@ambitresearch/genie 1.3.1

package/dist/config/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/config/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAMH,gFAAgF;AAChF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;EAKrB,CAAC;AAEX,wDAAwD;AACxD,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;AAEnE,mEAAmE;AACnE,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAIpC;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;aAClB,QAAQ,EAAE,SAAS,MAAM,EAAE;gBAA3B,QAAQ,EAAE,SAAS,MAAM,EAAE;CAIxD;AAID;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAazE;AAID,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,SAAS,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,yEAAyE;IACzE,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACpC,oEAAoE;IACpE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,OAAO,GAAE,kBAAuB,GAAG,YAAY,EAAE,CA8C5E;AAID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,KAAK,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAA2C,GACnE,IAAI,CAON"}

package/dist/config/secrets.js

@@ -0,0 +1,130 @@
+/**
+ * Secret loading (M5-03 / DRO-275) — no plaintext secrets at rest.
+ *
+ * Every secret genie uses is read only from env vars or, when
+ * `--secrets-from <path>` is passed (e.g. a mounted Docker/Kubernetes
+ * secret), from an owner-only `KEY=VALUE`-per-line file at that path (AC6).
+ * Files with group/other permission bits are rejected before reading. Nothing
+ * secret is ever hardcoded, and this module never writes a secret value to
+ * disk, argv, or a log line.
+ *
+ * Bootstrap contract (AC2): `loadSecrets()` throws `SecretValidationError`
+ * with one message per problem when any *required* secret is:
+ *   - missing (unset, and absent from a `--secrets-from` file if provided);
+ *   - shorter than its required minimum length;
+ *   - present verbatim anywhere in `process.argv` (a value passed as a CLI
+ *     flag is visible to `ps`/shell history on every other local user, so a
+ *     secret leaking into argv is treated as fatal, not just discouraged).
+ *
+ * AC3: `auditLoadedSecrets` logs which secret *names* were loaded (never
+ * values) as a single structured line on process.stderr, mirroring the
+ * stdout-is-JSON-RPC convention documented in `llm/client.ts`.
+ */
+import { readFileSync, statSync } from "node:fs";
+// ─── Known secrets ───────────────────────────────────────────────────────────
+/** Every secret env var genie recognises, and whether it's required to boot. */
+export const SECRET_DEFINITIONS = [
+    { key: "GENIE_LLM_API_KEY", required: true, minLength: 16 },
+    { key: "OAUTH_HS256_KEY", required: true, minLength: 32 },
+    { key: "GENIE_GIT_TOKEN", required: false, minLength: 0 },
+    { key: "OAUTH_CLIENT_SECRET", required: false, minLength: 0 },
+];
+/** Minimum acceptable length for a required secret value (AC2). */
+export const MIN_SECRET_LENGTH = 16;
+// ─── Errors ──────────────────────────────────────────────────────────────────
+/**
+ * Thrown by `loadSecrets` when bootstrap validation fails. Aggregates every
+ * problem found (not just the first) so a misconfigured deployment gets the
+ * full picture in one failure rather than fixing issues one at a time.
+ */
+export class SecretValidationError extends Error {
+    problems;
+    constructor(problems) {
+        super(`Secret validation failed:\n  - ${problems.join("\n  - ")}`);
+        this.problems = problems;
+        this.name = "SecretValidationError";
+    }
+}
+// ─── Secrets-from-file parsing ───────────────────────────────────────────────
+/**
+ * Parse a `KEY=VALUE`-per-line secrets file (AC6), e.g. a mounted secret
+ * mounted at `/run/secrets/genie`. Blank lines and `#`-prefixed comments are
+ * skipped. Values are not trimmed of surrounding quotes — the file is
+ * expected to hold raw values, matching Docker/Kubernetes secret conventions
+ * (unlike a shell-sourced `.env`, no quoting/escaping is applied).
