@3sln/trove 0.0.12 → 0.0.13

package/packages/web/src/bl/activity.js

@@ -32,10 +32,12 @@ const ACTIVE_MS = 1000; // while something is running, we want a live-feeling ba
 const IDLE_MS = 60_000; // otherwise just enough to notice a task someone else started
 
 export class ActivityService {
+  #state;
+
   constructor(platform) {
     this.platform = platform;
     this.api = platform.api;
-    this.state = {
+    this.#state = {
       tasks: [], // merged: local first, then the server mirror
       issues: [],
       issuesLoading: false,
@@ -46,21 +48,32 @@ export class ActivityService {
       // produced.
       tasksError: null,
       issuesError: null,
-      open: false, // the activity panel
     };
-    this.cell = cell(this.state);
+    this.cell = cell(this.#state);
     this._local = new Map(); // id -> local task (this browser owns these)
     this._server = [];
     this._timer = null;
     this._pollMs = null;
   }
 
+  /**
+   * The value, for whoever is about to decide something from it.
+   *
+   * The same door every slice offers. Actions read `.state` and queries read `.cell`, and
+   * the two are only equal by habit — bl/state.js says so, and says a resource has one
+   * value and one way to read it. `state` is also a public field on a service, which is one
+   * typo from `social.state.sidecar = null` bypassing the cell and notifying nothing.
+   */
+  get() {
+    return this.#state;
+  }
+
   observe() {
     return this.cell;
   }
   #set(patch) {
-    this.state = { ...this.state, ...patch };
-    this.cell.setValue(this.state);
+    this.#state = { ...this.#state, ...patch };
+    this.cell.setValue(this.#state);
   }
   #merge() {
     this.#set({ tasks: [...this._local.values(), ...this._server] });
@@ -211,103 +224,40 @@ export class ActivityService {
       // running→idle transition to notice and the fixed problem would sit on screen
       // until the next idle poll. A couple of bounded follow-ups cover that window
       // without turning this into a busy loop.
-      this.#followUp();
-      this.platform.notifications?.info?.('Retrying — watch its progress in Activity');
+      this.followUp();
+      this.platform.notifications.info('Retrying — watch its progress in Activity');
     } catch (err) {
-      this.platform.notifications?.error?.(`Couldn't retry: ${err.message}`);
+      this.platform.notifications.error(`Couldn't retry: ${err.message}`);
     }
   }
 
   async dismissIssue(id) {
-    const before = this.state.issues;
+    const before = this.#state.issues;
     this.#set({ issues: before.filter((i) => i.id !== id) });
     try {
       await this.api.dismissIssue(id);
     } catch (err) {
       this.#set({ issues: before }); // put it back rather than pretend
-      this.platform.notifications?.error?.(`Couldn't dismiss: ${err.message}`);
-    }
-  }
-
-  /** Two bounded re-reads after an action that may have resolved something. */
-  #followUp() {
-    for (const ms of [400, 1500]) {
-      const t = setTimeout(() => { this.refreshTasks(); this.refreshIssues(); }, ms);
-      t?.unref?.();
-    }
-  }
-
-  /** Rebuild the whole search index. Surfaced as a command; reports as a task. */
-  async rebuildIndex() {
-    try {
-      const res = await this.api.reindex();
-      await this.refreshTasks();
-      this.togglePanel(true);
-      if (res.alreadyRunning) this.platform.notifications?.info?.('A rebuild is already running');
-      return res;
-    } catch (err) {
-      this.platform.notifications?.error?.(`Couldn't rebuild the index: ${err.message}`);
-      throw err;
-    }
-  }
-
-  /**
-   * Reconcile a collection with its object store — the way a drive notices files added,
-   * replaced, or removed by anything that isn't Trove. Reports as a task, like a rebuild.
-   */
-  async scanCollection(collectionId) {
-    try {
-      const res = await this.api.scanCollection(collectionId);
-      await this.refreshTasks();
-      this.togglePanel(true);
-      if (res.alreadyRunning) this.platform.notifications?.info?.('A scan of this collection is already running');
-      this.#followUp();
-      return res;
-    } catch (err) {
-      this.platform.notifications?.error?.(`Couldn't scan “${collectionId}”: ${err.message}`);
-      throw err;
+      this.platform.notifications.error(`Couldn't dismiss: ${err.message}`);
     }
   }
 
