thinkpool-pair 0.7.364 → 0.7.366

package/cumulative-event-relay.mjs

@@ -1,53 +1 @@
-// Cumulative provider snapshots are replace-in-place UI state, not transcript
-// facts. Deliver the first immediately and coalesce a burst to its latest frame;
-// any durable event flushes the pending snapshot first to preserve wire order.
-//
-// 75ms is a readable 13.3fps ceiling: quick enough for an active reply without
-// turning every provider delta into a realtime broadcast or a full UI repaint.
-export const CUMULATIVE_EVENT_RELAY_WAIT_MS = 75
-
-export function createCumulativeEventRelay(emit, waitMs = CUMULATIVE_EVENT_RELAY_WAIT_MS) {
-  let lastSentAt = 0
-  let pending = null
-  let timer = null
-
-  const send = (event) => {
-    lastSentAt = Date.now()
-    emit(event)
-  }
-  const flush = () => {
-    if (timer) clearTimeout(timer)
-    timer = null
-    if (!pending) return
-    const event = pending
-    pending = null
-    send(event)
-  }
-  const relay = (event) => {
-    if (event?.kind !== 'assistant_stream') {
-      flush()
-      emit(event)
-      return
-    }
-    const remaining = waitMs - (Date.now() - lastSentAt)
-    if (!lastSentAt || remaining <= 0) {
-      pending = null
-      if (timer) clearTimeout(timer)
-      timer = null
-      send(event)
-      return
-    }
-    pending = event
-    if (!timer) {
-      timer = setTimeout(flush, remaining)
-      timer.unref?.()
-    }
-  }
-  relay.flush = flush
-  relay.cancel = () => {
-    if (timer) clearTimeout(timer)
-    timer = null
-    pending = null
-  }
-  return relay
-}
+export const CUMULATIVE_EVENT_RELAY_WAIT_MS=75;export function createCumulativeEventRelay(e,n=75){let t=0,l=null,u=null;const r=n=>{t=Date.now(),e(n)},o=()=>{if(u&&clearTimeout(u),u=null,!l)return;const e=l;l=null,r(e)},i=i=>{if("assistant_stream"!==i?.kind)return o(),void e(i);const a=n-(Date.now()-t);if(!t||a<=0)return l=null,u&&clearTimeout(u),u=null,void r(i);l=i,u||(u=setTimeout(o,a),u.unref?.())};return i.flush=o,i.cancel=()=>{u&&clearTimeout(u),u=null,l=null},i}

package/design-edit.mjs

@@ -1,424 +1 @@
-import crypto from 'node:crypto'
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import {
-  DESIGN_SOURCE_MAP_RELATIVE,
-  DESIGN_SOURCE_MAP_VERSION,
-  MAX_DESIGN_SOURCE_ENTRIES,
-  MAX_DESIGN_SOURCE_MAP_BYTES,
-} from './design-source-contract.mjs'
-
-const MAX_SOURCE_BYTES = 2 * 1024 * 1024
-const MAX_INTENT = 2_000
-const MAX_TEXT = 4_000
-const MAX_BATCH_EDITS = 8
-const GENERATED_SOURCE_PARTS = new Set(['dist', 'build', '.next', '.git', 'coverage', 'node_modules'])
-
-const clean = (value, max) => String(value ?? '').replace(/\0/g, '').trim().slice(0, max)
-const isInside = (parent, child) => {
-  const rel = path.relative(parent, child)
-  return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel))
-}
-
-// supabase-js does not copy the Auth session into an already-created Realtime
-// client. Private tpdesign:* joins therefore need the bridge owner's JWT pinned
-// explicitly, both at boot and whenever the account supervisor rotates it.
-export async function syncRealtimeAuth(client, accessToken, fallbackToken = null) {
-  const token = accessToken || fallbackToken
-  if (!token || typeof client?.realtime?.setAuth !== 'function') return false
-  try {
-    await client.realtime.setAuth(token)
-    return true
-  } catch {
-    return false
-  }
-}
-
-export function sourceRevision(source) {
-  return crypto.createHash('sha256').update(String(source)).digest('hex').slice(0, 24)
-}
-
-export function resolveDesignSourceMap(file, previewRoot, workspaceRoot) {
-  if (!file || !previewRoot || !workspaceRoot) return null
-  let sourceMapPath, expectedSourceMapPath, builtRoot, root, raw, parsed
-  try {
-    sourceMapPath = fs.realpathSync(file)
-    builtRoot = fs.realpathSync(previewRoot)
-    expectedSourceMapPath = fs.realpathSync(path.join(builtRoot, DESIGN_SOURCE_MAP_RELATIVE))
-    root = fs.realpathSync(workspaceRoot)
-    const stat = fs.statSync(sourceMapPath)
-    if (!stat.isFile() || stat.size <= 0 || stat.size > MAX_DESIGN_SOURCE_MAP_BYTES) return null
-    if (sourceMapPath !== expectedSourceMapPath || !isInside(root, builtRoot) || !isInside(builtRoot, sourceMapPath)) return null
-    raw = fs.readFileSync(sourceMapPath, 'utf8')
-    parsed = JSON.parse(raw)
-  } catch { return null }
-  if (parsed?.version !== DESIGN_SOURCE_MAP_VERSION || !parsed.entries || typeof parsed.entries !== 'object' || Array.isArray(parsed.entries)) return null
-  const rows = Object.entries(parsed.entries)
-  if (rows.length > MAX_DESIGN_SOURCE_ENTRIES) return null
-
-  const files = new Map()
-  const entries = new Map()
-  for (const [sourceId, value] of rows) {
-    if (!/^[A-Za-z0-9_-]{8,80}$/.test(sourceId) || !value || typeof value !== 'object') return null
-    const relative = clean(value.file, 700)
-    if (!relative || path.isAbsolute(relative) || relative.split(/[\\/]/).some((part) => part === '..' || GENERATED_SOURCE_PARTS.has(part))) return null
-    let sourcePath = files.get(relative)
-    if (!sourcePath) {
-      try {
-        sourcePath = fs.realpathSync(path.resolve(root, relative))
-        const stat = fs.statSync(sourcePath)
-        if (!stat.isFile() || stat.size > MAX_SOURCE_BYTES || !isInside(root, sourcePath)) return null
-      } catch { return null }
-      files.set(relative, sourcePath)
-    }
-    const start = Number(value.start)
-    const end = Number(value.end)
-    const line = Number(value.line)
-    const column = Number(value.column)
-    const tag = clean(value.tag, 40).toLowerCase()
-    const fileHash = clean(value.fileHash, 64).toLowerCase()
-    if (![start, end, line, column].every(Number.isSafeInteger) || start < 0 || end <= start || line < 1 || column < 0) return null
-    if (!/^[a-z][a-z0-9:-]*$/.test(tag) || !/^[a-f0-9]{24}$/.test(fileHash)) return null
-    entries.set(sourceId, { sourceId, file: relative.split(path.sep).join('/'), sourcePath, start, end, line, column, tag, fileHash })
-  }
-  return { path: sourceMapPath, revision: sourceRevision(raw), buildId: clean(parsed.buildId, 80), entries }
-}
-
-export function resolveDesignSource(file, workspaceRoot) {
-  if (!file || !workspaceRoot) return null
-  let sourcePath, root
-  try {
-    sourcePath = fs.realpathSync(file)
-    root = fs.realpathSync(workspaceRoot)
-    const stat = fs.statSync(sourcePath)
-    if (!stat.isFile() || stat.size > MAX_SOURCE_BYTES) return null
-  } catch { return null }
-  const rel = path.relative(root, sourcePath)
-  if (!rel || rel.startsWith('..') || path.isAbsolute(rel) || path.extname(sourcePath).toLowerCase() !== '.html') return null
-  // Generated bundles are evidence, not editable source. The agent may only receive
-  // an exact authored HTML artifact; it must never be pointed at dist output.