+ */
+export function parseSecretsFile(contents) {
+    const out = {};
+    for (const rawLine of contents.split("\n")) {
+        const line = rawLine.trim();
+        if (line === "" || line.startsWith("#"))
+            continue;
+        const eq = line.indexOf("=");
+        if (eq === -1)
+            continue;
+        const key = line.slice(0, eq).trim();
+        const value = line.slice(eq + 1);
+        if (key === "")
+            continue;
+        out[key] = value;
+    }
+    return out;
+}
+/**
+ * Load and validate every known secret (AC1/AC2). Reads from env only,
+ * optionally overlaid by a `--secrets-from` file (AC6). Throws
+ * `SecretValidationError` if any *required* secret is missing, too short, or
+ * leaked into argv verbatim.
+ *
+ * Returns only the secrets that were actually present (optional secrets are
+ * omitted when unset) so callers can distinguish "not configured" from "".
+ */
+export function loadSecrets(options = {}) {
+    const env = options.env ?? process.env;
+    const argv = options.argv ?? process.argv;
+    const readFile = options.readFile ?? ((path) => readFileSync(path, "utf8"));
+    const statFile = options.statFile ?? statSync;
+    let fileValues = {};
+    if (options.secretsFromPath) {
+        const mode = statFile(options.secretsFromPath).mode & 0o777;
+        if ((mode & 0o077) !== 0) {
+            throw new SecretValidationError([
+                `Secrets file ${options.secretsFromPath} must not be readable or writable by group or other users (mode ${mode.toString(8).padStart(3, "0")}).`,
+            ]);
+        }
+        fileValues = parseSecretsFile(readFile(options.secretsFromPath));
+    }
+    const problems = [];
+    const loaded = [];
+    for (const def of SECRET_DEFINITIONS) {
+        const value = fileValues[def.key] ?? env[def.key];
+        if (value === undefined || value === "") {
+            if (def.required)
+                problems.push(`${def.key} is required but not set.`);
+            continue;
+        }
+        if (def.required && value.length < def.minLength) {
+            problems.push(`${def.key} must be at least ${def.minLength} characters (got ${value.length}).`);
+        }
+        if (argv.some((arg) => arg.includes(value))) {
+            problems.push(`${def.key}'s value was found in process.argv — secrets must never be passed as CLI flags.`);
+        }
+        loaded.push({ key: def.key, value });
+    }
+    if (problems.length > 0)
+        throw new SecretValidationError(problems);
+    return loaded;
+}
+// ─── Startup audit (AC3) ─────────────────────────────────────────────────────
+/**
+ * Log which secrets were loaded — key names only, never values — as a single
+ * structured line on stderr (stdout is the JSON-RPC stream on the stdio
+ * transport; see `llm/client.ts` for the same convention).
