slidemind 0.3.20 → 0.4.1

package/src/bridge/client/engine-routing.mjs

@@ -23,7 +23,7 @@
 
 import { deriveEnvLabel } from "../config.mjs";
 import { getDesignBundleForBrand, getDesignBundleForBrandAnyBackend } from "./brands.mjs";
-import { isSessionInvalidError, sessionsInScope, bridgeFetch, backendCapabilitiesResult, backendSupportsEngineRoutes } from "./transport.mjs";
+import { isSessionInvalidError, sessionsInScope, bridgeFetch, backendCapabilitiesResult, backendSupportsEngineRoutes, capabilityUnknownError } from "./transport.mjs";
 
 export function searchRoute(searchId, suffix = "") {
   return `/api/cli/searches/${encodeURIComponent(String(searchId))}${suffix}`;
@@ -86,11 +86,12 @@ export async function resolveSearchBackend(searchId) {
   if (!isOpaqueSearchId(searchId)) return null;
   const failures = [];
   for (const s of sessionsInScope()) {
-    // A revoked session 401s the capability probe too, and that answer is
-    // indistinguishable from "old add-in" unless the failure is kept.
+    // A probe that got no answer (a revoked session 401s it; a slow relay
+    // times it out) says nothing about whether THIS environment holds the
+    // record — keep the failure, so "search expired" is never said for it.
     const probe = await backendCapabilitiesResult(s.backendURL);
-    if (probe.error && isSessionInvalidError(probe.error)) {
-      failures.push(probe.error);
+    if (probe.status === "unknown") {
+      failures.push(capabilityUnknownError(s.backendURL, probe));
       continue;
     }
     if (probe.caps?.engineRoutes !== true) continue;
@@ -112,6 +113,10 @@ export async function resolveSearchBackend(searchId) {
     (e) => isSessionInvalidError(e) || e?.code === "login_required",
   );
   if (blocking) throw blocking;
+  // An environment whose capabilities could not be read may well hold the
+  // record: that is a retryable failure, not an expiry.
+  const unknown = failures.find((e) => e?.code === "capability_unknown");
+  if (unknown) throw unknown;
   return null;
 }
 