-  if (rel.split(path.sep).some((part) => ['dist', 'build', '.next', '.git', 'coverage', 'node_modules'].includes(part))) return null
-  const source = fs.readFileSync(sourcePath, 'utf8')
-  const revision = sourceRevision(source)
-  const previewId = crypto.createHash('sha256')
-    .update(`${sourcePath}\0${revision}`)
-    .digest('base64url').slice(0, 32)
-  return { previewId, revision, sourcePath, workspaceRoot: root, source }
-}
-
-export function resolvePreviewDesignSource(manifest, workspaceRoot, box) {
-  if (!manifest || manifest.sourceKind !== 'preview' || !manifest.snapshot || !workspaceRoot || !box) return null
-  let sourcePath, root, outbox
-  try {
-    sourcePath = fs.realpathSync(manifest.snapshot)
-    root = fs.realpathSync(workspaceRoot)
-    outbox = fs.realpathSync(box)
-    const stat = fs.statSync(sourcePath)
-    if (!stat.isFile() || stat.size > MAX_SOURCE_BYTES) return null
-  } catch { return null }
-  const rel = path.relative(outbox, sourcePath)
-  if (!rel || rel.startsWith('..') || path.isAbsolute(rel) || path.extname(sourcePath).toLowerCase() !== '.html') return null
-  const route = clean(manifest.route || '/', 500)
-  const previewRoot = clean(manifest.previewRoot || 'dist', 500)
-  const captureKey = clean(manifest.captureKey, 1000)
-  if (!route.startsWith('/') || !captureKey || captureKey !== JSON.stringify([previewRoot, route])) return null
-  const source = fs.readFileSync(sourcePath, 'utf8')
-  let builtRoot = null
-  try {
-    builtRoot = fs.realpathSync(path.resolve(root, previewRoot))
-    if (!isInside(root, builtRoot)) return null
-  } catch { return null }
-  const sourceMap = manifest.sourceMap ? resolveDesignSourceMap(manifest.sourceMap, builtRoot, root) : null
-  const revision = sourceRevision(sourceMap ? `${source}\0${sourceMap.revision}` : source)
-  const previewId = crypto.createHash('sha256')
-    .update(`${root}\0${captureKey}\0${revision}`)
-    .digest('base64url').slice(0, 32)
-  return {
-    sourceKind: 'preview', previewId, revision, sourcePath, workspaceRoot: root, source, outbox,
-    route, previewRoot, captureKey, sourceMap, sourceMapPath: sourceMap?.path || null,
-    sourceMapDeclared: !!manifest.sourceMap,
-  }
-}
-
-// Older lane worktrees predate the explicit `source` manifest field and emit the
-// authored mockup path as `html` only. Preserve the explicit field when present;
-// otherwise let the same containment/generated-output checks decide whether the
-// HTML path is canonical editable source or view-only render evidence.
-export function resolveManifestDesignSource(manifest, workspaceRoot, { box } = {}) {
-  if (!manifest || typeof manifest !== 'object') return null
-  if (manifest.sourceKind === 'preview') return resolvePreviewDesignSource(manifest, workspaceRoot, box)
-  return resolveDesignSource(manifest.source || manifest.html, workspaceRoot)
-}
-
-// Authored mockups keep two representations: the canonical workspace source the
-// producing lane edits, and a settled inert DOM snapshot the Design viewer shows.
-// Snapshot paths are accepted only from this lane's private outbox so a crafted
-// manifest cannot upload an arbitrary host file as room-visible HTML.
-export function resolveManifestDisplaySource(manifest, record, { box } = {}) {
-  if (!record) return null
-  if (record.sourceKind === 'preview' || !manifest?.snapshot) return record.source
-  let snapshotPath, outbox
-  try {
-    snapshotPath = fs.realpathSync(manifest.snapshot)
-    outbox = fs.realpathSync(box)
-    const stat = fs.statSync(snapshotPath)
-    if (!stat.isFile() || stat.size > MAX_SOURCE_BYTES) return null
-  } catch { return null }
-  const rel = path.relative(outbox, snapshotPath)
-  if (!rel || rel.startsWith('..') || path.isAbsolute(rel) || path.extname(snapshotPath).toLowerCase() !== '.html') return null
-  return fs.readFileSync(snapshotPath, 'utf8')
-}
-
-export function refreshDesignSource(record) {
-  if (!record) return null
-  if (record.sourceKind !== 'preview') return resolveDesignSource(record.sourcePath, record.workspaceRoot)
-  return resolvePreviewDesignSource({
-    sourceKind: 'preview', snapshot: record.sourcePath, route: record.route,
-    previewRoot: record.previewRoot, captureKey: record.captureKey, sourceMap: record.sourceMapPath,
-  }, record.workspaceRoot, record.outbox)
-}
-
-// Design provenance is intentionally host-only, but it must survive a bridge
-// restart. Rebuild the in-memory registry from manifests already written by the
-// trusted lane render workflow; do not re-upload or re-broadcast old cards.
