@roj-ai/standalone-server 0.1.36 → 0.2.2

package/dist/main.js

@@ -26,10 +26,7 @@ async function main() {
         console.error(error instanceof Error ? error.message : String(error));
         process.exit(1);
     }
-    await startStandaloneServer({
-        presets: userConfig.presets,
-        localResources: userConfig.localResources,
-    });
+    await startStandaloneServer(userConfig);
 }
 main().catch((error) => {
     console.error('Fatal error:', error);

package/dist/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AACA;;;;;;GAMG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAExD,KAAK,UAAU,IAAI;IAClB,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,eAAe,CAAA;IACrD,MAAM,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAA;IAE7D,IAAI,UAAsD,CAAA;IAC1D,IAAI,CAAC;QACJ,UAAU,GAAG,MAAM,cAAc,CAAC,kBAAkB,CAAC,CAAA;QACrD,OAAO,CAAC,GAAG,CAAC,uBAAuB,kBAAkB,EAAE,CAAC,CAAA;QACxD,OAAO,CAAC,GAAG,CAAC,cAAc,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACzE,IAAI,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,sBAAsB,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC3F,CAAC;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,8BAA8B,kBAAkB,GAAG,CAAC,CAAA;QAClE,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAChB,CAAC;IAED,MAAM,qBAAqB,CAAC;QAC3B,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,cAAc,EAAE,UAAU,CAAC,cAAc;KACzC,CAAC,CAAA;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACtB,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AAChB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AACA;;;;;;GAMG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAExD,KAAK,UAAU,IAAI;IAClB,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,eAAe,CAAA;IACrD,MAAM,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAA;IAE7D,IAAI,UAAsD,CAAA;IAC1D,IAAI,CAAC;QACJ,UAAU,GAAG,MAAM,cAAc,CAAC,kBAAkB,CAAC,CAAA;QACrD,OAAO,CAAC,GAAG,CAAC,uBAAuB,kBAAkB,EAAE,CAAC,CAAA;QACxD,OAAO,CAAC,GAAG,CAAC,cAAc,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACzE,IAAI,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,sBAAsB,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC3F,CAAC;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,8BAA8B,kBAAkB,GAAG,CAAC,CAAA;QAClE,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAChB,CAAC;IAED,MAAM,qBAAqB,CAAC,UAAU,CAAC,CAAA;AACxC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACtB,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AAChB,CAAC,CAAC,CAAA"}

package/dist/platform-api.d.ts

@@ -13,23 +13,44 @@
  * - sessions.publish   — publishing requires the CF platform
  * - instances.archive  — no-op; shutdown the server instead
  */
-import type { Logger, Preset, SessionManager } from '@roj-ai/sdk';
+import type { Logger, Preset, Result, Session } from '@roj-ai/sdk';
+import { SessionId } from '@roj-ai/sdk';
 import { Hono } from 'hono';
-import type { GitInstanceFs } from './git-instance-fs.js';
 import type { InstanceState } from './instance.js';
 import type { LocalRegistry } from './local-registry.js';
+interface RpcError {
+    type: string;
+    message: string;
+    httpStatus: number;
+}
+interface PlatformSessionManager {
+    callManagerMethod(method: string, input: unknown): Promise<Result<unknown, RpcError>>;
+    callPluginMethod(sessionId: SessionId, method: string, input: unknown): Promise<Result<unknown, RpcError>>;
+    withSessionLease(sessionId: SessionId, reason: string, operation: (session: Pick<Session, 'close'>) => Promise<Result<void, RpcError>>): Promise<Result<void, RpcError>>;
+    getStats(): Promise<{
+        sessions: Array<{
+            id: SessionId;
+            presetId: string;
+            status: string;
+        }>;
+    }>;
+}
+interface SessionGitFs {
+    addSessionWorktree(instanceId: string, sessionId: string): Promise<string>;
+    removeSessionWorktree(instanceId: string, sessionId: string): Promise<void>;
+}
 interface Deps {
     instance: InstanceState;
-    sessionManager: SessionManager;
+    sessionManager: PlatformSessionManager;
     logger: Logger;
     presets: Preset[];
     registry: LocalRegistry;
