@roj-ai/standalone-server 0.1.10 → 0.1.12

package/dist/user-config-loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-config-loader.js","sourceRoot":"","sources":["../src/user-config-loader.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkB;IACtD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAA;IAEvD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,iCAAiC,YAAY,EAAE,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,GAAY,CAAA;IAChB,IAAI,CAAC;QACJ,GAAG,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAA;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACd,sCAAsC,YAAY,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC/G,CAAA;IACF,CAAC;IAED,MAAM,MAAM,GAAI,GAA6B,CAAC,OAAO,CAAA;IACrD,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,kDAAkD,YAAY,EAAE,CAAC,CAAA;IAClF,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,oCAAoC,YAAY,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,MAAM,WAAW,GAAG,MAAiC,CAAA;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,8CAA8C,YAAY,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,OAAmB,CAAA;IAC/C,MAAM,SAAS,GAAa,EAAE,CAAA;IAE9B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACjD,SAAS,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAA;YACpD,SAAQ;QACT,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;QACrC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,SAAS,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC9D,CAAC;IACF,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,8BAA8B,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC3F,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAClC,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,CAAA;IACvE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChF,CAAC;IAED,OAAO;QACN,OAAO;QACP,SAAS,EAAE,WAAW,CAAC,SAAgC;QACvD,WAAW,EAAE,WAAW,CAAC,WAAuC;KAChE,CAAA;AACF,CAAC"}
+{"version":3,"file":"user-config-loader.js","sourceRoot":"","sources":["../src/user-config-loader.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAExD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkB;IACtD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAA;IAEvD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,iCAAiC,YAAY,EAAE,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,GAAY,CAAA;IAChB,IAAI,CAAC;QACJ,GAAG,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAA;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACd,sCAAsC,YAAY,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC/G,CAAA;IACF,CAAC;IAED,MAAM,MAAM,GAAI,GAA6B,CAAC,OAAO,CAAA;IACrD,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,kDAAkD,YAAY,EAAE,CAAC,CAAA;IAClF,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,oCAAoC,YAAY,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,MAAM,WAAW,GAAG,MAAiC,CAAA;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,8CAA8C,YAAY,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,OAAmB,CAAA;IAC/C,MAAM,SAAS,GAAa,EAAE,CAAA;IAE9B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACjD,SAAS,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAA;YACpD,SAAQ;QACT,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;QACrC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,SAAS,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC9D,CAAC;IACF,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,8BAA8B,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC3F,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAClC,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,CAAA;IACvE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChF,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IACvC,MAAM,cAAc,GAAG,mBAAmB,CAAC,WAAW,CAAC,cAAc,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;IAE/F,OAAO;QACN,OAAO;QACP,SAAS,EAAE,WAAW,CAAC,SAAgC;QACvD,WAAW,EAAE,WAAW,CAAC,WAAuC;QAChE,cAAc;KACd,CAAA;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY,EAAE,SAAiB,EAAE,UAAkB;IAC/E,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,sCAAsC,UAAU,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,wBAAwB,UAAU,EAAE,CAAC,CAAA;QACzE,CAAC;QACD,MAAM,CAAC,GAAG,KAAgC,CAAA;QAC1C,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAA;QAC/E,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAA;QAC/E,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,IAAI,MAAM,UAAU,EAAE,CAAC,CAAA;QAC5E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAEhB,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;QAC7E,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,qBAAqB,YAAY,aAAa,UAAU,GAAG,CAAC,CAAA;QAChG,CAAC;QACD,OAAO;YACN,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;SACrD,CAAA;IACF,CAAC,CAAC,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@roj-ai/standalone-server",
-	"version": "0.1.10",
+	"version": "0.1.12",
 	"type": "module",
 	"main": "./dist/index.js",
 	"bin": {
@@ -33,10 +33,10 @@
 		"type-check": "tsc --noEmit"
 	},
 	"dependencies": {
-		"@roj-ai/client": "^0.1.10",
-		"@roj-ai/sdk": "^0.1.10",
-		"@roj-ai/shared": "^0.1.10",
-		"@roj-ai/transport": "^0.1.10",
+		"@roj-ai/client": "^0.1.12",
+		"@roj-ai/sdk": "^0.1.12",
+		"@roj-ai/shared": "^0.1.12",
+		"@roj-ai/transport": "^0.1.12",
 		"hono": "^4.10.7"
 	},
 	"devDependencies": {