-export function restoreDesignSources(box, workspaceRoot, term, limit = 100) {
-  if (!box || !workspaceRoot || !term) return []
-  let files
-  try {
-    files = fs.readdirSync(box, { withFileTypes: true })
-      .filter((entry) => entry.isFile() && entry.name.endsWith('.json') && !entry.name.endsWith('.receipt.json'))
-      .map((entry) => {
-        const file = path.join(box, entry.name)
-        return { file, mtimeMs: fs.statSync(file).mtimeMs }
-      })
-      .sort((a, b) => b.mtimeMs - a.mtimeMs)
-      .slice(0, Math.max(0, limit))
-  } catch { return [] }
-  const restored = []
-  for (const { file } of files) {
-    try {
-      const manifest = JSON.parse(fs.readFileSync(file, 'utf8'))
-      const record = resolveManifestDesignSource(manifest, workspaceRoot, { box })
-      if (!record) continue
-      Object.assign(record, {
-        term,
-        slug: String(manifest.slug || ''),
-        title: String(manifest.title || manifest.slug || ''),
-        desktop: manifest.desktop || null,
-        mobile: manifest.mobile || null,
-      })
-      const backupPath = path.join(box, '.design-revisions', `${record.revision}.html`)
-      if (fs.existsSync(backupPath)) record.backupPath = backupPath
-      restored.push(record)
-    } catch { /* stale or malformed manifests are ignored */ }
-  }
-  return restored
-}
-
-function safeTarget(value) {
-  if (!value || typeof value !== 'object') return null
-  const rect = value.rect && typeof value.rect === 'object' ? {
-    x: Number(value.rect.x) || 0,
-    y: Number(value.rect.y) || 0,
-    width: Math.max(0, Number(value.rect.width) || 0),
-    height: Math.max(0, Number(value.rect.height) || 0),
-  } : null
-  return {
-    selector: clean(value.selector, 600),
-    xpath: clean(value.xpath, 600),
-    tag: clean(value.tag, 40).toLowerCase(),
-    role: clean(value.role, 80),
-    name: clean(value.name, 240),
-    text: clean(value.text, MAX_TEXT),
-    canEditText: value.canEditText === true,
-    canReplaceImage: value.canReplaceImage === true,
-    nodeKey: clean(value.nodeKey, 80),
-    parentNodeKey: clean(value.parentNodeKey, 80),
-    sourceId: clean(value.sourceId, 80),
-    parentSourceId: clean(value.parentSourceId, 80),
-    rect,
-  }
-}
-
-export function resolveRequestSourceIdentity(record, target) {
-  if (!target?.sourceId) return { ok: true, identity: null }
-  const entry = record?.sourceMap?.entries?.get(target.sourceId)
-  if (!entry) return { ok: false, error: record?.sourceMapDeclared ? 'stale-source-identity' : 'source-identity-unavailable' }
-  if (target.tag && entry.tag !== target.tag) return { ok: false, error: 'source-identity-mismatch' }
-  let source
-  try { source = fs.readFileSync(entry.sourcePath, 'utf8') } catch { return { ok: false, error: 'stale-source-identity' } }
-  if (sourceRevision(source) !== entry.fileHash) return { ok: false, error: 'stale-source-identity' }
-  return {
-    ok: true,
-    identity: {
-      sourceId: entry.sourceId,
-      file: entry.file,
-      start: entry.start,
-      end: entry.end,
-      line: entry.line,
-      column: entry.column,
-      tag: entry.tag,
-      fileHash: entry.fileHash,
-    },
-  }
-}
-
-function safeMovement(value) {
-  if (!value || typeof value !== 'object') return null
-  const fromIndex = Number(value.fromIndex)
-  const toIndex = Number(value.toIndex)
-  if (![fromIndex, toIndex].every(Number.isSafeInteger) || fromIndex < 0 || toIndex < 0 || fromIndex > 499 || toIndex > 499) return null
-  return { fromIndex, toIndex }
-}
-
-function safeAsset(value, room) {
-  if (!value || typeof value !== 'object') return null
-  const asset = {
-    path: clean(value.path, 700),
-    name: clean(value.name, 240),
-    mediaType: clean(value.mediaType, 120).toLowerCase(),
-    size: Number(value.size),
-  }
-  const prefix = room ? `code/${String(room).toUpperCase()}/design-drafts/` : 'code/'
-  if (!asset.path.startsWith(prefix) || asset.path.split('/').includes('..') || !asset.mediaType.startsWith('image/')) return null
-  if (!Number.isSafeInteger(asset.size) || asset.size <= 0 || asset.size > 10 * 1024 * 1024) return null
-  return asset
-}
-
-export function validateDesignRequest(payload, registry, room = '') {
-  if (!payload || typeof payload !== 'object') return { ok: false, error: 'invalid-request' }
-  const previewId = clean(payload.previewId, 64)
-  const record = registry.get(previewId)
-  if (!record) return { ok: false, error: 'preview-unavailable' }
-  if (clean(payload.revision, 64) !== record.revision) return { ok: false, error: 'stale-preview' }
-  const target = safeTarget(payload.target)
-  if (!target?.selector && !target?.xpath) return { ok: false, error: 'select-an-element' }
-  const mode = ['text', 'prompt', 'move', 'image'].includes(payload.mode) ? payload.mode : null
-  if (!mode) return { ok: false, error: 'invalid-mode' }
-  const intent = clean(payload.intent, mode === 'text' ? MAX_TEXT : MAX_INTENT)
-  if (['text', 'prompt'].includes(mode) && !intent) return { ok: false, error: mode === 'text' ? 'enter-text' : 'describe-change' }
-  if (mode === 'text' && !target.canEditText) return { ok: false, error: 'text-edit-not-safe' }
-  const movement = mode === 'move' ? safeMovement(payload.movement) : null
-  if (mode === 'move' && (!movement || movement.fromIndex === movement.toIndex)) return { ok: false, error: 'invalid-move' }
-  const asset = mode === 'image' ? safeAsset(payload.asset, room) : null
-  if (mode === 'image' && (!target.canReplaceImage || !asset)) return { ok: false, error: 'invalid-image' }
-  const source = resolveRequestSourceIdentity(record, target)
-  if (!source.ok) return source
-  return {
-    ok: true,
-    record,
-    request: {
-      previewId, revision: record.revision, mode, intent, target, movement, asset,
-      sourceIdentity: source.identity, cid: clean(payload.cid, 80),
-    },
-  }
-}
-
-export function validateDesignBatchRequest(payload, registry, room = '') {
-  if (!payload || typeof payload !== 'object' || !Array.isArray(payload.edits)) return validateDesignRequest(payload, registry, room)
-  if (payload.edits.length < 1 || payload.edits.length > MAX_BATCH_EDITS) return { ok: false, error: 'invalid-batch' }
-  const previewId = clean(payload.previewId, 64)
-  const revision = clean(payload.revision, 64)
-  const cid = clean(payload.cid, 80)
-  const edits = []
-  const targets = new Set()
-  let record = null
-  for (let index = 0; index < payload.edits.length; index++) {
-    const verdict = validateDesignRequest({ ...payload.edits[index], previewId, revision, cid }, registry, room)