     /** Per-instance bare repo + per-session worktree manager. */
-    gitFs: GitInstanceFs;
+    gitFs: SessionGitFs;
     /** HMAC secret for signing download tokens (`sessionFiles.createDownloadUrl`). */
     tokenSecret: string;
     /** Externally-reachable base URL (e.g. `http://localhost:8765`) used when minting download URLs. */
-    publicBaseUrl: string;
+    getPublicBaseUrl(): string;
 }
 export declare function createPlatformApi(deps: Deps): Hono;
 export {};

package/dist/platform-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-api.d.ts","sourceRoot":"","sources":["../src/platform-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAGjE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAGxD,UAAU,IAAI;IACb,QAAQ,EAAE,aAAa,CAAA;IACvB,cAAc,EAAE,cAAc,CAAA;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,aAAa,CAAA;IACvB,6DAA6D;IAC7D,KAAK,EAAE,aAAa,CAAA;IACpB,kFAAkF;IAClF,WAAW,EAAE,MAAM,CAAA;IACnB,oGAAoG;IACpG,aAAa,EAAE,MAAM,CAAA;CACrB;AAQD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAuBlD"}
+{"version":3,"file":"platform-api.d.ts","sourceRoot":"","sources":["../src/platform-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAClE,OAAO,EAAE,SAAS,EAAyB,MAAM,aAAa,CAAA;AAG9D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAGxD,UAAU,QAAQ;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;CAClB;AAED,UAAU,sBAAsB;IAC/B,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;IACrF,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC1G,gBAAgB,CACf,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,GAC7E,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;IAClC,QAAQ,IAAI,OAAO,CAAC;QACnB,QAAQ,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,SAAS,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KACpE,CAAC,CAAA;CACF;AAED,UAAU,YAAY;IACrB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC1E,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3E;AAED,UAAU,IAAI;IACb,QAAQ,EAAE,aAAa,CAAA;IACvB,cAAc,EAAE,sBAAsB,CAAA;IACtC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,aAAa,CAAA;IACvB,6DAA6D;IAC7D,KAAK,EAAE,YAAY,CAAA;IACnB,kFAAkF;IAClF,WAAW,EAAE,MAAM,CAAA;IACnB,oGAAoG;IACpG,gBAAgB,IAAI,MAAM,CAAA;CAC1B;AAmLD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CA6BlD"}

package/dist/platform-api.js

@@ -13,46 +13,261 @@
  * - sessions.publish   — publishing requires the CF platform
  * - instances.archive  — no-op; shutdown the server instead
  */
-import { SessionId } from '@roj-ai/sdk';
+import { SessionId, sessionMetadataSchema } from '@roj-ai/sdk';
+import z from 'zod/v4';
 import { randomUUID } from 'node:crypto';
 import { Hono } from 'hono';
 import { signFileToken } from './signed-token.js';
+const RpcCallSchema = z.strictObject({
+    method: z.string(),
+    input: z.unknown().optional(),
+});
+const RpcEnvelopeSchema = z.union([
+    RpcCallSchema,
+    z.strictObject({ batch: z.array(RpcCallSchema) }),
+]);
+const AutoCreateSessionSchema = z.strictObject({
+    presetId: z.string().min(1),
+    blocking: z.boolean().optional(),
+    initialPrompt: z.string().optional(),
+    resourceIds: z.array(z.string()).optional(),
+    fileIds: z.array(z.string()).optional(),
+});
+const inputSchemas = {
+    'instances.create': z.strictObject({
+        templateSlug: z.string(),
+        bundleSlug: z.string().optional(),
+        bundleRevisionId: z.string().optional(),
+        name: z.string(),
+        vcsType: z.enum(['github', 'gitLocal', 'none']).optional(),
+        metadata: z.record(z.string(), z.unknown()).optional(),
+        autoCreateSession: AutoCreateSessionSchema.optional(),
+    }),
+    'instances.get': z.strictObject({ instanceId: z.string() }),
+    'instances.list': z.strictObject({
+        limit: z.number().optional(),
+        offset: z.number().optional(),
+    }),
+    'instances.status': z.strictObject({ instanceId: z.string() }),
+    'instances.archive': z.strictObject({ instanceId: z.string() }),
+    'sessions.create': z.strictObject({
+        instanceId: z.string(),
+        presetId: z.string().min(1),
+        blocking: z.boolean().optional(),
