@rig-c/review 0.1.0 → 0.2.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 firejune (Joon Kyoung)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -51,7 +51,7 @@ For a curated handoff, [REVIEW_PACKAGE.md](docs/REVIEW_PACKAGE.md) documents opt
 bun run review -- /absolute/path/to/package/review.json --checkpoint silhouette
 ```
 
-The server prints the exact link, for example `http://127.0.0.1:4317/?checkpoint=silhouette`. `--port 0` selects a free port. It binds only `127.0.0.1` and never opens a browser automatically. A folder containing `review.json` uses that explicit manifest.
+The server prints the exact link, for example `http://127.0.0.1:4317/?checkpoint=silhouette#cap=…`. The `#cap=` fragment is this server's write capability (see [Managed front and write capability](#managed-front-and-write-capability)). `--port 0` selects a free port. It binds only `127.0.0.1` and never opens a browser automatically. A folder containing `review.json` uses that explicit manifest.
 
 ## Compare two outputs
 
@@ -117,6 +117,10 @@ bun run smoke
 
 The server bundles `web/main.ts` at startup using the pinned installed runtime, with no CDN. `build` verifies that browser bundle in memory. CI checks types, focused path/state/API tests, bundling and the demo package. Follow AGENTS.md for contributor verification policy. [DESIGN.md](docs/DESIGN.md) distinguishes the runnable foundation from future modeling touch-up and preserves the illustrative screen concept.
 
+### Releasing
+
+Releases are cut by `.github/workflows/release.yml`. On every push to main, release-please keeps a `release: vX.Y.Z` pull request whose version comes from the conventional-commit subjects since the last release. Merging it tags the version, creates the GitHub release, runs typecheck and the install smoke on the tagged tree, and publishes to npm through trusted publishing (OIDC) with provenance. No npm token is stored. Nothing is published until a release PR is merged.
+
 ## Frame strip export
 
 The strip panel exports the explicitly entered inclusive feedback interval, or all current in-memory feedback intervals, as a PNG or JSON download. Batch selections include unsaved annotations; they do not submit or approve a review. Choose a declared reference video in single-package mode and an explicit clock basis A/B in compare mode. Every selected feedback interval must identify the selected animation. Separate intervals remain separate strip groups, including overlaps.
@@ -133,14 +137,16 @@ Single `--reference` is a declared video **id**; compare uses the explicitly sel
 
 Strip times require the selected report's exact `frameTimes` and matching animation. Missing or uniform-only clocks refuse PNG with `Report has no frameTimes — regenerate with pose 0.30.0 or later`; JSON retains requested frames with `time:null`. The other compare side may lack a clock: it can still be posed at the common seconds, while its frame label stays unknown. No frame rate is inferred from frame count, duration or video metadata.
 
-PNG export uses the pinned published `@rig-c/play` canvas player and real Node Canvas2D, with `ffmpeg` and `ffprobe` available on PATH for reference decoding. Missing capabilities fail by name. Each requested sample chooses the nearest actual decoded reference PTS (ties earlier); both rigs seek that actual PTS using the viewer's fixed step. JSON distinguishes requested time, actual PTS, delta, decoded frame index, actual player times and independently known producer frames. Requests outside the common domain refuse instead of clamping. The PNG shows source rows, chronological frame columns, and full source hashes/revisions/tool and renderer versions. Batch groups stack vertically. Exports are bounded to64 intervals,256 total frames,64 megapixels and16384 pixels per dimension; larger selections must be split.
+PNG export uses the pinned published `@rig-c/play` canvas player and real Node Canvas2D, with `ffmpeg` (5.1 or later, for `-fps_mode`) and `ffprobe` available on PATH for reference decoding. Missing capabilities fail by name. Each requested sample chooses the nearest actual decoded reference PTS (ties earlier); both rigs seek that actual PTS using the viewer's fixed step. JSON distinguishes requested time, actual PTS, delta, decoded frame index, actual player times and independently known producer frames. Requests outside the common domain refuse instead of clamping. The PNG shows source rows, chronological frame columns, and full source hashes/revisions/tool and renderer versions. Batch groups stack vertically. Exports are bounded to64 intervals,256 total frames,64 megapixels and16384 pixels per dimension; larger selections must be split.
 
 The footer fits its measured text while retaining full hashes. RGB/dark-tint features unsupported by the published Canvas2D path refuse with `STRIP_UNSUPPORTED_TINT`; they are not silently omitted.
 
 ## One-command owner handoff
 
 `open` validates and hashes an existing folder, starts a background loopback
-instance or reuses the exact matching one, prints its hash-bound URL, and exits:
+instance or reuses the exact matching one, prints its hash-bound URL, and exits.
+By default the URL goes through the managed front at `127.0.0.1:4318`; `--direct`
+prints the instance's own port instead (see [Managed front and write capability](#managed-front-and-write-capability)):
 
 ```sh
 bun run open -- /absolute/output --reference /absolute/original.mp4
@@ -199,6 +205,40 @@ printed: every current instance binds only `127.0.0.1`.
 The printed feedback retrieval command uses POSIX shell quoting for literal path
 arguments. It is not a PowerShell or cmd.exe command string.
 
+### Managed front and write capability
+
+`open` is **managed by default**. It ensures one detached loopback front at
+`127.0.0.1:4318` (`RIG_REVIEW_FRONT_PORT` overrides) for the state directory and
+prints `http://127.0.0.1:4318/instances/<key>/?input=…&handoff=…#cap=…`. Every
+inspection therefore shares one stable browser origin, so Settings, panel sizes and
+source-bound drafts survive a reopen. The front only routes: it takes the worker
+address from that key's private open record, allows a closed per-method route
+list, bounds bodies (16 KiB control, 1 MiB session/strip) and upstream time,
+limits concurrent upstream streams, re-verifies the worker's nonce on every
+request, and refuses an unknown, expired or replaced instance by name
+(`FRONT_INSTANCE_UNKNOWN`, `FRONT_INSTANCE_EXPIRED`, `FRONT_INSTANCE_REPLACED`).
+Worker error text is not passed through; failures become named `FRONT_*` codes.
+Package assets keep their `sandbox` CSP through the front. It never reads packages.
+Idle fronts exit after 30 minutes once no live instance remains.
+
+If another listener holds the front port, `open` fails with
+`FRONT_PORT_BUSY: 127.0.0.1:4318 is held by another listener; use --direct` and
+does not fall back silently. `open --direct` keeps the per-instance port and
+prints that worker's own URL.
+
+One origin cannot isolate scripts that run on it, so writes are bound to a
+per-instance capability rather than to the page's origin or the key in its path.
+Each worker mints a 256-bit capability kept only in its private 0600 open record.
+`open` (managed or direct) and the foreground `review`/`review compare` commands
+print it in the `#cap=` fragment, which browsers never send to a server. The page
+moves it into memory and that tab's `sessionStorage`, then removes the fragment
+from the address bar. Every mutation sends it as `X-Review-Capability`; the front
+checks it before forwarding and the worker compares it again in constant time
+before its existing same-origin check. No endpoint returns it, so a page opened
+for one instance cannot submit to another. A copied view link (without the
+fragment) opens read-only and says *Read-only view: reopen with rig-review open to
+edit*; run `open` again for a writable link.
+
 ## Control the current inspection page
 
 Opt in once when opening a fixed package, then keep that page open:
@@ -271,10 +311,14 @@ workspace selections are accepted without restoring a top-level workspace switch
 for a different source binding is refused.
 