+ */
+export function auditLoadedSecrets(loaded, write = (line) => process.stderr.write(line)) {
+    write(JSON.stringify({
+        event: "secrets.loaded",
+        keys: loaded.map((s) => s.key),
+    }) + "\n");
+}
+//# sourceMappingURL=secrets.js.map

package/dist/config/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/config/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,gFAAgF;AAEhF,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,EAAE,GAAG,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;IAC3D,EAAE,GAAG,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;IACzD,EAAE,GAAG,EAAE,iBAAiB,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;IACzD,EAAE,GAAG,EAAE,qBAAqB,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;CACrD,CAAC;AAKX,mEAAmE;AACnE,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAClB;IAA5B,YAA4B,QAA2B;QACrD,KAAK,CAAC,kCAAkC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QADzC,aAAQ,GAAR,QAAQ,CAAmB;QAErD,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,GAAG,KAAK,EAAE;YAAE,SAAS;QACzB,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AA0BD;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,UAA8B,EAAE;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAE9C,IAAI,UAAU,GAA2B,EAAE,CAAC;IAC5C,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,qBAAqB,CAAC;gBAC9B,gBAAgB,OAAO,CAAC,eAAe,mEAAmE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI;aAChJ,CAAC,CAAC;QACL,CAAC;QACD,UAAU,GAAG,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAmB,EAAE,CAAC;IAElC,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAElD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,IAAI,GAAG,CAAC,QAAQ;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,GAAG,2BAA2B,CAAC,CAAC;YACvE,SAAS;QACX,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC;YACjD,QAAQ,CAAC,IAAI,CACX,GAAG,GAAG,CAAC,GAAG,qBAAqB,GAAG,CAAC,SAAS,oBAAoB,KAAK,CAAC,MAAM,IAAI,CACjF,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CACX,GAAG,GAAG,CAAC,GAAG,iFAAiF,CAC5F,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAEnE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAA+B,EAC/B,QAAgC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;IAEpE,KAAK,CACH,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,gBAAgB;QACvB,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;KAC/B,CAAC,GAAG,IAAI,CACV,CAAC;AACJ,CAAC"}

package/dist/framework/html.d.ts

@@ -0,0 +1,103 @@
+/**
+ * `HtmlAdapter` (M2-08 stub → **v2 · DRO-617**) — the vanilla-HTML framework adapter.
+ *
+ * Lowers a neutral {@link RenderInput} (a self-contained `.html` document /
+ * template) into the three target artefacts, mirroring {@link ReactAdapter} /
+ * {@link VueAdapter} method-for-method so `conjure` treats every framework the
+ * same:
+ *   - {@link HtmlAdapter.renderSource}  → `<Name>.html` (the canonical source)
+ *   - {@link HtmlAdapter.renderPreview} → `<Name>.preview.js` — a browser-ready
+ *     **IIFE** exposing the component on `globalThis.GenieComponent` for the M4
+ *     iframe grid to mount, exactly like the React/Vue previews
+ *   - {@link HtmlAdapter.extractDts}    → `<Name>.d.ts` — a minimal custom-element
+ *     typing surface (an `HTMLElementTagNameMap` augmentation for any
+ *     `customElements.define(...)` the source registers), or a valid empty module
+ *
+ * ── Why vanilla HTML still emits a `.preview.js` IIFE ─────────────────────────
+ * The HTML *is* already browser-ready — but the M4-03 iframe grid mounts **every**
+ * framework through the identical `window.{@link PREVIEW_GLOBAL_NAME}` handle
+ * (`{ default, <Name> }`), so React and Vue cards mount the same way (react.ts /
+ * vue.ts). Emitting an HTML card as a raw document instead would fork the grid's
+ * mount path per framework. Instead this adapter wraps the markup in the same
+ * preview-global contract: the IIFE exposes a descriptor whose `mount(container)`
+ * writes the component's markup into the card and *re-executes* any inline
+ * `<script>` (browsers do not run scripts inserted via `innerHTML`), so an
+ * interactive vanilla-HTML component behaves the same mounted as it would opened
+ * directly. This is the issue's "mostly a pass-through + optional JS/CSS inlining":
+ * no bundler, no compile — the markup flows through verbatim, only *wrapped* for a
+ * uniform mount.
+ *
+ * ── No preview host globals ───────────────────────────────────────────────────
+ * Unlike React (`window.React`) and Vue (`window.Vue`), a vanilla-HTML preview has
+ * **no** framework runtime to resolve from a host global — the browser is the
+ * runtime. So there is no host-global contract and no esbuild rewrite plugin here;
+ * the preview is fully self-contained and evaluates in any window.
+ *
+ * ── Import-time safety ────────────────────────────────────────────────────────
+ * Nothing heavy is imported here at all — the preview is assembled from plain
+ * string templating and `extractDts` scans the source with a regex — so resolving
+ * an `HtmlAdapter` (which the registry does on first `getAdapter("html")`) is
+ * free, and `conjure` can read its `promptDirective` / `defaultViewport` on the
+ * generation hot path with zero cost. The React/Vue adapters lazy-`import` esbuild
+ * / ts-morph / the SFC compiler for the same "keep resolving cheap" reason; the
+ * HTML adapter simply needs none of them.