+        origin: z.string().optional(),
+        expiresIn: z.number().optional(),
+        initialPrompt: z.string().optional(),
+    }),
+    'sessions.list': z.strictObject({ instanceId: z.string() }),
+    'tokens.create': z.strictObject({
+        instanceId: z.string(),
+        origin: z.string().optional(),
+        expiresIn: z.number().optional(),
+        meta: z.record(z.string(), z.unknown()).optional(),
+    }),
+    'resources.create': z.strictObject({
+        slug: z.string(),
+        name: z.string().optional(),
+        description: z.string().optional(),
+        fileId: z.string(),
+        label: z.string().optional(),
+    }),
+    'resources.addRevision': z.strictObject({
+        resourceId: z.string().optional(),
+        resourceSlug: z.string().optional(),
+        fileId: z.string(),
+        label: z.string().optional(),
+    }),
+    'resources.get': z.strictObject({
+        resourceId: z.string().optional(),
+        resourceSlug: z.string().optional(),
+    }),
+    'resources.list': z.strictObject({
+        limit: z.number().optional(),
+        offset: z.number().optional(),
+    }),
+    'resources.delete': z.strictObject({ resourceId: z.string() }),
+    'sessionFiles.createDownloadUrl': z.strictObject({
+        instanceId: z.string(),
+        sessionId: z.string(),
+        scope: z.enum(['workspace', 'session']),
+        path: z.string(),
+        ttlSeconds: z.number().optional(),
+    }),
+};
+const InstanceSummaryOutputSchema = z.strictObject({
+    instanceId: z.string(),
+    name: z.string(),
+    status: z.string(),
+    templateSlug: z.string(),
+    bundleSlug: z.string(),
+    bundleRevisionId: z.string(),
+    vcsType: z.string(),
+    metadata: z.record(z.string(), z.unknown()).nullable(),
+    createdAt: z.string(),
+});
+const SessionSummaryOutputSchema = z.strictObject({
+    id: z.string(),
+    presetId: z.string().nullable(),
+    status: z.string(),
+    createdAt: z.string(),
+});
+const ResourceOutputSchema = z.strictObject({
+    id: z.string(),
+    slug: z.string(),
+    name: z.string().nullable(),
+    description: z.string().nullable(),
+    latestRevision: z.strictObject({
+        id: z.string(),
+        label: z.string().nullable(),
+        file: z.strictObject({
+            id: z.string(),
+            filename: z.string(),
+            mimeType: z.string(),
+            size: z.number(),
+        }),
+        createdAt: z.string(),
+    }).nullable(),
+    createdAt: z.string(),
+});
+const outputSchemas = {
+    'instances.create': z.strictObject({
+        instanceId: z.string(),
+        status: z.enum(['created', 'initializing', 'ready']),
+        sessionId: z.string().optional(),
+        wsToken: z.string().optional(),
+    }),
+    'instances.get': InstanceSummaryOutputSchema,
+    'instances.list': z.strictObject({
+        instances: z.array(InstanceSummaryOutputSchema),
+        total: z.number(),
+    }),
+    'instances.status': z.strictObject({
+        instanceId: z.string(),
+        status: z.string(),
+        sandbox: z.strictObject({
+            state: z.enum(['stopped', 'starting', 'running', 'pausing', 'paused', 'failed']),
+            e2bId: z.string().optional(),
+            lastActivityAt: z.string().optional(),
+            versions: z.strictObject({
+                sdk: z.string(),
+                runtime: z.strictObject({ name: z.string(), version: z.string() }).nullable(),
+            }).optional(),
+        }).nullable(),
+        sessions: z.array(SessionSummaryOutputSchema),
+        lifecycleEvents: z.array(z.strictObject({
+            event: z.string(),
+            detail: z.string().optional(),
+            createdAt: z.string(),
+        })),
+        serviceUrls: z.array(z.strictObject({
+            code: z.string(),
+            sessionId: z.string().nullable(),
+            serviceType: z.string().nullable(),
+            port: z.number(),
+        })),
+    }),
+    'instances.archive': z.strictObject({ ok: z.boolean() }),
+    'sessions.create': z.strictObject({
+        sessionId: z.string(),