-    if (!verdict.ok) return { ...verdict, editIndex: index }
-    const targetKey = verdict.request.target.sourceId || verdict.request.target.nodeKey || verdict.request.target.selector || verdict.request.target.xpath
-    if (targets.has(targetKey)) return { ok: false, error: 'duplicate-target', editIndex: index }
-    targets.add(targetKey)
-    record = verdict.record
-    edits.push(verdict.request)
-  }
-  return { ok: true, record, request: { previewId, revision: record.revision, mode: 'batch', edits, cid } }
-}
-
-export async function deleteDesignAssetDraft({ webBase, token, room, path: assetPath, fetcher = fetch }) {
-  if (!webBase || !token || !room || !assetPath) return false
-  const response = await fetcher(`${String(webBase).replace(/\/$/, '')}/api/code-design-draft`, {
-    method: 'DELETE',
-    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
-    body: JSON.stringify({ code: room, path: assetPath }),
-  }).catch(() => null)
-  return !!response?.ok
-}
-
-export async function materializeDesignAsset({ webBase, token, room, asset, requestId, cleanup = true, fetcher = fetch }) {
-  if (!webBase || !token || !room || !asset?.path || !requestId) return null
-  const headers = { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` }
-  const signed = await fetcher(`${String(webBase).replace(/\/$/, '')}/api/code-attachment-url`, {
-    method: 'POST',
-    headers,
-    body: JSON.stringify({ code: room, path: asset.path }),
-  })
-  if (!signed.ok) return null
-  const { url } = await signed.json()
-  if (!url) return null
-  const response = await fetcher(url)
-  if (!response.ok) return null
-  const data = Buffer.from(await response.arrayBuffer())
-  if (!data.length || data.length > 10 * 1024 * 1024) return null
-  const ext = path.extname(asset.name).replace(/[^.a-zA-Z0-9]/g, '').slice(0, 9) || '.img'
-  const dir = path.join(os.tmpdir(), 'thinkpool-design-assets')
-  const file = path.join(dir, `${clean(requestId, 80)}${ext}`)
-  fs.mkdirSync(dir, { recursive: true })
-  fs.writeFileSync(file, data)
-  if (cleanup) await deleteDesignAssetDraft({ webBase, token, room, path: asset.path, fetcher })
-  return file
-}
-
-function designAction(request) {
-  if (request.mode === 'text') return `Replace only this element's visible text with:\n${request.intent}`
-  if (request.mode === 'move') return `Move only this selected element within its current direct parent, from sibling position ${request.movement.fromIndex + 1} to ${request.movement.toIndex + 1}. Preserve the parent, responsive behavior, semantics, and every other sibling.`
-  if (request.mode === 'image') return `Replace only this selected image's content with the uploaded image at this bridge-local temporary path:\n${request.asset.localPath}\nCopy it into an appropriate durable project asset location. Preserve the existing image frame, dimensions, border radius, object-fit behavior, responsive rules, and surrounding layout.`
-  return `Apply this visual change to only the selected element unless the instruction explicitly requires its immediate context:\n${request.intent}`
-}
-
-function selectedElementBlock(request) {
-  const identity = request.sourceIdentity
-    ? `\n\nBridge-verified application source:\n${JSON.stringify(request.sourceIdentity, null, 2)}`
-    : '\n\nApplication source identity: unavailable — selector/XPath fallback only.'
-  return `Selected element:\n${JSON.stringify(request.target, null, 2)}${identity}`
-}
-
-const designModeLabel = (mode) => ({ text: 'Text', prompt: 'Prompt', move: 'Move', image: 'Image' })[mode] || 'Edit'
-
-function visibleDesignAction(request) {
-  if (request.mode === 'text') return `Replacement text:\n${clean(request.intent, MAX_TEXT)}`
-  if (request.mode === 'prompt') return `Instruction:\n${clean(request.intent, MAX_INTENT)}`
-  if (request.mode === 'move') return `Move from position ${request.movement.fromIndex + 1} to position ${request.movement.toIndex + 1}.`
-  if (request.mode === 'image') return `Replacement image: ${clean(request.asset?.name || 'uploaded image', 240)}`
-  return ''
-}
-
-// Complete, room-safe transcript text for the visible Design dispatch. Keep the
-// user instructions and order; omit host-only paths and locator packets.
-export function designTranscript(request, { restore = false } = {}) {
-  if (restore) return 'Thinkpool Design · restore the previous verified revision'
-  const edits = request?.mode === 'batch' ? request.edits : [request]
-  const valid = Array.isArray(edits) ? edits.filter(Boolean).slice(0, MAX_BATCH_EDITS) : []
-  const heading = request?.mode === 'batch'
-    ? `Thinkpool Design · ${valid.length} pooled edit${valid.length === 1 ? '' : 's'}`
-    : 'Thinkpool Design · 1 edit'
-  const details = valid.map((edit, index) => {
-    const target = clean(edit.target?.name || edit.target?.tag || 'element', 240)
-    return `${index + 1}. ${designModeLabel(edit.mode)} · ${target}\n${visibleDesignAction(edit)}`
-  })
-  return [heading, ...details].join('\n\n')
-}
-
-export function designPrompt({ record, request, by, restore = false, priorRecord = null }) {
-  const batch = request.mode === 'batch' ? request.edits : null
-  const work = restore
-    ? `Restore only the immediately previous Design Mode change by comparing the current artifact with this bridge-created verified backup: ${priorRecord?.backupPath || '(backup unavailable)'}. Do not overwrite unrelated changes.`
-    : batch
-      ? batch.map((edit, index) => `Edit ${index + 1} of ${batch.length} · ${edit.mode}\n${selectedElementBlock(edit)}\n\n${designAction(edit)}`).join('\n\n---\n\n')
-      : `${selectedElementBlock(request)}\n\n${designAction(request)}`
-  if (record.sourceKind === 'preview') {
