@p4code/cli 0.1.22 → 0.1.23

package/dist/bin.mjs

@@ -77,6 +77,10 @@ import * as HttpClientResponse$1 from "effect/unstable/http/HttpClientResponse";
 import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
 import * as Tracer from "effect/Tracer";
 import "effect/unstable/observability";
+import * as NodeFSP from "node:fs/promises";
+import { compile } from "@mdx-js/mdx";
+import remarkFrontmatter from "remark-frontmatter";
+import remarkGfm from "remark-gfm";
 import * as Cookies from "effect/unstable/http/Cookies";
 import * as HttpEffect from "effect/unstable/http/HttpEffect";
 import { RpcSerialization, RpcServer } from "effect/unstable/rpc";
@@ -86,7 +90,6 @@ import * as TxQueue from "effect/TxQueue";
 import * as TxRef from "effect/TxRef";
 import * as Fiber from "effect/Fiber";
 import * as SynchronizedRef from "effect/SynchronizedRef";
-import * as NodeFSP from "node:fs/promises";
 import * as RcMap from "effect/RcMap";
 import { FileFinder } from "@ff-labs/fff-node";
 import * as LayerMap from "effect/LayerMap";
@@ -233,7 +236,7 @@ const make$76 = () => {
 const layer$72 = Layer.sync(NetService, make$76);
 //#endregion
 //#region package.json
-var version = "0.1.22";
+var version = "0.1.23";
 //#endregion
 //#region src/config.ts
 /**
@@ -261,6 +264,7 @@ const deriveServerPaths = Effect.fn(function* (baseDir, devUrl, options = {}) {
 	const stateDir = join(baseDir, devUrl !== void 0 && !options.baseDirIsExplicit ? "dev" : "userdata");
 	const dbPath = join(stateDir, "state.sqlite");
 	const attachmentsDir = join(stateDir, "attachments");
+	const mdxBuildsDir = join(stateDir, "mdx-builds");
 	const logsDir = join(stateDir, "logs");
 	const providerLogsDir = join(logsDir, "provider");
 	const providerStatusCacheDir = join(baseDir, "caches");
@@ -272,6 +276,7 @@ const deriveServerPaths = Effect.fn(function* (baseDir, devUrl, options = {}) {
 		providerStatusCacheDir,
 		worktreesDir: join(baseDir, "worktrees"),
 		attachmentsDir,
+		mdxBuildsDir,
 		logsDir,
 		serverLogPath: join(logsDir, "server.log"),
 		serverTracePath: join(logsDir, "server.trace.ndjson"),
@@ -293,6 +298,7 @@ const ensureServerDirectories = Effect.fn(function* (derivedPaths) {
 		fs.makeDirectory(derivedPaths.providerLogsDir, { recursive: true }),
 		fs.makeDirectory(derivedPaths.terminalLogsDir, { recursive: true }),
 		fs.makeDirectory(derivedPaths.attachmentsDir, { recursive: true }),
+		fs.makeDirectory(derivedPaths.mdxBuildsDir, { recursive: true }),
 		fs.makeDirectory(derivedPaths.worktreesDir, { recursive: true }),
 		fs.makeDirectory(path.dirname(derivedPaths.keybindingsConfigPath), { recursive: true }),
 		fs.makeDirectory(path.dirname(derivedPaths.settingsPath), { recursive: true }),
@@ -7773,13 +7779,18 @@ const ProjectReadFileResult = Schema$1.Struct({
 	relativePath: TrimmedNonEmptyString,
 	contents: Schema$1.String,
 	byteLength: NonNegativeInt,
-	truncated: Schema$1.Boolean
+	truncated: Schema$1.Boolean,
+	/**
+	* The file is not UTF-8 text, so `contents` is empty and only the metadata
+	* is meaningful. Reported rather than raised because a `.docx` in a preview
+	* panel is an ordinary file to describe, not a failed read to apologise for.