+        status: z.enum(['creating', 'active']),
+        wsToken: z.string().optional(),
+    }),
+    'sessions.list': z.strictObject({ sessions: z.array(SessionSummaryOutputSchema) }),
+    'tokens.create': z.strictObject({ token: z.string(), expiresAt: z.string() }),
+    'resources.create': z.strictObject({ resourceId: z.string(), revisionId: z.string() }),
+    'resources.addRevision': z.strictObject({
+        revisionId: z.string(),
+        noop: z.boolean().optional(),
+    }),
+    'resources.get': ResourceOutputSchema,
+    'resources.list': z.strictObject({ resources: z.array(ResourceOutputSchema) }),
+    'resources.delete': z.strictObject({ ok: z.boolean() }),
+    'sessionFiles.createDownloadUrl': z.strictObject({ url: z.string(), expiresAt: z.string() }),
+};
 export function createPlatformApi(deps) {
     const app = new Hono();
     app.post('/rpc', async (c) => {
-        const body = await c.req.json().catch(() => ({}));
-        if (Array.isArray(body.batch)) {
+        let rawBody;
+        try {
+            rawBody = await c.req.json();
+        }
+        catch {
+            return c.json({ ok: false, error: { type: 'invalid_request', message: 'Invalid JSON body' } }, 400);
+        }
+        const parsedBody = RpcEnvelopeSchema.safeParse(rawBody);
+        if (!parsedBody.success) {
+            return c.json({ ok: false, error: { type: 'invalid_request', message: parsedBody.error.message } }, 400);
+        }
+        const body = parsedBody.data;
+        if ('batch' in body) {
             const results = [];
             for (const call of body.batch) {
                 results.push(await dispatch(deps, call.method, call.input));
             }
             return c.json({ results });
         }
-        if (typeof body.method !== 'string') {
-            return c.json({ ok: false, error: { type: 'invalid_request', message: 'Missing method' } }, 400);
-        }
         const result = await dispatch(deps, body.method, body.input);
         return c.json(result);
     });
     return app;
 }
 async function dispatch(deps, method, input) {
-    const handler = handlers[method];
-    if (!handler) {
-        return { ok: false, error: { type: 'method_not_found', message: `Method not supported in standalone: ${method}` } };
-    }
     try {
-        const value = await handler(deps, input ?? {});
+        const value = await callHandler(deps, method, input ?? {});
         return { ok: true, value };
     }
     catch (err) {
+        if (err instanceof UnsupportedMethodError) {
+            return { ok: false, error: { type: 'method_not_found', message: err.message } };
+        }
         const message = err instanceof Error ? err.message : String(err);
         deps.logger.error(`Platform RPC handler failed: ${method}`, err instanceof Error ? err : new Error(message));
         return { ok: false, error: { type: 'handler_error', message } };
     }
 }
-// Shared by `instances.create.autoCreateSession` and `sessions.create`. Creates
-// a session via the SDK session manager, injects any matching local resources,
+async function callHandler(deps, method, input) {
+    switch (method) {
+        case 'instances.create':
+            return outputSchemas['instances.create'].parse(await handlers['instances.create'](deps, inputSchemas['instances.create'].parse(input)));
+        case 'instances.get':
+            return outputSchemas['instances.get'].parse(await handlers['instances.get'](deps, inputSchemas['instances.get'].parse(input)));
+        case 'instances.list':
+            return outputSchemas['instances.list'].parse(await handlers['instances.list'](deps, inputSchemas['instances.list'].parse(input)));
+        case 'instances.status':
+            return outputSchemas['instances.status'].parse(await handlers['instances.status'](deps, inputSchemas['instances.status'].parse(input)));
+        case 'instances.archive':
+            return outputSchemas['instances.archive'].parse(await handlers['instances.archive'](deps, inputSchemas['instances.archive'].parse(input)));
+        case 'sessions.create':
