@tryvitris/website-harness 0.0.0-stage → 0.1.0-beta.6

package/bin/chunks/chunk-TY33XMHW.js

@@ -0,0 +1,239 @@
+import {
+  validateAddedMedia
+} from "./chunk-G7MNMULR.js";
+import {
+  json,
+  save,
+  within
+} from "./chunk-T6PE4KN4.js";
+
+// src/stock/library.ts
+import { existsSync, readFileSync, mkdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { createHash } from "node:crypto";
+var digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
+function readStockCatalog(path) {
+  const catalog = json(path);
+  if (![1, 2].includes(catalog.version) || !Array.isArray(catalog.items)) throw new Error("Unsupported stock catalog");
+  const ids = /* @__PURE__ */ new Set();
+  for (const item of catalog.items) {
+    if (!/^[a-z0-9][a-z0-9-]*$/.test(item.id) || ids.has(item.id)) throw new Error(`Invalid/duplicate stock id: ${item.id}`);
+    ids.add(item.id);
+    for (const value of [item.src, item.thumb]) if (!/^\/stock\/(images|thumbs|videos)\/[a-z0-9-]+\.(jpg|jpeg|png|webp|mp4)$/.test(value)) throw new Error(`Invalid stock path: ${value}`);
+    if (item.sha256 && !/^[a-f0-9]{64}$/.test(item.sha256)) throw new Error(`Invalid stock hash: ${item.id}`);
+    if (item.inspection && item.inspection.assetHash !== item.sha256) throw new Error(`Stale inspection: ${item.id}`);
+  }
+  return catalog;
+}
+function accepted(item) {
+  return item.status === "accepted" && Boolean(item.sha256 && item.inspection?.assetHash === item.sha256 && item.inspection.evidence.length);
+}
+async function stockBytes(item, cacheRoot, thumb = false, assetOrigin = process.env.VITRIS_STOCK_ORIGIN) {
+  const hash = thumb ? item.thumbSha256 : item.sha256;
+  if (!hash) throw new Error(`No pinned ${thumb ? "thumbnail" : "asset"} hash for ${item.id}`);
+  const rel = (thumb ? item.thumb : item.src).replace(/^\//, "");
+  const path = within(cacheRoot, rel);
+  let bytes;
+  if (existsSync(path)) bytes = readFileSync(path);
+  else {
+    const provider = thumb ? item.thumbnailUrl : item.downloadUrl;
+    const paths = [thumb ? item.thumb : item.src];
+    if (!thumb && item.legacySrc) paths.push(item.legacySrc);
+    if (thumb && item.legacyThumb) paths.push(item.legacyThumb);
+    const urls = [...assetOrigin ? paths.map((path2) => new URL(path2, assetOrigin).href) : [], ...provider ? [provider] : []];
+    for (const url of urls) {
+      const parsed = new URL(url);
+      if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(parsed.hostname))) continue;
+      try {
+        const response = await fetch(url, { signal: AbortSignal.timeout(3e4) });
+        if (!response.ok) continue;
+        const candidate = Buffer.from(await response.arrayBuffer());
+        if (digest(candidate) === hash) return candidate;
+      } catch {
+      }
+    }
+    throw new Error(`No matching pinned bytes for ${item.id}. Restore the local cache or provide --origin for the managed stock server; changed provider bytes need a new inspection.`);
+  }
+  if (digest(bytes) !== hash) throw new Error(`Stock bytes changed for ${item.id}; inspect a new version rather than silently replacing it`);
+  return bytes;
+}
+async function importStock(opts) {
+  const { root, item } = opts;
+  if (!accepted(item)) throw new Error("Import requires an accepted, inspected stock asset");
+  if (!opts.reason.trim() || !opts.placements.length) throw new Error("Stock import requires purpose and proposed routes");
+  const inventoryPath = join(root, "onboarding/media-inventory.json");
+  const inventory = json(inventoryPath);
+  const id = `stock-${item.sha256.slice(0, 20)}`;