+	*/
+	binary: Schema$1.Boolean
 });
 const ProjectFileFailure = Schema$1.Literals([
 	"workspace_path_outside_root",
 	"resolved_path_outside_root",
 	"path_not_file",
-	"binary_file",
 	"operation_failed"
 ]);
 const ProjectFileOperation = Schema$1.Literals([
@@ -8913,6 +8924,8 @@ const AssetResource = Schema$1.Union([
 		threadId: ThreadId,
 		path: TrimmedNonEmptyString.check(Schema$1.isMaxLength(ASSET_PATH_MAX_LENGTH))
 	}),
+	Schema$1.TaggedStruct("local-file", { path: TrimmedNonEmptyString.check(Schema$1.isMaxLength(ASSET_PATH_MAX_LENGTH)) }),
+	Schema$1.TaggedStruct("mdx-preview", { path: TrimmedNonEmptyString.check(Schema$1.isMaxLength(ASSET_PATH_MAX_LENGTH)) }),
 	Schema$1.TaggedStruct("attachment", { attachmentId: TrimmedNonEmptyString.check(Schema$1.isMaxLength(256)) }),
 	Schema$1.TaggedStruct("project-favicon", { cwd: TrimmedNonEmptyString.check(Schema$1.isMaxLength(ASSET_PATH_MAX_LENGTH)) })
 ]);
@@ -9002,6 +9015,32 @@ var AssetProjectFaviconNotFoundError = class extends Schema$1.TaggedErrorClass()
 		return "Project favicon was not found.";
 	}
 };
+var AssetLocalFileNotFoundError = class extends Schema$1.TaggedErrorClass()("AssetLocalFileNotFoundError", { resource: AssetResource }) {
+	get message() {
+		return "Local file was not found.";
+	}
+};
+var AssetLocalFileInspectionError = class extends Schema$1.TaggedErrorClass()("AssetLocalFileInspectionError", {
+	resource: AssetResource,
+	cause: Schema$1.Defect()
+}) {
+	get message() {
+		return "Failed to inspect the local file.";
+	}
+};
+var AssetLocalPathValidationError = class extends Schema$1.TaggedErrorClass()("AssetLocalPathValidationError", { resource: AssetResource }) {
+	get message() {
+		return "Local file path must be absolute.";
+	}
+};
+var AssetMdxBuildError = class extends Schema$1.TaggedErrorClass()("AssetMdxBuildError", {
+	resource: AssetResource,
+	cause: Schema$1.Defect()
+}) {
+	get message() {
+		return "Failed to prepare the MDX preview build.";
+	}
+};
 var AssetSigningKeyLoadError = class extends Schema$1.TaggedErrorClass()("AssetSigningKeyLoadError", {
 	resource: AssetResource,
 	cause: Schema$1.Defect()
@@ -9023,6 +9062,10 @@ const AssetAccessError = Schema$1.Union([
 	AssetProjectFaviconResolutionError,
 	AssetProjectFaviconInspectionError,
 	AssetProjectFaviconNotFoundError,
+	AssetLocalFileNotFoundError,
+	AssetLocalFileInspectionError,
+	AssetLocalPathValidationError,
+	AssetMdxBuildError,
 	AssetSigningKeyLoadError
 ]);
 //#endregion
@@ -16107,7 +16150,7 @@ function buildSkillOverrides(disabled, discovered) {
 *
 * @module provider/Drivers/ClaudeSkills
 */
-const FRONTMATTER_PATTERN = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/;
+const FRONTMATTER_PATTERN$1 = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/;
 /**
 * The `name`/`description` header a skill and a subagent definition both carry.
 *
@@ -16117,7 +16160,7 @@ const FRONTMATTER_PATTERN = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/;
 * one question both callers are asking.
 */
 function parseMarkdownFrontmatter(contents) {
-	const match = FRONTMATTER_PATTERN.exec(contents);
+	const match = FRONTMATTER_PATTERN$1.exec(contents);
 	if (!match) return { kind: "missing" };
 	let parsed;
 	try {
@@ -30504,6 +30547,374 @@ function isWorkspacePreviewEntryPath(path) {
 	return isWorkspaceBrowserPreviewPath(path) || isWorkspaceImagePreviewPath(path);
 }
 //#endregion
+//#region src/assets/mdxCompile.ts
+/**
+* Pure MDX compilation for the preview renderer.
+*
+* Compilation only: nothing here touches the filesystem, resolves a module, or
+* runs a bundler. The output is a single ES module that imports only the host
+* page's runtime shim, so the build directory it lands in never needs a
+* `node_modules` beside it.
+*
+* @module mdxCompile
+*/
+/**
+* Stable, unhashed module the host page publishes its React JSX runtime and
+* component provider on. Compiled documents are cached across app versions, so
+* this specifier must not carry a build hash.
+*/
+const MDX_RUNTIME_SPECIFIER = "/mdx-jsx-runtime.js";
+/**
+* Scheme the compiler rewrites relative asset references to.
