";
+import { z } from "zod";
+import type { StorageAdapter } from "@nodetool-ai/storage";
+import { type HttpApiOptions } from "../http-api.js";
+interface RouteOptions {
+    apiOptions: HttpApiOptions;
+    storage?: StorageAdapter;
+}
+/**
+ * The capability's inputs minus `timeline_id`, which the path carries.
+ *
+ * The two enums are spelled out rather than imported so the door refuses a
+ * value the endpoint would reject; the capability checks them again for
+ * callers that never come through HTTP.
+ */
+export declare const isolateSubjectRequest: z.ZodObject<{
+    clip_id: z.ZodString;
+    model: z.ZodOptional<z.ZodEnum<{
+        "General Use (Dynamic)": "General Use (Dynamic)";
+        "General Use (Heavy)": "General Use (Heavy)";
+        "General Use (Light 2K)": "General Use (Light 2K)";
+        "General Use (Light)": "General Use (Light)";
+        Matting: "Matting";
+        Portrait: "Portrait";
+    }>>;
+    operating_resolution: z.ZodOptional<z.ZodEnum<{
+        "1024x1024": "1024x1024";
+        "2048x2048": "2048x2048";
+        "2304x2304": "2304x2304";
+    }>>;
+    refine_foreground: z.ZodOptional<z.ZodBoolean>;
+    regenerate: z.ZodOptional<z.ZodBoolean>;
+    background: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export type IsolateSubjectRequest = z.infer<typeof isolateSubjectRequest>;
+declare const timelineIsolateSubjectRoutes: FastifyPluginAsync<RouteOptions>;
+export default timelineIsolateSubjectRoutes;
+//# sourceMappingURL=timeline-isolate-subject.d.ts.map

package/dist/routes/timeline-isolate-subject.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timeline-isolate-subject.d.ts","sourceRoot":"","sources":["../../src/routes/timeline-isolate-subject.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AAKxB,UAAU,YAAY;IACpB,UAAU,EAAE,cAAc,CAAC;IAC3B,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;iBAkBhC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAuC1E,QAAA,MAAM,4BAA4B,EAAE,kBAAkB,CAAC,YAAY,CAuDlE,CAAC;eAEa,4BAA4B"}