+ */
+import { type AdapterFile, type FrameworkAdapter, type Framework, type RenderInput, type Viewport } from "./interface.js";
+/**
+ * v2 tracking issue this adapter was implemented under (kept exported for
+ * provenance and referenced by the conformance suite's URL-shape assertion).
+ * Retained now that HTML is no longer a stub so historical links still resolve.
+ */
+export declare const HTML_TRACKING_ISSUE = "https://github.com/ambitresearch/genie/issues/130";
+/**
+ * The property name the preview descriptor carries the component's raw markup
+ * under. Exported so a test (or the M4 grid) can read the pass-through markup off
+ * `window.GenieComponent.default.html` without re-deriving the key.
+ */
+export declare const PREVIEW_HTML_KEY = "html";
+export declare class HtmlAdapter implements FrameworkAdapter {
+    readonly framework: Framework;
+    /**
+     * A comfortable default card for a vanilla-HTML component when the caller has no
+     * better viewport. Matches the React/Vue adapters (and the RFC's default preview
+     * grid cell, §7.5) so a framework switch never resizes a card by default.
+     */
+    readonly defaultViewport: Viewport;
+    /**
+     * The framework directive `conjure` injects into the generation prompt (AC4):
+     * name the target framework and the self-contained vanilla-HTML shape the model
+     * should emit. Kept aligned with the original stub's directive so a prompt built
+     * before this adapter graduated still reads identically.
+     */
+    readonly promptDirective: string;
+    /**
+     * The canonical source file: `<Name>.html`, carrying the model-authored markup
+     * verbatim. `text/html` matches the MIME the kit-file classifier maps `.html` to
+     * (`mime-types` resolves `.html` → `text/html`), so an adapter-emitted source and
+     * a store-read source report the same type.
+     */
+    renderSource(input: RenderInput): AdapterFile;
+    /**
+     * Wrap the component markup in the browser-ready **IIFE** exposing it on
+     * `globalThis.${PREVIEW_GLOBAL_NAME}` (`{ default, <Name> }`), so the M4 grid
+     * mounts an HTML card through the identical `window.GenieComponent` handle it
+     * uses for React/Vue — see {@link previewIife} for the descriptor + `mount`
+     * contract. The markup passes through verbatim (no bundler, no compile); this is
+     * `async` only to satisfy the {@link FrameworkAdapter} contract (React/Vue are
+     * async because they lazy-load esbuild) — HTML needs no async work, so it
+     * resolves immediately.
+     */
+    renderPreview(input: RenderInput): Promise<AdapterFile>;
+    /**
+     * Emit a `.d.ts` typing surface (parity with React/Vue). A vanilla-HTML
+     * component exports no component type, so the useful typing is the **custom
+     * elements** it registers: {@link customElementTags} scans the source for
+     * `customElements.define("x-y", …)` and {@link dtsForCustomElements} augments
+     * `HTMLElementTagNameMap` for each. A component that registers none falls back to
+     * a valid empty module (`export {};`) — never an empty file — exactly as the
+     * React/Vue adapters do for a source with no exported declarations. `async` only
+     * to match the contract; the work is synchronous.
+     */
+    extractDts(input: RenderInput): Promise<AdapterFile>;
+}
+//# sourceMappingURL=html.d.ts.map

package/dist/framework/html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../../src/framework/html.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,QAAQ,EACd,MAAM,gBAAgB,CAAC;AAQxB;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,sDAAsD,CAAC;AAoBvF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAgIvC,qBAAa,WAAY,YAAW,gBAAgB;IAClD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAU;IAEvC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAA+B;IAEjE;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAInB;IAEb;;;;;OAKG;IACH,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,WAAW;IAQ7C;;;;;;;;;OASG;IACH,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAQvD;;;;;;;;;OASG;IACH,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;CAQrD"}

package/dist/framework/html.js

@@ -0,0 +1,271 @@
+/**
+ * `HtmlAdapter` (M2-08 stub → **v2 · DRO-617**) — the vanilla-HTML framework adapter.