-    return `A room member used ThinkPool Design Mode on a rendered application preview. This is an authorized source edit in your current workspace.\n\nRendered snapshot (read-only evidence): ${record.sourcePath}\nApplication workspace: ${record.workspaceRoot}\nPreview root: ${record.previewRoot}\nPreview route: ${record.route}\nExpected snapshot revision: ${record.revision}\nRequested by: ${clean(by || 'A room member', 120)}\nOperation: ${batch ? `${batch.length} queued edits in one batch` : request.mode}\n\n${work}\n\nRules:\n- Re-read the rendered snapshot and confirm the selected element still matches before editing.\n- Do not edit the snapshot. For an edit with bridge-verified application source, start at that exact relative file and range. For a selector/XPath fallback, locate the represented element in application source and do not call the match exact.\n- Before editing a bridge-verified target, confirm the current source still hashes to the supplied fileHash. If it does not, stop and request a fresh capture/reselection.\n- If fallback selector, text, or surrounding structure does not identify one application source location unambiguously, stop without editing and explain that the person must reselect it.\n${batch ? '- Apply the queued edits in order in one source pass, then build and capture once after the full batch.' : '- Apply only the requested change, then build and capture once.'}\n- Preserve the product page faithfully: keep its real copy, structure, fonts, assets, spacing, responsive behavior, and unrelated source unchanged.\n- Run the project build, then use preview_start with root ${record.previewRoot} and preview_capture with path ${record.route}, both viewports, and title ${JSON.stringify(record.title || record.slug || 'Design preview')}. The bridge correlates that capture to this request.\n- Do not claim the edit is verified until the room receives the new desktop and mobile capture.\n- If the build or capture fails, report the failure instead of substituting a screenshot-only result.`
-  }
-  return `A room member used ThinkPool Design Mode on the artifact below. This is an authorized source edit in your current workspace.\n\nArtifact source: ${record.sourcePath}\nWorkspace: ${record.workspaceRoot}\nExpected source revision: ${record.revision}\nRequested by: ${clean(by || 'A room member', 120)}\nOperation: ${restore ? 'restore the immediately previous verified Design Mode revision' : batch ? `${batch.length} queued edits in one batch` : request.mode}\n\n${work}\n\nRules:\n- Re-read the exact artifact source and confirm its revision/content still matches every selected element before editing.\n${batch ? '- Apply the queued edits in order in one source pass, then render once after the full batch.' : '- Apply only the requested change, then render the result once.'}\n- Edit the canonical source above; do not search for or edit a different plausible file.\n- Preserve the represented product page faithfully: keep its real copy, structure, fonts, assets, spacing, and responsive behavior except for the selected edits. Never replace it with generic mockup content.\n- Preserve unrelated content and styling.\n- Use the existing mockup render workflow to produce both desktop and mobile captures after the edit. Run it with TP_DESIGN_REQUEST_ID=${request.cid} and TP_DESIGN_PARENT_REVISION=${record.revision} in the command environment so the proof correlates to this request.\n- Do not claim this is live until both captures succeed and the room receives the manifest.\n- If any target is stale or ambiguous, stop without editing and explain that the person must reselect it.`
-}
+import e from"node:crypto";import t from"node:fs";import r from"node:os";import n from"node:path";import{DESIGN_SOURCE_MAP_RELATIVE as o,DESIGN_SOURCE_MAP_VERSION as i,MAX_DESIGN_SOURCE_ENTRIES as s,MAX_DESIGN_SOURCE_MAP_BYTES as a}from"./design-source-contract.mjs";const c=2097152,u=4e3,l=new Set(["dist","build",".next",".git","coverage","node_modules"]),d=(e,t)=>String(e??"").replace(/\0/g,"").trim().slice(0,t),p=(e,t)=>{const r=n.relative(e,t);return""===r||!r.startsWith("..")&&!n.isAbsolute(r)};export async function syncRealtimeAuth(e,t,r=null){const n=t||r;if(!n||"function"!=typeof e?.realtime?.setAuth)return!1;try{return await e.realtime.setAuth(n),!0}catch{return!1}}export function sourceRevision(t){return e.createHash("sha256").update(String(t)).digest("hex").slice(0,24)}export function resolveDesignSourceMap(e,r,u){if(!e||!r||!u)return null;let h,m,f,g,v,y;try{h=t.realpathSync(e),f=t.realpathSync(r),m=t.realpathSync(n.join(f,o)),g=t.realpathSync(u);const i=t.statSync(h);if(!i.isFile()||i.size<=0||i.size>a)return null;if(h!==m||!p(g,f)||!p(f,h))return null;v=t.readFileSync(h,"utf8"),y=JSON.parse(v)}catch{return null}if(y?.version!==i||!y.entries||"object"!=typeof y.entries||Array.isArray(y.entries))return null;const b=Object.entries(y.entries);if(b.length>s)return null;const w=new Map,x=new Map;for(const[e,r]of b){if(!/^[A-Za-z0-9_-]{8,80}$/.test(e)||!r||"object"!=typeof r)return null;const o=d(r.file,700);if(!o||n.isAbsolute(o)||o.split(/[\\/]/).some(e=>".."===e||l.has(e)))return null;let i=w.get(o);if(!i){try{i=t.realpathSync(n.resolve(g,o));const e=t.statSync(i);if(!e.isFile()||e.size>c||!p(g,i))return null}catch{return null}w.set(o,i)}const s=Number(r.start),a=Number(r.end),u=Number(r.line),h=Number(r.column),m=d(r.tag,40).toLowerCase(),f=d(r.fileHash,64).toLowerCase();if(![s,a,u,h].every(Number.isSafeInteger)||s<0||a<=s||u<1||h<0)return null;if(!/^[a-z][a-z0-9:-]*$/.test(m)||!/^[a-f0-9]{24}$/.test(f))return null;x.set(e,{sourceId:e,file:o.split(n.sep).join("/"),sourcePath:i,start:s,end:a,line:u,column:h,tag:m,fileHash:f})}return{path:h,revision:sourceRevision(v),buildId:d(y.buildId,80),entries:x}}export function resolveDesignSource(r,o){if(!r||!o)return null;let i,s;try{i=t.realpathSync(r),s=t.realpathSync(o);const e=t.statSync(i);if(!e.isFile()||e.size>c)return null}catch{return null}const a=n.relative(s,i);if(!a||a.startsWith("..")||n.isAbsolute(a)||".html"!==n.extname(i).toLowerCase())return null;if(a.split(n.sep).some(e=>["dist","build",".next",".git","coverage","node_modules"].includes(e)))return null;const u=t.readFileSync(i,"utf8"),l=sourceRevision(u);return{previewId:e.createHash("sha256").update(`${i}\0${l}`).digest("base64url").slice(0,32),revision:l,sourcePath:i,workspaceRoot:s,source:u}}export function resolvePreviewDesignSource(r,o,i){if(!(r&&"preview"===r.sourceKind&&r.snapshot&&o&&i))return null;let s,a,u;try{s=t.realpathSync(r.snapshot),a=t.realpathSync(o),u=t.realpathSync(i);const e=t.statSync(s);if(!e.isFile()||e.size>c)return null}catch{return null}const l=n.relative(u,s);if(!l||l.startsWith("..")||n.isAbsolute(l)||".html"!==n.extname(s).toLowerCase())return null;const h=d(r.route||"/",500),m=d(r.previewRoot||"dist",500),f=d(r.captureKey,1e3);if(!h.startsWith("/")||!f||f!==JSON.stringify([m,h]))return null;const g=t.readFileSync(s,"utf8");let v=null;try{if(v=t.realpathSync(n.resolve(a,m)),!p(a,v))return null}catch{return null}const y=r.sourceMap?resolveDesignSourceMap(r.sourceMap,v,a):null,b=sourceRevision(y?