   /**
-   * Ask the server whether the backing stores are actually usable from a browser.
+   * Two bounded re-reads after an action that may have resolved something.
    *
-   * Unlike a scan or a reindex this finishes in one round trip, so it reports its own
-   * result rather than handing back a task: the answer to "did I fix the bucket?" should
-   * be available immediately, and the issue list is refreshed so a problem that is now
-   * fixed visibly disappears rather than sitting there until the next poll.
+   * Public, because the action that started the work is the thing that knows it may have
+   * resolved something — a small, real loss of encapsulation in exchange for the three
+   * network verbs no longer living inside a resource.
    */
-  async checkStorage() {
-    try {
-      const res = await this.api.checkStorage();
-      await this.refresh();
-      this.togglePanel(true);
-      const problems = (res.results || []).reduce((n, r) => n + (r.findings?.length || 0), 0);
-      if (problems) {
-        this.platform.notifications?.warn?.(`Found ${problems} storage problem${problems === 1 ? '' : 's'} — see Activity`);
-      } else if (!res.checked) {
-        this.platform.notifications?.info?.('There are no collections to check yet');
-      } else if (!res.corsChecked) {
-        // Honest about what was not checked. Reporting "all good" having skipped the check
-        // that matters is how a diagnostic stops being believed.
-        this.platform.notifications?.info?.('Stores are reachable. Browser access was not checked — this drive has no public URL configured.');
-      } else {
-        this.platform.notifications?.success?.('Stores are reachable and allow browser access');
-      }
-      return res;
-    } catch (err) {
-      this.platform.notifications?.error?.(`Couldn't check the stores: ${err.message}`);
-      throw err;
+  followUp() {
+    for (const ms of [400, 1500]) {
+      const t = setTimeout(() => { this.refreshTasks(); this.refreshIssues(); }, ms);
+      t?.unref?.();
     }
   }
 
-  togglePanel(open) {
-    this.#set({ open: open ?? !this.state.open });
-    if (this.state.open) this.refresh();
-  }
-
   get running() {
-    return this.state.tasks.filter((t) => t.status === 'running');
+    return this.#state.tasks.filter((t) => t.status === 'running');
   }
 
   /**

package/packages/web/src/bl/index.js

@@ -1,8 +1,15 @@
-// Assemble the ngin engine and the reactive services into one `app` context,
-// register commands and built-in openers, and expose everything the UI needs.
-// The engine holds a single `app` singleton provider so Actions can reach the
-// platform and services; the app object also carries the engine so Actions can
-// dispatch follow-up Actions (the choreographer pattern).
+// Assemble the ngin engine: one provider per named resource, then commands, the built-in
+// context keys, and the boot dispatches.
+//
+// There is no `app` provider. It existed, and it made the engine's state one opaque blob —
+// every query and every action leased the whole world, and a lease that always covers
+// everything tells you nothing about what a piece of work touches or how long it needs it.
+// It survived longest as the thing command handlers closed over, and went when they stopped
+// being closures (see bl/commands.js). `static deps = ['explorer']` means what it says now,
+// and web/test/leases.test.js checks that it stays true.
+//
+// `app` the OBJECT is still returned, because the shell and the e2e harness hold the
+// services directly — but nothing leases it.
 
 import { Engine, Provider } from '@3sln/ngin';
 import { cell } from '../runtime.js';
@@ -14,7 +21,7 @@ import { SocialService } from './social.js';
 import { OfflineService } from './offline.js';
 import { ActivityService } from './activity.js';
 import { registerCommands } from './commands.js';
-import { NavigateAction, LoadCollectionsAction, OpenInitialCollectionAction, OpenPluginPanelAction } from './actions.js';
+import { NavigateAction } from './actions.js';
 