+ *
+ * Lowers a neutral {@link RenderInput} (a self-contained `.html` document /
+ * template) into the three target artefacts, mirroring {@link ReactAdapter} /
+ * {@link VueAdapter} method-for-method so `conjure` treats every framework the
+ * same:
+ *   - {@link HtmlAdapter.renderSource}  → `<Name>.html` (the canonical source)
+ *   - {@link HtmlAdapter.renderPreview} → `<Name>.preview.js` — a browser-ready
+ *     **IIFE** exposing the component on `globalThis.GenieComponent` for the M4
+ *     iframe grid to mount, exactly like the React/Vue previews
+ *   - {@link HtmlAdapter.extractDts}    → `<Name>.d.ts` — a minimal custom-element
+ *     typing surface (an `HTMLElementTagNameMap` augmentation for any
+ *     `customElements.define(...)` the source registers), or a valid empty module
+ *
+ * ── Why vanilla HTML still emits a `.preview.js` IIFE ─────────────────────────
+ * The HTML *is* already browser-ready — but the M4-03 iframe grid mounts **every**
+ * framework through the identical `window.{@link PREVIEW_GLOBAL_NAME}` handle
+ * (`{ default, <Name> }`), so React and Vue cards mount the same way (react.ts /
+ * vue.ts). Emitting an HTML card as a raw document instead would fork the grid's
+ * mount path per framework. Instead this adapter wraps the markup in the same
+ * preview-global contract: the IIFE exposes a descriptor whose `mount(container)`
+ * writes the component's markup into the card and *re-executes* any inline
+ * `<script>` (browsers do not run scripts inserted via `innerHTML`), so an
+ * interactive vanilla-HTML component behaves the same mounted as it would opened
+ * directly. This is the issue's "mostly a pass-through + optional JS/CSS inlining":
+ * no bundler, no compile — the markup flows through verbatim, only *wrapped* for a
+ * uniform mount.
+ *
+ * ── No preview host globals ───────────────────────────────────────────────────
+ * Unlike React (`window.React`) and Vue (`window.Vue`), a vanilla-HTML preview has
+ * **no** framework runtime to resolve from a host global — the browser is the
+ * runtime. So there is no host-global contract and no esbuild rewrite plugin here;
+ * the preview is fully self-contained and evaluates in any window.
+ *
+ * ── Import-time safety ────────────────────────────────────────────────────────
+ * Nothing heavy is imported here at all — the preview is assembled from plain
+ * string templating and `extractDts` scans the source with a regex — so resolving
+ * an `HtmlAdapter` (which the registry does on first `getAdapter("html")`) is
+ * free, and `conjure` can read its `promptDirective` / `defaultViewport` on the
+ * generation hot path with zero cost. The React/Vue adapters lazy-`import` esbuild
+ * / ts-morph / the SFC compiler for the same "keep resolving cheap" reason; the
+ * HTML adapter simply needs none of them.
+ */
+import { componentPath, } from "./interface.js";
+// The M4 grid's preview-global name is a cross-framework contract; import the
+// single source of truth from the React adapter rather than redeclaring it, so
+// HTML, Vue and React cards are all mounted through the identical
+// `window.GenieComponent` handle. (react.js has no heavy top-level imports —
+// only `import type` — so this stays free and pulls no esbuild/ts-morph.)
+import { PREVIEW_GLOBAL_NAME } from "./react.js";
+/**
+ * v2 tracking issue this adapter was implemented under (kept exported for
+ * provenance and referenced by the conformance suite's URL-shape assertion).