+  const ext = item.src.split(".").pop();
+  const path = `/media/stock/${item.sha256}.${ext}`;
+  const bytes = await stockBytes(item, opts.cacheRoot, false, opts.assetOrigin);
+  const poster = item.kind === "video" ? await stockBytes(item, opts.cacheRoot, true, opts.assetOrigin) : void 0;
+  const dest = within(root, path.slice(1));
+  mkdirSync(dirname(dest), { recursive: true });
+  const { writeFileSync } = await import("node:fs");
+  writeFileSync(dest, bytes);
+  const posterPath = poster ? `/media/stock/${item.thumbSha256}.jpg` : void 0;
+  if (poster && posterPath) writeFileSync(within(root, posterPath.slice(1)), poster);
+  const entry = {
+    id,
+    path,
+    sources: [item.sourceUrl || `https://www.pexels.com/photo/${item.pexelsId}/`],
+    description: item.inspection.description,
+    role: "illustration",
+    disposition: "use",
+    reason: opts.reason,
+    inspected: true,
+    placements: opts.placements,
+    origin: "stock",
+    provenance: { sourceUrl: item.sourceUrl || `https://www.pexels.com/photo/${item.pexelsId}/`, termsUrl: item.termsUrl || "https://www.pexels.com/license/", credit: item.credit, acquiredAt: item.acquiredAt, originalSha256: item.sha256 },
+    identity: "none",
+    identityEvidence: [],
+    sha256: item.sha256,
+    stockId: item.id,
+    kind: item.kind,
+    width: item.width,
+    height: item.height,
+    duration: item.duration,
+    poster: posterPath,
+    posterSha256: poster ? item.thumbSha256 : void 0,
+    inspection: item.inspection
+  };
+  const prior = inventory.assets.find((a) => a.id === id);
+  if (prior) {
+    prior.placements = [.../* @__PURE__ */ new Set([...prior.placements, ...opts.placements])];
+  } else inventory.assets.push(entry);
+  save(inventoryPath, inventory);
+  return id;
+}
+
+// src/stock/selection.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, statSync } from "node:fs";
+import { join as join2 } from "node:path";
+function identityAsset(asset) {
+  return Boolean(asset.identity && !["none", "uncertain"].includes(asset.identity));
+}
+function eligibleForSlot(asset, slot) {
+  if (!asset.inspected || asset.disposition !== "use") return false;
+  if (slot.kind && (asset.kind || "image") !== slot.kind) return false;
+  if (slot.minWidth && (!asset.width || asset.width < slot.minWidth)) return false;
+  if (slot.identity && slot.identity !== "none") return asset.origin === "customer" && asset.identity === slot.identity && Boolean(asset.identityEvidence?.length);
+  return true;
+}
+function shortlistForSlot(assets, slot, limit = 8) {
+  const stop = /* @__PURE__ */ new Set(["the", "our", "and", "for", "with", "show", "image", "photo", "illustrate", "section", "home"]);
+  const words = [...new Set(`${slot.purpose} ${slot.id}`.toLowerCase().split(/[^a-z0-9]+/).filter((w) => w.length > 2 && !stop.has(w)))];
+  const relevance = (a) => {
+    const text = JSON.stringify([a.description, a.role, a.inspection]).toLowerCase();
+    return words.reduce((n, w) => n + Number(text.includes(w)), 0);
+  };
+  return assets.filter((a) => eligibleForSlot(a, slot)).sort((a, b) => relevance(b) - relevance(a) || Number(b.origin === "customer") - Number(a.origin === "customer") || a.id.localeCompare(b.id)).slice(0, Math.max(0, Math.min(limit, 8)));
+}
+function checkMediaIdentity(assets, root) {
+  return assets.flatMap((asset) => {
+    const failures = [];
+    if ((asset.origin === "stock" || asset.origin === "authored") && identityAsset(asset)) failures.push(`${asset.id}: ${asset.origin} cannot stand in for customer identity or proof`);