 Ordinary form inputs, selected panels, view state and unsent feedback/checkpoint
-choices are kept in browser local storage for the same source. Changing the
-model/source clears the previous draft in that page's storage scope. The global
-appearance preference remains, while a source-bound appearance override does
-not carry over. URL view state takes precedence over the locally saved view.
+choices are kept in browser local storage for the same source. The draft scope
+includes the source hash (`single:<id>:<sourceHash>`; compare uses both sides'
+id and hash), so two revisions of one package keep separate drafts. Opening a page
+deletes no draft; saving evicts the least-recently-written drafts beyond 32, but
+never one written within the last 24 hours. Browser
+Settings (below) remain, while a source-bound appearance override does not
+carry over. URL view state takes precedence over the locally saved view. Each
+Inspector section's own scroll position is part of this source-bound draft.
 
 Local recovery compares the original submitted server-session fingerprint,
 including its update time. It cannot replace a newer server review: conflicting
@@ -284,3 +328,50 @@ errors never count as a successful save. Nothing is written to the server or
 input package merely by restoring a page. Browser storage is convenient local
 recovery, not a durable backup; export feedback separately when it must be kept.
 Control capabilities are excluded from links and browser persistence.
+
+## Workspace settings and panels
+
+The left, right and bottom panels are resizable. Drag a separator, or focus it
+and use the arrow keys (Shift for larger steps) and Home/End. Escape, a
+cancelled pointer or window blur during a drag returns the previous size. The
+stage keeps a usable minimum. When the window is too narrow, the left and then
+the right panel, and when it is too short, the Inspector, become explicit
+drawers opened from buttons above the stage instead of shrinking to nothing. Responsive clamping
+never overwrites the desired size, so a wider window restores it.
+
+Settings, in the lower left, holds browser defaults: Theme, Sync cameras by
+default, Repeat idle by default, and Reset layout. Defaults seed a new
+inspection only. A view link or source draft keeps its own appearance, camera
+sync and idle choice, and restoring it neither changes the saved defaults nor
+starts playback. Reset layout restores panel sizes and nothing else.
+
+These defaults and desired panel sizes are one versioned, closed record in
+browser `localStorage` (`rig-review-preferences/1`). It holds no source path,
+hash, feedback, review decision or capability. The first load migrates the
+earlier same-origin appearance preference. If storage is denied, unavailable
+or the record is corrupt, the page uses defaults and every control keeps
+working for that page; a corrupt record is refused rather than overwritten
+until you change a setting. Several open tabs merge their writes per field, so
+changing the theme in one tab does not undo a panel size changed in another.
+Separate browser profiles keep separate preferences.
+
+Browser storage is per origin. Managed opens share the front's one origin, so
+Settings, panel sizes and drafts carry across reopens. `--direct` and foreground
+serving use per-port origins and keep them separate.
+
+
+## Inspect a part
+
+The right Parts explorer selects an actual model slot on a specific single/A/B side. All rows follow the public held snapshot's exact draw-order z, including hidden/null slots. Search matches the exact source slot names: a row is shown when its name contains the typed text, case-sensitively, with no case folding or normalization. Arrow keys/Home/End move between result buttons, Enter/Space selects, and Escape returns to search. Whole rig restores full drawing. Selecting a drawn row fits its conservative world bounds within the existing camera zoom range; Sync cameras applies the same normalized camera action to every visible pane, while independent mode changes only that selected pane. Hidden/empty geometry reports `PART_FIT_UNAVAILABLE` and keeps the camera.
+
+Solo preserves the full held pose's resolved clips and filters only drawing. In context, the whole rig remains visible with an amber dashed conservative selection box; this box is geometry/clip bounds, not exact source-alpha coverage. Selection changes no track, skin, set, motion, source asset or review decision. The selected slot's side/mode survives source-bound links and local drafts. The Rig inspector shows actual posed mesh counts or region corners, page/region, current skin/set context and declared attachment candidates. **Use slot for feedback** explicitly prefills the target; selecting a row alone submits nothing.
+
+The pinned published `@rig-c/play`1.12.0 supplies `slotIdentity()` and frame generation. The explorer atomically retains the public identity snapshot with the same-generation held frame: exact attachment key, owning skin, active set/skin, full z order and explicit hidden/no-attachment/timeline-null/set-hide reasons. Hidden/null slots keep null keys with their reported reason; declarations and texture/UV names never replace that public result. An identity-known attachment need not have a visible primitive or positive fit bounds. The current UI follows its selected slot as animation changes, updating the displayed identity to the actual held frame.
+
+Source-bound links/drafts and explicit feedback preserve that side/slot plus exact attachment/owning skin/set/active skin/null reason. A restored explicit target is checked after restoring its animation/time/set and drawing; `PART_IDENTITY_MISMATCH` rolls back rather than silently substituting another key. Older slot-only links remain readable and resolve from the current authoritative snapshot. Runtime generation is current observation/feedback evidence, never a persistent identity. Named vertex weights and original source alpha remain unavailable in this inspection; packed pages are not original part images.
+
+This explorer is inspection. Producer-backed optimization and candidate Apply/undo/export remain separate work; the explorer does not generate mesh, rig or motion bytes.
+
+## License
+
+MIT. See [LICENSE](LICENSE).

package/docs/DESIGN.md

@@ -41,3 +41,32 @@ An inclusive annotation interval can also become a derived frame strip. The sing
 Exact report `frameTimes` selects the requested seconds. Actual video decoding selects the nearest presented PTS (ties earlier), which drives all rig rows through the same published player/poser and fixed seek step as inspection. Requested frames, decoded PTS and each side's independently known frame remain distinct data. Missing clocks do not become a guessed rate or an empty rendered cell: PNG names the regeneration requirement and JSON can preserve an unmapped selection.
 