+ * Retained now that HTML is no longer a stub so historical links still resolve.
+ */
+export const HTML_TRACKING_ISSUE = "https://github.com/ambitresearch/genie/issues/130";
+/**
+ * Matches a `customElements.define("tag-name", …)` registration in the source,
+ * capturing the custom-element tag (which must contain a hyphen per the HTML
+ * spec). Used by {@link HtmlAdapter.extractDts} to surface a typed element map.
+ * Tolerant of single/double/back quotes and arbitrary whitespace around `(`.
+ *
+ * **Case-sensitive by design** (only the `g` flag — no `i`): `customElements.define`
+ * is a case-sensitive JS API, so a mixed-case token like `CustomElements.Define` is
+ * not a real registration and must not match. More importantly, a valid custom-element
+ * name is lowercase per the HTML spec — `define("X-Counter", …)` throws `SyntaxError`
+ * at runtime — so an `i` flag would let the tag group accept uppercase names and type
+ * an element in `HTMLElementTagNameMap` that can never actually be registered. The
+ * literal `customElements`/`define` and every valid tag name are already lowercase,
+ * so dropping `i` costs nothing and rejects exactly the tags that can never exist.
+ */
+const CUSTOM_ELEMENT_DEFINE = /customElements\s*\.\s*define\s*\(\s*["'`]([a-z][a-z0-9]*-[a-z0-9-]*)["'`]/g;
+/**
+ * The property name the preview descriptor carries the component's raw markup
+ * under. Exported so a test (or the M4 grid) can read the pass-through markup off
+ * `window.GenieComponent.default.html` without re-deriving the key.
+ */
+export const PREVIEW_HTML_KEY = "html";
+/**
+ * Serialize a string into a JS string literal that is also safe to embed inside
+ * an HTML `<script>` block. `JSON.stringify` handles quotes/newlines/control
+ * chars, and replacing every `<` with the `<` escape means the literal can
+ * never contain a `</script>` (or `<script>`, or `<!--`) token an HTML parser
+ * would act on. `"<"` evaluates back to `"<"` at JS runtime, so the value
+ * the descriptor carries is byte-identical to the source markup.
+ */
+function jsStringForHtmlEmbedding(value) {
+    return JSON.stringify(value).replace(/</g, "\\u003c");
+}
+/**
+ * Build the browser-ready preview IIFE body for a vanilla-HTML component. The
+ * emitted script assigns `window.GenieComponent = { default: descriptor, <Name>:
+ * descriptor }` (the same `{ default, <Name> }` shape React/Vue expose), where the
+ * descriptor is:
+ *
+ *   {
+ *     framework: "html",
+ *     html: "<the component markup, verbatim>",
+ *     mount: function (container) { … }
+ *   }
+ *
+ * `mount` writes the markup into the target element and then re-executes any
+ * inline `<script>` the markup carried — because setting `innerHTML` produces
+ * inert `<script>` nodes the browser will not run. Re-creating each `<script>`
+ * (copying its attributes + text) makes an interactive vanilla-HTML component work
+ * mounted exactly as it would opened directly (the "optional JS … inlining" the
+ * issue calls for). It is defensive about a missing DOM (returns without throwing)
+ * so evaluating the bundle for static analysis never crashes.
+ *
+ * The markup is embedded via `JSON.stringify` so any quotes / newlines in the
+ * source are safely escaped into a single JS string literal. `JSON.stringify`
+ * does **not** escape `<` (or `/`), so a literal `</script>` in the markup would
+ * survive verbatim — harmless in a standalone `.js` file, but a script-breakout
+ * hazard the instant this preview is inlined into an HTML `<script>` block (which
+ * an iframe host page may do). Escaping every `<` to its `<` unicode form
+ * closes that hole: `"<"` evaluates back to `<` at runtime (so the mounted
+ * markup is byte-identical to the source), yet no HTML parser ever sees a
+ * `<script` / `</script` token in the emitted preview. The standard safe-embed
+ * technique used by JSON-in-HTML serializers.