+    if (identityAsset(asset) && !asset.identityEvidence?.length) failures.push(`${asset.id}: identity role needs source-page evidence`);
+    if (root && identityAsset(asset)) for (const evidence of asset.identityEvidence || []) {
+      const path = evidence.split("#")[0];
+      if (path.includes("\\") || path.split("/").includes("..") || !/^onboarding\/(copy|raw|stills)\//.test(path) && path !== "onboarding/brief.json") {
+        failures.push(`${asset.id}: identity evidence must reference a captured onboarding artifact`);
+        continue;
+      }
+      try {
+        if (!existsSync2(within(root, path)) || !statSync(within(root, path)).isFile()) failures.push(`${asset.id}: missing identity evidence ${path}`);
+      } catch {
+        failures.push(`${asset.id}: invalid identity evidence path`);
+      }
+    }
+    if (identityAsset(asset) && asset.disposition !== "use" && !asset.identityDecision?.trim()) failures.push(`${asset.id}: account for omitted identity asset with an explicit decision`);
+    if (asset.origin === "stock" && (!asset.sha256 || !asset.inspected)) failures.push(`${asset.id}: stock must be inspected and pinned`);
+    return failures;
+  });
+}
+function validateMediaSelection(root, selection, requireSelection = false) {
+  const invPath = join2(root, "onboarding/media-inventory.json");
+  if (!existsSync2(invPath)) return [];
+  const assets = json(invPath).assets;
+  const failures = checkMediaIdentity(assets, root);
+  failures.push(...validateAddedMedia(root, { version: 2, harvestHash: "", assets }).findings.map((finding) => `[${finding.code}] ${finding.path}: ${finding.explanation}`));
+  for (const asset of assets.filter((a) => a.disposition === "use" && a.sha256)) {
+    const file = within(root, asset.path.replace(/^\//, ""));
+    if (!existsSync2(file) || digest(readFileSync2(file)) !== asset.sha256) failures.push(`${asset.id}: selected media missing or changed`);
+    if (asset.kind === "video" && (!asset.poster || !existsSync2(within(root, asset.poster.replace(/^\//, ""))))) failures.push(`${asset.id}: video needs a local poster`);
+  }
+  if (!selection && existsSync2(join2(root, "onboarding/media-selection.json"))) selection = json(join2(root, "onboarding/media-selection.json"));
+  if (!selection) return requireSelection && assets.some((a) => a.origin && a.disposition === "use") ? [...failures, "Modern media inventory requires onboarding/media-selection.json with explicit placements or no-match decisions"] : failures;
+  if (selection.version !== 1 || !Array.isArray(selection.placements)) return [...failures, "Invalid media selection manifest"];
+  const seen = /* @__PURE__ */ new Set();
+  for (const row of selection.placements) {
+    if (!row.slot?.id || !row.slot.route || !row.slot.purpose || !row.reason?.trim()) {
+      failures.push("Media placement needs a slot, route, purpose and reason");
+      continue;
+    }
+    if (seen.has(row.slot.id)) failures.push(`Duplicate media slot: ${row.slot.id}`);
+    seen.add(row.slot.id);
+    if (row.noMatch && !row.assetId) continue;
+    const asset = assets.find((a) => a.id === row.assetId);
+    if (!asset || row.noMatch || !eligibleForSlot(asset, row.slot)) failures.push(`${row.slot.id}: ineligible media selection`);
+  }
+  const used = new Set(selection.placements.map((p) => p.assetId));
+  for (const asset of assets.filter((a) => identityAsset(a) && a.disposition === "use")) if (!used.has(asset.id) && !asset.identityDecision?.trim()) failures.push(`${asset.id}: identity asset omitted from placements without a decision`);
+  return failures;
+}