 The export uses dedicated real canvas players and leaves the live playhead/session alone. PNG pixels, full source identity/footer and JSON are derived output outside the input packages. Exporting never approves a review or authors motion. Browser download controls share the bounded backend plan; a CLI can render and write new external files without providing a filesystem endpoint to the browser. Real CLI canvas/video tests do not establish browser WebGL or interactive presentation parity.
+
+
+## Implemented slot inspection and public identity snapshots
+
+The right Parts explorer provides source-hash-bound slot selection, held-pose clipped Solo, Whole/context, conservative bounds fit, a diagnostic selection box, actual mesh/region counts and reproducible selection context. This is inspection rather than geometry editing. All rows use the public held identity snapshot's exact z order, including hidden/null slots. Current source-bound links/drafts and control observations retain side/slot/mode.
+
+Published Play1.12.0 supplies a frozen `slotIdentity()` snapshot coherent with `posedFrame().generation`. Review retains copied frame/identity together only after equal-generation and source-slot/order checks, uses the player's default public filter, and never seeks/reposes/changes physics merely to read identity. Exact owning skin/key, active set/skin and null reasons come from that snapshot, not a unique-declaration or texture match. A resolved identity can remain known without visible geometry or fit bounds. Clip declarations do not invent keys when the API reports no drawable attachment.
+
+Live selection follows a slot. A source-bound bookmark captures its exact identity tuple at that pose; restore validates it after applying time/animation/set and drawing, with transactional rollback on a named mismatch. Old slot-only bookmarks resolve through current public identity. Generation belongs to current readback/feedback, not a stable source target. Named weights and original part alpha remain unavailable without an exact original-source mapping. A conservative bounds box and counts are not source-faithfulness or physics validation.
+
+A future optimization operation sends explicit source-bound selection/bounds to the owning producer. That producer returns a new package revision/hash and provenance including producer version/request identity; Review never regenerates rig, motion or mesh bytes. Candidate Apply/undo/export requires its own implemented contract and acceptance, rather than being inferred from the explorer.
+
+## Workspace geometry and browser preferences
+
+Left, right and bottom panels have pointer and keyboard separators with separator semantics: orientation, the controlled panel, an accessible name and the actual reachable minimum/maximum/current pixels. Arrow keys act only when the separator itself has focus, so text-entry arrows are never intercepted. A drag holds pointer capture; cancel, lost capture, blur, Escape and disposal restore the previous desired size and release it.
+
+The allocator measures the layout rectangle minus stage chrome and keeps a 240×180 CSS-pixel stage minimum. It shrinks side panels proportionally toward their own minima; when the width still cannot hold them it turns the left, then the right panel, and when the height cannot hold it the Inspector, into a native modal drawer opened from a trigger outside it. Effective sizes are computed from desired sizes and never written back; a separator inverts the allocator so a clamped pixel value is not saved as the desktop desire.
+
+Browser defaults live in one closed, versioned record: theme, default camera sync, default idle repeat and the three desired panel sizes. Each field carries a logical stamp, so stale whole-record writes from other tabs converge per field without wall-clock ordering; an equal-stamp disagreement quarantines only that field until an explicit edit repairs it. Denied, unavailable or corrupt storage falls back to in-page defaults. The legacy same-origin appearance key migrates once, only when no new record exists. Reset layout changes geometry only.
+
+Content state stays source-bound. Each Inspector section's x/y scroll offset is captured before its panel hides and restored after it shows, after two frames of layout, and again when its content extent changes. Restoring clamps to the current extent without replacing the remembered offset, and intentional user scrolling supersedes a pending restore. Offsets are kept in the source draft's UI state, never in the global record or a copied view link.
+
+Browser storage is origin-scoped. Managed opens (the default) share one loopback front origin that routes `/instances/<key>/…` to each worker, so Settings, sizes and drafts carry across reopens; `--direct` keeps per-port origins. Because one origin cannot isolate its scripts, writes require a per-instance capability handed off only in the printed `#cap=` fragment and checked by both the front and the worker; a fragment-less copied link is read-only. Draft scopes carry the source hash, so revisions of one package never clobber each other's drafts.
+
+## Comparison eligibility
+
+A layout is offered only for inputs that actually loaded and rendered. One pure decision (`src/comparison-eligibility.ts`) takes load outcomes, never declared paths: the rig counts after its first successful draw, an image after `decode()`, a pose after it parses, and a video after `seeked` at the held time with a decoded frame. A new video stays pending until then; a held time outside its duration is refused as `REFERENCE_OUT_OF_DOMAIN`, never clamped.
+
+Single review keeps the requested layout in the source-bound draft and shows it when usable; otherwise the most useful loaded single pane is shown. Unavailable layout buttons stay visible, disabled, with the named reason as their description, and no placeholder pane stands in for a missing input. Two-build comparison keeps its identity and domain checks: a failed side leaves the survivor as a static single pane with the failed side named, feedback needs the settled pair, and a real zero-duration domain allows static inspection without playback. Modeling-candidate comparison is reported as unavailable (no producer handoff); no candidate UI exists. Remote observation reports the requested and effective layouts and each reason.

package/docs/REVIEW_PACKAGE.md

@@ -587,8 +587,11 @@ These optional fields preserve acceptance of older payloads by the current
 parser; strict older binaries may refuse new observations. This is not a
 forward-compatibility promise or a new source/review identity.
 
