rivet-design 0.16.3 → 0.17.0

package/dist/library/HubServer.js

@@ -0,0 +1,95 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startHubServer = void 0;
+const StaticPreviewServer_1 = require("./StaticPreviewServer");
+const app_1 = require("../routes/library/app");
+const ProjectRuntimeService_1 = require("../services/ProjectRuntimeService");
+const ProjectFolderPicker_1 = require("../services/ProjectFolderPicker");
+const ProjectCardPreviews_1 = require("../services/ProjectCardPreviews");
+const path_1 = __importDefault(require("path"));
+const HubDiscovery_1 = require("../services/HubDiscovery");
+const HubNavigation_1 = require("../services/HubNavigation");
+const ProjectLibrary_1 = require("../services/ProjectLibrary");
+const StaticLibraryPreviews_1 = require("../services/StaticLibraryPreviews");
+const http_1 = require("./http");
+/** Starts one shared application coordinator while keeping project runtimes independent. */
+const startHubServer = async ({ root = (0, ProjectLibrary_1.currentLibraryRoot)(), telemetry, uiDirectory = path_1.default.resolve(__dirname, '../../src/ui/dist'), } = {}) => {
+    const discovery = await HubDiscovery_1.HubDiscovery.open(root);
+    const claim = discovery.claim();
+    if (claim.status === 'occupied') {
+        discovery.close();
+        return null;
+    }
+    const token = claim.token;
+    let library;
+    try {
+        library = await ProjectLibrary_1.ProjectLibrary.open(root);
+    }
+    catch (error) {
+        discovery.release(token);
+        discovery.close();
+        throw error;
+    }
+    const navigation = new HubNavigation_1.HubNavigation();
+    const previews = new StaticLibraryPreviews_1.StaticLibraryPreviews(library, StaticPreviewServer_1.startStaticPreviewServer);
+    const runtime = new ProjectRuntimeService_1.ProjectRuntimeService(library.registry);
+    const cardPreviews = new ProjectCardPreviews_1.ProjectCardPreviews({
+        library,
+        runtime,
+        previews,
+        telemetry,
+    });
+    const folderPicker = new ProjectFolderPicker_1.ProjectFolderPicker();
+    const app = (0, app_1.createLibraryApp)({
+        token,
+        library,
+        navigation,
+        previews,
+        runtime,
+        cardPreviews,
+        folderPicker,
+        telemetry,
+        uiDirectory,
+    });
+    let listener;
+    try {
+        listener = await (0, http_1.listenLocally)(app);
+        discovery.publish({ token, port: listener.port });
+    }
+    catch (error) {
+        if (listener)
+            await (0, http_1.closeListener)(listener.server);
+        navigation.close();
+        await cardPreviews.close();
+        await previews.close();
+        library.close();
+        discovery.release(token);
+        discovery.close();
+        throw error;
+    }
+    const activeListener = listener;
+    let isClosed = false;
+    return {
+        url: activeListener.url,
+        token,
+        library,
+        close: async () => {
+            if (isClosed)
+                return;
+            isClosed = true;
+            folderPicker.close();
+            navigation.close();
+            await cardPreviews.close();
+            await (0, http_1.closeListener)(activeListener.server);
+            await previews.close();
+            library.close();
+            discovery.release(token);
+            discovery.close();
+        },
+    };
+};
+exports.startHubServer = startHubServer;
+//# sourceMappingURL=HubServer.js.map

package/dist/library/HubServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HubServer.js","sourceRoot":"","sources":["../../src/library/HubServer.ts"],"names":[],"mappings":";;;;;;AAAA,+DAAiE;AACjE,+CAAyD;AACzD,6EAA0E;AAC1E,yEAAsE;AACtE,yEAAsE;AACtE,gDAAwB;AACxB,2DAAwD;AACxD,6DAA0D;AAC1D,+DAAgF;AAChF,6EAA0E;AAC1E,iCAAsD;AAStD,4FAA4F;AACrF,MAAM,cAAc,GAAG,KAAK,EAAE,EACnC,IAAI,GAAG,IAAA,mCAAkB,GAAE,EAC3B,SAAS,EACT,WAAW,GAAG,cAAI,CAAC,OAAO,CAAC,SAAS,EAAE,mBAAmB,CAAC,MAC5C,EAAE,EAAE,EAAE;IACpB,MAAM,SAAS,GAAG,MAAM,2BAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAChC,SAAS,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,IAAI,OAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,+BAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzB,SAAS,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,6BAAa,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,6CAAqB,CAAC,OAAO,EAAE,8CAAwB,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,IAAI,6CAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,IAAI,yCAAmB,CAAC;QAC3C,OAAO;QACP,OAAO;QACP,QAAQ;QACR,SAAS;KACV,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,yCAAmB,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAA,sBAAgB,EAAC;QAC3B,KAAK;QACL,OAAO;QACP,UAAU;QACV,QAAQ;QACR,OAAO;QACP,YAAY;QACZ,YAAY;QACZ,SAAS;QACT,WAAW;KACZ,CAAC,CAAC;IACH,IAAI,QAA+D,CAAC;IACpE,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAA,oBAAa,EAAC,GAAG,CAAC,CAAC;QACpC,SAAS,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,QAAQ;YAAE,MAAM,IAAA,oBAAa,EAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnD,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,YAAY,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzB,SAAS,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,cAAc,GAAG,QAAQ,CAAC;IAChC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO;QACL,GAAG,EAAE,cAAc,CAAC,GAAG;QACvB,KAAK;QACL,OAAO;QACP,KAAK,EAAE,KAAK,IAAmB,EAAE;YAC/B,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,YAAY,CAAC,KAAK,EAAE,CAAC;YACrB,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,YAAY,CAAC,KAAK,EAAE,CAAC;YAC3B,MAAM,IAAA,oBAAa,EAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;YACvB,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACzB,SAAS,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AA1EW,QAAA,cAAc,kBA0EzB"}