 export function createApp(platform) {
   // Named slices, not services — see bl/state.js. Each is still its own provider, so a
@@ -135,7 +142,6 @@ export function createApp(platform) {
         },
         () => {},
       ),
-      mediaUrls: Provider.fromSingleton(platform.mediaUrls),
       plugins: Provider.fromSingleton(platform.plugins),
     },
   });
@@ -149,10 +155,13 @@ export function createApp(platform) {
   // outside the engine, and one of them has to carry the intent in. Everything past this
   // point is an action on the feed.
   platform.commands.dispatch = (action) => engine.dispatch(action);
-  // The same seam for the two other places that originate outside the engine: a docked
-  // plugin frame opening a file, and the plugin RPC asking for its panel.
+  // The same seam for everything that originates outside the engine: a docked plugin frame
+  // opening a file, and the plugin RPC asking for its panel. ONE seam — there was a second,
+  // `openPluginPanel`, which was `dispatch` with one action pre-applied, declared
+  // differently (a field in the platform literal versus one materialising from nowhere) and
+  // guarded differently (`dispatch?.()` optional, `openPluginPanel()` not), so a reader
+  // looking for how the plugin layer reaches the engine had to find both.
   platform.dispatch = (action) => engine.dispatch(action);
-  platform.openPluginPanel = (pluginId) => engine.dispatch(new OpenPluginPanelAction(pluginId));
 
   registerCommands(app);
 
@@ -165,7 +174,10 @@ export function createApp(platform) {
   social.init();
   offline.init();
   activity.init();
-  engine.dispatch(new LoadCollectionsAction());
+  // NOT `LoadCollectionsAction` as well. `OpenInitialCollectionAction`, dispatched at boot
+  // by workbench.js, fetches and writes the same two fields on both its normal and its
+  // share-link path — so every cold start made two identical GETs to /api/collections and
+  // installed two writers for one fact.
 
   return { engine, app };
 }

package/packages/web/src/bl/launcher.js

@@ -16,6 +16,7 @@
 // carrying-a-handle problem that menu items had before they carried `actions`.
 
 import { parseTagQuery, filterLabel } from './tagQuery.js';
+import { iconForKind } from './fileType.js';
 import {
   ExecCommandAction, CloseSearchModalAction, OpenFileAction, SearchAction, FilterAction,
   SetLaunchQueryAction,
@@ -27,14 +28,6 @@ export function launcherMode(query) {
   return q.startsWith('!') ? 'command' : q.includes('#') ? 'filter' : 'search';
 }
 
-const iconFor = (node) => {
-  const t = node?.contentType || '';
-  if (t.startsWith('image/')) return 'file-image';
-  if (t.startsWith('audio/')) return 'file-audio';
-  if (t.startsWith('video/')) return 'file-video';
-  return 'file-text';
-};
-
 /**
  * Everything you can do to a file, as descriptions.
  *
@@ -80,7 +73,7 @@ export function trashMenuOf(node) {
  */
 function fileItem(node, { modal, pinnedIds, keys }) {
   return {
-    icon: iconFor(node),
+    icon: iconForKind(node),
     title: node.name,
     detail: node.contentType || '',
     node,

package/packages/web/src/bl/links.js

@@ -10,30 +10,43 @@
 // and renaming breaks them. It has to say so clearly, and say WHY, because "nothing
 // happened" is the worst possible response to a click.
 
+import { Action } from '@3sln/ngin';
 import { parseTroveUri } from '@3sln/trove/core/links.js';
+import { runAction } from '../dispatch.js';
 import { OpenFileAction } from './actions.js';
 
 /**
  * Open what a `trove:` URI points at.
- * @param {object} ui       the workbench ui helper
- * @param {string} uri      the link as written in the document
- * @param {{from?: object}} [opts]  the item the link was followed FROM, for messages
+ *
+ * An ACTION, because it is a network stat, a choice between three failure messages, and an
+ * open. It was a plain function taking the UI bag — the only module in bl/ whose parameter
+ * was a UI-layer shape, reaching `ui.platform.api` and `ui.engine` to do all of that with
+ * no lease on anything and nothing of it on the feed. pluginHost.js states the rule for the
+ * same kind of edge: "Dispatched, not called: opening a file from a docked plugin frame is
+ * the same intent as opening one from the drive, and the engine should see both."
+ *
+ * The laziness the module header argues for is untouched — this still runs at click time,
+ * and where the work runs was never what that argument was about.
  */
-export async function openTroveLink(ui, uri, { from } = {}) {
-  const ref = parseTroveUri(uri);
-  const notify = ui.platform.notifications;
-  if (!ref) {
-    notify.warn(`"${uri}" isn’t a valid Trove link.`);
-    return null;
-  }
-  try {
-    const res = await ui.platform.api.stat(uri);
-    if (!res?.node) throw new Error('not found');
-    ui.engine.dispatch(new OpenFileAction(res.node));
-    return res.node;
-  } catch (err) {
-    notify.warn(describeBrokenLink(ref, err, from));
-    return null;
+export class OpenTroveLinkAction extends Action {
+  static deps = ['api', 'engine', 'notifications'];
+
+  /** @param {string} uri the link as written; @param {object} [from] the item it was in */
+  constructor(uri, from = null) { super(); this.uri = uri; this.from = from; }
+
+  async execute({ api, engine, notifications }) {
+    const ref = parseTroveUri(this.uri);
+    if (!ref) {
+      notifications.warn(`"${this.uri}" isn’t a valid Trove link.`);
+      return;
+    }
+    try {
+      const res = await api.stat(this.uri);
+      if (!res?.node) throw new Error('not found');
+      await runAction(engine, new OpenFileAction(res.node));
+    } catch (err) {
+      notifications.warn(describeBrokenLink(ref, err, this.from));
+    }
   }
 }
 