-Browser local storage uses `rig-review-draft/1:<scope>:<sourceHash>` and an active
-source marker `rig-review-active/1:<scope>`. A draft has schema
+Browser local storage uses `rig-review-draft/1:<scope>:<sourceHash>`, where the
+scope itself carries the source identity (`single:<id>:<sourceHash>`, or compare's
+A and B id/hash), plus a written-time index `rig-review-draft-index/1`. Opening
+deletes nothing; a write evicts the least-recently-written drafts beyond 32 except
+any written within the last 24 hours. A draft has schema
 `rig-review-local-draft/1` and a maximum512KiB UTF-8 payload. It contains ordinary
 ID/radio form inputs, UI selections, the inspection bookmark and the unsent
 feedback/checkpoint/status session. It records the SHA-256 fingerprint of the
@@ -605,3 +608,20 @@ selection, form and view overrides do not migrate. No restore writes the server,
 model, motion or source assets. Capability tokens, worker credentials and arbitrary
 paths/commands are not persistence fields. Local browser storage can be cleared
 or unavailable and is not a durable backup or an authoritative approval ledger.
+
+
+## Parts explorer and source-bound selection
+
+Part selection is closed `{side:"single"|"a"|"b",slot:string,mode:"context"|"solo",identity?:{attachment:string|null,skin:string|null,reason:null|"hidden"|"no-attachment"|"timeline-null"|"set-hide",set:string|null,activeSkin:string|null}}` or null for Whole rig. Slot membership is checked against that side's actual model catalog, whose exact byte SHA-256 must equal `reviewedSource.rig.sha256`. The source model remains immutable. The catalog retains explicit slot/bone/setup and skin/attachment declarations; an atlas page does not identify a part. Malformed catalog/hash mismatch refuses rather than substituting a guessed catalog.
+
+`selection.part` is optional in versioned inspection links/drafts; absent legacy values mean Whole rig. Unknown keys, invalid modes/sides and unavailable slot membership refuse before restoration mutation. Single cannot restore an A/B target and compare cannot restore a single target. Existing transactional rollback also restores selection. Restoring explicit view cameras does not auto-fit the selected part; a deliberate local selection or Fit action does. The optional `part` control observation reports this exact actual slot/identity selection, and optional `partGeneration:number|null` names its held runtime generation. These observations add no selection/source-writing/approval command. Generation is rejected inside the persisted target identity.
+
+`context.part` in explicit feedback carries copied observed side/slot/mode, the exact identity tuple, held generation, null reason, drawn kind/page/region/sequence/z, actual mesh counts, active skin (null means no skin set), active set, declared skin/key candidates, conservative world-Y-up bounds and `activeAttachment:{skin,attachment}|null`. Play1.12.0's public `slotIdentity()` supplies attachment key and owning skin, including ambiguous/linked/set-selected cases. Hidden/non-drawn API reasons preserve attachment/owning skin null rather than guessing a catalog key. `reason:null` identifies a resolved attachment; it does not promise visible pixels, geometry or positive fit bounds. `identityUnavailable` is null after a valid public snapshot, including known null reasons; no held snapshot reports `PART_IDENTITY_UNAVAILABLE`. No UV/topology/texture-name match is identity evidence. Named vertex weights and original source alpha remain unavailable; the package supplies no inferred loose-art mapping.
+
+Review copies `posedFrame()` with its explicit (nonenumerable upstream) generation and reads `slotIdentity()` under the same public generation. It respects the default public slot filter rather than requesting an unfiltered frame. Every actual frame row must have its coherent snapshot slot/z and resolved identity, while identity-only rows need not have a visible primitive. Unknown/repeated slots, invalid full z order, invalid key/null reason shape and generation mismatch refuse by name before replacing retained state. Identity checks do not call seek/repose or reset physics.
+
+The live selected slot follows animation changes and each successful draw refreshes its actual identity. Bookmarks/drafts capture the tuple at their explicit inspection time; restoration checks that exact tuple only after restoring animation/time/set and drawing. `PART_IDENTITY_MISMATCH` causes the existing full inspection rollback. Legacy targets lacking identity resolve through a valid current public snapshot or refuse `PART_IDENTITY_UNAVAILABLE`; they do not infer keys. Runtime generation is observation/feedback only and is never persisted as a stable target ID.
+
+The right list orders every slot by the public snapshot's exact held z, including hidden/null slots. Solo filters a copied full held posed frame after clip resolution; it never sets player skin, set, slots, clock or track. Context/Whole preserve full drawing. An amber diagnostic selection box uses conservative world bounds intersected with a normal clip's AABB; inverse clips remain conservative. It is not alpha coverage or an exact clip polygon. Selection/Fit centers those bounds within the established0.25–8× camera limit. SyncON sends the same fit-relative zoom/normalized pan signature to visible panes; OFF affects only the selected side. Missing/nonpositive bounds report `PART_FIT_UNAVAILABLE`. Fitting never reseeks or authors motion.
+
+Selection, links, controls and export never approve a review. Producer-backed optimization must use a separately owned producer returning a new source-bound package revision/hash and provenance; Review does not generate rig, motion or mesh bytes.

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "@rig-c/review",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "type": "module",
   "description": "Local human rig inspection and structured feedback export",
+  "license": "MIT",
   "scripts": {
     "review": "bun src/cli.ts",
     "check": "bun src/cli.ts check",
@@ -16,7 +17,7 @@
   },
   "dependencies": {
     "@napi-rs/canvas": "1.0.11",
-    "@rig-c/play": "1.11.2"
+    "@rig-c/play": "1.12.0"
   },
   "devDependencies": {
     "@types/bun": "^1.3.0",
@@ -34,7 +35,8 @@
     "examples/demo",
     "docs/REVIEW_PACKAGE.md",
     "docs/DESIGN.md",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
   "exports": {
     "./package.json": "./package.json"