@@ -126,17 +131,37 @@ export async function resolveSearchBackend(searchId) {
 // the design does the caller fall back to the pane relay (the design lives on
 // an older add-in, and searching a different corpus would fold ITS slides into
 // this deck). Returns null for that fallback and when nothing paired serves the
-// routes at all.
+// routes at all — and only when that is KNOWN: an environment whose capability
+// probe got no answer throws `capability_unknown` (retryable, see
+// transport.backendCapabilities) rather than being counted as an old add-in.
+// The pane relay is the path for an add-in without the routes, never for a
+// request that timed out (x103).
+//
+// That unanswered probe is thrown only when the answer DEPENDS on it. A
+// candidate that serves the deck's design wins outright whatever the silent
+// environment would have said, so a stopped `local` must not block a deck
+// bound to `dev` (2026-10-11). Where it could have changed the pick (no
+// candidate at all, no candidate serving the design, a sole candidate that
+// might have had a rival), guessing would search another corpus, so it throws.
 export async function resolveEngineBackend({ backendURL = null, brandId = null } = {}) {
   if (backendURL) {
     return (await backendSupportsEngineRoutes(backendURL)) ? backendURL : null;
   }
   const sessions = sessionsInScope();
   const candidates = [];
+  const unanswered = [];
   for (const s of sessions) {
-    if (await backendSupportsEngineRoutes(s.backendURL)) candidates.push(s.backendURL);
+    try {
+      if (await backendSupportsEngineRoutes(s.backendURL)) candidates.push(s.backendURL);
+    } catch (err) {
+      unanswered.push({ backendURL: s.backendURL, err });
+    }
   }
-  if (candidates.length === 0) return null;
+  const unlessUnanswered = (answer) => {
+    if (unanswered.length) throw unanswered[0].err;
+    return answer;
+  };
+  if (candidates.length === 0) return unlessUnanswered(null);
   // Exactly one CONNECTED environment: there is nothing else the deck could
   // belong to. Note the test is on the sessions, not on the candidates — during
   // a rollout only one of several environments serves the routes, and taking it
@@ -145,7 +170,7 @@ export async function resolveEngineBackend({ backendURL = null, brandId = null }
   if (brandId) {
     // The memo only stands while that environment is still a candidate.
     const memo = engineBackendForBrand.get(brandId);
-    if (memo) return candidates.includes(memo) ? memo : null;
+    if (memo) return candidates.includes(memo) ? memo : unlessUnanswered(null);
     // Candidates first: an environment that serves both the design AND the
     // engine routes wins outright, even when an older environment also has the
     // (content-identical) design.
@@ -158,6 +183,8 @@ export async function resolveEngineBackend({ backendURL = null, brandId = null }
         // This candidate doesn't serve the design — try the next.
       }
     }
+    // The silent environment may be the candidate that serves it.
+    unlessUnanswered();
     try {
       const { backendURL: be } = await getDesignBundleForBrandAnyBackend(brandId);
       engineBackendForBrand.set(brandId, be);
@@ -170,7 +197,7 @@ export async function resolveEngineBackend({ backendURL = null, brandId = null }
       // rather than guessing an environment.
     }
   }
-  if (candidates.length === 1) return candidates[0];
+  if (candidates.length === 1) return unlessUnanswered(candidates[0]);
   const err = new Error(
     `Several connected environments run engine search (${candidates
       .map((u) => deriveEnvLabel(u))
@@ -186,16 +213,24 @@ export async function resolveEngineBackend({ backendURL = null, brandId = null }
 // "backend authoring ready" half of the readiness picture (`doctor`, `ready`),
 // reported as ENV LABELS so no URL can reach a printed line. Pass
 // connectionStatus()'s `backends` to skip environments that are already known
-// unreachable; without it every session in scope is probed.
+// unreachable; without it every session in scope is probed. An environment
+// whose probe got no answer is listed under `unknown`, not under "no routes":
+// a readiness report must not call a slow relay an old add-in.
 export async function engineReachability({ backends = null } = {}) {
   const urls = Array.isArray(backends)
     ? backends.filter((b) => b?.ok && b.backendURL).map((b) => b.backendURL)
     : sessionsInScope().map((s) => s.backendURL);
   const envs = [];
+  const unknown = [];
   for (const url of urls) {
-    if (await backendSupportsEngineRoutes(url)) envs.push(deriveEnvLabel(url));
+    try {
+      if (await backendSupportsEngineRoutes(url)) envs.push(deriveEnvLabel(url));
+    } catch (err) {
+      if (err?.code !== "capability_unknown") throw err;
+      unknown.push(deriveEnvLabel(url));
+    }
   }
-  return { available: envs.length > 0, envs };
+  return { available: envs.length > 0, envs, unknown };
 }
 
 // Resolve + verify the backend for a direct engine call. Throws a typed

package/src/bridge/client/engine-search.mjs

@@ -4,7 +4,7 @@ import { deriveEnvLabel } from "../config.mjs";
 import { assertSearchId, downloadTimeoutMs, resultRoute, directEngineBackend } from "./engine-routing.mjs";
 import { pickAnyPresentationEntry } from "./pane-ops.mjs";
 import { resolveBackendForPres, engineOpWithPaneWait } from "./presentations.mjs";
-import { engineTimeoutMs, bridgeFetch, bridgeStreamToFile, envInt, delegatedBodyFields, graphHeaders } from "./transport.mjs";
+import { engineTimeoutMs, bridgeFetch, bridgeStreamToFile, envInt, delegatedBodyFields, graphHeaders, backendCapabilities } from "./transport.mjs";
 