`${g}\0${y.revision}`:g);return{sourceKind:"preview",previewId:e.createHash("sha256").update(`${a}\0${f}\0${b}`).digest("base64url").slice(0,32),revision:b,sourcePath:s,workspaceRoot:a,source:g,outbox:u,route:h,previewRoot:m,captureKey:f,sourceMap:y,sourceMapPath:y?.path||null,sourceMapDeclared:!!r.sourceMap}}export function resolveManifestDesignSource(e,t,{box:r}={}){return e&&"object"==typeof e?"preview"===e.sourceKind?resolvePreviewDesignSource(e,t,r):resolveDesignSource(e.source||e.html,t):null}export function resolveManifestDisplaySource(e,r,{box:o}={}){if(!r)return null;if("preview"===r.sourceKind||!e?.snapshot)return r.source;let i,s;try{i=t.realpathSync(e.snapshot),s=t.realpathSync(o);const r=t.statSync(i);if(!r.isFile()||r.size>c)return null}catch{return null}const a=n.relative(s,i);return!a||a.startsWith("..")||n.isAbsolute(a)||".html"!==n.extname(i).toLowerCase()?null:t.readFileSync(i,"utf8")}export function refreshDesignSource(e){return e?"preview"!==e.sourceKind?resolveDesignSource(e.sourcePath,e.workspaceRoot):resolvePreviewDesignSource({sourceKind:"preview",snapshot:e.sourcePath,route:e.route,previewRoot:e.previewRoot,captureKey:e.captureKey,sourceMap:e.sourceMapPath},e.workspaceRoot,e.outbox):null}export function restoreDesignSources(e,r,o,i=100){if(!e||!r||!o)return[];let s;try{s=t.readdirSync(e,{withFileTypes:!0}).filter(e=>e.isFile()&&e.name.endsWith(".json")&&!e.name.endsWith(".receipt.json")).map(r=>{const o=n.join(e,r.name);return{file:o,mtimeMs:t.statSync(o).mtimeMs}}).sort((e,t)=>t.mtimeMs-e.mtimeMs).slice(0,Math.max(0,i))}catch{return[]}const a=[];for(const{file:i}of s)try{const s=JSON.parse(t.readFileSync(i,"utf8")),c=resolveManifestDesignSource(s,r,{box:e});if(!c)continue;Object.assign(c,{term:o,slug:String(s.slug||""),title:String(s.title||s.slug||""),desktop:s.desktop||null,mobile:s.mobile||null});const u=n.join(e,".design-revisions",`${c.revision}.html`);t.existsSync(u)&&(c.backupPath=u),a.push(c)}catch{}return a}export function resolveRequestSourceIdentity(e,r){if(!r?.sourceId)return{ok:!0,identity:null};const n=e?.sourceMap?.entries?.get(r.sourceId);if(!n)return{ok:!1,error:e?.sourceMapDeclared?"stale-source-identity":"source-identity-unavailable"};if(r.tag&&n.tag!==r.tag)return{ok:!1,error:"source-identity-mismatch"};let o;try{o=t.readFileSync(n.sourcePath,"utf8")}catch{return{ok:!1,error:"stale-source-identity"}}return sourceRevision(o)!==n.fileHash?{ok:!1,error:"stale-source-identity"}:{ok:!0,identity:{sourceId:n.sourceId,file:n.file,start:n.start,end:n.end,line:n.line,column:n.column,tag:n.tag,fileHash:n.fileHash}}}export function validateDesignRequest(e,t,r=""){if(!e||"object"!=typeof e)return{ok:!1,error:"invalid-request"};const n=d(e.previewId,64),o=t.get(n);if(!o)return{ok:!1,error:"preview-unavailable"};if(d(e.revision,64)!==o.revision)return{ok:!1,error:"stale-preview"};const i=function(e){if(!e||"object"!=typeof e)return null;const t=e.rect&&"object"==typeof e.rect?{x:Number(e.rect.x)||0,y:Number(e.rect.y)||0,width:Math.max(0,Number(e.rect.width)||0),height:Math.max(0,Number(e.rect.height)||0)}:null;return{selector:d(e.selector,600),xpath:d(e.xpath,600),tag:d(e.tag,40).toLowerCase(),role:d(e.role,80),name:d(e.name,240),text:d(e.text,u),canEditText:!0===e.canEditText,canReplaceImage:!0===e.canReplaceImage,nodeKey:d(e.nodeKey,80),parentNodeKey:d(e.parentNodeKey,80),sourceId:d(e.sourceId,80),parentSourceId:d(e.parentSourceId,80),rect:t}}(e.target);if(!i?.selector&&!i?.xpath)return{ok:!1,error:"select-an-element"};const s=["text","prompt","move","image"].includes(e.mode)?e.mode:null;if(!s)return{ok:!1,error:"invalid-mode"};const a=d(e.intent,"text"===s?u:2e3);if(["text","prompt"].includes(s)&&!a)return{ok:!1,error:"text"===s?"enter-text":"describe-change"};if("text"===s&&!i.canEditText)return{ok:!1,error:"text-edit-not-safe"};const c="move"===s?function(e){if(!e||"object"!=typeof e)return null;const t=Number(e.fromIndex),r=Number(e.toIndex);return![t,r].every(Number.isSafeInteger)||t<0||r<0||t>499||r>499?null:{fromIndex:t,toIndex:r}}(e.movement):null;if("move"===s&&(!c||c.fromIndex===c.toIndex))return{ok:!1,error:"invalid-move"};const l="image"===s?function(e,t){if(!e||"object"!=typeof e)return null;const r={path:d(e.path,700),name:d(e.name,240),mediaType:d(e.mediaType,120).toLowerCase(),size:Number(e.size)},n=t?`code/${String(t).toUpperCase()}/design-drafts/`:"code/";return r.path.startsWith(n)&&!r.path.split("/").includes("..")&&r.mediaType.startsWith("image/")?!Number.isSafeInteger(r.size)||r.size<=0||r.size>10485760?null:r:null}(e.asset,r):null;if(!("image"!==s||i.canReplaceImage&&l))return{ok:!1,error:"invalid-image"};const p=resolveRequestSourceIdentity(o,i);return p.ok?{ok:!0,record:o,request:{previewId:n,revision:o.revision,mode:s,intent:a,target:i,movement:c,asset:l,sourceIdentity:p.identity,cid:d(e.cid,80)}}:p}export function validateDesignBatchRequest(e,t,r=""){if(!e||"object"!=typeof e||!Array.isArray(e.edits))return validateDesignRequest(e,t,r);if(e.edits.length<1||e.edits.length>8)return{ok:!1,error:"invalid-batch"};const n=d(e.previewId,64),o=d(e.revision,64),i=d(e.cid,80),s=[],a=new Set;let c=null;for(let u=0;u<e.edits.length;u++){const l=validateDesignRequest({...e.edits[u],previewId:n,revision:o,cid:i},t,r);if(!l.ok)return{...l,editIndex:u};const d=l.request.target.sourceId||l.request.target.nodeKey||l.request.target.selector||l.request.target.xpath;if(a.has(d))return{ok:!1,error:"duplicate-target",editIndex:u};a.add(d),c=l.record,s.push(l.request)}return{ok:!0,record:c,request:{previewId:n,revision:c.revision,mode:"batch",edits:s,cid:i}}}export async function deleteDesignAssetDraft({webBase:e,token:t,room:r,path:n,fetcher:o=fetch}){if(!(e&&t&&r&&n))return!1;const i=await o(`${String(e).replace(/\/$/,"")}/api/code-design-draft`,{method:"DELETE",headers:{"Content-Type":"application/json",Authorization:`Bearer ${t}`},body:JSON.stringify({code:r,path:n})}).catch(()=>null);return!!i?.ok}export async function materializeDesignAsset({webBase:e,token:o,room:i,asset:s,requestId:a,cleanup:c=!0,fetcher:u=fetch}){if(!(e&&o&&i&&s?.path&&a))return null;const l={"Content-Type":"application/json",Authorization:`Bearer ${o}`},p=await u(`${String(e).replace(/\/$/,"")}/api/code-attachment-url`,{method:"POST",headers:l,body:JSON.stringify({code:i,path:s.path})});if(!p.ok)return null;const{url:h}=await p.json();if(!h)return null;const m=await u(h);if(!m.ok)return null;const f=Buffer.from(await m.arrayBuffer());if(!f.length||f.length>10485760)return null;const g=n.extname(s.name).replace(/[^.a-zA-Z0-9]/g,"").slice(0,9)||".img",v=n.join(r.tmpdir(),"thinkpool-design-assets"),y=n.join(v,`${d(a,80)}${g}`);return t.mkdirSync(v,{recursive:!0}),t.writeFileSync(y,f),c&&await deleteDesignAssetDraft({webBase:e,token:o,room:i,path:s.path,fetcher:u}),y}function h(e){return"text"===e.mode?`Replace only this element's visible text with:\n${e.intent}`:"move"===e.mode?