+*
+* The compiled module is served from the build directory, so `./diagram.png`
+* would resolve against the wrong origin path. Rather than copying referenced
+* files into the build directory, the reference is rewritten to a marker the
+* host page resolves against the source-directory grant carried by the same
+* asset token. Cached builds therefore stay valid when the token rotates.
+*/
+const MDX_ASSET_SCHEME = "p4-asset:";
+const FRONTMATTER_PATTERN = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/;
+const EMPTY_FRONTMATTER = {
+	title: null,
+	created: null,
+	status: null,
+	rest: {}
+};
+function scalarToString(value) {
+	if (typeof value === "string") return value;
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	if (value instanceof Date) return value.toISOString().slice(0, 10);
+	return null;
+}
+/**
+* Read the leading YAML block.
+*
+* Parsed here rather than through a remark plugin because the renderer needs
+* the values as data for the document header, while remark-frontmatter's job
+* is only to keep the block from reaching the body as literal text.
+*/
+function parseMdxFrontmatter(source) {
+	const match = FRONTMATTER_PATTERN.exec(source);
+	if (!match?.[1]) return EMPTY_FRONTMATTER;
+	let parsed;
+	try {
+		parsed = parse(match[1]);
+	} catch {
+		return EMPTY_FRONTMATTER;
+	}
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return EMPTY_FRONTMATTER;
+	const entries = Object.entries(parsed);
+	const rest = {};
+	for (const [key, value] of entries) {
+		if (key === "title" || key === "created" || key === "status") continue;
+		const scalar = scalarToString(value);
+		if (scalar !== null) rest[key] = scalar;
+	}
+	return {
+		title: scalarToString(parsed.title),
+		created: scalarToString(parsed.created),
+		status: scalarToString(parsed.status),
+		rest
+	};
+}
+function isRewritableAssetUrl(url) {
+	if (url.length === 0) return false;
+	if (url.startsWith("#") || url.startsWith("/")) return false;
+	if (url.startsWith("data:") || url.startsWith("p4-asset:")) return false;
+	return !/^[A-Za-z][A-Za-z\d+.-]*:/.test(url);
+}
+function walk(node, visit) {
+	const stack = [{
+		node,
+		parent: null
+	}];
+	while (stack.length > 0) {
+		const current = stack.pop();
+		if (!current) break;
+		if (!visit(current.node, current.parent)) continue;
+		for (const child of current.node.children ?? []) stack.push({
+			node: child,
+			parent: current.node
+		});
+	}
+}
+/**
+* Drop `import`/`export` statements before compilation.
+*
+* Dropping rather than rejecting is deliberate: authored plans never contain
+* imports, third-party `.mdx` found on disk usually does, and a dropped import
+* is never resolved or executed either way. The component that would have come
+* from the import is then undefined, which the host page's fallback renders as
+* a labeled placeholder instead of blanking the document.
+*/
+function remarkDropEsm(state) {
+	return (tree) => {
+		walk(tree, (node) => {
+			if (!node.children) return true;
+			const kept = node.children.filter((child) => child.type !== "mdxjsEsm");
+			if (kept.length !== node.children.length) {
+				state.droppedImports = true;
+				node.children = kept;
+			}
+			return true;
+		});
+	};
+}
+/**
+* Collect every capitalised element the document renders.
+*
+* MDX resolves components through `{...provideComponents(), ...props.components}`,
+* a plain object, and throws `Expected component X to be defined` for a name
+* neither supplies — which would blank the whole document over one unresolved
+* tag. A proxy cannot help, because the spread copies own keys only. Naming
+* the components at compile time lets the host page put a real placeholder in
+* the map for each one it does not provide.
+*/
+function remarkCollectComponentNames(state) {
+	return (tree) => {
+		walk(tree, (node) => {
+			if (node.type !== "mdxJsxFlowElement" && node.type !== "mdxJsxTextElement") return true;
+			const name = node.name;
+			if (typeof name !== "string" || name.length === 0) return true;
+			const base = name.split(".")[0] ?? name;
+			if (base[0] === base[0]?.toUpperCase()) state.names.add(base);
+			return true;
+		});
+	};
+}
+/** Rewrite relative image references to the host page's asset marker. */
+function remarkRewriteRelativeAssets() {
+	return (tree) => {
+		walk(tree, (node) => {
+			if (node.type === "image" && typeof node.url === "string" && isRewritableAssetUrl(node.url)) {
+				node.url = `${MDX_ASSET_SCHEME}${node.url}`;
+				return true;
+			}
+			if (node.type === "mdxJsxFlowElement" || node.type === "mdxJsxTextElement") for (const attribute of node.attributes ?? []) {
+				if (attribute.type !== "mdxJsxAttribute") continue;
+				if (attribute.name !== "src" && attribute.name !== "poster") continue;
+				if (typeof attribute.value !== "string" || !isRewritableAssetUrl(attribute.value)) continue;
+				attribute.value = `${MDX_ASSET_SCHEME}${attribute.value}`;
+			}
+			return true;
+		});
+	};
+}
+/**
+* Point every surviving import at the host page's runtime shim.