package/src/files-upload-route.ts

@@ -0,0 +1,64 @@
+/**
+ * POST /api/v1/files/upload — multipart endpoint matching the `@roj-ai/client/platform.files.upload`
+ * two-phase contract:
+ *
+ *   1. Preflight with `contentHash`, `filename`, `mimeType` only. If we already have
+ *      the bytes (sha-256 match), respond `{ ok, fileId, ..., deduped: true }`.
+ *      Otherwise respond 409 `{ error: 'file-required' }`.
+ *   2. Retry with the same fields plus a `file` blob. We persist the bytes,
+ *      record the file, and respond `{ ok, fileId, ..., deduped: false }`.
+ *
+ * No bearer auth (standalone is open) — but we accept and ignore an
+ * `Authorization: Bearer …` header so client code copy-pasted from the platform
+ * keeps working.
+ */
+
+import type { Context } from 'hono'
+import type { LocalRegistry } from './local-registry.js'
+
+interface Deps {
+	registry: LocalRegistry
+}
+
+export function createFilesUploadRoute(deps: Deps) {
+	return async (c: Context) => {
+		let form: FormData
+		try {
+			form = await c.req.formData()
+		} catch {
+			return c.json({ ok: false, error: 'invalid_multipart' }, 400)
+		}
+
+		const contentHash = form.get('contentHash')
+		const filename = form.get('filename')
+		const mimeType = form.get('mimeType')
+		if (typeof contentHash !== 'string' || typeof filename !== 'string' || typeof mimeType !== 'string') {
+			return c.json(
+				{ ok: false, error: 'invalid_form' },
+				400,
+			)
+		}
+
+		const file = form.get('file')
+		const buffer = file && typeof file !== 'string' && 'arrayBuffer' in file
+			? Buffer.from(await file.arrayBuffer())
+			: undefined
+
+		const result = await deps.registry.uploadFile({ buffer, filename, mimeType, contentHash })
+
+		if ('error' in result) {
+			// Preflight miss — client retries with body.
+			return c.json({ ok: false, error: result.error }, 409)
+		}
+
+		return c.json({
+			ok: true,
+			fileId: result.fileId,
+			filename: result.filename,
+			mimeType: result.mimeType,
+			size: result.size,
+			r2Key: '',
+			deduped: result.deduped,
+		})
+	}
+}

package/src/instance.ts

@@ -4,6 +4,10 @@
  * A standalone server hosts exactly one "instance" — a workspace containing
  * sessions. The instance id is either supplied via config or auto-generated
  * on startup and remains stable for the process lifetime.
+ *
+ * `metadata` is mutated by `instances.create` calls (last write wins). It is
+ * a single-tenant local-dev convenience; consumers that need per-instance
+ * isolation must run separate processes.
  */
 
 export interface InstanceState {
@@ -11,13 +15,20 @@ export interface InstanceState {
 	name: string
 	createdAt: string
 	presetIds: string[]
+	metadata: Record<string, unknown> | null
 }
 