package/dist/library/StaticPreviewServer.d.ts

@@ -0,0 +1,7 @@
+/** Starts the dedicated listener for one canonical saved snapshot directory. */
+export declare const startStaticPreviewServer: (root: string) => Promise<{
+    server: import("node:http").Server;
+    url: string;
+    port: number;
+}>;
+//# sourceMappingURL=StaticPreviewServer.d.ts.map

package/dist/library/StaticPreviewServer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StaticPreviewServer.d.ts","sourceRoot":"","sources":["../../src/library/StaticPreviewServer.ts"],"names":[],"mappings":"AAKA,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,GAAU,MAAM,MAAM;;;;EAI1D,CAAC"}

package/dist/library/StaticPreviewServer.js

@@ -0,0 +1,18 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startStaticPreviewServer = void 0;
+const express_1 = __importDefault(require("express"));
+const promises_1 = __importDefault(require("fs/promises"));
+const staticPreview_1 = require("../routes/library/staticPreview");
+const http_1 = require("./http");
+/** Starts the dedicated listener for one canonical saved snapshot directory. */
+const startStaticPreviewServer = async (root) => {
+    const app = (0, express_1.default)();
+    app.use((0, staticPreview_1.createStaticPreviewRoutes)(await promises_1.default.realpath(root)));
+    return (0, http_1.listenLocally)(app);
+};
+exports.startStaticPreviewServer = startStaticPreviewServer;
+//# sourceMappingURL=StaticPreviewServer.js.map

package/dist/library/StaticPreviewServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StaticPreviewServer.js","sourceRoot":"","sources":["../../src/library/StaticPreviewServer.ts"],"names":[],"mappings":";;;;;;AAAA,sDAA8B;AAC9B,2DAA6B;AAC7B,mEAA4E;AAC5E,iCAAuC;AAEvC,gFAAgF;AACzE,MAAM,wBAAwB,GAAG,KAAK,EAAE,IAAY,EAAE,EAAE;IAC7D,MAAM,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,IAAA,yCAAyB,EAAC,MAAM,kBAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,IAAA,oBAAa,EAAC,GAAG,CAAC,CAAC;AAC5B,CAAC,CAAC;AAJW,QAAA,wBAAwB,4BAInC"}

package/dist/library/http.d.ts

@@ -0,0 +1,11 @@
+import { type Server } from 'http';
+import type { Express } from 'express';
+/** Listens on loopback with an OS-assigned port, never exposing project files to the LAN. */
+export declare const listenLocally: (app: Express) => Promise<{
+    server: Server;
+    url: string;
+    port: number;
+}>;
+/** Closes a listener and its idle HTTP connections. */
+export declare const closeListener: (server: Server) => Promise<void>;
+//# sourceMappingURL=http.d.ts.map

package/dist/library/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/library/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,MAAM,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,6FAA6F;AAC7F,eAAO,MAAM,aAAa,GACxB,KAAK,OAAO,KACX,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAiBvD,CAAC;AAEF,uDAAuD;AACvD,eAAO,MAAM,aAAa,GAAI,QAAQ,MAAM,KAAG,OAAO,CAAC,IAAI,CAIvD,CAAC"}

package/dist/library/http.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.closeListener = exports.listenLocally = void 0;
+const http_1 = require("http");
+/** Listens on loopback with an OS-assigned port, never exposing project files to the LAN. */
+const listenLocally = async (app) => {
+    const server = (0, http_1.createServer)(app);
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            server.removeListener('error', reject);
+            resolve();
+        });
+    });
+    const address = server.address();
+    if (!address || typeof address === 'string')
+        throw new Error('No local listening address');
+    return {
+        server,
+        url: `http://127.0.0.1:${address.port}`,
+        port: address.port,
+    };
+};
+exports.listenLocally = listenLocally;
+/** Closes a listener and its idle HTTP connections. */
+const closeListener = (server) => new Promise((resolve, reject) => {
+    server.close((error) => (error ? reject(error) : resolve()));
+    server.closeIdleConnections();
+});
+exports.closeListener = closeListener;
+//# sourceMappingURL=http.js.map

package/dist/library/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/library/http.ts"],"names":[],"mappings":";;;AAAA,+BAAiD;AAGjD,6FAA6F;AACtF,MAAM,aAAa,GAAG,KAAK,EAChC,GAAY,EAC4C,EAAE;IAC1D,MAAM,MAAM,GAAG,IAAA,mBAAY,EAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACvC,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QACzC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,OAAO;QACL,MAAM;QACN,GAAG,EAAE,oBAAoB,OAAO,CAAC,IAAI,EAAE;QACvC,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC;AACJ,CAAC,CAAC;AAnBW,QAAA,aAAa,iBAmBxB;AAEF,uDAAuD;AAChD,MAAM,aAAa,GAAG,CAAC,MAAc,EAAiB,EAAE,CAC7D,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,oBAAoB,EAAE,CAAC;AAChC,CAAC,CAAC,CAAC;AAJQ,QAAA,aAAa,iBAIrB"}