+*
+* After the author's statements are dropped, the only imports left are the
+* ones MDX itself emits (the JSX runtime and the component provider). Both are
+* satisfied by one unhashed module, which is what lets the compiled output be
+* cached independently of the app build.
+*/
+function recmaPinRuntimeImports() {
+	return (tree) => {
+		for (const statement of tree.body) {
+			if (statement.type !== "ImportDeclaration" || !statement.source) continue;
+			statement.source.value = MDX_RUNTIME_SPECIFIER;
+			statement.source.raw = JSON.stringify(MDX_RUNTIME_SPECIFIER);
+		}
+	};
+}
+function errorPosition(error) {
+	const place = error?.place;
+	const point = place?.start ?? place;
+	const line = point?.line ?? error.line;
+	const column = point?.column ?? error.column;
+	return {
+		line: typeof line === "number" ? line : null,
+		column: typeof column === "number" ? column : null
+	};
+}
+/** Compile MDX source into a single self-contained ES module. */
+async function compileMdxDocument(source) {
+	const frontmatter = parseMdxFrontmatter(source);
+	const state = { droppedImports: false };
+	const collected = { names: /* @__PURE__ */ new Set() };
+	try {
+		const compiled = await compile(source, {
+			development: false,
+			jsx: false,
+			outputFormat: "program",
+			providerImportSource: MDX_RUNTIME_SPECIFIER,
+			remarkPlugins: [
+				remarkFrontmatter,
+				remarkGfm,
+				() => remarkDropEsm(state),
+				() => remarkCollectComponentNames(collected),
+				remarkRewriteRelativeAssets
+			],
+			recmaPlugins: [recmaPinRuntimeImports]
+		});
+		return {
+			ok: true,
+			code: String(compiled),
+			droppedImports: state.droppedImports,
+			componentNames: [...collected.names],
+			frontmatter
+		};
+	} catch (cause) {
+		const { line, column } = errorPosition(cause);
+		return {
+			ok: false,
+			message: cause instanceof Error ? cause.message : "Failed to compile MDX.",
+			line,
+			column,
+			frontmatter
+		};
+	}
+}
+//#endregion
+//#region src/assets/mdxPreviewStore.ts
+/**
+* On-disk cache of compiled MDX previews.
+*
+* A build is keyed by the source file's real path, mtime and size, so opening
+* the same unchanged document twice reuses the cached output and touching the
+* file invalidates it. Output lives under the server state directory, next to
+* `attachments`, because it is generated data that must never be written back
+* into the user's workspace.
+*
+* @module mdxPreviewStore
+*/
+/** Bumping this invalidates every cached build after a renderer change. */
+const BUILD_FORMAT_VERSION = 1;
+const MDX_BUILD_DOCUMENT_FILE = "document.js";
+const MDX_BUILD_META_FILE = "meta.json";
+/** Only these two names resolve inside a build directory. */
+const MDX_BUILD_FILES = /* @__PURE__ */ new Set([MDX_BUILD_DOCUMENT_FILE, MDX_BUILD_META_FILE]);
+const BUILD_ID_PATTERN = /^[0-9a-f]{32}$/;
+const CACHE_MAX_AGE_MS = 10080 * 60 * 1e3;
+const CACHE_MAX_TOTAL_BYTES = 64 * 1024 * 1024;
+function isMdxBuildId(value) {
+	return BUILD_ID_PATTERN.test(value);
+}
+function buildIdFor(input) {
+	return NodeCrypto.createHash("sha256").update(`${BUILD_FORMAT_VERSION}\0${input.realPath}\0${input.mtimeMs}\0${input.size}`).digest("hex").slice(0, 32);
+}
+function metaFor(input) {
+	return {
+		title: input.frontmatter.title,
+		created: input.frontmatter.created,
+		status: input.frontmatter.status,
+		rest: input.frontmatter.rest,
+		sourceName: input.sourceName,
+		droppedImports: input.droppedImports,
+		componentNames: input.componentNames,
+		error: input.error,
+		source: input.source
+	};
+}
+async function directorySize(path) {
+	const entries = await NodeFSP.readdir(path, { withFileTypes: true }).catch(() => []);
+	let total = 0;
+	for (const entry of entries) {
+		if (!entry.isFile()) continue;
+		const info = await NodeFSP.stat(NodePath.join(path, entry.name)).catch(() => null);
+		total += info?.size ?? 0;
+	}
+	return total;
+}
+/**
+* Drop builds that aged out, then oldest-first until the directory fits.