 // Brand-engine search through the local bridge. New add-ins run this
 // server-side with the relayed user token; older add-ins may fall back to a
@@ -308,3 +308,26 @@ export async function engineDownloadToFile({
     return shape(res);
   });
 }
+
+// The collage reader behind `transcribe`'s icon fetch: each item is a motif plus
+// the numbered contact sheet (`gridDataUri`) its search returned; the answer is
+// one 1-based selection, or null for "nothing here shows it", per item. Null
+// when the backend does not offer it (no `assetPicks` capability) — the caller
+// then decides by file name alone.
+export async function pickAssets({ items, backendURL }) {
+  const caps = await backendCapabilities(backendURL);
+  if (caps?.assetPicks !== true) return null;
+  if (!items.length) return [];
+  const res = await bridgeFetch(
+    "/api/cli/asset-picks",
+    {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ items }),
+      timeoutMs: engineTimeoutMs(),
+    },
+    backendURL,
+  );
+  const data = (await res.json()) ?? {};
+  return Array.isArray(data.picks) ? data.picks : null;
+}

package/src/bridge/client/render.mjs

@@ -9,7 +9,14 @@
 //      for older backends that don't serve /api/cli/capabilities yet.
 
 import { resolveBackendForPres } from "./presentations.mjs";
-import { bridgeFetch, envInt, sleep, backendSupportsRenderJobs, assertCliVersionSupported } from "./transport.mjs";
+import {
+  bridgeFetch,
+  envInt,
+  sleep,
+  backendSupportsRenderJobs,
+  assertCliVersionSupported,
+  assertImageIntentSupported,
+} from "./transport.mjs";
 
 // Rebuild a job failure into the exact error shape bridgeFetch throws for the
 // sync route, so callers (etag self-heal, error texts) can't tell the
@@ -197,6 +204,7 @@ export async function renderPptx({
   sourceGuids = null,
   conversions = null,
   reconcile = null,
+  imageIntent = null,
   backendURL = null,
   onProgress = null,
 }) {
@@ -217,6 +225,10 @@ export async function renderPptx({
   // speaks this CLI's contract fails deep and confusingly; fail here instead
   // with the actionable `slidemind update`.
   await assertCliVersionSupported(be);
+  // And, when this deck carries approved image obligations, the contract that
+  // enforces them. Before the upload, so an old add-in costs a capability probe
+  // rather than a render that silently drops the user's picture.
+  if (imageIntent) await assertImageIntentSupported(be);
   const basePath = renderBasePath({ presId, brandId });
   const label = brandId ? (deckName ?? brandId) : presId;
   const body = { slides: slides ?? {} };
@@ -251,6 +263,14 @@ export async function renderPptx({
   if (reconcile && Object.keys(reconcile).length > 0) {
     body.reconcile = reconcile;
   }
+  // The deck's approved image obligations (src/bridge/image-intent-envelope.mjs).
+  // Its asset descriptors carry `workspacePath`, not bytes: those bytes are
+  // already in `deckAssets` above under that exact key, so the envelope points
+  // at them instead of shipping every screenshot twice. It also travels when the
+  // JSX forgot to bind a use — that is the whole point of validating against
+  // expectations rather than against the JSX. Additive: a deck with no image
+  // uses sends the same body it always did.
+  if (imageIntent) body.imageIntent = imageIntent;
   // The brand surface has no presId to label the render with — pass the deck
   // slug so job records/temp dirs stay readable (server-side sanitized).
   if (brandId && deckName) body.deckName = deckName;
@@ -278,6 +298,7 @@ export async function translateDeck({
   captured,
   nativeSlides = null,
   etag = null,
+  imageIntent = null,
   backendURL = null,
 }) {
   if (!presId && !brandId) {
@@ -290,6 +311,7 @@ export async function translateDeck({
     be = await resolveBackendForPres(presId);
   }
   await assertCliVersionSupported(be);
+  if (imageIntent) await assertImageIntentSupported(be);
   const body = { captured };
   // Reused native one-slide .pptx (base64), keyed by play-order filename — the
   // server splices them in alongside the locally-captured JSX slides (contract
@@ -298,6 +320,10 @@ export async function translateDeck({
     body.nativeSlides = nativeSlides;
   }
   if (etag) body.etag = etag;
+  // Same envelope as the render route: expected image obligations, descriptors
+  // pointing into the captured deck's own asset bytes. Both routes have to
+  // enforce the same thing, so both carry the same expectations.
+  if (imageIntent) body.imageIntent = imageIntent;
   if (brandId && deckName) body.deckName = deckName;
   const res = await bridgeFetch(
     `${renderBasePath({ presId, brandId })}/translate`,