package/dist/routes/timeline-isolate-subject.js

@@ -0,0 +1,128 @@
+/**
+ * Subject isolation — `POST /api/timelines/:id/isolate-subject`.
+ *
+ * The inspector's "Isolate subject" button posts here. Nothing is generated or
+ * written in the browser: the route hands the body to the `isolate_subject`
+ * capability, which reads the stored document, marks the clip's matte in
+ * flight, runs the provider, stores the mask it returns as an asset, and
+ * persists the result. The client reloads the document the capability saved,
+ * so the agent path and the inspector path write the same bytes.
+ *
+ * Unlike the audio bake, this capability calls a provider through a node, so
+ * the run carries the server's node registry. Everything else — the body being
+ * this route's own schema rather than the capability's JSON Schema, the
+ * timeline id coming off the path, a refusal being a 400 — matches
+ * `timeline-audio-bake.ts`, because a browser request is untrusted input at an
+ * HTTP boundary either way.
+ */
+import { z } from "zod";
+import { contextSecretAvailability, createCapabilityRun, gateFromContext } from "@nodetool-ai/agents";
+import { getSecret } from "@nodetool-ai/models";
+import { PERMISSION_GATE_CONTEXT_KEY, ProcessingContext, headlessGate } from "@nodetool-ai/runtime";
+import { bridge } from "../lib/bridge.js";
+import { getUserId, getWorkflowRuntimeEnvironment } from "../http-api.js";
+import { getAssetAdapter } from "../lib/storage.js";
+const ISOLATE_HOST = "isolate-subject route";
+/**
+ * The capability's inputs minus `timeline_id`, which the path carries.
+ *
+ * The two enums are spelled out rather than imported so the door refuses a
+ * value the endpoint would reject; the capability checks them again for
+ * callers that never come through HTTP.
+ */
+export const isolateSubjectRequest = z.object({
+    clip_id: z.string().min(1),
+    model: z
+        .enum([
+        "General Use (Light)",
+        "General Use (Light 2K)",
+        "General Use (Heavy)",
+        "Matting",
+        "Portrait",
+        "General Use (Dynamic)"
+    ])
+        .optional(),
+    operating_resolution: z
+        .enum(["1024x1024", "2048x2048", "2304x2304"])
+        .optional(),
+    refine_foreground: z.boolean().optional(),
+    regenerate: z.boolean().optional(),
+    background: z.boolean().optional()
+});
+function jsonResponse(data, status = 200) {
+    return new Response(JSON.stringify(data ?? null), {
+        status,
+        headers: { "content-type": "application/json" }
+    });
+}
+async function readJsonBody(request) {
+    const contentType = request.headers.get("content-type") ?? "";
+    if (!contentType.toLowerCase().includes("application/json")) {
+        return {};
+    }
+    try {
+        return await request.json();
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * A capability refusal — a missing clip, a clip with no asset, a document that
+ * moved under the call. A generation that ran and failed is not one of these:
+ * it comes back with `status: "failed"` and the previous matte still in place,
+ * which is a 200 the client renders.
+ */
+function capabilityRefusal(result) {
+    if (result !== null &&
+        typeof result === "object" &&
+        !("status" in result) &&
+        typeof result.error === "string") {
+        return result.error;
+    }
+    return null;
+}
+const timelineIsolateSubjectRoutes = async (app, opts) => {
+    const { apiOptions } = opts;
+    app.post("/api/timelines/:id/isolate-subject", async (req, reply) => {
+        const { id } = req.params;
+        await bridge(req, reply, async (request) => {
+            const userId = getUserId(request, apiOptions.userIdHeader ?? "x-user-id");
+            const parsed = isolateSubjectRequest.safeParse(await readJsonBody(request));
+            if (!parsed.success) {
+                const issue = parsed.error.issues[0];
+                const path = issue?.path.join(".") ?? "";
+                return jsonResponse({
+                    detail: path
+                        ? `${path}: ${issue?.message ?? "Invalid body"}`
+                        : (issue?.message ?? "Invalid body")
+                }, 400);
+            }
+            const context = new ProcessingContext({
+                jobId: `isolate-subject-${Date.now()}`,
+                userId,
+                secretResolver: getSecret,
+                storage: opts.storage ?? getAssetAdapter()
+            });
+            // A route has nobody to ask, so it runs `auto` with escalations denied,
+            // the way every headless host does; the run reads that gate back off
+            // the context rather than being built ungated.
+            context.set(PERMISSION_GATE_CONTEXT_KEY, headlessGate(ISOLATE_HOST));
+            const nodeRegistry = apiOptions.registry ??
+                (await getWorkflowRuntimeEnvironment(apiOptions)).registry;
+            const result = await createCapabilityRun({
+                context,
+                gate: gateFromContext(context, ISOLATE_HOST),
+                nodeRegistry,
+                availableSecrets: contextSecretAvailability(context)
+            }).invoke("isolate_subject", { ...parsed.data, timeline_id: id });
+            const refusal = capabilityRefusal(result);
+            if (refusal !== null) {
+                return jsonResponse({ detail: refusal }, 400);
+            }
+            return jsonResponse(result);
+        });
+    });
+};
+export default timelineIsolateSubjectRoutes;
+//# sourceMappingURL=timeline-isolate-subject.js.map