+*
+* Both bounds exist because either alone leaks: a TTL lets a burst of large
+* documents blow past any disk budget within the window, and a size cap alone
+* keeps stale builds alive indefinitely on a quiet machine.
+*/
+async function evictStaleBuilds(buildsDir, keepBuildId, now) {
+	const entries = await NodeFSP.readdir(buildsDir, { withFileTypes: true }).catch(() => []);
+	const surviving = [];
+	for (const entry of entries) {
+		if (!entry.isDirectory() || entry.name === keepBuildId) continue;
+		const path = NodePath.join(buildsDir, entry.name);
+		if (!isMdxBuildId(entry.name)) {
+			await NodeFSP.rm(path, {
+				recursive: true,
+				force: true
+			}).catch(() => void 0);
+			continue;
+		}
+		const info = await NodeFSP.stat(path).catch(() => null);
+		if (!info) continue;
+		if (now - info.mtimeMs > CACHE_MAX_AGE_MS) {
+			await NodeFSP.rm(path, {
+				recursive: true,
+				force: true
+			}).catch(() => void 0);
+			continue;
+		}
+		surviving.push({
+			path,
+			mtimeMs: info.mtimeMs,
+			size: await directorySize(path)
+		});
+	}
+	let total = surviving.reduce((sum, entry) => sum + entry.size, 0);
+	if (total <= CACHE_MAX_TOTAL_BYTES) return;
+	for (const entry of surviving.toSorted((a, b) => a.mtimeMs - b.mtimeMs)) {
+		if (total <= CACHE_MAX_TOTAL_BYTES) break;
+		await NodeFSP.rm(entry.path, {
+			recursive: true,
+			force: true
+		}).catch(() => void 0);
+		total -= entry.size;
+	}
+}
+/**
+* Compile `sourcePath` if needed and return the build that serves it.
+*
+* A compile failure is not an error here: it produces a build whose `meta.json`
+* carries the diagnostic, so the renderer can show an error card with the
+* source rather than a blank page.
+*/
+async function prepareMdxBuild(input) {
+	const realPath = await NodeFSP.realpath(input.sourcePath);
+	const stat = await NodeFSP.stat(realPath);
+	if (!stat.isFile()) throw new Error(`MDX preview source is not a file: ${realPath}`);
+	const buildId = buildIdFor({
+		realPath,
+		mtimeMs: stat.mtimeMs,
+		size: stat.size
+	});
+	const buildDir = NodePath.join(input.buildsDir, buildId);
+	const sourceDir = NodePath.dirname(realPath);
+	const metaPath = NodePath.join(buildDir, MDX_BUILD_META_FILE);
+	if ((await NodeFSP.stat(metaPath).catch(() => null))?.isFile()) {
+		const touchedAtSeconds = input.now / 1e3;
+		await NodeFSP.utimes(buildDir, touchedAtSeconds, touchedAtSeconds).catch(() => void 0);
+		await evictStaleBuilds(input.buildsDir, buildId, input.now);
+		return {
+			buildId,
+			sourceDir
+		};
+	}
+	const source = await NodeFSP.readFile(realPath, "utf8");
+	const outcome = await compileMdxDocument(source);
+	const sourceName = NodePath.basename(realPath);
+	await NodeFSP.mkdir(buildDir, { recursive: true });
+	if (outcome.ok) await NodeFSP.writeFile(NodePath.join(buildDir, MDX_BUILD_DOCUMENT_FILE), outcome.code, "utf8");
+	const meta = metaFor({
+		frontmatter: outcome.frontmatter,
+		sourceName,