package/dist/library/importFiles.d.ts

@@ -0,0 +1,18 @@
+import type { VariantHistoryManifest } from '../services/VariantHistoryService';
+/** Enumerates only durable source files, rejecting links and borrowed object stores. */
+export declare const sourceFiles: (dataDirectory: string) => Promise<string[]>;
+/** Hashes source content rather than volatile index/WAL bytes for divergence detection. */
+export declare const sourceFingerprint: (dataDirectory: string) => Promise<string>;
+/** Copies durable bytes into staging without modifying or linking source files. */
+export declare const copySourceFiles: (source: string, destination: string) => Promise<void>;
+/** Reads supported persisted manifests and checks that path and metadata identities agree. */
+export declare const readSourceManifests: (dataDirectory: string) => Promise<VariantHistoryManifest[]>;
+/** Resolves artifact paths within their owner and verifies regular files exist. */
+export declare const verifyArtifactFile: (root: string, relative: string) => Promise<void>;
+/** Relocates managed reference paths while preserving external workspace references. */
+export declare const relocateContext: (args: {
+    sourceDirectory: string;
+    stageDirectory: string;
+    bundleDirectory: string;
+}) => Promise<void>;
+//# sourceMappingURL=importFiles.d.ts.map

package/dist/library/importFiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"importFiles.d.ts","sourceRoot":"","sources":["../../src/library/importFiles.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAiDhF,wFAAwF;AACxF,eAAO,MAAM,WAAW,GAAU,eAAe,MAAM,KAAG,OAAO,CAAC,MAAM,EAAE,CAyBzE,CAAC;AAEF,2FAA2F;AAC3F,eAAO,MAAM,iBAAiB,GAC5B,eAAe,MAAM,KACpB,OAAO,CAAC,MAAM,CAchB,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,eAAe,GAC1B,QAAQ,MAAM,EACd,aAAa,MAAM,KAClB,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF,8FAA8F;AAC9F,eAAO,MAAM,mBAAmB,GAC9B,eAAe,MAAM,KACpB,OAAO,CAAC,sBAAsB,EAAE,CA2BlC,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,kBAAkB,GAC7B,MAAM,MAAM,EACZ,UAAU,MAAM,KACf,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,eAAe,GAAU,MAAM;IAC1C,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB,KAAG,OAAO,CAAC,IAAI,CA2Cf,CAAC"}