-export function createInstance(options: { id?: string; name?: string; presetIds: string[] }): InstanceState {
+export function createInstance(options: {
+	id?: string
+	name?: string
+	presetIds: string[]
+	metadata?: Record<string, unknown> | null
+}): InstanceState {
 	return {
 		id: options.id ?? 'default',
 		name: options.name ?? 'standalone',
 		createdAt: new Date().toISOString(),
 		presetIds: options.presetIds,
+		metadata: options.metadata ?? null,
 	}
 }

package/src/local-registry.ts

@@ -0,0 +1,334 @@
+/**
+ * On-disk file + resource registry for the standalone server.
+ *
+ * Stands in for the platform's Contember-backed file/resource service. State
+ * lives in `{dataPath}/.roj-platform-state.json` (JSON manifest) plus
+ * `{dataPath}/.roj-platform-state/files/{fileId}` (raw bytes). Operations are
+ * append-only at the resource level (revisions accumulate), so re-running
+ * `roj-standalone` between sessions preserves uploads and revisions added
+ * during a previous run.
+ *
+ * Files are content-addressable by SHA-256 — re-uploading the same bytes
+ * returns the existing fileId with `deduped: true`, mirroring the platform's
+ * /files/upload contract used by `@roj-ai/client/platform.files.upload`.
+ */
+
+import { createHash, randomUUID } from 'node:crypto'
+import { existsSync } from 'node:fs'
+import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises'
+import { basename, extname, join } from 'node:path'
+import type { LocalResource, Logger } from '@roj-ai/sdk'
+
+interface FileMeta {
+	id: string
+	filename: string
+	mimeType: string
+	size: number
+	contentHash: string
+	createdAt: string
+}
+
+interface ResourceRevision {
+	id: string
+	fileId: string
+	label: string | null
+	createdAt: string
+}
+
+interface ResourceRecord {
+	id: string
+	slug: string
+	name: string | null
+	description: string | null
+	revisions: ResourceRevision[]
+	createdAt: string
+}
+
+interface RegistryState {
+	files: Record<string, FileMeta>
+	resources: Record<string, ResourceRecord>
+}
+
+export interface ResourceOutput {
+	id: string
+	slug: string
+	name: string | null
+	description: string | null
+	latestRevision: {
+		id: string
+		label: string | null
+		file: { id: string; filename: string; mimeType: string; size: number }
+		createdAt: string
+	} | null
+	createdAt: string
+}
+
+export interface UploadResult {
+	fileId: string
+	filename: string
+	mimeType: string
+	size: number
+	deduped: boolean
+}
+
+export class LocalRegistry {
+	private state: RegistryState = { files: {}, resources: {} }
+	private statePath: string
+	private filesDir: string
+
+	constructor(
+		private readonly dataPath: string,
+		private readonly logger: Logger,
+	) {
+		this.statePath = join(dataPath, '.roj-platform-state.json')
+		this.filesDir = join(dataPath, '.roj-platform-state', 'files')
+	}
+
+	async init(): Promise<void> {
+		await mkdir(this.filesDir, { recursive: true })
+		if (existsSync(this.statePath)) {
+			try {
+				const raw = await readFile(this.statePath, 'utf8')
+				this.state = JSON.parse(raw)
+			} catch (err) {
+				this.logger.warn('Local registry manifest is corrupt, starting fresh', {
+					err: err instanceof Error ? err.message : String(err),
+				})
+				this.state = { files: {}, resources: {} }
+			}
+		}
+	}
+
+	async uploadFile(args: {
+		buffer?: Buffer
+		filename: string
+		mimeType: string
+		contentHash?: string
+	}): Promise<UploadResult | { error: 'file-required'; contentHash: string }> {
+		// Phase 1 — preflight by hash. If we already have the bytes, return the
+		// existing fileId without needing the body.
+		if (args.contentHash) {
+			const existing = Object.values(this.state.files).find(f => f.contentHash === args.contentHash)
+			if (existing) {
+				return {
+					fileId: existing.id,
+					filename: existing.filename,