+		droppedImports: outcome.ok ? outcome.droppedImports : false,
+		componentNames: outcome.ok ? outcome.componentNames : [],
+		error: outcome.ok ? null : {
+			message: outcome.message,
+			line: outcome.line
+		},
+		source: outcome.ok ? null : source
+	});
+	await NodeFSP.writeFile(metaPath, JSON.stringify(meta), "utf8");
+	await evictStaleBuilds(input.buildsDir, buildId, input.now);
+	return {
+		buildId,
+		sourceDir
+	};
+}
+//#endregion
 //#region ../../packages/shared/src/projectFavicon.ts
 const PROJECT_FAVICON_FALLBACK_MARKER = "project-favicon-missing";
 //#endregion
@@ -30722,6 +31133,10 @@ const PREVIEW_ASSET_EXTENSIONS = /* @__PURE__ */ new Set([
 	".woff",
 	".woff2"
 ]);
+/** Relative references inside a compiled MDX document resolve to images only. */
+const MDX_SOURCE_ASSET_EXTENSIONS = new Set(WORKSPACE_IMAGE_PREVIEW_EXTENSIONS);
+/** Path prefix under an MDX build token that maps to the source directory. */
+const MDX_SOURCE_ASSET_PREFIX = "assets/";
 const AssetClaimsSchema = Schema$1.Union([
 	Schema$1.Struct({
 		version: Schema$1.Literal(1),
@@ -30737,6 +31152,25 @@ const AssetClaimsSchema = Schema$1.Union([
 		relativePath: Schema$1.String,
 		expiresAt: Schema$1.Number
 	}),
+	Schema$1.Struct({
+		version: Schema$1.Literal(1),
+		kind: Schema$1.Literal("local-file"),
+		baseDirectory: Schema$1.String,
+		expiresAt: Schema$1.Number
+	}),
+	Schema$1.Struct({
+		version: Schema$1.Literal(1),
+		kind: Schema$1.Literal("local-file-exact"),
+		filePath: Schema$1.String,
+		expiresAt: Schema$1.Number
+	}),
+	Schema$1.Struct({
+		version: Schema$1.Literal(1),
+		kind: Schema$1.Literal("mdx-build"),
+		buildId: Schema$1.String,
+		sourceDirectory: Schema$1.String,
+		expiresAt: Schema$1.Number
+	}),
 	Schema$1.Struct({
 		version: Schema$1.Literal(1),
 		kind: Schema$1.Literal("attachment"),
@@ -30786,6 +31220,41 @@ const resolveCanonicalWorkspaceFileForRequest = (input) => resolveCanonicalWorks
 	relativePath: input.relativePath,
 	cause
 })), Effect.orElseSucceed(() => null));
+/**
+* Reject anything that could walk out of a directory grant.
+*
+* Shared by every directory-scoped claim so the workspace grant and the two
+* new local grants cannot drift apart: a rule relaxed for one of them would
+* otherwise silently relax for none of the others, which is how the
+* out-of-workspace path becomes the weak one.
+*/
+function isSafeGrantRelativePath(decodedPath, allowedExtensions, extname) {
+	if (decodedPath.length === 0 || decodedPath.includes("\0")) return false;
+	if (decodedPath.split(/[\\/]/).some((segment) => segment === "." || segment === ".." || segment.startsWith("."))) return false;
+	return allowedExtensions.has(extname(decodedPath).toLowerCase());
+}
+/**
+* Resolve a relative path inside a directory grant, following symlinks.
+*
+* The realpath comparison is the point: without it a symlink inside the
+* granted directory would hand out any file on disk while every textual check
+* above still passed.