`Move only this selected element within its current direct parent, from sibling position ${e.movement.fromIndex+1} to ${e.movement.toIndex+1}. Preserve the parent, responsive behavior, semantics, and every other sibling.`:"image"===e.mode?`Replace only this selected image's content with the uploaded image at this bridge-local temporary path:\n${e.asset.localPath}\nCopy it into an appropriate durable project asset location. Preserve the existing image frame, dimensions, border radius, object-fit behavior, responsive rules, and surrounding layout.`:`Apply this visual change to only the selected element unless the instruction explicitly requires its immediate context:\n${e.intent}`}function m(e){const t=e.sourceIdentity?`\n\nBridge-verified application source:\n${JSON.stringify(e.sourceIdentity,null,2)}`:"\n\nApplication source identity: unavailable — selector/XPath fallback only.";return`Selected element:\n${JSON.stringify(e.target,null,2)}${t}`}export function designTranscript(e,{restore:t=!1}={}){if(t)return"Thinkpool Design · restore the previous verified revision";const r="batch"===e?.mode?e.edits:[e],n=Array.isArray(r)?r.filter(Boolean).slice(0,8):[],o="batch"===e?.mode?`Thinkpool Design · ${n.length} pooled edit${1===n.length?"":"s"}`:"Thinkpool Design · 1 edit",i=n.map((e,t)=>{const r=d(e.target?.name||e.target?.tag||"element",240);return`${t+1}. ${n=e.mode,{text:"Text",prompt:"Prompt",move:"Move",image:"Image"}[n]||"Edit"} · ${r}\n${function(e){return"text"===e.mode?`Replacement text:\n${d(e.intent,u)}`:"prompt"===e.mode?`Instruction:\n${d(e.intent,2e3)}`:"move"===e.mode?`Move from position ${e.movement.fromIndex+1} to position ${e.movement.toIndex+1}.`:"image"===e.mode?`Replacement image: ${d(e.asset?.name||"uploaded image",240)}`:""}(e)}`;var n});return[o,...i].join("\n\n")}export function designPrompt({record:e,request:t,by:r,restore:n=!1,priorRecord:o=null}){const i="batch"===t.mode?t.edits:null,s=n?`Restore only the immediately previous Design Mode change by comparing the current artifact with this bridge-created verified backup: ${o?.backupPath||"(backup unavailable)"}. Do not overwrite unrelated changes.`:i?i.map((e,t)=>`Edit ${t+1} of ${i.length} · ${e.mode}\n${m(e)}\n\n${h(e)}`).join("\n\n---\n\n"):`${m(t)}\n\n${h(t)}`;return"preview"===e.sourceKind?`A room member used ThinkPool Design Mode on a rendered application preview. This is an authorized source edit in your current workspace.\n\nRendered snapshot (read-only evidence): ${e.sourcePath}\nApplication workspace: ${e.workspaceRoot}\nPreview root: ${e.previewRoot}\nPreview route: ${e.route}\nExpected snapshot revision: ${e.revision}\nRequested by: ${d(r||"A room member",120)}\nOperation: ${i?`${i.length} queued edits in one batch`:t.mode}\n\n${s}\n\nRules:\n- Re-read the rendered snapshot and confirm the selected element still matches before editing.\n- Do not edit the snapshot. For an edit with bridge-verified application source, start at that exact relative file and range. For a selector/XPath fallback, locate the represented element in application source and do not call the match exact.\n- Before editing a bridge-verified target, confirm the current source still hashes to the supplied fileHash. If it does not, stop and request a fresh capture/reselection.\n- If fallback selector, text, or surrounding structure does not identify one application source location unambiguously, stop without editing and explain that the person must reselect it.\n${i?"- Apply the queued edits in order in one source pass, then build and capture once after the full batch.":"- Apply only the requested change, then build and capture once."}\n- Preserve the product page faithfully: keep its real copy, structure, fonts, assets, spacing, responsive behavior, and unrelated source unchanged.\n- Run the project build, then use preview_start with root ${e.previewRoot} and preview_capture with path ${e.route}, both viewports, and title ${JSON.stringify(e.title||e.slug||"Design preview")}. The bridge correlates that capture to this request.\n- Do not claim the edit is verified until the room receives the new desktop and mobile capture.\n- If the build or capture fails, report the failure instead of substituting a screenshot-only result.`:`A room member used ThinkPool Design Mode on the artifact below. This is an authorized source edit in your current workspace.\n\nArtifact source: ${e.sourcePath}\nWorkspace: ${e.workspaceRoot}\nExpected source revision: ${e.revision}\nRequested by: ${d(r||"A room member",120)}\nOperation: ${n?"restore the immediately previous verified Design Mode revision":i?`${i.length} queued edits in one batch`:t.mode}\n\n${s}\n\nRules:\n- Re-read the exact artifact source and confirm its revision/content still matches every selected element before editing.\n${i?"- Apply the queued edits in order in one source pass, then render once after the full batch.":"- Apply only the requested change, then render the result once."}\n- Edit the canonical source above; do not search for or edit a different plausible file.\n- Preserve the represented product page faithfully: keep its real copy, structure, fonts, assets, spacing, and responsive behavior except for the selected edits. Never replace it with generic mockup content.\n- Preserve unrelated content and styling.\n- Use the existing mockup render workflow to produce both desktop and mobile captures after the edit. Run it with TP_DESIGN_REQUEST_ID=${t.cid} and TP_DESIGN_PARENT_REVISION=${e.revision} in the command environment so the proof correlates to this request.\n- Do not claim this is live until both captures succeed and the room receives the manifest.\n- If any target is stale or ambiguous, stop without editing and explain that the person must reselect it.`}

package/design-source-contract.mjs

@@ -1,4 +1 @@
-export const DESIGN_SOURCE_MAP_VERSION = 1
-export const DESIGN_SOURCE_MAP_RELATIVE = '.thinkpool-design/source-map.json'
-export const MAX_DESIGN_SOURCE_MAP_BYTES = 2 * 1024 * 1024
-export const MAX_DESIGN_SOURCE_ENTRIES = 50_000
+export const DESIGN_SOURCE_MAP_VERSION=1;export const DESIGN_SOURCE_MAP_RELATIVE=".thinkpool-design/source-map.json";export const MAX_DESIGN_SOURCE_MAP_BYTES=2097152;export const MAX_DESIGN_SOURCE_ENTRIES=5e4;

package/direct-pair-room.mjs

@@ -1,57 +1 @@
-import { pairKeyFor, pairTopic } from './cross-terminal.mjs'
-
-// A standalone room bridge is already the authoritative process for its room. It
-// must be reachable over the pair bus even when the account-level supervisor is
-// not running. Keep the identity and request handling in a small tested module so
-// the standalone path preserves the same pair-only and bounded-post invariants as
-// account.mjs.