package/src/cli.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env bun
+import {randomBytes} from 'node:crypto';
 import {parseControlCommand} from './control.ts';
 import { loadReview } from './manifest.ts';
 import { formatFeedbackIssues } from './feedback-export.ts';
@@ -14,7 +15,7 @@ import { readSession, type Feedback } from './session.ts';
 import { readCompareSession } from './compare-session.ts';
 import { exportReviewStrip, exportCompareStrip, stripJson, writeStripOutput, validateStripOutput } from './strip-export.ts';
 import type { StripInterval, StripRequest } from './strip.ts';
-const usage='Usage: rig-review open <dir> [--reference <video>] [--compare <dir>] [--animation <name>] [--control]\n       rig-review control <dir> [--reference <video>] [--compare <dir>] [--animation <name>] [--page <id> --expected-revision <n> --command <JSON> --wait-ms <n>]\n       rig-review feedback <dir> [--reference <video>] [--compare <dir>] [--animation <name>] [--format json|issue]\n       Usage: bun run review -- <review.json|output-directory> [--port 4317] [--checkpoint ID]\n       bun run check -- <review.json|output-directory>\n       bun run feedback -- <review.json|output-directory>\n       bun run review -- compare <a> <b> --reference <video> --animation <name> [--port 4317]\n       bun run check -- compare <a> <b> --reference <video> --animation <name>\n       bun run feedback -- compare <a> <b> --reference <video> --animation <name>';
+const usage='Usage: rig-review open <dir> [--reference <video>] [--compare <dir>] [--animation <name>] [--control] [--direct]\n       open is managed by default: one loopback front at 127.0.0.1:4318 (RIG_REVIEW_FRONT_PORT overrides) serves /instances/<key>/; --direct serves the worker on its own port.\n       rig-review control <dir> [--reference <video>] [--compare <dir>] [--animation <name>] [--page <id> --expected-revision <n> --command <JSON> --wait-ms <n>]\n       rig-review feedback <dir> [--reference <video>] [--compare <dir>] [--animation <name>] [--format json|issue]\n       Usage: bun run review -- <review.json|output-directory> [--port 4317] [--checkpoint ID]\n       bun run check -- <review.json|output-directory>\n       bun run feedback -- <review.json|output-directory>\n       bun run review -- compare <a> <b> --reference <video> --animation <name> [--port 4317]\n       bun run check -- compare <a> <b> --reference <video> --animation <name>\n       bun run feedback -- compare <a> <b> --reference <video> --animation <name>';
 async function stripCommand(args:string[],options:{stateDir?:string}){
   const compare=args[0]==='compare';if(compare)args.shift();const a=args.shift(),b=compare?args.shift():undefined;if(!a||compare&&!b)throw new Error('strip: expected package input(s)');
   let reference:string|undefined,referenceVideo:string|undefined,animation:string|undefined,basis:'a'|'b'|undefined,range:string|undefined,output:string|undefined,jsonOnly=false,all=false;
@@ -34,7 +35,7 @@ async function stripCommand(args:string[],options:{stateDir?:string}){
 }
 export function parseOpenInputs(args:string[]):OpenInputs {
  const input=args.shift();if(!input||input.startsWith('--'))throw new Error(usage);const result:OpenInputs={input},seen=new Set<string>();
- while(args.length){const flag=args.shift()!;if(seen.has(flag))throw new Error(`Duplicate open option ${flag}`);seen.add(flag);if(flag==='--control'){result.control=true;continue;}const value=args.shift();if(value===undefined||value==='')throw new Error(`Missing value for ${flag}`);if(flag==='--reference')result.reference=value;else if(flag==='--compare')result.compare=value;else if(flag==='--animation')result.animation=value;else throw new Error(`Unknown open option ${flag}`);}return result;
+ while(args.length){const flag=args.shift()!;if(seen.has(flag))throw new Error(`Duplicate open option ${flag}`);seen.add(flag);if(flag==='--control'){result.control=true;continue;}if(flag==='--direct'){result.direct=true;continue;}const value=args.shift();if(value===undefined||value==='')throw new Error(`Missing value for ${flag}`);if(flag==='--reference')result.reference=value;else if(flag==='--compare')result.compare=value;else if(flag==='--animation')result.animation=value;else throw new Error(`Unknown open option ${flag}`);}return result;
 }
 async function controlCommand(args:string[],stateDir?:string){
  const input=args.shift();if(!input||input==='--help'||input==='-h'){console.log(usage);return;}
@@ -75,7 +76,7 @@ function commandHelpRequested(args:readonly string[],command:'open'|'review'|'ch
  const flags=command==='open'?['--reference','--compare','--animation']:compare?['--reference','--animation','--port']:['--port','--checkpoint','--reference','--compare','--animation'];
  for(let i=compare?3:1;i<args.length;){
   const flag=args[i];if(flag==='--help'||flag==='-h')return true;
-  if(command==='open'&&flag==='--control'){i++;continue;}if(!flags.includes(flag!))return false;i+=2;
+  if(command==='open'&&(flag==='--control'||flag==='--direct')){i++;continue;}if(!flags.includes(flag!))return false;i+=2;
  }
  return false;
 }
@@ -98,7 +99,7 @@ export async function main(args:string[],options:{stateDir?:string}={}){
     const p=await loadCompare({a,b,reference,animation});
     if(command==='feedback'){printFeedback(await readFeedbackCompareSession(p,options.stateDir));return;}
     if(command==='check'){console.log(`Comparison valid: ${p.response.title}\nSource SHA-256: ${p.response.sourceHash}\nAnimation: ${animation}\nReference SHA-256: ${p.response.reference.sha256}\nPlayback: two compiled models present`);return;}
-    const server=await startCompareServer(p,{port,stateDir:options.stateDir});console.log(`Compare ready: http://127.0.0.1:${server.port}/\nComparison: ${p.response.title}\nSource SHA-256: ${p.response.sourceHash}\nPress Ctrl+C to stop.`);return;
+    const capability=randomBytes(32).toString('hex'),server=await startCompareServer(p,{port,stateDir:options.stateDir,capability});console.log(`Compare ready: http://127.0.0.1:${server.port}/#cap=${capability}\nComparison: ${p.response.title}\nSource SHA-256: ${p.response.sourceHash}\nPress Ctrl+C to stop.`);return;
   }
   const input=args.shift();if(!input)throw new Error(usage);let port=4317;let checkpoint:string|undefined,reference:string|undefined,compare:string|undefined,animation:string|undefined;
   while(args.length){const flag=args.shift();const value=args.shift();if(!value)throw new Error(`Missing value for ${flag}`);if(flag==='--port'){port=Number(value);if(!Number.isInteger(port)||port<0||port>65535)throw new Error('--port: expected integer 0…65535');}else if(flag==='--checkpoint')checkpoint=value;else if(flag==='--reference')reference=value;else if(flag==='--compare')compare=value;else if(flag==='--animation')animation=value;else throw new Error(`Unknown option ${flag}\n${usage}`);}
@@ -107,7 +108,8 @@ export async function main(args:string[],options:{stateDir?:string}={}){
   const fromReport=command==='review'&&animation===undefined&&p.report?.animation!==undefined;
   const selection=animation!==undefined||fromReport?selectAnimation([{label:'single',catalog:p.feedbackCatalog,report:p.report}],animation,true):null;const initialAnimation=selection?.name;if(command==='feedback'){const saved=await readFeedbackSession(p,options.stateDir);await assertReviewUnchanged(p);printFeedback(saved);return;}if(command==='check'){console.log(`Package valid: ${p.manifest.title}\nRevision: ${p.manifest.revision}\nSource SHA-256: ${p.sourceHash}\nDeclared files: ${p.files.size}\nPlayback: ${p.manifest.model?'compiled model present':'unavailable (no model)'}`);return;}
   if(checkpoint&&!p.manifest.checkpoints.some(v=>v.id===checkpoint))throw new Error(`Unknown checkpoint ${checkpoint}`);
-  const server=await startServer(p,{port,stateDir:options.stateDir,initialAnimation});const url=new URL(`http://127.0.0.1:${server.port}/`);if(checkpoint)url.searchParams.set('checkpoint',checkpoint);
+  // Foreground serving uses the same `#cap=` fragment handoff as open: the printed link alone can submit.
+  const capability=randomBytes(32).toString('hex'),server=await startServer(p,{port,stateDir:options.stateDir,initialAnimation,capability});const url=new URL(`http://127.0.0.1:${server.port}/`);if(checkpoint)url.searchParams.set('checkpoint',checkpoint);url.hash='cap='+capability;
   if(fromReport&&selection)console.error(animationDiagnostic(selection));
   console.log(`Review ready: ${url}\nPackage: ${p.manifest.title} (${p.manifest.revision})\nSource SHA-256: ${p.sourceHash}\nPress Ctrl+C to stop.`);
 }