+					mimeType: existing.mimeType,
+					size: existing.size,
+					deduped: true,
+				}
+			}
+			if (!args.buffer) {
+				return { error: 'file-required', contentHash: args.contentHash }
+			}
+		}
+
+		if (!args.buffer) {
+			throw new Error('uploadFile requires a buffer when contentHash is unknown')
+		}
+
+		const contentHash = args.contentHash ?? sha256Hex(args.buffer)
+
+		// Re-check after computing — the client may not have provided a hash but
+		// we still want dedupe.
+		const matched = Object.values(this.state.files).find(f => f.contentHash === contentHash)
+		if (matched) {
+			return {
+				fileId: matched.id,
+				filename: matched.filename,
+				mimeType: matched.mimeType,
+				size: matched.size,
+				deduped: true,
+			}
+		}
+
+		const id = randomUUID()
+		const meta: FileMeta = {
+			id,
+			filename: args.filename,
+			mimeType: args.mimeType,
+			size: args.buffer.length,
+			contentHash,
+			createdAt: new Date().toISOString(),
+		}
+		await writeFile(join(this.filesDir, id), args.buffer)
+		this.state.files[id] = meta
+		await this.persist()
+		return { fileId: id, filename: meta.filename, mimeType: meta.mimeType, size: meta.size, deduped: false }
+	}
+
+	async readFileById(fileId: string): Promise<{ meta: FileMeta; buffer: Buffer } | null> {
+		const meta = this.state.files[fileId]
+		if (!meta) return null
+		try {
+			const buffer = await readFile(join(this.filesDir, fileId))
+			return { meta, buffer }
+		} catch {
+			return null
+		}
+	}
+
+	async createResource(args: {
+		slug: string
+		name?: string
+		description?: string
+		fileId: string
+		label?: string
+	}): Promise<{ resourceId: string; revisionId: string }> {
+		if (!this.state.files[args.fileId]) {
+			throw new Error(`File not found: ${args.fileId}`)
+		}
+		const existing = this.findBySlug(args.slug)
+		if (existing) {
+			throw new Error(`Resource with slug already exists: ${args.slug}`)
+		}
+		const resourceId = randomUUID()
+		const revisionId = randomUUID()
+		const now = new Date().toISOString()
+		this.state.resources[resourceId] = {
+			id: resourceId,
+			slug: args.slug,
+			name: args.name ?? null,
+			description: args.description ?? null,
+			revisions: [{ id: revisionId, fileId: args.fileId, label: args.label ?? null, createdAt: now }],
+			createdAt: now,
+		}
+		await this.persist()
+		return { resourceId, revisionId }
+	}
+
+	async addRevision(args: {
+		resourceId?: string
+		resourceSlug?: string
+		fileId: string
+		label?: string
+	}): Promise<{ revisionId: string; noop: boolean }> {
+		const record = this.findResource(args)
+		if (!record) {
+			throw new Error('Resource not found')
+		}
+		if (!this.state.files[args.fileId]) {
+			throw new Error(`File not found: ${args.fileId}`)
+		}
+		const latest = record.revisions[record.revisions.length - 1]
+		const incomingLabel = args.label ?? null
+		if (latest && latest.fileId === args.fileId && latest.label === incomingLabel) {
+			return { revisionId: latest.id, noop: true }
+		}
+		const revisionId = randomUUID()
+		record.revisions.push({
+			id: revisionId,
+			fileId: args.fileId,
+			label: incomingLabel,
+			createdAt: new Date().toISOString(),
+		})
+		await this.persist()
+		return { revisionId, noop: false }
+	}
+
+	getResource(args: { resourceId?: string; resourceSlug?: string }): ResourceOutput | null {
+		const record = this.findResource(args)
+		return record ? toResourceOutput(record, this.state.files) : null
+	}
+
+	listResources(): ResourceOutput[] {
+		return Object.values(this.state.resources).map(r => toResourceOutput(r, this.state.files))
+	}
+
+	async deleteResource(resourceId: string): Promise<{ ok: boolean }> {
+		if (!this.state.resources[resourceId]) return { ok: true }
+		delete this.state.resources[resourceId]
+		await this.persist()
+		return { ok: true }
+	}
+
+	/**