+ */
+function previewIife(input) {
+    const markup = jsStringForHtmlEmbedding(input.source);
+    const componentExport = JSON.stringify(input.componentName);
+    return [
+        `(function () {`,
+        `  "use strict";`,
+        `  var descriptor = {`,
+        `    framework: "html",`,
+        `    ${PREVIEW_HTML_KEY}: ${markup},`,
+        `    mount: function (container) {`,
+        `      if (!container || typeof document === "undefined") return;`,
+        `      container.innerHTML = descriptor.${PREVIEW_HTML_KEY};`,
+        `      // Scripts inserted via innerHTML are inert; re-create each so the`,
+        `      // browser executes it — this is what makes interactivity work mounted.`,
+        `      var inert = container.querySelectorAll("script");`,
+        `      for (var i = 0; i < inert.length; i++) {`,
+        `        var old = inert[i];`,
+        `        var next = document.createElement("script");`,
+        `        for (var a = 0; a < old.attributes.length; a++) {`,
+        `          var attr = old.attributes[a];`,
+        `          next.setAttribute(attr.name, attr.value);`,
+        `        }`,
+        `        next.textContent = old.textContent;`,
+        `        old.parentNode.replaceChild(next, old);`,
+        `      }`,
+        `      return container;`,
+        `    },`,
+        `  };`,
+        `  var GC = { default: descriptor };`,
+        `  GC[${componentExport}] = descriptor;`,
+        `  if (typeof window !== "undefined") {`,
+        `    window.${PREVIEW_GLOBAL_NAME} = GC;`,
+        `  } else if (typeof globalThis !== "undefined") {`,
+        `    globalThis.${PREVIEW_GLOBAL_NAME} = GC;`,
+        `  }`,
+        `})();`,
+    ].join("\n");
+}
+/**
+ * Collect the distinct custom-element tag names the source registers via
+ * `customElements.define("x-y", …)`, in first-seen order. Empty when the markup
+ * defines no custom elements (the common case for a plain HTML component).
+ */
+function customElementTags(source) {
+    const tags = [];
+    const seen = new Set();
+    // `matchAll` needs the /g flag (present on CUSTOM_ELEMENT_DEFINE); re-run from a
+    // fresh matcher each call so the shared regex's lastIndex never leaks state.
+    for (const match of source.matchAll(CUSTOM_ELEMENT_DEFINE)) {
+        const tag = match[1];
+        if (tag && !seen.has(tag)) {
+            seen.add(tag);
+            tags.push(tag);
+        }
+    }
+    return tags;
+}
+/**
+ * Build the `.d.ts` typing surface for an HTML component. Vanilla HTML has no
+ * exported component type the way a `.tsx`/`.vue` source does, so the only stable
+ * typing worth surfacing is the **custom elements** the markup registers: each
+ * `customElements.define("x-y", …)` is declared as an `HTMLElement` and mapped in
+ * `HTMLElementTagNameMap`, so a consuming TypeScript project's
+ * `document.createElement("x-y")` / `querySelector("x-y")` are typed. When the
+ * source registers none, fall back to a valid empty module (never an empty file),
+ * mirroring the React/Vue `export {};` fallback.
+ */
+function dtsForCustomElements(tags) {
+    if (tags.length === 0)
+        return `export {};\n`;
+    const lines = [
+        "// Custom elements this HTML component registers via customElements.define().",
+        "declare global {",
+        "  interface HTMLElementTagNameMap {",
+    ];
+    for (const tag of tags) {
+        lines.push(`    ${JSON.stringify(tag)}: HTMLElement;`);
+    }
+    lines.push("  }", "}", "export {};", "");
+    return lines.join("\n");
+}
+export class HtmlAdapter {
+    framework = "html";
+    /**
+     * A comfortable default card for a vanilla-HTML component when the caller has no
+     * better viewport. Matches the React/Vue adapters (and the RFC's default preview
+     * grid cell, §7.5) so a framework switch never resizes a card by default.