-
-export function standalonePairIdentity ({ row, myUid } = {}) {
-  const participants = Array.isArray(row?.participants) ? row.participants.map(String) : []
-  const me = String(myUid || '')
-  if (!me || String(row?.owner_id || '') !== me || participants.length !== 2 || !participants.includes(me)) return null
-  const partnerUid = participants.find((uid) => uid !== me)
-  const key = pairKeyFor(me, partnerUid)
-  if (!partnerUid || !key) return null
-  return { partnerUid, key, topic: pairTopic(key) }
-}
-
-export function createStandalonePairResponder ({
-  room,
-  roomName = null,
-  host = null,
-  formatPeek,
-  receivePost,
-  now = () => Date.now(),
-  postLimit = 6,
-  postWindowMs = 60_000,
-} = {}) {
-  if (!room || typeof formatPeek !== 'function' || typeof receivePost !== 'function') {
-    throw new TypeError('room, formatPeek, and receivePost are required')
-  }
-  let bucket = { count: 0, resetAt: 0 }
-
-  const isTarget = (payload) => String(payload?.targetRoom || '').toUpperCase().trim() === room
-  const allowPost = () => {
-    const t = now()
-    if (t >= bucket.resetAt) bucket = { count: 0, resetAt: t + postWindowMs }
-    if (bucket.count >= postLimit) return false
-    bucket.count += 1
-    return true
-  }
-
-  return Object.freeze({
-    list: (payload) => ({ nonce: payload?.nonce, rooms: [{ code: room, name: roomName, host }] }),
-    peek: (payload) => {
-      if (!isTarget(payload)) return null
-      try { return { nonce: payload?.nonce, text: formatPeek(payload) } }
-      catch { return { nonce: payload?.nonce, error: 'Could not read that session.' } }
-    },
-    post: async (payload) => {
-      if (!isTarget(payload)) return null
-      if (!allowPost()) return { nonce: payload?.nonce, error: 'Too many cross-room posts to this device right now — try again shortly.' }
-      try { return { nonce: payload?.nonce, ...(await receivePost(payload)) } }
-      catch { return { nonce: payload?.nonce, error: `Could not deliver to room ${room}.` } }
-    },
-  })
-}
+import{pairKeyFor as n,pairTopic as t}from"./cross-terminal.mjs";export function standalonePairIdentity({row:r,myUid:e}={}){const o=Array.isArray(r?.participants)?r.participants.map(String):[],i=String(e||"");if(!i||String(r?.owner_id||"")!==i||2!==o.length||!o.includes(i))return null;const c=o.find(n=>n!==i),s=n(i,c);return c&&s?{partnerUid:c,key:s,topic:t(s)}:null}export function createStandalonePairResponder({room:n,roomName:t=null,host:r=null,formatPeek:e,receivePost:o,now:i=()=>Date.now(),postLimit:c=6,postWindowMs:s=6e4}={}){if(!n||"function"!=typeof e||"function"!=typeof o)throw new TypeError("room, formatPeek, and receivePost are required");let a={count:0,resetAt:0};const u=t=>String(t?.targetRoom||"").toUpperCase().trim()===n;return Object.freeze({list:e=>({nonce:e?.nonce,rooms:[{code:n,name:t,host:r}]}),peek:n=>{if(!u(n))return null;try{return{nonce:n?.nonce,text:e(n)}}catch{return{nonce:n?.nonce,error:"Could not read that session."}}},post:async t=>{if(!u(t))return null;if(!(()=>{const n=i();return n>=a.resetAt&&(a={count:0,resetAt:n+s}),!(a.count>=c||(a.count+=1,0))})())return{nonce:t?.nonce,error:"Too many cross-room posts to this device right now — try again shortly."};try{return{nonce:t?.nonce,...await o(t)}}catch{return{nonce:t?.nonce,error:`Could not deliver to room ${n}.`}}}})}

package/dispatch-lease.mjs

@@ -1,37 +1 @@
-// One live dispatch intent per structured terminal.
-//
-// Durable permission rows can outlive the agent turn that requested them. The
-// lease is the bridge-local execution fence: arguments still need the durable
-// fingerprint/authority checks, and the matching intent must also remain current
-// until the lane is created. A newer human turn or abort supersedes the lease, so
-// a late (otherwise valid) approval cannot resurrect an old runtime choice.
-
-const nextGeneration = (entry) =>
-  (Number.isSafeInteger(entry?.dispatchGeneration) ? entry.dispatchGeneration : 0) + 1
-
-export function beginDispatchLease (entry, permissionId) {
-  if (!entry || !permissionId) return Object.freeze({ ok: false, code: 'invalid_dispatch' })
-  if (entry.dispatchLease) return Object.freeze({ ok: false, code: 'dispatch_pending', active: entry.dispatchLease })
-  const lease = Object.freeze({ permissionId, generation: nextGeneration(entry) })
-  entry.dispatchGeneration = lease.generation
-  entry.dispatchLease = lease
-  return Object.freeze({ ok: true, lease })
-}
-
-export function isDispatchLeaseCurrent (entry, lease) {
-  return Boolean(entry && lease && entry.dispatchLease === lease && entry.dispatchGeneration === lease.generation)
-}
-
-export function finishDispatchLease (entry, lease) {
-  if (!isDispatchLeaseCurrent(entry, lease)) return false
-  entry.dispatchLease = null
-  return true
-}
-
-export function supersedeDispatchLease (entry) {
-  const lease = entry?.dispatchLease || null
-  if (!entry || !lease) return null
-  entry.dispatchGeneration = nextGeneration(entry)
-  entry.dispatchLease = null
-  return lease
-}
+const e=e=>(Number.isSafeInteger(e?.dispatchGeneration)?e.dispatchGeneration:0)+1;export function beginDispatchLease(t,n){if(!t||!n)return Object.freeze({ok:!1,code:"invalid_dispatch"});if(t.dispatchLease)return Object.freeze({ok:!1,code:"dispatch_pending",active:t.dispatchLease});const i=Object.freeze({permissionId:n,generation:e(t)});return t.dispatchGeneration=i.generation,t.dispatchLease=i,Object.freeze({ok:!0,lease:i})}export function isDispatchLeaseCurrent(e,t){return Boolean(e&&t&&e.dispatchLease===t&&e.dispatchGeneration===t.generation)}export function finishDispatchLease(e,t){return!!isDispatchLeaseCurrent(e,t)&&(e.dispatchLease=null,!0)}export function supersedeDispatchLease(t){const n=t?.dispatchLease||null;return t&&n?(t.dispatchGeneration=e(t),t.dispatchLease=null,n):null}