package/packages/web/src/bl/offline.js

@@ -24,19 +24,33 @@ const FILES_CACHE = 'trove-files-v1';
 const embed = new LocalHashEmbedding({ dimensions: 256 });
 
 export class OfflineService {
+  #state;
+
   constructor(platform) {
     this.platform = platform;
     this.api = platform.api;
     this.db = null;
-    this.state = { online: navigator.onLine, pins: [], queued: 0, syncing: false };
-    this.cell = cell(this.state);
+    this.#state = { online: navigator.onLine, pins: [], queued: 0, syncing: false };
+    this.cell = cell(this.#state);
+  }
+  /**
+   * The value, for whoever is about to decide something from it.
+   *
+   * The same door every slice offers. Actions read `.state` and queries read `.cell`, and
+   * the two are only equal by habit — bl/state.js says so, and says a resource has one
+   * value and one way to read it. `state` is also a public field on a service, which is one
+   * typo from `social.state.sidecar = null` bypassing the cell and notifying nothing.
+   */
+  get() {
+    return this.#state;
   }
+
   observe() {
     return this.cell;
   }
   #set(patch) {
-    this.state = { ...this.state, ...patch };
-    this.cell.setValue(this.state);
+    this.#state = { ...this.#state, ...patch };
+    this.cell.setValue(this.#state);
   }
 
   async init() {
@@ -48,10 +62,10 @@ export class OfflineService {
     // `navigator.onLine` only reflects that an interface is up — on a captive portal or
     // dead uplink it's `true` while the server is unreachable, which would leave us
     // falsely "online" with every request silently failing. Confirm real reachability.
-    if (this.state.online && !(await this.api.reachable())) this.#set({ online: false });
+    if (this.#state.online && !(await this.api.reachable())) this.#set({ online: false });
     // Tell the plugin host our initial connectivity so it can probe plugins.
-    this.platform.plugins?.setOnline?.(this.state.online);
-    if (this.state.online) this.flushQueue();
+    this.platform.plugins?.setOnline?.(this.#state.online);
+    if (this.#state.online) this.flushQueue();
   }
 
   async #onOnline() {
@@ -110,7 +124,7 @@ export class OfflineService {
   }
 
   async unpin(id) {
-    const pin = this.state.pins.find((p) => p.id === id);
+    const pin = this.#state.pins.find((p) => p.id === id);
     if (pin && 'caches' in window) {
       const cache = await caches.open(FILES_CACHE);
       // The same stable key `pin` stored under — never a freshly minted URL.
@@ -157,7 +171,7 @@ export class OfflineService {
   }
 
   async flushQueue() {
-    if (!this.state.online || this.state.syncing) return;
+    if (!this.#state.online || this.#state.syncing) return;
     // Claim the sync BEFORE any await — two 'online' events (or init + an event) can
     // fire concurrently, and a check-then-act guard after an await let both pass and
     // replay the queue twice (double-posting). Setting syncing synchronously here makes
@@ -189,7 +203,7 @@ export class OfflineService {
       this.#set({ syncing: false });
       // Be honest: only claim success for what actually applied, and surface drops.
       if (dropped) this.platform.notifications.warn(`${dropped} offline change${dropped > 1 ? 's' : ''} couldn't be applied and ${dropped > 1 ? 'were' : 'was'} discarded.`);
-      if (synced && this.state.queued === 0) this.platform.notifications.info(`${synced} offline change${synced > 1 ? 's' : ''} synced.`);
+      if (synced && this.#state.queued === 0) this.platform.notifications.info(`${synced} offline change${synced > 1 ? 's' : ''} synced.`);
     }
   }
 }

package/packages/web/src/bl/pluginInstall.js

@@ -9,8 +9,16 @@
 import { parsePackage, fetchPackage, reviewSummary, displayName } from '../platform/pluginPackage.js';
 import { pluginId } from '@3sln/trove/core/plugins/identity.js';
 import { installPolicyFor } from './trust.js';
+import { InstallReviewedPluginAction } from './actions.js';
 