+*/
+const resolveCanonicalFileWithinDirectory = Effect.fn("AssetAccess.resolveCanonicalFileWithinDirectory")(function* (input) {
+	const fileSystem = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const [canonicalBase, canonicalFile] = yield* Effect.all([optionOnNotFound(fileSystem.realPath(input.baseDirectory)), optionOnNotFound(fileSystem.realPath(path.join(input.baseDirectory, input.relativePath)))]);
+	if (Option.isNone(canonicalBase) || Option.isNone(canonicalFile)) return null;
+	const relative = path.relative(canonicalBase.value, canonicalFile.value);
+	if (relative === "" || relative.startsWith("..") || path.isAbsolute(relative)) return null;
+	const info = yield* optionOnNotFound(fileSystem.stat(canonicalFile.value));
+	return Option.isSome(info) && info.value.type === "File" ? canonicalFile.value : null;
+});
+const resolveCanonicalFileWithinDirectoryForRequest = (input) => resolveCanonicalFileWithinDirectory(input).pipe(Effect.tapError((cause) => Effect.logError("Failed to resolve a granted asset path.", {
+	baseDirectory: input.baseDirectory,
+	relativePath: input.relativePath,
+	cause
+})), Effect.orElseSucceed(() => null));
 const issueAssetUrl = Effect.fn("AssetAccess.issueAssetUrl")(function* (input) {
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
@@ -30836,6 +31305,59 @@ const issueAssetUrl = Effect.fn("AssetAccess.issueAssetUrl")(function* (input) {
 			fileName = path.basename(resolved.relativePath);
 			break;
 		}
+		case "local-file": {
+			if (!path.isAbsolute(input.resource.path)) return yield* new AssetLocalPathValidationError({ resource: input.resource });
+			if (!isWorkspacePreviewEntryPath(input.resource.path)) return yield* new AssetPreviewTypeValidationError({ resource: input.resource });
+			const canonicalFile = yield* optionOnNotFound(fileSystem.realPath(input.resource.path)).pipe(Effect.mapError((cause) => new AssetLocalFileInspectionError({
+				resource: input.resource,
+				cause
+			})));
+			if (Option.isNone(canonicalFile)) return yield* new AssetLocalFileNotFoundError({ resource: input.resource });
+			const info = yield* optionOnNotFound(fileSystem.stat(canonicalFile.value)).pipe(Effect.mapError((cause) => new AssetLocalFileInspectionError({
+				resource: input.resource,
+				cause
+			})));
+			if (Option.isNone(info) || info.value.type !== "File") return yield* new AssetLocalFileNotFoundError({ resource: input.resource });
+			claims = isWorkspaceImagePreviewPath(canonicalFile.value) ? {
+				version: 1,
+				kind: "local-file-exact",
+				filePath: canonicalFile.value,
+				expiresAt
+			} : {
+				version: 1,
+				kind: "local-file",
+				baseDirectory: path.dirname(canonicalFile.value),
+				expiresAt
+			};
+			fileName = path.basename(canonicalFile.value);
+			break;
+		}
+		case "mdx-preview": {
+			if (!path.isAbsolute(input.resource.path)) return yield* new AssetLocalPathValidationError({ resource: input.resource });
+			const config = yield* ServerConfig$1;
+			const now = yield* Clock.currentTimeMillis;
+			const sourcePath = input.resource.path;
+			const build = yield* Effect.tryPromise({
+				try: () => prepareMdxBuild({
+					buildsDir: config.mdxBuildsDir,
+					sourcePath,
+					now
+				}),
+				catch: (cause) => new AssetMdxBuildError({
+					resource: input.resource,
+					cause
+				})
+			});
+			claims = {
+				version: 1,
+				kind: "mdx-build",
+				buildId: build.buildId,
+				sourceDirectory: build.sourceDir,
+				expiresAt
+			};
+			fileName = "meta.json";
+			break;
+		}
 		case "attachment": {
 			const attachmentPath = resolveAttachmentPathById({
 				attachmentsDir: (yield* ServerConfig$1).attachmentsDir,
@@ -30932,6 +31454,54 @@ const resolveAsset = Effect.fn("AssetAccess.resolveAsset")(function* (token, rel
 	const decodedPath = decodeRelativePath(relativePath);
 	if (decodedPath === null) return null;
 	const path = yield* Path.Path;
+	if (claims.kind === "local-file-exact") {
+		if (decodedPath !== path.basename(claims.filePath)) return null;
+		const fileSystem = yield* FileSystem.FileSystem;
+		const info = yield* optionOnNotFound(fileSystem.stat(claims.filePath)).pipe(Effect.tapError((cause) => Effect.logError("Failed to inspect local asset.", {
+			path: claims.filePath,
+			cause
+		})), Effect.orElseSucceed(() => Option.none()));
+		return Option.isSome(info) && info.value.type === "File" ? {
+			kind: "file",