package/dist/library/importFiles.js

@@ -0,0 +1,184 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.relocateContext = exports.verifyArtifactFile = exports.readSourceManifests = exports.copySourceFiles = exports.sourceFingerprint = exports.sourceFiles = void 0;
+const sourcePresentation_1 = require("../storage/library/sourcePresentation");
+const promises_1 = __importDefault(require("fs/promises"));
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const crypto_1 = require("crypto");
+const zod_1 = require("zod");
+const HISTORY_DIRECTORIES = [
+    'variants',
+    'variant-context',
+    'store.git',
+];
+const SNAPSHOT_TOP_LEVEL = new Set([
+    'HEAD',
+    'config',
+    'objects',
+    'refs',
+    'packed-refs',
+]);
+const SafeId = zod_1.z.string().regex(/^[A-Za-z0-9_-]+$/);
+const Pointer = zod_1.z
+    .object({ ref: zod_1.z.string(), commitSha: zod_1.z.string().regex(/^[a-f0-9]{40}$/) })
+    .passthrough();
+const ManifestSchema = zod_1.z
+    .object({
+    schemaVersion: zod_1.z.literal(2),
+    sessionId: SafeId,
+    variantId: SafeId,
+    label: zod_1.z.string(),
+    brief: zod_1.z.string(),
+    sessionPrompt: zod_1.z.string(),
+    projectKind: zod_1.z.enum(['existing', 'fresh']),
+    status: zod_1.z.enum([
+        'completed',
+        'committed',
+        'rejected',
+        'cancelled',
+        'removed',
+    ]),
+    createdAt: zod_1.z.string(),
+    statusChangedAt: zod_1.z.string(),
+    changedFilesCount: zod_1.z.number().int().nonnegative(),
+    artifact: zod_1.z.object({ kind: zod_1.z.enum(['diff', 'project']) }).passthrough(),
+    preview: zod_1.z
+        .object({ kind: zod_1.z.enum(['static', 'dev-server', 'none']) })
+        .passthrough(),
+    tree: Pointer.extend({
+        treeSha: zod_1.z.string().regex(/^[a-f0-9]{40}$/),
+    }).optional(),
+    base: Pointer.optional(),
+    parent: Pointer.optional(),
+})
+    .passthrough();
+/** Enumerates only durable source files, rejecting links and borrowed object stores. */
+const sourceFiles = async (dataDirectory) => {
+    const files = [];
+    const walk = async (relative) => {
+        const absolute = path_1.default.join(dataDirectory, relative);
+        const stat = await promises_1.default.lstat(absolute);
+        if (stat.isSymbolicLink())
+            throw new Error(`Cannot import symbolic link: ${relative}`);
+        if (relative === path_1.default.join('store.git', 'objects', 'info', 'alternates'))
+            throw new Error('Snapshot store depends on an external object database');
+        if (stat.isFile()) {
+            files.push(relative);
+            return;
+        }
+        if (!stat.isDirectory())
+            throw new Error(`Cannot import non-regular file: ${relative}`);
+        for (const name of (await promises_1.default.readdir(absolute)).sort()) {
+            if (relative === 'store.git' && !SNAPSHOT_TOP_LEVEL.has(name))
+                continue;
+            if (name.endsWith('.lock'))
+                continue;
+            await walk(path_1.default.join(relative, name));
+        }
+    };
+    for (const name of HISTORY_DIRECTORIES) {
+        if (fs_1.default.existsSync(path_1.default.join(dataDirectory, name)))
+            await walk(name);
+    }
+    return files.sort();
+};
+exports.sourceFiles = sourceFiles;
+/** Hashes source content rather than volatile index/WAL bytes for divergence detection. */
+const sourceFingerprint = async (dataDirectory) => {
+    const hash = (0, crypto_1.createHash)('sha256');
+    for (const relative of await (0, exports.sourceFiles)(dataDirectory)) {
+        hash.update(relative);
+        hash.update('\0');
+        const fileHash = (0, crypto_1.createHash)('sha256');
+        for await (const chunk of fs_1.default.createReadStream(path_1.default.join(dataDirectory, relative)))
+            fileHash.update(chunk);
+        hash.update(fileHash.digest());
+    }
+    hash.update((await (0, sourcePresentation_1.readSourcePresentation)(dataDirectory)) ?? '');
+    return hash.digest('hex');
+};
+exports.sourceFingerprint = sourceFingerprint;
+/** Copies durable bytes into staging without modifying or linking source files. */
+const copySourceFiles = async (source, destination) => {
+    for (const relative of await (0, exports.sourceFiles)(source)) {
+        const target = path_1.default.join(destination, relative);
+        await promises_1.default.mkdir(path_1.default.dirname(target), { recursive: true });
+        await promises_1.default.copyFile(path_1.default.join(source, relative), target);
+    }
+};
+exports.copySourceFiles = copySourceFiles;
+/** Reads supported persisted manifests and checks that path and metadata identities agree. */
+const readSourceManifests = async (dataDirectory) => {
+    const manifests = [];
+    for (const relative of await (0, exports.sourceFiles)(dataDirectory)) {
+        const parts = relative.split(path_1.default.sep);
+        if (parts[0] !== 'variants' ||
+            parts.length !== 4 ||
+            parts[3] !== 'manifest.json')
+            continue;
+        if (parts[2].includes('.tmp-'))
+            continue;
+        const raw = JSON.parse(await promises_1.default.readFile(path_1.default.join(dataDirectory, relative), 'utf8'));
+        if (typeof raw !== 'object' ||
+            !raw ||
+            !('schemaVersion' in raw) ||
+            raw.schemaVersion !== 2)
+            throw new Error(`Unsupported history schema in ${relative}`);
+        const parsed = ManifestSchema.parse(raw);
+        if (parsed.sessionId !== parts[1] || parsed.variantId !== parts[2])
+            throw new Error(`History identity mismatch in ${relative}`);
+        manifests.push(parsed);
+    }
+    return manifests;
+};
+exports.readSourceManifests = readSourceManifests;
+/** Resolves artifact paths within their owner and verifies regular files exist. */
+const verifyArtifactFile = async (root, relative) => {
+    const absolute = path_1.default.resolve(root, relative);
+    if (!absolute.startsWith(path_1.default.resolve(root) + path_1.default.sep))
+        throw new Error('Artifact escapes its history directory');
+    if (!(await promises_1.default.stat(absolute)).isFile())
+        throw new Error(`Missing artifact: ${relative}`);
+};
+exports.verifyArtifactFile = verifyArtifactFile;
+/** Relocates managed reference paths while preserving external workspace references. */
+const relocateContext = async (args) => {
+    const sourceContext = path_1.default.join(args.sourceDirectory, 'variant-context');
+    const canonicalContext = fs_1.default.existsSync(sourceContext)
+        ? fs_1.default.realpathSync(sourceContext)
+        : sourceContext;
+    const destinationContext = path_1.default.join(args.bundleDirectory, 'variant-context');
+    const relocate = (value) => {
+        if (typeof value === 'string' && path_1.default.isAbsolute(value)) {
+            let canonical = value;
+            try {
+                canonical = fs_1.default.realpathSync(value);
+            }
+            catch {
+                /* Unavailable external references retain their provenance. */
+            }
+            if (canonical === canonicalContext ||
+                canonical.startsWith(canonicalContext + path_1.default.sep))
+                return path_1.default.join(destinationContext, path_1.default.relative(canonicalContext, canonical));
+        }
+        if (Array.isArray(value))
+            return value.map(relocate);
+        if (value && typeof value === 'object')
+            return Object.fromEntries(Object.entries(value).map(([key, nested]) => [key, relocate(nested)]));
+        return value;
+    };
+    for (const relative of await (0, exports.sourceFiles)(args.sourceDirectory)) {
+        if (!relative.startsWith('variant-context' + path_1.default.sep) ||
+            !relative.endsWith(path_1.default.sep + 'context.json'))
+            continue;
+        const filename = path_1.default.join(args.stageDirectory, relative);
+        const document = JSON.parse(await promises_1.default.readFile(filename, 'utf8'));
+        await promises_1.default.writeFile(filename, JSON.stringify(relocate(document), null, 2) + '\n');
+    }
+};
+exports.relocateContext = relocateContext;
+//# sourceMappingURL=importFiles.js.map