+function saveSelection(root, selection) {
+  const errors = validateMediaSelection(root, selection);
+  if (errors.length) throw new Error(errors.join("; "));
+  save(join2(root, "onboarding/media-selection.json"), selection);
+}
+function validateRenderedMedia(root) {
+  const path = join2(root, "onboarding/media-selection.json");
+  if (!existsSync2(path)) return [];
+  const inventory = json(join2(root, "onboarding/media-inventory.json"));
+  const selection = json(path);
+  const errors = [];
+  for (const row of selection.placements) {
+    if (!row.assetId || row.noMatch) continue;
+    const asset = inventory.assets.find((a) => a.id === row.assetId);
+    if (!asset) continue;
+    const route = row.slot.route.replace(/^\//, "").replace(/\/$/, "");
+    const page = within(root, `dist/${route ? route + "/" : ""}index.html`);
+    if (!existsSync2(page) || !readFileSync2(page, "utf8").includes(asset.path)) errors.push(`${row.slot.id}: selected asset missing from rendered route ${row.slot.route}`);
+  }
+  return errors;
+}
+
+// src/stock/search.ts
+function searchStock(items, query = {}) {
+  const words = [query.text, query.subject, query.context, query.detail, query.metaphor, query.composition, query.setting, query.lighting, ...query.palette || []].filter(Boolean).join(" ").toLowerCase().split(/[^a-z0-9]+/).filter((w) => w.length > 2);
+  const scored = items.filter((item) => {
+    if (item.status === "excluded" || item.status === "staged") return false;
+    const subject = JSON.stringify([item.alt, item.inspection?.subjects]).toLowerCase();
+    if (query.unwantedSubjects?.some((s) => subject.includes(s.toLowerCase()))) return false;
+    if (query.cropTolerance === "low" && (!item.inspection || /tight|limited|avoid crop/i.test(item.inspection.cropNotes))) return false;
+    if (query.kind && item.kind !== query.kind) return false;
+    if (query.minWidth && (!item.width || item.width < query.minWidth)) return false;
+    if (query.industry && !(item.inspection?.industries || item.categories).includes(query.industry)) return false;
+    if (query.role && !(item.inspection?.roles || item.categories).includes(query.role)) return false;
+    if (query.negativeSpace && !item.inspection?.negativeSpace.includes(query.negativeSpace)) return false;
+    const ratio = item.width && item.height ? item.width / item.height : 0;
+    if (query.orientation && (!ratio || (query.orientation === "landscape" ? ratio < 1.15 : query.orientation === "portrait" ? ratio > 0.87 : ratio < 0.87 || ratio > 1.15))) return false;
+    return true;
+  }).map((item) => {
+    const text = JSON.stringify([item.alt, item.tags, item.categories, item.inspection]).toLowerCase();
+    return { item, score: words.reduce((n, word) => n + Number(text.includes(word)), 0), exposure: query.recentExposure?.[item.id] || 0 };
+  }).filter((row) => !words.length || row.score > 0);
+  return scored.sort((a, b) => b.score - Math.min(0.5, b.exposure * 0.1) - (a.score - Math.min(0.5, a.exposure * 0.1)) || a.item.id.localeCompare(b.item.id)).slice(0, Math.max(0, Math.min(query.limit ?? 100, 500))).map((row) => row.item);
+}
+
+export {
+  digest,
+  readStockCatalog,
+  accepted,
+  stockBytes,
+  importStock,
+  shortlistForSlot,
+  validateMediaSelection,
+  saveSelection,
+  validateRenderedMedia,
+  searchStock
+};

package/bin/chunks/chunk-VH7PM7KJ.js

@@ -0,0 +1,179 @@
+import {
+  productionPreflightTimeoutMs
+} from "./chunk-2NW7KSPA.js";
+import {
+  verifyPreservedSite
+} from "./chunk-YQYHROLZ.js";
+import {
+  EXIT_CODES
+} from "./chunk-JCRGE6AL.js";
+import {
+  artifactManifest