+	 * Idempotent: ensures every config-declared local resource exists in the
+	 * registry. Skips slugs that already have a record (so previously uploaded
+	 * revisions survive restarts).
+	 */
+	async bootstrapLocalResources(localResources: LocalResource[]): Promise<void> {
+		for (const lr of localResources) {
+			if (this.findBySlug(lr.slug)) {
+				this.logger.info('Local resource already in registry, skipping bootstrap', { slug: lr.slug })
+				continue
+			}
+			const buffer = await readFile(lr.path)
+			const filename = basename(lr.path)
+			const mimeType = guessMimeType(filename)
+			const upload = await this.uploadFile({ buffer, filename, mimeType })
+			if ('error' in upload) {
+				throw new Error(`Bootstrap upload failed for ${lr.slug}: ${upload.error}`)
+			}
+			await this.createResource({
+				slug: lr.slug,
+				name: lr.name ?? lr.slug,
+				fileId: upload.fileId,
+			})
+			this.logger.info('Bootstrapped local resource', { slug: lr.slug, fileId: upload.fileId, size: upload.size })
+		}
+	}
+
+	private async persist(): Promise<void> {
+		const tmp = `${this.statePath}.tmp`
+		await writeFile(tmp, JSON.stringify(this.state, null, 2), 'utf8')
+		await rename(tmp, this.statePath)
+	}
+
+	private findResource(args: { resourceId?: string; resourceSlug?: string }): ResourceRecord | null {
+		if (args.resourceId) return this.state.resources[args.resourceId] ?? null
+		if (args.resourceSlug) return this.findBySlug(args.resourceSlug)
+		return null
+	}
+
+	private findBySlug(slug: string): ResourceRecord | null {
+		for (const r of Object.values(this.state.resources)) {
+			if (r.slug === slug) return r
+		}
+		return null
+	}
+}
+
+function toResourceOutput(record: ResourceRecord, files: Record<string, FileMeta>): ResourceOutput {
+	const latest = record.revisions[record.revisions.length - 1]
+	const file = latest ? files[latest.fileId] : undefined
+	return {
+		id: record.id,
+		slug: record.slug,
+		name: record.name,
+		description: record.description,
+		latestRevision:
+			latest && file
+				? {
+					id: latest.id,
+					label: latest.label,
+					file: { id: file.id, filename: file.filename, mimeType: file.mimeType, size: file.size },
+					createdAt: latest.createdAt,
+				}
+				: null,
+		createdAt: record.createdAt,
+	}
+}
+
+function sha256Hex(buf: Buffer): string {
+	return createHash('sha256').update(buf).digest('hex')
+}
+
+function guessMimeType(filename: string): string {
+	switch (extname(filename).toLowerCase()) {
+		case '.zip':
+			return 'application/zip'
+		case '.json':
+			return 'application/json'
+		default:
+			return 'application/octet-stream'
+	}
+}
+
+// Exported for tests / smoke scripts that want to nuke local state cleanly.
+export async function clearLocalRegistry(dataPath: string): Promise<void> {
+	const statePath = join(dataPath, '.roj-platform-state.json')
+	const filesDir = join(dataPath, '.roj-platform-state')
+	if (existsSync(statePath)) await rm(statePath)
+	if (existsSync(filesDir)) await rm(filesDir, { recursive: true })
+}

package/src/main.ts

@@ -20,13 +20,19 @@ async function main() {
 		userConfig = await loadUserConfig(absoluteConfigPath)
 		console.log(`Loaded config from: ${absoluteConfigPath}`)
 		console.log(`  Presets: ${userConfig.presets.map(p => p.id).join(', ')}`)
+		if (userConfig.localResources?.length) {
+			console.log(`  Local resources: ${userConfig.localResources.map(r => r.slug).join(', ')}`)
+		}
 	} catch (error) {
 		console.error(`Failed to load config from ${absoluteConfigPath}:`)
 		console.error(error instanceof Error ? error.message : String(error))
 		process.exit(1)
 	}
 
-	await startStandaloneServer({ presets: userConfig.presets })
+	await startStandaloneServer({
+		presets: userConfig.presets,
+		localResources: userConfig.localResources,
+	})
 }
 
 main().catch((error) => {