package/dist/library/importFiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"importFiles.js","sourceRoot":"","sources":["../../src/library/importFiles.ts"],"names":[],"mappings":";;;;;;AAAA,8EAA+E;AAC/E,2DAA6B;AAC7B,4CAAwB;AACxB,gDAAwB;AACxB,mCAAoC;AACpC,6BAAwB;AAGxB,MAAM,mBAAmB,GAAG;IAC1B,UAAU;IACV,iBAAiB;IACjB,WAAW;CACH,CAAC;AACX,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,MAAM;IACN,QAAQ;IACR,SAAS;IACT,MAAM;IACN,aAAa;CACd,CAAC,CAAC;AACH,MAAM,MAAM,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;AACpD,MAAM,OAAO,GAAG,OAAC;KACd,MAAM,CAAC,EAAE,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;KAC1E,WAAW,EAAE,CAAC;AACjB,MAAM,cAAc,GAAG,OAAC;KACrB,MAAM,CAAC;IACN,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,MAAM;IACjB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE;IACjB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE;IACjB,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE;IACzB,WAAW,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,OAAC,CAAC,IAAI,CAAC;QACb,WAAW;QACX,WAAW;QACX,UAAU;QACV,WAAW;QACX,SAAS;KACV,CAAC;IACF,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE;IACrB,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE;IAC3B,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACjD,QAAQ,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;IACvE,OAAO,EAAE,OAAC;SACP,MAAM,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;SAC1D,WAAW,EAAE;IAChB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;KAC5C,CAAC,CAAC,QAAQ,EAAE;IACb,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE;IACxB,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,wFAAwF;AACjF,MAAM,WAAW,GAAG,KAAK,EAAE,aAAqB,EAAqB,EAAE;IAC5E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,KAAK,EAAE,QAAgB,EAAiB,EAAE;QACrD,MAAM,QAAQ,GAAG,cAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,kBAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,cAAc,EAAE;YACvB,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;QAC9D,IAAI,QAAQ,KAAK,cAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YACrB,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;QACjE,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,kBAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACvD,IAAI,QAAQ,KAAK,WAAW,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YACxE,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,SAAS;YACrC,MAAM,IAAI,CAAC,cAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACvC,IAAI,YAAM,CAAC,UAAU,CAAC,cAAI,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC,CAAC;AAzBW,QAAA,WAAW,eAyBtB;AAEF,2FAA2F;AACpF,MAAM,iBAAiB,GAAG,KAAK,EACpC,aAAqB,EACJ,EAAE;IACnB,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC;IAClC,KAAK,MAAM,QAAQ,IAAI,MAAM,IAAA,mBAAW,EAAC,aAAa,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClB,MAAM,QAAQ,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,YAAM,CAAC,gBAAgB,CAC/C,cAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CACnC;YACC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,IAAA,2CAAsB,EAAC,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC,CAAC;AAhBW,QAAA,iBAAiB,qBAgB5B;AAEF,mFAAmF;AAC5E,MAAM,eAAe,GAAG,KAAK,EAClC,MAAc,EACd,WAAmB,EACJ,EAAE;IACjB,KAAK,MAAM,QAAQ,IAAI,MAAM,IAAA,mBAAW,EAAC,MAAM,CAAC,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,cAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,kBAAE,CAAC,KAAK,CAAC,cAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,kBAAE,CAAC,QAAQ,CAAC,cAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;AACH,CAAC,CAAC;AATW,QAAA,eAAe,mBAS1B;AAEF,8FAA8F;AACvF,MAAM,mBAAmB,GAAG,KAAK,EACtC,aAAqB,EACc,EAAE;IACrC,MAAM,SAAS,GAA6B,EAAE,CAAC;IAC/C,KAAK,MAAM,QAAQ,IAAI,MAAM,IAAA,mBAAW,EAAC,aAAa,CAAC,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,cAAI,CAAC,GAAG,CAAC,CAAC;QACvC,IACE,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU;YACvB,KAAK,CAAC,MAAM,KAAK,CAAC;YAClB,KAAK,CAAC,CAAC,CAAC,KAAK,eAAe;YAE5B,SAAS;QACX,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACzC,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAC7B,MAAM,kBAAE,CAAC,QAAQ,CAAC,cAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAC9D,CAAC;QACF,IACE,OAAO,GAAG,KAAK,QAAQ;YACvB,CAAC,GAAG;YACJ,CAAC,CAAC,eAAe,IAAI,GAAG,CAAC;YACzB,GAAG,CAAC,aAAa,KAAK,CAAC;YAEvB,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;QAC9D,SAAS,CAAC,IAAI,CAAC,MAA2C,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AA7BW,QAAA,mBAAmB,uBA6B9B;AAEF,mFAAmF;AAC5E,MAAM,kBAAkB,GAAG,KAAK,EACrC,IAAY,EACZ,QAAgB,EACD,EAAE;IACjB,MAAM,QAAQ,GAAG,cAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,cAAI,CAAC,GAAG,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,IAAI,CAAC,CAAC,MAAM,kBAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE;QACrC,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;AACrD,CAAC,CAAC;AATW,QAAA,kBAAkB,sBAS7B;AAEF,wFAAwF;AACjF,MAAM,eAAe,GAAG,KAAK,EAAE,IAIrC,EAAiB,EAAE;IAClB,MAAM,aAAa,GAAG,cAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IACzE,MAAM,gBAAgB,GAAG,YAAM,CAAC,UAAU,CAAC,aAAa,CAAC;QACvD,CAAC,CAAC,YAAM,CAAC,YAAY,CAAC,aAAa,CAAC;QACpC,CAAC,CAAC,aAAa,CAAC;IAClB,MAAM,kBAAkB,GAAG,cAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAW,EAAE;QAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,cAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,IAAI,CAAC;gBACH,SAAS,GAAG,YAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YACzC,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;YAChE,CAAC;YACD,IACE,SAAS,KAAK,gBAAgB;gBAC9B,SAAS,CAAC,UAAU,CAAC,gBAAgB,GAAG,cAAI,CAAC,GAAG,CAAC;gBAEjD,OAAO,cAAI,CAAC,IAAI,CACd,kBAAkB,EAClB,cAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAC3C,CAAC;QACN,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YACpC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CACtE,CAAC;QACJ,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,KAAK,MAAM,QAAQ,IAAI,MAAM,IAAA,mBAAW,EAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;QAC/D,IACE,CAAC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,GAAG,cAAI,CAAC,GAAG,CAAC;YAClD,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAI,CAAC,GAAG,GAAG,cAAc,CAAC;YAE7C,SAAS;QACX,MAAM,QAAQ,GAAG,cAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,kBAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1E,MAAM,kBAAE,CAAC,SAAS,CAChB,QAAQ,EACR,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CACnD,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AA/CW,QAAA,eAAe,mBA+C1B"}