+} from "./chunk-XL2DRAYI.js";
+import {
+  gradeAll,
+  sourceRevision
+} from "./chunk-3CTBXY5K.js";
+import {
+  parseReleaseRecord
+} from "./chunk-M4LNHYYR.js";
+import {
+  buildVerified,
+  isPreserveSite
+} from "./chunk-E5Y46VBX.js";
+import {
+  findHarnessRoot
+} from "./chunk-HNORQ74T.js";
+import {
+  json,
+  save
+} from "./chunk-T6PE4KN4.js";
+
+// src/integrations/hosting.ts
+import { cpSync, existsSync as existsSync2, mkdirSync } from "node:fs";
+import { dirname, join as join2, resolve as resolve2 } from "node:path";
+import { randomUUID } from "node:crypto";
+
+// src/cli/verify.ts
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { spawnSync } from "node:child_process";
+async function verifySite(opts = {}) {
+  const root = resolve(opts.site || ".");
+  if (!existsSync(root)) {
+    return {
+      ok: false,
+      exitCode: EXIT_CODES.CONFIG_OR_CLI_ERROR,
+      error: `Site root not found: ${root}`
+    };
+  }
+  if (opts.dryRun) {
+    return {
+      ok: true,
+      exitCode: EXIT_CODES.SUCCESS,
+      summary: `[dry-run] Would verify build and evaluate graph gates on ${root}`
+    };
+  }
+  if (isPreserveSite(root)) {
+    if (opts.environment === "production") return { ok: false, exitCode: EXIT_CODES.CONFIG_OR_CLI_ERROR, error: "Preserve mode supports temporary previews only" };
+    try {
+      await buildVerified(root);
+      const report = await verifyPreservedSite(root, { remoteUrl: opts.remoteUrl });
+      return {
+        ok: report.ok,
+        exitCode: report.ok ? EXIT_CODES.SUCCESS : EXIT_CODES.GATES_FAILED,
+        summary: report.ok ? `Preserve checks passed (${report.checks.length} route/viewport comparisons)` : "Preserve verification failed; see agent/reviews/preserve.json",
+        failures: report.failures,
+        data: { build: { ok: true }, grades: [{ node: "preserve", ok: report.ok, failures: report.failures }], failures: report.failures }
+      };
+    } catch (error) {
+      return { ok: false, exitCode: EXIT_CODES.GATES_FAILED, error: error instanceof Error ? error.message : String(error) };
+    }
+  }
+  if (opts.remoteUrl) return { ok: false, exitCode: EXIT_CODES.CONFIG_OR_CLI_ERROR, error: "--remote is supported only for preserve sites" };
+  const allFailures = [];
+  let buildOk = true;
+  let buildError;
+  try {
+    await buildVerified(root);
+  } catch (err) {
+    buildOk = false;
+    buildError = err instanceof Error ? err.message : String(err);
+    allFailures.push(`Build failed: ${buildError}`);
+  }
+  const grades = gradeAll(root);
+  for (const g of grades) {
+    if (!g.ok) {
+      allFailures.push(...g.failures.map((f) => `${g.node}: ${f}`));
+    }
+  }
+  const environment = opts.environment || "preview";
+  if (environment === "production" && buildOk) {
+    const harness = findHarnessRoot();
+    const bundled = join(harness, "bin/vitris-launch-preflight.js");
+    const preflight = existsSync(bundled) ? bundled : join(harness, "scripts/launch-preflight.ts");
+    const result = spawnSync(process.execPath, [
+      ...preflight.endsWith(".ts") ? ["--experimental-strip-types"] : [],
+      preflight,
+      "--site",
+      root,
+      "--environment",
+      "production"
+    ], { encoding: "utf8", timeout: productionPreflightTimeoutMs() });
+    if (result.status !== 0) {
+      const path = join(root, "agent/reviews/launch-preflight.json");
+      const receipt = existsSync(path) ? JSON.parse(readFileSync(path, "utf8")) : void 0;
+      allFailures.push(`launch: ${receipt?.blockerIds?.join(", ") || result.stderr || result.error?.message || "production preflight failed"}`);