+            return outputSchemas['sessions.create'].parse(await handlers['sessions.create'](deps, inputSchemas['sessions.create'].parse(input)));
+        case 'sessions.list':
+            return outputSchemas['sessions.list'].parse(await handlers['sessions.list'](deps, inputSchemas['sessions.list'].parse(input)));
+        case 'tokens.create':
+            return outputSchemas['tokens.create'].parse(await handlers['tokens.create'](deps, inputSchemas['tokens.create'].parse(input)));
+        case 'resources.create':
+            return outputSchemas['resources.create'].parse(await handlers['resources.create'](deps, inputSchemas['resources.create'].parse(input)));
+        case 'resources.addRevision':
+            return outputSchemas['resources.addRevision'].parse(await handlers['resources.addRevision'](deps, inputSchemas['resources.addRevision'].parse(input)));
+        case 'resources.get':
+            return outputSchemas['resources.get'].parse(await handlers['resources.get'](deps, inputSchemas['resources.get'].parse(input)));
+        case 'resources.list':
+            return outputSchemas['resources.list'].parse(await handlers['resources.list'](deps, inputSchemas['resources.list'].parse(input)));
+        case 'resources.delete':
+            return outputSchemas['resources.delete'].parse(await handlers['resources.delete'](deps, inputSchemas['resources.delete'].parse(input)));
+        case 'sessionFiles.createDownloadUrl':
+            return outputSchemas['sessionFiles.createDownloadUrl'].parse(await handlers['sessionFiles.createDownloadUrl'](deps, inputSchemas['sessionFiles.createDownloadUrl'].parse(input)));
+        default:
+            throw new UnsupportedMethodError(method);
+    }
+}
+class UnsupportedMethodError extends Error {
+    method;
+    constructor(method) {
+        super(`Method not supported in standalone: ${method}`);
+        this.method = method;
+    }
+}
+// Creates a session via the SDK session manager, injects selected local files,
 // then (if set) pushes `initialPrompt` as a user-chat message — order matters:
 // resources must land in the workspace before the agent's first inference so
 // the agent sees a non-empty workspace. Mirrors roj-platform's project-init
@@ -70,14 +285,18 @@ async function startSession(deps, input) {
         workspaceDir,
     });
     if (!created.ok) {
-        // Roll back the worktree we just created so a retry isn't blocked by an
-        // orphaned dir. Best-effort — failure here is logged inside removeSessionWorktree.
-        await deps.gitFs.removeSessionWorktree(deps.instance.id, sessionId);
+        await removeWorktreeAfterFailure(deps, sessionId);
         throw new Error(created.error.message);
     }
-    const resources = resolveSessionResources(deps, input.presetId, input.resourceIds);
-    for (const resource of resources) {
-        await injectRegistryResource(deps, sessionId, resource);
+    try {
+        const selections = resolveSessionFiles(deps, input.presetId, input.resourceIds, input.fileIds);
+        for (const selection of selections) {
+            await injectRegistryFile(deps, sessionId, selection);
+        }
+    }
+    catch (error) {
+        await rollbackCreatedSession(deps, sessionId);
+        throw error;
     }
     if (input.initialPrompt) {
         const sent = await deps.sessionManager.callPluginMethod(SessionId(sessionId), 'user-chat.sendMessage', {
@@ -90,23 +309,32 @@ async function startSession(deps, input) {
             });
         }
     }
-    return { sessionId };
+    // Creation is synchronous here — there is no provisioning step to wait on,
+    // so the session is active by the time this returns. The contract's other
+    // value, 'creating', belongs to the CF platform.
+    return { sessionId, status: 'active' };
 }
 // Resolution mirrors roj-platform's project-init.ts:206:
-//   1. explicit input.resourceIds — matched against the local registry by ID
-//      first, then by slug (since local-dev callers often pass slugs as ids).
-//   2. fallback to preset.defaultResourceSlugs (looked up by slug).