package/dist/routes/account.d.ts

@@ -0,0 +1,4 @@
+import type { TelemetryService } from '../services/TelemetryService';
+/** Serves machine account state and stores or clears browser sign-in credentials. */
+export declare const createAccountRouter: (telemetry?: TelemetryService) => import("express-serve-static-core").Router;
+//# sourceMappingURL=account.d.ts.map

package/dist/routes/account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../src/routes/account.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAMrE,qFAAqF;AACrF,eAAO,MAAM,mBAAmB,GAAI,YAAY,gBAAgB,+CA2C/D,CAAC"}

package/dist/routes/account.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAccountRouter = void 0;
+const express_1 = require("express");
+const ConfigManager_1 = require("../services/ConfigManager");
+const logger_1 = require("../utils/logger");
+const log = (0, logger_1.createLogger)('AccountRoutes');
+/** Serves machine account state and stores or clears browser sign-in credentials. */
+const createAccountRouter = (telemetry) => {
+    const router = (0, express_1.Router)();
+    router.get('/account', (_req, res) => {
+        const config = (0, ConfigManager_1.getConfigManager)();
+        const account = {
+            isAuthenticated: config.isAuthenticated(),
+            email: config.getEmail(),
+            name: config.getDisplayName(),
+            userId: config.getUserId(),
+        };
+        res.json(account);
+    });
+    // Store auth credentials after browser-based OAuth completion.
+    router.post('/auth/store', (req, res) => {
+        const { email, token, refreshToken, userId } = req.body ?? {};
+        if (!email || !token) {
+            return res.status(400).json({ error: 'Missing email or token' });
+        }
+        try {
+            (0, ConfigManager_1.getConfigManager)().setAuth(token, email, refreshToken, userId);
+        }
+        catch {
+            return res
+                .status(500)
+                .json({ error: 'Failed to store auth credentials' });
+        }
+        telemetry?.identifyUser();
+        log.info(`Stored auth for ${email} via browser OAuth`);
+        res.json({ success: true });
+    });
+    router.post('/auth/logout', (_req, res) => {
+        try {
+            (0, ConfigManager_1.getConfigManager)().clearAuth();
+        }
+        catch (error) {
+            log.warn('Logout failed', error);
+            return res.status(500).json({ error: 'Failed to log out' });
+        }
+        log.info('Cleared auth via logout');
+        res.json({ success: true });
+    });
+    return router;
+};
+exports.createAccountRouter = createAccountRouter;
+//# sourceMappingURL=account.js.map

package/dist/routes/account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../../src/routes/account.ts"],"names":[],"mappings":";;;AAAA,qCAAiC;AACjC,6DAA6D;AAG7D,4CAA+C;AAE/C,MAAM,GAAG,GAAG,IAAA,qBAAY,EAAC,eAAe,CAAC,CAAC;AAE1C,qFAAqF;AAC9E,MAAM,mBAAmB,GAAG,CAAC,SAA4B,EAAE,EAAE;IAClE,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IACxB,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACnC,MAAM,MAAM,GAAG,IAAA,gCAAgB,GAAE,CAAC;QAClC,MAAM,OAAO,GAAY;YACvB,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE;YACzC,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE;YACxB,IAAI,EAAE,MAAM,CAAC,cAAc,EAAE;YAC7B,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE;SAC3B,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAC/D,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAC9D,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC;YACH,IAAA,gCAAgB,GAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG;iBACP,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,SAAS,EAAE,YAAY,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,CAAC;QACvD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACxC,IAAI,CAAC;YACH,IAAA,gCAAgB,GAAE,CAAC,SAAS,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;YACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AA3CW,QAAA,mBAAmB,uBA2C9B"}