package/src/compare-server.ts

@@ -1,5 +1,5 @@
 import {createControlServer,type ControlIdentity} from './control-server.ts';
-import {openGate,staleOpenStatus,type OpenIdentity} from './open-protocol.ts';
+import {openGate,staleOpenStatus,accessGate,openNonceGate,stampOpen,type OpenIdentity} from './open-protocol.ts';
 import { readFile } from 'node:fs/promises';
 import { appRoot, buildWeb } from './build.ts';
 import { packagePath, safeFile } from './manifest.ts';
@@ -28,13 +28,15 @@ function serveAsset(req:Request,path:string):Response{
   }
   return new Response(req.method==='HEAD'?null:file,{headers:{...assetHeaders,'Content-Length':String(size)}});
 }
-export async function startCompareServer(p:ComparePackage,options:{port?:number;stateDir?:string;open?:OpenIdentity;activity?:()=>void;control?:ControlIdentity}={}){
+/** `capability` (open workers and foreground CLI serving) gates every non-GET request; tests may omit it. */
+export async function startCompareServer(p:ComparePackage,options:{port?:number;stateDir?:string;open?:OpenIdentity;activity?:()=>void;control?:ControlIdentity;capability?:string}={}){
   const bundle=await buildWeb('compare');
   const frames=referenceFrameIndex(p.referencePath,p.response.binding.reference.sha256,p.response.sourceHash);
   const control=options.control?createControlServer({identity:options.control,sourceHash:p.response.sourceHash,mode:'compare',unchanged:()=>assertCompareUnchanged(p),activity:options.activity}):null;
-  return Bun.serve({hostname:'127.0.0.1',port:options.port??4317,async fetch(req,server){try{
-    const url=new URL(req.url),origin=`http://127.0.0.1:${server.port}`;
+  const handle=async(req:Request,port:number|undefined):Promise<Response>=>{try{
+    const url=new URL(req.url),origin=`http://127.0.0.1:${port}`;
     if(url.origin!==origin)return json({error:'Loopback host required'},403);
+    const refused=openNonceGate(req,options.open)??accessGate(req,options.capability);if(refused)return refused;
     const controlled=await control?.(req,origin);if(controlled)return controlled;
     options.activity?.();const gate=openGate(req,options.open);if(gate){if(gate.status===200){try{await assertCompareUnchanged(p);}catch{return staleOpenStatus(options.open!);}}return gate;}
     if(req.method==='PUT'&&url.pathname==='/api/compare/session'){
@@ -56,5 +58,6 @@ export async function startCompareServer(p:ComparePackage,options:{port?:number;
     if(url.pathname==='/'||url.pathname==='/index.html')return new Response(req.method==='HEAD'?null:await readFile(appRoot+'web/compare.html'),{headers:{...headers,'Content-Type':'text/html; charset=utf-8'}});
     if(url.pathname==='/styles.css')return new Response(req.method==='HEAD'?null:await readFile(appRoot+'web/compare.css'),{headers:{...headers,'Content-Type':'text/css'}});
     return json({error:'Not found'},404);
-  }catch(e){const message=e instanceof Error?e.message:'Request failed';return json({error:message},message.includes('inputs changed')?409:400);}}});
+  }catch(e){const message=e instanceof Error?e.message:'Request failed';return json({error:message},message.includes('inputs changed')?409:400);}};
+  return Bun.serve({hostname:'127.0.0.1',port:options.port??4317,async fetch(req,server){return stampOpen(req,await handle(req,server.port),options.open);}});
 }

package/src/comparison-eligibility.ts

@@ -0,0 +1,54 @@
+/** Layout offers follow actual load events. A declared path, a stored request or a placeholder never establishes an input. */
+export type InputState={state:'loaded'}|{state:'pending'}|{state:'absent'}|{state:'failed';reason:string}|{state:'out-of-domain';reason:string};
+export const singleLayouts=['compare','reference','rig'] as const;
+export const pairLayouts=['compare','a','b','reference'] as const;
+export type SingleLayout=typeof singleLayouts[number];
+export type PairLayout=typeof pairLayouts[number];
+export type ComparisonLayout=SingleLayout|PairLayout;
+/** Review has no producer candidate handoff yet; this is stated, not drawn. */
+export const candidateUnavailable={state:'unavailable',reason:'no producer handoff'} as const;
+export interface Eligibility<L extends ComparisonLayout> {
+ mode:'single'|'compare';requested:L;effective:L|null;usable:L[];reasons:Partial<Record<L,string>>;candidate:typeof candidateUnavailable;
+}
+export interface PairEligibility extends Eligibility<PairLayout> {feedback:boolean;playback:boolean;static:boolean}
+export interface SingleInputs {rig:InputState;reference:InputState;requested:SingleLayout}
+export type PairDomain={end:number}|{refused:string}|null;
+export interface PairInputs {a:InputState;b:InputState;reference:InputState;domain:PairDomain;requested?:PairLayout}
+
+const prose:Record<InputState['state'],string>={loaded:'',pending:'not rendered yet',absent:'not supplied',failed:'',['out-of-domain']:''};
+/** Named reason for an input that cannot be drawn. Codes are stable; detail is display text. */
+export function inputReason(name:'RIG'|'REFERENCE'|'A'|'B',input:InputState):string|null {
+ if(input.state==='loaded')return null;
+ if(input.state==='failed')return `${name}_FAILED: ${input.reason}`;
+ if(input.state==='out-of-domain')return `${name}_OUT_OF_DOMAIN: ${input.reason}`;
+ return `${name}_${input.state.toUpperCase()}: ${name==='REFERENCE'&&input.state==='pending'?'held time not decoded yet':prose[input.state]}`;
+}
+function settle<L extends ComparisonLayout>(mode:'single'|'compare',requested:L,order:readonly L[],reasons:Partial<Record<L,string>>,fallback:readonly L[]):Eligibility<L> {
+ const usable=order.filter(layout=>reasons[layout]===undefined);
+ const effective=usable.includes(requested)?requested:fallback.find(layout=>usable.includes(layout))??null;
+ return {mode,requested,effective,usable,reasons,candidate:candidateUnavailable};
+}
+/** Single review: side by side needs an actually drawn rig AND a decoded reference. */
+export function singleEligibility(value:SingleInputs):Eligibility<SingleLayout> {
+ const rig=inputReason('RIG',value.rig),reference=inputReason('REFERENCE',value.reference),reasons:Partial<Record<SingleLayout,string>>={};
+ if(rig)reasons.rig=rig;if(reference)reasons.reference=reference;
+ if(rig||reference)reasons.compare=[rig,reference].filter(Boolean).join(' · ');
+ return settle('single',value.requested,singleLayouts,reasons,value.requested==='reference'?['reference','rig']:['rig','reference']);
+}
+/** A held time outside a video's real domain is refused, never clamped. */
+export function videoReferenceAt(held:number,duration:number):InputState {
+ if(!Number.isFinite(duration)||duration<0)return {state:'failed',reason:'video duration is not finite'};
+ if(!Number.isFinite(held)||held<0||held>duration)return {state:'out-of-domain',reason:`held time ${held} s is outside the video domain 0–${duration} s`};
+ return {state:'pending'};
+}
+/** Two builds: the pair needs both sides, the shared video and a valid common domain. A failed side leaves the survivor usable alone. */
+export function pairEligibility(value:PairInputs):PairEligibility {
+ const a=inputReason('A',value.a),b=inputReason('B',value.b),reference=inputReason('REFERENCE',value.reference),reasons:Partial<Record<PairLayout,string>>={};
+ if(a)reasons.a=a;if(b)reasons.b=b;if(reference)reasons.reference=reference;
+ const domain=value.domain,end=domain&&'end' in domain&&Number.isFinite(domain.end)&&domain.end>=0?domain.end:null;
+ const domainReason=a||b||reference?null:domain===null?'DOMAIN_PENDING: shared domain not established':'refused' in domain?`DOMAIN_REFUSED: ${domain.refused}`:end===null?'DOMAIN_REFUSED: shared end is not finite':null;
+ if(a||b||reference||domainReason)reasons.compare=[a,b,reference,domainReason].filter(Boolean).join(' · ');
+ const result=settle('compare',value.requested??'compare',pairLayouts,reasons,['a','b','reference']);
+ const pair=result.usable.includes('compare');
+ return {...result,feedback:pair,playback:pair&&end!==null&&end>0,static:pair&&end===0};
+}