package/dist/routes/timeline-isolate-subject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timeline-isolate-subject.js","sourceRoot":"","sources":["../../src/routes/timeline-isolate-subject.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,eAAe,EAChB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,YAAY,EACb,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EACL,SAAS,EACT,6BAA6B,EAE9B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAO7C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC;SACL,IAAI,CAAC;QACJ,qBAAqB;QACrB,wBAAwB;QACxB,qBAAqB;QACrB,SAAS;QACT,UAAU;QACV,uBAAuB;KACxB,CAAC;SACD,QAAQ,EAAE;IACb,oBAAoB,EAAE,CAAC;SACpB,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;SAC7C,QAAQ,EAAE;IACb,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACzC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAIH,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IAC/C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE;QAChD,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAgB;IAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC9D,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,MAAe;IACxC,IACE,MAAM,KAAK,IAAI;QACf,OAAO,MAAM,KAAK,QAAQ;QAC1B,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC;QACrB,OAAQ,MAA8B,CAAC,KAAK,KAAK,QAAQ,EACzD,CAAC;QACD,OAAQ,MAA4B,CAAC,KAAK,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,4BAA4B,GAAqC,KAAK,EAC1E,GAAG,EACH,IAAI,EACJ,EAAE;IACF,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAE5B,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAClE,MAAM,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,MAAwB,CAAC;QAC5C,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACzC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,YAAY,IAAI,WAAW,CAAC,CAAC;YAC1E,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAC5C,MAAM,YAAY,CAAC,OAAO,CAAC,CAC5B,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACrC,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACzC,OAAO,YAAY,CACjB;oBACE,MAAM,EAAE,IAAI;wBACV,CAAC,CAAC,GAAG,IAAI,KAAK,KAAK,EAAE,OAAO,IAAI,cAAc,EAAE;wBAChD,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,IAAI,cAAc,CAAC;iBACvC,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC;gBACpC,KAAK,EAAE,mBAAmB,IAAI,CAAC,GAAG,EAAE,EAAE;gBACtC,MAAM;gBACN,cAAc,EAAE,SAAS;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,eAAe,EAAE;aAC3C,CAAC,CAAC;YACH,wEAAwE;YACxE,qEAAqE;YACrE,+CAA+C;YAC/C,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;YAErE,MAAM,YAAY,GAChB,UAAU,CAAC,QAAQ;gBACnB,CAAC,MAAM,6BAA6B,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;YAE7D,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;gBACvC,OAAO;gBACP,IAAI,EAAE,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC;gBAC5C,YAAY;gBACZ,gBAAgB,EAAE,yBAAyB,CAAC,OAAO,CAAC;aACrD,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;YAElE,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,YAAY,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,eAAe,4BAA4B,CAAC"}

package/dist/routes/timeline-track-object.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Subject tracking — `POST /api/timelines/:id/track-object`.
+ *
+ * The inspector sends the same inputs as the `track_object` capability. The
+ * capability owns source validation, provider execution, and compare-and-swap
+ * persistence, so the browser never writes a MediaTrack directly.
+ */
+import type { FastifyPluginAsync } from "fastify";
+import { z } from "zod";
+import type { StorageAdapter } from "@nodetool-ai/storage";
+import { type HttpApiOptions } from "../http-api.js";
+interface RouteOptions {
+    apiOptions: HttpApiOptions;
+    storage?: StorageAdapter;
+}
+export declare const trackObjectRequest: z.ZodObject<{
+    clip_id: z.ZodString;
+    provider: z.ZodOptional<z.ZodString>;
+    model: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    initial_region: z.ZodObject<{
+        x: z.ZodNumber;
+        y: z.ZodNumber;
+        width: z.ZodNumber;
+        height: z.ZodNumber;
+    }, z.core.$strip>;
+    start_ms: z.ZodNumber;
+    end_ms: z.ZodNumber;
+    direction: z.ZodOptional<z.ZodEnum<{
+        backward: "backward";
+        both: "both";
+        forward: "forward";
+    }>>;
+    track_id: z.ZodOptional<z.ZodString>;
+    regenerate: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+declare const timelineTrackObjectRoutes: FastifyPluginAsync<RouteOptions>;
+export default timelineTrackObjectRoutes;
+//# sourceMappingURL=timeline-track-object.d.ts.map