-function resolveSessionResources(deps, presetId, inputResourceIds) {
-    if (inputResourceIds && inputResourceIds.length > 0) {
-        const matched = [];
+//   1. explicit resourceIds, followed by explicit fileIds.
+//   2. preset.defaultResourceSlugs only when no explicit IDs were supplied.
+// Repeated selections of the same registry file are injected once.
+function resolveSessionFiles(deps, presetId, inputResourceIds, inputFileIds) {
+    const hasExplicitFiles = (inputResourceIds?.length ?? 0) > 0 || (inputFileIds?.length ?? 0) > 0;
+    const resolved = [];
+    const seenFileIds = new Set();
+    if (hasExplicitFiles) {
         const unmatched = [];
-        for (const id of inputResourceIds) {
+        for (const id of inputResourceIds ?? []) {
             const resource = deps.registry.getResource({ resourceId: id }) ?? deps.registry.getResource({ resourceSlug: id });
-            const resolved = toResolvedResource(resource);
-            if (resolved)
-                matched.push(resolved);
-            else
+            const selection = toResolvedFile(resource);
+            if (!selection) {
                 unmatched.push(id);
+                continue;
+            }
+            if (seenFileIds.has(selection.fileId))
+                continue;
+            seenFileIds.add(selection.fileId);
+            resolved.push(selection);
         }
         if (unmatched.length > 0) {
             deps.logger.warn('Some input resourceIds did not match the local registry; ignoring', {
@@ -114,58 +342,92 @@ function resolveSessionResources(deps, presetId, inputResourceIds) {
                 availableSlugs: deps.registry.listResources().map(r => r.slug),
             });
         }
-        if (matched.length > 0)
-            return matched;
+        for (const fileId of inputFileIds ?? []) {
+            if (seenFileIds.has(fileId))
+                continue;
+            seenFileIds.add(fileId);
+            resolved.push({ fileId });
+        }
+        return resolved;
     }
     const preset = deps.presets.find(p => p.id === presetId);
     const slugs = preset?.defaultResourceSlugs ?? [];
-    const resolved = [];
     const missing = [];
     for (const slug of slugs) {
-        const r = toResolvedResource(deps.registry.getResource({ resourceSlug: slug }));
-        if (r)
-            resolved.push(r);
-        else
+        const selection = toResolvedFile(deps.registry.getResource({ resourceSlug: slug }));
+        if (!selection) {
             missing.push(slug);
+            continue;
+        }
+        if (seenFileIds.has(selection.fileId))
+            continue;
+        seenFileIds.add(selection.fileId);
+        resolved.push(selection);
     }
     if (missing.length > 0) {
         deps.logger.warn("Preset declares defaultResourceSlugs not present in the local registry; those slots will be skipped", { presetId, missing, availableSlugs: deps.registry.listResources().map(r => r.slug) });
     }
     return resolved;
 }
-function toResolvedResource(resource) {
+function toResolvedFile(resource) {
     if (!resource || !resource.latestRevision)
         return null;
     const file = resource.latestRevision.file;
     return {
-        resourceId: resource.id,
-        slug: resource.slug,
-        name: resource.name,
         fileId: file.id,
-        filename: file.filename,
-        mimeType: file.mimeType,
+        metadata: { slug: resource.slug, name: resource.name ?? resource.slug },
     };
 }
-async function injectRegistryResource(deps, sessionId, resource) {
-    const file = await deps.registry.readFileById(resource.fileId);
+async function injectRegistryFile(deps, sessionId, selection) {
+    const file = await deps.registry.readFileById(selection.fileId);
     if (!file) {
-        throw new Error(`Registry file not found for resource ${resource.slug} (fileId=${resource.fileId})`);
+        if (selection.metadata?.slug) {
+            throw new Error(`Registry file not found for resource ${selection.metadata.slug} (fileId=${selection.fileId})`);
+        }
+        deps.logger.warn('Selected fileId did not match the local registry; ignoring', {
+            fileId: selection.fileId,
+        });
+        return;
     }
     const result = await deps.sessionManager.callPluginMethod(SessionId(sessionId), 'resources.inject', {
         sessionId,