-/** @typedef {{notifications: object, overlay: object, plugins: object, social: object, workbench: object}} InstallResources */
+/**
+ * What an install touches. The parameter list below is the same set spelled out, so a lease
+ * that forgot one is a missing ARGUMENT at the top of the function rather than an
+ * `undefined` several lines in — which is how a missing `overlay` came to be reported to
+ * the user as "Couldn't read the plugin", about a file that read perfectly.
+ *
+ * @typedef {{notifications: object, overlay: object, plugins: object, social: object, workbench: object}} InstallResources
+ */
 
 /** @param {InstallResources} r */
 export async function beginInstallFromFile(r, file) {
@@ -32,16 +40,17 @@ export async function beginInstallFromUrl(r, url) {
   }
 }
 
-async function review(r, pkg) {
+/** @param {InstallResources} r */
+async function review({ notifications, overlay, plugins, social, workbench }, pkg) {
   const label = displayName(pkg.manifest);
-  if (r.plugins.plugins.has(pluginId(pkg.manifest))) {
-    r.notifications.warn(`“${label}” is already installed.`);
+  if (plugins.plugins.has(pluginId(pkg.manifest))) {
+    notifications.warn(`“${label}” is already installed.`);
     return;
   }
   // Trust assessment can hit the network (domain assetlinks); do it before review.
   let trust = { status: 'unverified' };
   try {
-    trust = await r.plugins.assessTrust(pkg);
+    trust = await plugins.assessTrust(pkg);
   } catch { /* offline / unreachable */ }
 
   // A tampered package is refused here rather than presented with a warning. The review
@@ -50,31 +59,25 @@ async function review(r, pkg) {
   // are not what was signed, so there is nothing to weigh. See installPolicyFor.
   const policy = installPolicyFor(trust);
   if (!policy.allowed) {
-    r.notifications.error(`“${label}” was not installed. ${policy.detail}`, { sticky: true });
+    notifications.error(`“${label}” was not installed. ${policy.detail}`, { sticky: true });
     return;
   }
 
-  const summary = reviewSummary(pkg, trust);
-  r.overlay.set({ dialog: {
+  // `installActions`, not an `onInstall` closure. Two docblocks state the invariant —
+  // "Nothing in a dialog spec is callable, which matters because the spec lives in
+  // workbench state" (actions.js) and "the dialog spec holds no functions" (overlays.js) —
+  // and this dialog was the sole violation. That closure cleared the overlay, moved the
+  // workbench, raised a notification and performed the network install, all after the
+  // dispatching action's lease had been released and none of it on the feed.
+  //
+  // The alternative was already here: pluginReview keeps its ticked grants in viewState and
+  // dispatches per toggle, so the action needs to carry only `pkg` and `trust` and can read
+  // the grants from the key the dialog already writes.
+  overlay.set({ dialog: {
     kind: 'plugin-review',
-    summary,
+    summary: reviewSummary(pkg, trust),
     policy,
-    isAdmin: !!r.social.state.admin,
-    onInstall: async (grants) => {
-      r.overlay.set({ dialog: null });
-      // Account installs upload the package + run a handshake that can take a while —
-      // switch to the plugins view (which shows the plugin's loading state) and hold a
-      // sticky "Installing…" toast so the user isn't left staring at nothing.
-      r.workbench.set({ activity: 'plugins', sidebarVisible: true });
-      const pending = r.notifications.info(`Installing “${label}”…`, { sticky: true });
-      try {
-        await r.plugins.install(pkg, { grants, trust });
-        r.notifications.dismiss(pending);
-        r.notifications.success(`Installed “${label}”`);
-      } catch (err) {
-        r.notifications.dismiss(pending);
-        r.notifications.error(`Install failed: ${err.message}`);
-      }
-    },
+    isAdmin: !!social.get().admin,
+    installActions: [new InstallReviewedPluginAction(pkg, trust, label)],
   } });
 }