package/dist/routes/timeline-track-object.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timeline-track-object.d.ts","sourceRoot":"","sources":["../../src/routes/timeline-track-object.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AAKxB,UAAU,YAAY;IACpB,UAAU,EAAE,cAAc,CAAC;IAC3B,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;iBAgB7B,CAAC;AA+BH,QAAA,MAAM,yBAAyB,EAAE,kBAAkB,CAAC,YAAY,CAmD/D,CAAC;eAEa,yBAAyB"}

package/dist/routes/timeline-track-object.js

@@ -0,0 +1,97 @@
+/**
+ * Subject tracking — `POST /api/timelines/:id/track-object`.
+ *
+ * The inspector sends the same inputs as the `track_object` capability. The
+ * capability owns source validation, provider execution, and compare-and-swap
+ * persistence, so the browser never writes a MediaTrack directly.
+ */
+import { z } from "zod";
+import { contextSecretAvailability, createCapabilityRun, gateFromContext } from "@nodetool-ai/agents";
+import { getSecret } from "@nodetool-ai/models";
+import { PERMISSION_GATE_CONTEXT_KEY, ProcessingContext, headlessGate } from "@nodetool-ai/runtime";
+import { bridge } from "../lib/bridge.js";
+import { getUserId, getWorkflowRuntimeEnvironment } from "../http-api.js";
+import { getAssetAdapter } from "../lib/storage.js";
+const TRACK_OBJECT_HOST = "track-object route";
+export const trackObjectRequest = z.object({
+    clip_id: z.string().min(1),
+    provider: z.string().min(1).optional(),
+    model: z.string().min(1).optional(),
+    name: z.string().min(1).optional(),
+    initial_region: z.object({
+        x: z.number(),
+        y: z.number(),
+        width: z.number(),
+        height: z.number()
+    }),
+    start_ms: z.number(),
+    end_ms: z.number(),
+    direction: z.enum(["forward", "backward", "both"]).optional(),
+    track_id: z.string().min(1).optional(),
+    regenerate: z.boolean().optional()
+});
+function jsonResponse(data, status = 200) {
+    return new Response(JSON.stringify(data ?? null), {
+        status,
+        headers: { "content-type": "application/json" }
+    });
+}
+async function readJsonBody(request) {
+    const contentType = request.headers.get("content-type") ?? "";
+    if (!contentType.toLowerCase().includes("application/json"))
+        return {};
+    try {
+        return await request.json();
+    }
+    catch {
+        return {};
+    }
+}
+function capabilityRefusal(result) {
+    if (result !== null &&
+        typeof result === "object" &&
+        typeof result.error === "string" &&
+        !("status" in result)) {
+        return result.error;
+    }
+    return null;
+}
+const timelineTrackObjectRoutes = async (app, opts) => {
+    app.post("/api/timelines/:id/track-object", async (req, reply) => {
+        const { id } = req.params;
+        await bridge(req, reply, async (request) => {
+            const userId = getUserId(request, opts.apiOptions.userIdHeader ?? "x-user-id");
+            const parsed = trackObjectRequest.safeParse(await readJsonBody(request));
+            if (!parsed.success) {
+                const issue = parsed.error.issues[0];
+                const path = issue?.path.join(".") ?? "";
+                return jsonResponse({
+                    detail: path
+                        ? `${path}: ${issue?.message ?? "Invalid body"}`
+                        : (issue?.message ?? "Invalid body")
+                }, 400);
+            }
+            const context = new ProcessingContext({
+                jobId: `track-object-${Date.now()}`,
+                userId,
+                secretResolver: getSecret,
+                storage: opts.storage ?? getAssetAdapter()
+            });
+            context.set(PERMISSION_GATE_CONTEXT_KEY, headlessGate(TRACK_OBJECT_HOST));
+            const nodeRegistry = opts.apiOptions.registry ??
+                (await getWorkflowRuntimeEnvironment(opts.apiOptions)).registry;
+            const result = await createCapabilityRun({
+                context,
+                gate: gateFromContext(context, TRACK_OBJECT_HOST),
+                nodeRegistry,
+                availableSecrets: contextSecretAvailability(context)
+            }).invoke("track_object", { ...parsed.data, timeline_id: id });
+            const refusal = capabilityRefusal(result);
+            if (refusal !== null)
+                return jsonResponse({ detail: refusal }, 400);
+            return jsonResponse(result);
+        });
+    });
+};
+export default timelineTrackObjectRoutes;
+//# sourceMappingURL=timeline-track-object.js.map