package/dist/routes/agentVariants.d.ts

@@ -1,3 +1,4 @@
+export { nestedFreshSessionWorkdirs } from '../services/historyRoots';
 import { Router } from 'express';
 import { type AgentVariantsOrchestrator } from '../agent-variants';
 import type { ActiveLeaseMetadata, SessionBridgeService, WatcherLiveness } from '../services/SessionBridgeService';
@@ -17,20 +18,8 @@ import { type InlineStartTracker } from './inlineStartTracker';
 export type VariantPreviewBridgeOptions = {
     isEnabled: boolean;
     expectedParentOrigin?: string;
+    resolveLibraryOrigin?: () => string | undefined;
 };
-/**
- * Fresh sessions scaffold their workdir at `<root>/.rivet/<slug>/` and persist
- * variant history one level deeper (`<slug>/.rivet/variants`, plus the
- * content-addressed `<slug>/.rivet/store.git`). `resolveHistoryProjectPaths`
- * otherwise only walks UP the tree and trusts the live in-memory session's
- * `workspacePath` — so after a Rivet restart, reopening the repo root can't find
- * those nested workdirs and the panel shows zero past directions even though the
- * files are intact. Scan one level of `<projectPath>/.rivet/*` for the tell-tale
- * history markers to rediscover them. Scoped to a single level and gated on the
- * marker so scratch dirs (`.rivet-preview-*`, `mcp-bridge`, a bare `variants`
- * dir) are never mistaken for session workdirs.
- */
-export declare const nestedFreshSessionWorkdirs: (projectPath: string) => string[];
 /**
  * Stamp the live {@link WatcherLiveness} onto a variants snapshot so the UI can
  * detect a stale host-agent watch loop off real queue/waiter state. Applied to

package/dist/routes/agentVariants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agentVariants.d.ts","sourceRoot":"","sources":["../../src/routes/agentVariants.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAA+B,MAAM,SAAS,CAAC;AAG9D,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,mBAAmB,CAAC;AAiB3B,OAAO,KAAK,EACV,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EAChB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,OAAO,EACL,qBAAqB,EAKtB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAEL,sBAAsB,EAEvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAEL,oBAAoB,EACrB,MAAM,kCAAkC,CAAC;AAK1C,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,sBAAsB,CAAC;AAM9B;;;;;;GAMG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC,SAAS,EAAE,OAAO,CAAC;IACnB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAulBF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,GAAI,aAAa,MAAM,KAAG,MAAM,EAmBtE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAC/B,UAAU,OAAO,EACjB,UAAU,eAAe,GAAG,IAAI,EAChC,4BAA4B,MAAM,EAClC,eAAc,mBAAmB,EAAO,KACvC,OAiBF,CAAC;AAEF,eAAO,MAAM,yBAAyB,GACpC,cAAc,yBAAyB,EACvC,SAAS,oBAAoB,EAC7B,YAAY,gBAAgB,EAC5B,yBAAyB,qBAAqB,EAC9C,wBAAwB,sBAAsB,EAC9C,oBAAoB,IAAI,CACtB,iBAAiB,EACjB,sBAAsB,GAAG,0BAA0B,GAAG,kBAAkB,CACzE,EACD,wBAAwB,oBAAoB,EAC5C,gBAAgB,2BAA2B,EAC3C,6BAA6B,kBAAkB,KAC9C,MA8gEF,CAAC"}
+{"version":3,"file":"agentVariants.d.ts","sourceRoot":"","sources":["../../src/routes/agentVariants.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAGtE,OAAO,EAAE,MAAM,EAA+B,MAAM,SAAS,CAAC;AAG9D,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,mBAAmB,CAAC;AAiB3B,OAAO,KAAK,EACV,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EAChB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,OAAO,EACL,qBAAqB,EAKtB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAEL,sBAAsB,EAEvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAEL,oBAAoB,EACrB,MAAM,kCAAkC,CAAC;AAK1C,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,sBAAsB,CAAC;AAM9B;;;;;;GAMG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC,SAAS,EAAE,OAAO,CAAC;IACnB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oBAAoB,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;CACjD,CAAC;AA0lBF;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAC/B,UAAU,OAAO,EACjB,UAAU,eAAe,GAAG,IAAI,EAChC,4BAA4B,MAAM,EAClC,eAAc,mBAAmB,EAAO,KACvC,OAiBF,CAAC;AAEF,eAAO,MAAM,yBAAyB,GACpC,cAAc,yBAAyB,EACvC,SAAS,oBAAoB,EAC7B,YAAY,gBAAgB,EAC5B,yBAAyB,qBAAqB,EAC9C,wBAAwB,sBAAsB,EAC9C,oBAAoB,IAAI,CACtB,iBAAiB,EACjB,sBAAsB,GAAG,0BAA0B,GAAG,kBAAkB,CACzE,EACD,wBAAwB,oBAAoB,EAC5C,gBAAgB,2BAA2B,EAC3C,6BAA6B,kBAAkB,KAC9C,MAghEF,CAAC"}