+    }
+  }
+  const ok = buildOk && allFailures.length === 0;
+  const summary = ok ? `All verification gates passed (${grades.length} nodes checked, build verified).` : `Verification failed:
+${allFailures.map((f) => `  - ${f}`).join("\n")}`;
+  return {
+    ok,
+    exitCode: ok ? EXIT_CODES.SUCCESS : EXIT_CODES.GATES_FAILED,
+    summary,
+    failures: allFailures,
+    data: {
+      build: { ok: buildOk, error: buildError },
+      grades,
+      failures: allFailures
+    }
+  };
+}
+
+// src/integrations/hosting.ts
+async function prepareVerifiedRelease(siteRoot, environment = "preview") {
+  const root = resolve2(siteRoot);
+  const verified = await verifySite({ site: root, environment });
+  if (!verified.ok) throw new Error(`Release verification failed: ${verified.error || verified.summary}`);
+  const distDirectory = join2(root, "dist");
+  const evidence = json(join2(distDirectory, "build-evidence.json"));
+  const version = json(join2(findHarnessRoot(), "package.json")).version;
+  const artifactDigest = artifactManifest(distDirectory).sha256;
+  const outputDirectory = join2(root, "agent/release-bundles", artifactDigest);
+  mkdirSync(dirname(outputDirectory), { recursive: true });
+  if (!existsSync2(outputDirectory)) cpSync(distDirectory, outputDirectory, { recursive: true });
+  if (artifactManifest(outputDirectory).sha256 !== artifactDigest) throw new Error("Staged release bytes differ from verified build");
+  const artifact = {
+    schemaVersion: 1,
+    sourceRevision: sourceRevision(root).digest,
+    artifactDigest,
+    compilerDigest: evidence.compilerHash,
+    harnessVersion: version,
+    environment,
+    policyId: isPreserveSite(root) ? "preserve-preview-v1" : environment === "production" ? "launch-preflight" : "preview-gates",
+    outputDirectory,
+    checkedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  save(join2(root, "agent/release-candidate.json"), artifact);
+  return artifact;
+}
+async function deployVerifiedArtifact(siteRoot, artifact, adapter) {
+  const root = resolve2(siteRoot);
+  if (!existsSync2(join2(root, "agent/release-candidate.json"))) throw new Error("No prepared release candidate exists");
+  const prepared = json(join2(root, "agent/release-candidate.json"));
+  if (JSON.stringify(prepared) !== JSON.stringify(artifact)) throw new Error("Release candidate differs from the prepared record");
+  if (sourceRevision(root).digest !== artifact.sourceRevision) throw new Error("Source changed after release verification");
+  if (artifactManifest(artifact.outputDirectory).sha256 !== artifact.artifactDigest) throw new Error("Build bytes changed after release verification");
+  const deployment = artifact.environment === "production" ? await adapter.publish(artifact) : await adapter.deployPreview(artifact);
+  if (deployment.artifactDigest !== artifact.artifactDigest) throw new Error("Hosting adapter returned a different artifact identity");
+  const release = parseReleaseRecord({
+    schemaVersion: 1,
+    sourceRevision: artifact.sourceRevision,
+    buildDigest: artifact.artifactDigest,
+    compilerDigest: artifact.compilerDigest,
+    harnessVersion: artifact.harnessVersion,
+    policyId: artifact.policyId,
+    environment: artifact.environment,
+    deploymentReceipt: deployment.deploymentId
+  });
+  save(join2(root, `agent/releases/${randomUUID()}.json`), { release, deployment, adapter: adapter.id });
+  return { release, deployment };
+}
+
+export {
+  verifySite,
+  prepareVerifiedRelease,
+  deployVerifiedArtifact