-        filename: resource.filename,
-        mimeType: resource.mimeType,
+        filename: file.meta.filename,
+        mimeType: file.meta.mimeType,
         size: file.buffer.length,
         fileBuffer: file.buffer,
-        metadata: { slug: resource.slug, name: resource.name ?? resource.slug },
+        metadata: selection.metadata,
     });
     if (!result.ok) {
         deps.logger.error('Registry resource injection failed', undefined, {
             sessionId,
-            slug: resource.slug,
+            fileId: selection.fileId,
             error: result.error,
         });
-        throw new Error(`Failed to inject resource '${resource.slug}': ${result.error.message ?? result.error.type}`);
+        throw new Error(`Failed to inject registry file '${selection.fileId}': ${result.error.message}`);
+    }
+}
+async function rollbackCreatedSession(deps, sessionId) {
+    let closeAttempted = false;
+    try {
+        const closeResult = await deps.sessionManager.withSessionLease(SessionId(sessionId), 'standalone:rollback', async (session) => {
+            closeAttempted = true;
+            return session.close();
+        });
+        if (!closeResult.ok) {
+            deps.logger.error(closeAttempted ? 'Failed to close session during rollback' : 'Failed to load session for rollback', undefined, { sessionId, error: closeResult.error });
+        }
+    }
+    catch (error) {
+        deps.logger.error(closeAttempted ? 'Failed to close session during rollback' : 'Failed to load session for rollback', error instanceof Error ? error : new Error(String(error)), { sessionId });
+    }
+    await removeWorktreeAfterFailure(deps, sessionId);
+}
+async function removeWorktreeAfterFailure(deps, sessionId) {
+    try {
+        await deps.gitFs.removeSessionWorktree(deps.instance.id, sessionId);
+    }
+    catch (error) {
+        deps.logger.error('Failed to remove session worktree during rollback', error instanceof Error ? error : new Error(String(error)), { sessionId });
     }
 }
 const handlers = {
@@ -179,6 +441,7 @@ const handlers = {
                 presetId: input.autoCreateSession.presetId,
                 initialPrompt: input.autoCreateSession.initialPrompt,
                 resourceIds: input.autoCreateSession.resourceIds,
+                fileIds: input.autoCreateSession.fileIds,
             });
             sessionId = result.sessionId;
         }
@@ -215,9 +478,22 @@ const handlers = {
         const result = await sessionManager.callManagerMethod('sessions.list', {});
         if (!result.ok)
             throw new Error(result.error.message);
-        return result.value;
+        // callManagerMethod is typed Result<unknown>, so the plugin's output schema
+        // does not reach us — validate here rather than assert.
+        const listed = z.object({ sessions: z.array(sessionMetadataSchema) }).parse(result.value);
+        return {
+            sessions: listed.sessions.map(s => ({
+                id: String(s.sessionId),
+                presetId: s.presetId,
+                status: s.status,
+                createdAt: new Date(s.createdAt).toISOString(),
+            })),
+        };
     },
-    'tokens.create': async () => ({ token: '' }),
+    // Standalone has no auth: the token is empty and never checked. expiresAt is
+    // still part of the contract, so hand back a real timestamp rather than
+    // omitting the field and hoping no caller reads it.
+    'tokens.create': async () => ({ token: '', expiresAt: new Date(Date.now() + 3600_000).toISOString() }),
     'resources.create': async (deps, input) => deps.registry.createResource(input),
     'resources.addRevision': async (deps, input) => deps.registry.addRevision(input),
     'resources.get': async (deps, input) => {
@@ -250,7 +526,7 @@ const handlers = {
             .split('/')
             .map(seg => encodeURIComponent(seg))
             .join('/');
-        const url = `${deps.publicBaseUrl}/api/v1/instances/${input.instanceId}/sessions/${input.sessionId}/files/${input.scope}/${encodedPath}?token=${encodeURIComponent(token)}`;
+        const url = `${deps.getPublicBaseUrl()}/api/v1/instances/${input.instanceId}/sessions/${input.sessionId}/files/${input.scope}/${encodedPath}?token=${encodeURIComponent(token)}`;
         return { url, expiresAt: new Date(expiresAt).toISOString() };
     },
 };