package/dist/routes/timeline-track-object.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timeline-track-object.js","sourceRoot":"","sources":["../../src/routes/timeline-track-object.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,eAAe,EAChB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,YAAY,EACb,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EACL,SAAS,EACT,6BAA6B,EAE9B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAO/C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QACb,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QACb,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IAC/C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE;QAChD,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAgB;IAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC9D,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAAE,OAAO,EAAE,CAAC;IACvE,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAe;IACxC,IACE,MAAM,KAAK,IAAI;QACf,OAAO,MAAM,KAAK,QAAQ;QAC1B,OAAQ,MAA8B,CAAC,KAAK,KAAK,QAAQ;QACzD,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC,EACrB,CAAC;QACD,OAAQ,MAA4B,CAAC,KAAK,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,yBAAyB,GAAqC,KAAK,EACvE,GAAG,EACH,IAAI,EACJ,EAAE;IACF,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC/D,MAAM,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,MAAwB,CAAC;QAC5C,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACzC,MAAM,MAAM,GAAG,SAAS,CACtB,OAAO,EACP,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,WAAW,CAC5C,CAAC;YACF,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;YACzE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACrC,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACzC,OAAO,YAAY,CACjB;oBACE,MAAM,EAAE,IAAI;wBACV,CAAC,CAAC,GAAG,IAAI,KAAK,KAAK,EAAE,OAAO,IAAI,cAAc,EAAE;wBAChD,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,IAAI,cAAc,CAAC;iBACvC,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC;gBACpC,KAAK,EAAE,gBAAgB,IAAI,CAAC,GAAG,EAAE,EAAE;gBACnC,MAAM;gBACN,cAAc,EAAE,SAAS;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,eAAe,EAAE;aAC3C,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CACT,2BAA2B,EAC3B,YAAY,CAAC,iBAAiB,CAAC,CAChC,CAAC;YAEF,MAAM,YAAY,GAChB,IAAI,CAAC,UAAU,CAAC,QAAQ;gBACxB,CAAC,MAAM,6BAA6B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;YAClE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;gBACvC,OAAO;gBACP,IAAI,EAAE,eAAe,CAAC,OAAO,EAAE,iBAAiB,CAAC;gBACjD,YAAY;gBACZ,gBAAgB,EAAE,yBAAyB,CAAC,OAAO,CAAC;aACrD,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;YAE/D,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,YAAY,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YACpE,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,eAAe,yBAAyB,CAAC"}

package/dist/routes/timelines.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Timeline zip download and upload —
+ *   `GET  /api/timelines/:id/export-zip`
+ *   `POST /api/timelines/import-zip`
+ *
+ * The web app reads and writes sequences over `/trpc/timeline.*`; these are the
+ * two non-tRPC doors, because one response is a binary archive and the other
+ * request is a multipart upload. Both go through `lib/timeline-bundle.ts`, so a
+ * bundle written here imports anywhere.
+ */
+import type { FastifyPluginAsync } from "fastify";
+import { type HttpApiOptions } from "../http-api.js";
+interface RouteOptions {
+    apiOptions: HttpApiOptions;
+}
+declare const timelinesRoutes: FastifyPluginAsync<RouteOptions>;
+export default timelinesRoutes;
+//# sourceMappingURL=timelines.d.ts.map

package/dist/routes/timelines.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timelines.d.ts","sourceRoot":"","sources":["../../src/routes/timelines.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAQlD,OAAO,EAAa,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAWhE,UAAU,YAAY;IACpB,UAAU,EAAE,cAAc,CAAC;CAC5B;AA8FD,QAAA,MAAM,eAAe,EAAE,kBAAkB,CAAC,YAAY,CA+GrD,CAAC;eAEa,eAAe"}