package/src/control.ts

@@ -1,4 +1,5 @@
 /** Inspection-only protocol. Source identity and human review decisions are not commands. */
+import {singleLayouts,pairLayouts,type ComparisonLayout,type Eligibility} from './comparison-eligibility.ts';
 export type ControlMode='single'|'compare';
 export type ControlCameraTarget='rig'|'a'|'b'|'reference';
 export interface ControlCamera {zoom:number;pan:{x:number;y:number}}
@@ -13,11 +14,39 @@ export interface ControlView {
  cameraSync?:boolean;activeCamera?:ControlCameraTarget;
  cameras:{rig:ControlNumericCamera|null;a:ControlNumericCamera|null;b:ControlNumericCamera|null;reference:ControlNumericCamera|null};
 }
+export type PartIdentityReason='hidden'|'no-attachment'|'timeline-null'|'set-hide';
+/** Persistable exact target at the bookmarked pose. Generation is observation only. */
+export interface ControlPartIdentity {attachment:string|null;skin:string|null;reason:PartIdentityReason|null;set:string|null;activeSkin:string|null}
+export function parsePartIdentity(value:unknown):ControlPartIdentity {
+ const o=controlObject(value,['attachment','skin','reason','set','activeSkin'],'control.part.identity');
+ const nullable=(value:unknown,name:string)=>value===null?null:controlString(value,name,512);
+ const result={attachment:nullable(o.attachment,'part.attachment'),skin:nullable(o.skin,'part.skin'),reason:o.reason===null?null:choice(o.reason,['hidden','no-attachment','timeline-null','set-hide'] as const,'part.reason'),set:nullable(o.set,'part.set'),activeSkin:nullable(o.activeSkin,'part.activeSkin')};
+ if(result.reason===null?(result.attachment===null||result.skin===null):(result.attachment!==null||result.skin!==null))throw new Error('PART_IDENTITY_SHAPE: resolved key/owning skin or explicit null reason required');return result;
+}
+export interface ControlPart {side:'single'|'a'|'b';slot:string;mode:'context'|'solo';identity?:ControlPartIdentity}
+export function parseControlPart(value:unknown):ControlPart|null {if(value===null)return null;const o=controlObject(value,['side','slot','mode','identity'],'control.part');return {side:choice(o.side,['single','a','b'] as const,'control.part.side'),slot:controlString(o.slot,'control.part.slot',512),mode:choice(o.mode,['context','solo'] as const,'control.part.mode'),...(o.identity===undefined?{}:{identity:parsePartIdentity(o.identity)})};}
+/** Observed layout offer: requested (source-bound draft), effective (actually visible) and a named reason per unavailable layout. */
+export interface ControlComparison {mode:'single'|'compare';requestedLayout:ComparisonLayout;effectiveLayout:ComparisonLayout|null;usableLayouts:ComparisonLayout[];reasons:Partial<Record<ComparisonLayout,string>>;candidate:{state:'unavailable';reason:'no producer handoff'}}
+export function controlComparison(value:Eligibility<ComparisonLayout>):ControlComparison {return {mode:value.mode,requestedLayout:value.requested,effectiveLayout:value.effective,usableLayouts:[...value.usable],reasons:{...value.reasons},candidate:{...value.candidate}};}
+export function parseControlComparison(value:unknown):ControlComparison {
+ const o=controlObject(value,['mode','requestedLayout','effectiveLayout','usableLayouts','reasons','candidate'],'control.comparison');
+ const mode=choice(o.mode,['single','compare'] as const,'control.comparison.mode'),layouts:readonly ComparisonLayout[]=mode==='single'?singleLayouts:pairLayouts;
+ const requested=choice(o.requestedLayout,layouts,'control.comparison.requestedLayout');
+ if(!Array.isArray(o.usableLayouts)||o.usableLayouts.length>layouts.length)throw new Error('control.comparison.usableLayouts: expected layout list');
+ const usable=o.usableLayouts.map(item=>choice(item,layouts,'control.comparison.usableLayouts'));if(new Set(usable).size!==usable.length)throw new Error('control.comparison.usableLayouts: duplicate layout');
+ const effective=o.effectiveLayout===null?null:choice(o.effectiveLayout,layouts,'control.comparison.effectiveLayout');
+ if(effective===null?usable.length>0:!usable.includes(effective))throw new Error('control.comparison.effectiveLayout: must be a usable layout, null only when none is usable');
+ if(usable.includes(requested)&&effective!==requested)throw new Error('control.comparison.effectiveLayout: a usable request is effective');
+ const r=controlObject(o.reasons,layouts,'control.comparison.reasons'),reasons:Partial<Record<ComparisonLayout,string>>={};
+ for(const layout of layouts){if(usable.includes(layout)){if(r[layout]!==undefined)throw new Error(`control.comparison.reasons.${layout}: usable layout has no refusal`);}else reasons[layout]=controlString(r[layout],`control.comparison.reasons.${layout}`,1024);}
+ const c=controlObject(o.candidate,['state','reason'],'control.comparison.candidate');if(c.state!=='unavailable'||c.reason!=='no producer handoff')throw new Error('control.comparison.candidate: no candidate source exists');
+ return {mode,requestedLayout:requested,effectiveLayout:effective,usableLayouts:usable,reasons,candidate:{state:'unavailable',reason:'no producer handoff'}};