+			path: claims.filePath
+		} : null;
+	}
+	if (claims.kind === "local-file") {
+		if (!isSafeGrantRelativePath(decodedPath, PREVIEW_ASSET_EXTENSIONS, path.extname)) return null;
+		const localFile = yield* resolveCanonicalFileWithinDirectoryForRequest({
+			baseDirectory: claims.baseDirectory,
+			relativePath: decodedPath
+		});
+		return localFile ? {
+			kind: "file",
+			path: localFile
+		} : null;
+	}
+	if (claims.kind === "mdx-build") {
+		if (!isMdxBuildId(claims.buildId)) return null;
+		const config = yield* ServerConfig$1;
+		if (MDX_BUILD_FILES.has(decodedPath)) {
+			const buildFile = yield* resolveCanonicalFileWithinDirectoryForRequest({
+				baseDirectory: path.join(config.mdxBuildsDir, claims.buildId),
+				relativePath: decodedPath
+			});
+			return buildFile ? {
+				kind: "file",
+				path: buildFile
+			} : null;
+		}
+		if (!decodedPath.startsWith(MDX_SOURCE_ASSET_PREFIX)) return null;
+		const sourceRelativePath = decodedPath.slice(7);
+		if (!isSafeGrantRelativePath(sourceRelativePath, MDX_SOURCE_ASSET_EXTENSIONS, path.extname)) return null;
+		const sourceFile = yield* resolveCanonicalFileWithinDirectoryForRequest({
+			baseDirectory: claims.sourceDirectory,
+			relativePath: sourceRelativePath
+		});
+		return sourceFile ? {
+			kind: "file",
+			path: sourceFile
+		} : null;
+	}
 	if (claims.kind === "workspace-file-exact") {
 		if (decodedPath !== path.basename(claims.relativePath)) return null;
 		const exactWorkspaceFile = yield* resolveCanonicalWorkspaceFileForRequest({
@@ -30943,8 +31513,7 @@ const resolveAsset = Effect.fn("AssetAccess.resolveAsset")(function* (token, rel
 			path: exactWorkspaceFile
 		} : null;
 	}
-	const segments = decodedPath.split(/[\\/]/);
-	if (decodedPath.length === 0 || decodedPath.includes("\0") || segments.some((segment) => segment === "." || segment === ".." || segment.startsWith(".")) || !PREVIEW_ASSET_EXTENSIONS.has(path.extname(decodedPath).toLowerCase())) return null;
+	if (!isSafeGrantRelativePath(decodedPath, PREVIEW_ASSET_EXTENSIONS, path.extname)) return null;
 	const joinedRelativePath = claims.baseRelativePath === "." ? decodedPath : path.join(claims.baseRelativePath, decodedPath);
 	const workspaceFile = yield* resolveCanonicalWorkspaceFileForRequest({
 		workspaceRoot: claims.workspaceRoot,
@@ -39822,20 +40391,10 @@ var WorkspacePathNotFileError = class extends Schema$1.TaggedErrorClass()("Works
 		return `Workspace path '${this.relativePath}' in '${this.workspaceRoot}' is not a file: ${this.resolvedPath}`;
 	}
 };
-var WorkspaceBinaryFileError = class extends Schema$1.TaggedErrorClass()("WorkspaceBinaryFileError", {
-	workspaceRoot: Schema$1.String,
-	relativePath: Schema$1.String,
-	resolvedPath: Schema$1.String
-}) {
-	get message() {
-		return `Workspace file '${this.relativePath}' in '${this.workspaceRoot}' is binary and cannot be previewed as text.`;
-	}
-};
 Schema$1.Union([
 	WorkspaceFileSystemOperationError,
 	WorkspaceFilePathEscapeError,
-	WorkspacePathNotFileError,
-	WorkspaceBinaryFileError
+	WorkspacePathNotFileError
 ]);
 /** Service tag for workspace file operations. */
 var WorkspaceFileSystem = class extends Context.Service()("@p4code/cli/workspace/WorkspaceFileSystem") {};
@@ -39919,16 +40478,19 @@ const make$29 = Effect.gen(function* () {
 				})
 			});
 			const fileBytes = buffer.subarray(0, bytesRead);
-			if (fileBytes.includes(0)) return yield* new WorkspaceBinaryFileError({
-				workspaceRoot: input.cwd,
-				relativePath: input.relativePath,
-				resolvedPath: realTargetPath
-			});
+			if (fileBytes.includes(0)) return {
+				relativePath: target.relativePath,
+				contents: "",
+				byteLength: stat.size,
+				truncated: false,
+				binary: true
+			};
 			return {
 				relativePath: target.relativePath,
 				contents: new TextDecoder("utf-8").decode(fileBytes),
 				byteLength: stat.size,
-				truncated: stat.size > PROJECT_READ_FILE_MAX_BYTES
+				truncated: stat.size > PROJECT_READ_FILE_MAX_BYTES,
+				binary: false
 			};
 		}), (handle) => Effect.tryPromise({
 			try: () => handle.close(),
@@ -45757,10 +46319,6 @@ function projectFileFailureContext(error) {
 			failure: "path_not_file",
 			resolvedPath: error.resolvedPath
 		};
-		case "WorkspaceBinaryFileError": return {
-			failure: "binary_file",
-			resolvedPath: error.resolvedPath
-		};
 		default: return unexpectedCompatibilityError(error);
 	}
 }