+};

package/bin/chunks/chunk-WEFDVXFX.js

@@ -0,0 +1,65 @@
+import {
+  within
+} from "./chunk-T6PE4KN4.js";
+
+// src/build/serve.ts
+import { createServer } from "node:http";
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { gzipSync } from "node:zlib";
+var previewIdentity = (dist) => createHash("sha256").update(resolve(dist)).digest("hex");
+function previewServer(dist, options = {}) {
+  return createServer((req, res) => {
+    try {
+      const pathname = new URL(req.url || "/", "http://localhost").pathname;
+      if (pathname === "/__vitris_preview") {
+        res.setHeader("content-type", "application/json");
+        res.end(JSON.stringify({ identity: previewIdentity(dist) }));
+        return;
+      }
+      const redirectFile = join(dist, "_redirects");
+      const redirect = existsSync(redirectFile) ? readFileSync(redirectFile, "utf8").split(/\r?\n/).map((line) => line.trim().split(/\s+/)).find((parts) => parts[0] === pathname && parts[1]?.startsWith("/") && /^(200|30[1278])$/.test(parts[2] || "301")) : void 0;
+      if (redirect && redirect[2] !== "200") {
+        res.writeHead(Number(redirect[2] || 301), { location: redirect[1] });
+        res.end();
+        return;
+      }
+      let file = within(dist, "." + decodeURIComponent(redirect?.[1] || pathname));
+      if (existsSync(file) && statSync(file).isDirectory()) file = join(file, "index.html");
+      if (!existsSync(file)) {
+        res.statusCode = 404;
+        const fallback = join(dist, "404.html");
+        if (existsSync(fallback)) {
+          res.setHeader("content-type", "text/html");
+          res.end(readFileSync(fallback));
+        } else res.end("Not found");
+        return;
+      }
+      const ext = file.split(".").pop();
+      res.setHeader("content-type", { html: "text/html", css: "text/css", js: "text/javascript", json: "application/json", png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg", gif: "image/gif", avif: "image/avif", svg: "image/svg+xml", webp: "image/webp", woff2: "font/woff2", mp4: "video/mp4", webm: "video/webm" }[ext] || "application/octet-stream");
+      const bytes = readFileSync(file);
+      const etag = `W/"${createHash("sha256").update(bytes).digest("hex")}"`;
+      res.setHeader("etag", etag);
+      res.setHeader("cache-control", /^\/(?:assets\/immutable|media\/optimized)\//.test(pathname) ? "public, max-age=31536000, immutable" : "public, max-age=0, must-revalidate");
+      if (req.headers["if-none-match"] === etag) {
+        res.writeHead(304);
+        res.end();
+        return;
+      }
+      if (options.compress && /^(html|css|js|json|xml|svg|txt)$/.test(ext) && req.headers["accept-encoding"]?.includes("gzip")) {
+        res.setHeader("content-encoding", "gzip");
+        res.setHeader("vary", "Accept-Encoding");
+        res.end(gzipSync(bytes));
+      } else res.end(bytes);
+    } catch {
+      res.writeHead(403);
+      res.end();
+    }
+  });
+}
+
+export {
+  previewIdentity,
+  previewServer
+};

package/bin/chunks/chunk-XGTHGWPW.js

@@ -0,0 +1,90 @@
+// scripts/lib/r2.ts
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { spawnSync } from "node:child_process";
+var R2_BUCKET = "vitris-assets";
+function loadDevVars(root) {
+  let text = "";
+  try {
+    text = readFileSync(join(root, ".dev.vars"), "utf8");
+  } catch {
+    return;
+  }
+  for (const line of text.split(/\r?\n/)) {
+    if (!line || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq === -1) continue;
+    const key = line.slice(0, eq).trim();