+}
 export interface ControlInspection {
  theme:'system'|'dark'|'light';layout:'auto';effectiveLayout:'row'|'column'|null;
  cameras:{rig:ControlCamera;reference:ControlCamera;a?:ControlCamera;b?:ControlCamera};animation:string|null;time:number|null;
  playing:boolean;loop:'idle'|'off';layers:ControlLayers;ready:boolean;seeking:boolean;
- dirty:boolean;busy:boolean;feedbackEligible:boolean;view?:ControlView;
+ dirty:boolean;busy:boolean;feedbackEligible:boolean;view?:ControlView;comparison?:ControlComparison;part?:ControlPart|null;partGeneration?:number|null;
  capabilities:{camera:boolean;referenceCamera:boolean;animation:boolean;time:boolean;playback:boolean;layers:ControlLayers};
 }
 export type ControlCommand=
@@ -73,9 +102,9 @@ export function parseControlCommand(v:unknown):ControlCommand{
  return {type,images:bool(base.images,'control.layers.images'),meshes:bool(base.meshes,'control.layers.meshes'),bones:bool(base.bones,'control.layers.bones')};
 }
 export function parseControlInspection(v:unknown):ControlInspection{
- const o=controlObject(v,['theme','layout','effectiveLayout','cameras','animation','time','playing','loop','layers','ready','seeking','dirty','busy','feedbackEligible','capabilities','view'],'control.inspection');
+ const o=controlObject(v,['theme','layout','effectiveLayout','cameras','animation','time','playing','loop','layers','ready','seeking','dirty','busy','feedbackEligible','capabilities','view','part','partGeneration','comparison'],'control.inspection');
  const c=controlObject(o.cameras,['rig','reference','a','b'],'control.cameras'),a=controlObject(o.capabilities,['camera','referenceCamera','animation','time','playback','layers'],'control.capabilities');
- return {...(o.view===undefined?{}:{view:parseControlView(o.view)}),theme:choice(o.theme,['system','dark','light'] as const,'control.theme'),layout:choice(o.layout,['auto'] as const,'control.layout'),effectiveLayout:o.effectiveLayout===null?null:choice(o.effectiveLayout,['row','column'] as const,'control.effectiveLayout'),cameras:{rig:camera(c.rig),reference:camera(c.reference),...(c.a===undefined?{}:{a:camera(c.a)}),...(c.b===undefined?{}:{b:camera(c.b)})},animation:o.animation===null?null:controlString(o.animation,'control.animation'),time:o.time===null?null:num(o.time,'control.time',0,Number.MAX_SAFE_INTEGER),playing:bool(o.playing,'control.playing'),loop:choice(o.loop,['idle','off'] as const,'control.loop'),layers:layers(o.layers),ready:bool(o.ready,'control.ready'),seeking:bool(o.seeking,'control.seeking'),dirty:bool(o.dirty,'control.dirty'),busy:bool(o.busy,'control.busy'),feedbackEligible:bool(o.feedbackEligible,'control.feedbackEligible'),capabilities:{camera:bool(a.camera,'control.capabilities.camera'),referenceCamera:bool(a.referenceCamera,'control.capabilities.referenceCamera'),animation:bool(a.animation,'control.capabilities.animation'),time:bool(a.time,'control.capabilities.time'),playback:bool(a.playback,'control.capabilities.playback'),layers:layers(a.layers)}};
+ return {...(o.view===undefined?{}:{view:parseControlView(o.view)}),...(o.comparison===undefined?{}:{comparison:parseControlComparison(o.comparison)}),...(o.part===undefined?{}:{part:parseControlPart(o.part)}),...(o.partGeneration===undefined?{}:{partGeneration:o.partGeneration===null?null:controlInteger(o.partGeneration,'control.partGeneration')}),theme:choice(o.theme,['system','dark','light'] as const,'control.theme'),layout:choice(o.layout,['auto'] as const,'control.layout'),effectiveLayout:o.effectiveLayout===null?null:choice(o.effectiveLayout,['row','column'] as const,'control.effectiveLayout'),cameras:{rig:camera(c.rig),reference:camera(c.reference),...(c.a===undefined?{}:{a:camera(c.a)}),...(c.b===undefined?{}:{b:camera(c.b)})},animation:o.animation===null?null:controlString(o.animation,'control.animation'),time:o.time===null?null:num(o.time,'control.time',0,Number.MAX_SAFE_INTEGER),playing:bool(o.playing,'control.playing'),loop:choice(o.loop,['idle','off'] as const,'control.loop'),layers:layers(o.layers),ready:bool(o.ready,'control.ready'),seeking:bool(o.seeking,'control.seeking'),dirty:bool(o.dirty,'control.dirty'),busy:bool(o.busy,'control.busy'),feedbackEligible:bool(o.feedbackEligible,'control.feedbackEligible'),capabilities:{camera:bool(a.camera,'control.capabilities.camera'),referenceCamera:bool(a.referenceCamera,'control.capabilities.referenceCamera'),animation:bool(a.animation,'control.capabilities.animation'),time:bool(a.time,'control.capabilities.time'),playback:bool(a.playback,'control.capabilities.playback'),layers:layers(a.layers)}};
 }
 export function parseControlRequest(v:unknown):ControlRequest{
  const o=controlObject(v,['schema','requestId','pageId','instanceKey','sourceHash','expectedRevision','command'],'control.request');

package/src/front-worker.ts

@@ -0,0 +1,2 @@
+import {runFront} from './front.ts';
+if(import.meta.main)runFront(Bun.argv[2]??'').catch(error=>{console.error(error instanceof Error?error.message:String(error));process.exit(1);});