package/dist/routes/agentVariants.js

@@ -4,6 +4,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createAgentVariantsRouter = exports.stampWatcherLiveness = exports.nestedFreshSessionWorkdirs = void 0;
+const historyRoots_1 = require("../services/historyRoots");
+var historyRoots_2 = require("../services/historyRoots");
+Object.defineProperty(exports, "nestedFreshSessionWorkdirs", { enumerable: true, get: function () { return historyRoots_2.nestedFreshSessionWorkdirs; } });
 const node_fs_1 = __importDefault(require("node:fs"));
 const path_1 = __importDefault(require("path"));
 const express_1 = require("express");
@@ -79,10 +82,10 @@ const PREVIEW_CDN_HOSTS = [
  * (`frame-ancestors 'self' → refused to connect`). See
  * docs/preview-target-addressing-design.md.
  */
-const buildStaticPreviewCsp = (parentFrameOrigin) => {
-    const frameAncestors = parentFrameOrigin
-        ? `'self' ${parentFrameOrigin}`
-        : "'self'";
+const buildStaticPreviewCsp = (parentFrameOrigin, libraryOrigin) => {
+    const frameAncestors = ["'self'", parentFrameOrigin, libraryOrigin]
+        .filter(Boolean)
+        .join(' ');
     return [
         "default-src 'self' data: blob:",
         `script-src 'self' 'unsafe-inline' blob: ${PREVIEW_CDN_HOSTS}`,
@@ -546,41 +549,6 @@ const generatedProjectWorkspaceRoot = (projectPath) => {
     const rootPath = segments.slice(0, rivetIndex).join(path_1.default.sep);
     return path_1.default.resolve(rootPath || path_1.default.parse(normalized).root);
 };
-/**
- * Fresh sessions scaffold their workdir at `<root>/.rivet/<slug>/` and persist
- * variant history one level deeper (`<slug>/.rivet/variants`, plus the
- * content-addressed `<slug>/.rivet/store.git`). `resolveHistoryProjectPaths`
- * otherwise only walks UP the tree and trusts the live in-memory session's
- * `workspacePath` — so after a Rivet restart, reopening the repo root can't find
- * those nested workdirs and the panel shows zero past directions even though the
- * files are intact. Scan one level of `<projectPath>/.rivet/*` for the tell-tale
- * history markers to rediscover them. Scoped to a single level and gated on the
- * marker so scratch dirs (`.rivet-preview-*`, `mcp-bridge`, a bare `variants`
- * dir) are never mistaken for session workdirs.
- */
-const nestedFreshSessionWorkdirs = (projectPath) => {
-    const rivetDir = path_1.default.join(projectPath, '.rivet');
-    let entries;
-    try {
-        entries = node_fs_1.default.readdirSync(rivetDir, { withFileTypes: true });
-    }
-    catch {
-        // No `.rivet/` here (or unreadable) — nothing to rediscover.
-        return [];
-    }
-    const workdirs = [];
-    for (const entry of entries) {
-        if (!entry.isDirectory())
-            continue;
-        const workdir = path_1.default.join(rivetDir, entry.name);
-        const ownsHistory = node_fs_1.default.existsSync(path_1.default.join(workdir, '.rivet', 'variants')) ||
-            node_fs_1.default.existsSync(path_1.default.join(workdir, '.rivet', 'store.git'));
-        if (ownsHistory)
-            workdirs.push(workdir);
-    }
-    return workdirs;
-};
-exports.nestedFreshSessionWorkdirs = nestedFreshSessionWorkdirs;
 /**
  * Stamp the live {@link WatcherLiveness} onto a variants snapshot so the UI can
  * detect a stale host-agent watch loop off real queue/waiter state. Applied to
@@ -699,7 +667,7 @@ const createAgentVariantsRouter = (orchestrator, bridge, telemetry, variantHisto
         for (const scanRoot of [params.projectPath, upwardRoot]) {
             if (!scanRoot)
                 continue;
-            for (const nested of (0, exports.nestedFreshSessionWorkdirs)(scanRoot)) {
+            for (const nested of (0, historyRoots_1.nestedFreshSessionWorkdirs)(scanRoot)) {
                 addCandidate(nested);
             }
         }
@@ -848,7 +816,7 @@ const createAgentVariantsRouter = (orchestrator, bridge, telemetry, variantHisto
         const cacheDir = await variantHistory.store.extractToCache({
             projectPath: args.projectPath,
             treeSha: manifest.tree.treeSha,
-            commitish: manifest.tree.ref,
+            commitish: manifest.tree.commitSha,
         });
         const appDir = resolvePathWithinRoot(cacheDir, manifest.serve.recipe.cwd);
         if (!appDir || !node_fs_1.default.existsSync(path_1.default.join(appDir, 'package.json'))) {
@@ -1361,7 +1329,7 @@ const createAgentVariantsRouter = (orchestrator, bridge, telemetry, variantHisto
             return;
         }
         try {
-            const raw = await variantHistory.metadata.readVariantsUiState(projectPath);
+            const raw = await variantHistory.readVariantsUiState(projectPath);
             let stored = null;
             if (raw) {
                 try {
@@ -1401,7 +1369,7 @@ const createAgentVariantsRouter = (orchestrator, bridge, telemetry, variantHisto
             return;
         }
         try {
-            await variantHistory.metadata.writeVariantsUiState(projectPath, JSON.stringify(parsed.data.uiState));
+            await variantHistory.writeVariantsUiState(projectPath, JSON.stringify(parsed.data.uiState));
             res.json({ projectPath, uiState: parsed.data.uiState });
         }
         catch (err) {
@@ -1827,7 +1795,7 @@ const createAgentVariantsRouter = (orchestrator, bridge, telemetry, variantHisto
                 .status(200)
                 .type('html')
                 .set('Cache-Control', 'no-store')
-                .set('Content-Security-Policy', buildStaticPreviewCsp(previewBridge?.expectedParentOrigin))
+                .set('Content-Security-Policy', buildStaticPreviewCsp(previewBridge?.expectedParentOrigin, previewBridge?.resolveLibraryOrigin?.()))
                 .set('X-Content-Type-Options', 'nosniff')
                 .send(finalHtml);
         }
@@ -2544,7 +2512,7 @@ const serveHistoryPreview = async (req, res, variantHistory, resolveProjectPath,
         if (/\.html?$/i.test(file.relativePath)) {
             const html = file.body.toString('utf8');
             res
-                .set('Content-Security-Policy', buildStaticPreviewCsp(previewBridge?.expectedParentOrigin))
+                .set('Content-Security-Policy', buildStaticPreviewCsp(previewBridge?.expectedParentOrigin, previewBridge?.resolveLibraryOrigin?.()))
                 .set('X-Content-Type-Options', 'nosniff');
             // Embedded mode drives this snapshot iframe over the preview bridge; the
             // listener must be present or selecting/commenting on a past variant