+    let value = line.slice(eq + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    if (process.env[key] == null) process.env[key] = value;
+  }
+  if (process.env.CF_API_TOKEN && !process.env.CLOUDFLARE_API_TOKEN) {
+    process.env.CLOUDFLARE_API_TOKEN = process.env.CF_API_TOKEN;
+  }
+  if (process.env.CF_ACCOUNT_ID && !process.env.CLOUDFLARE_ACCOUNT_ID) {
+    process.env.CLOUDFLARE_ACCOUNT_ID = process.env.CF_ACCOUNT_ID;
+  }
+}
+function assetsOrigin() {
+  return (process.env.ASSETS_ORIGIN || process.env.VITRIS_BACKEND_ORIGIN || process.env.KERNEL_ORIGIN || "http://127.0.0.1:8787").replace(
+    /\/$/,
+    ""
+  );
+}
+function publicAssetUrl(r2Key) {
+  return `${assetsOrigin()}/assets/${r2Key}`;
+}
+function putLocalR2(root, key, file, contentType) {
+  const args = [
+    "wrangler",
+    "r2",
+    "object",
+    "put",
+    `${R2_BUCKET}/${key}`,
+    `--file=${file}`,
+    `--content-type=${contentType}`,
+    "--force",
+    "--local",
+    "--persist-to",
+    ".wrangler/state"
+  ];
+  const result = spawnSync("npx", args, { cwd: root, stdio: "inherit", shell: true, env: process.env });
+  if (result.status !== 0) throw new Error(`Failed to put ${key} (local R2)`);
+}
+async function putRemoteR2(key, file, contentType) {
+  const account = process.env.CLOUDFLARE_ACCOUNT_ID || process.env.CF_ACCOUNT_ID;
+  const token = process.env.CLOUDFLARE_API_TOKEN || process.env.CF_API_TOKEN;
+  if (!account || !token) throw new Error("Missing Cloudflare account credentials for remote R2");
+  const body = readFileSync(file);
+  const res = await fetch(
+    `https://api.cloudflare.com/client/v4/accounts/${account}/r2/buckets/${R2_BUCKET}/objects/${key}`,
+    {
+      method: "PUT",
+      headers: {
+        authorization: `Bearer ${token}`,
+        "content-type": contentType
+      },
+      body
+    }
+  );
+  if (!res.ok) {
+    const text = await res.text();
+    throw new Error(`Remote R2 put ${key} failed (${res.status}): ${text.slice(0, 180)}`);
+  }
+}
+function writeScratchFile(path, data) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, data);
+}
+
+export {
+  loadDevVars,
+  assetsOrigin,
+  publicAssetUrl,
+  putLocalR2,
+  putRemoteR2,
+  writeScratchFile
+};

package/bin/chunks/chunk-XL2DRAYI.js

@@ -0,0 +1,39 @@
+// src/knowledge/artifact.ts
+import { createHash } from "node:crypto";
+import { lstatSync, readFileSync, readdirSync } from "node:fs";
+import { join, relative, resolve } from "node:path";
+
+// src/knowledge/artifact-order.ts
+function compareArtifactPaths(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+
+// src/knowledge/artifact.ts
+function artifactManifest(distDirectory) {
+  const root = resolve(distDirectory);
+  const files = [];
+  function walk(dir) {
+    for (const name of readdirSync(dir).sort()) {
+      const full = join(dir, name);
+      const rel = relative(root, full).replaceAll("\\", "/");
+      const stat = lstatSync(full);
+      if (stat.isSymbolicLink()) throw new Error(`Symlink in publishable artifact: ${rel}`);
+      if (stat.isDirectory()) {
+        walk(full);
+        continue;
+      }
+      if (!stat.isFile()) throw new Error(`Unsupported publishable artifact: ${rel}`);
+      const bytes = readFileSync(full);
+      files.push({ path: rel, bytes: bytes.length, sha256: createHash("sha256").update(bytes).digest("hex") });
+    }
+  }
+  walk(root);
+  files.sort((a, b) => compareArtifactPaths(a.path, b.path));
+  const sha256 = createHash("sha256").update(JSON.stringify(files)).digest("hex");
+  return { schemaVersion: 1, files, sha256 };
+}
+
+export {
+  compareArtifactPaths,
+  artifactManifest
+};