+     */
+    defaultViewport = { width: 400, height: 300 };
+    /**
+     * The framework directive `conjure` injects into the generation prompt (AC4):
+     * name the target framework and the self-contained vanilla-HTML shape the model
+     * should emit. Kept aligned with the original stub's directive so a prompt built
+     * before this adapter graduated still reads identically.
+     */
+    promptDirective = [
+        "Target framework: html",
+        "Emit a self-contained vanilla HTML component: semantic markup with inline " +
+            "<style>, and vanilla JS in a <script> only if interactivity is required.",
+    ].join("\n");
+    /**
+     * The canonical source file: `<Name>.html`, carrying the model-authored markup
+     * verbatim. `text/html` matches the MIME the kit-file classifier maps `.html` to
+     * (`mime-types` resolves `.html` → `text/html`), so an adapter-emitted source and
+     * a store-read source report the same type.
+     */
+    renderSource(input) {
+        return {
+            path: componentPath(input, `${input.componentName}.html`),
+            content: input.source,
+            mimeType: "text/html",
+        };
+    }
+    /**
+     * Wrap the component markup in the browser-ready **IIFE** exposing it on
+     * `globalThis.${PREVIEW_GLOBAL_NAME}` (`{ default, <Name> }`), so the M4 grid
+     * mounts an HTML card through the identical `window.GenieComponent` handle it
+     * uses for React/Vue — see {@link previewIife} for the descriptor + `mount`
+     * contract. The markup passes through verbatim (no bundler, no compile); this is
+     * `async` only to satisfy the {@link FrameworkAdapter} contract (React/Vue are
+     * async because they lazy-load esbuild) — HTML needs no async work, so it
+     * resolves immediately.
+     */
+    renderPreview(input) {
+        return Promise.resolve({
+            path: componentPath(input, `${input.componentName}.preview.js`),
+            content: previewIife(input),
+            mimeType: "text/javascript",
+        });
+    }
+    /**
+     * Emit a `.d.ts` typing surface (parity with React/Vue). A vanilla-HTML
+     * component exports no component type, so the useful typing is the **custom
+     * elements** it registers: {@link customElementTags} scans the source for
+     * `customElements.define("x-y", …)` and {@link dtsForCustomElements} augments
+     * `HTMLElementTagNameMap` for each. A component that registers none falls back to
+     * a valid empty module (`export {};`) — never an empty file — exactly as the
+     * React/Vue adapters do for a source with no exported declarations. `async` only
+     * to match the contract; the work is synchronous.
+     */
+    extractDts(input) {
+        const tags = customElementTags(input.source);
+        return Promise.resolve({
+            path: componentPath(input, `${input.componentName}.d.ts`),
+            content: dtsForCustomElements(tags),
+            mimeType: "text/plain",
+        });
+    }
+}
+//# sourceMappingURL=html.js.map

package/dist/framework/html.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.js","sourceRoot":"","sources":["../../src/framework/html.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EACL,aAAa,GAMd,MAAM,gBAAgB,CAAC;AACxB,8EAA8E;AAC9E,+EAA+E;AAC/E,kEAAkE;AAClE,6EAA6E;AAC7E,0EAA0E;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,mDAAmD,CAAC;AAEvF;;;;;;;;;;;;;;GAcG;AACH,MAAM,qBAAqB,GACzB,4EAA4E,CAAC;AAE/E;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAAC,KAAa;IAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,SAAS,WAAW,CAAC,KAAkB;IACrC,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC5D,OAAO;QACL,gBAAgB;QAChB,iBAAiB;QACjB,sBAAsB;QACtB,wBAAwB;QACxB,OAAO,gBAAgB,KAAK,MAAM,GAAG;QACrC,mCAAmC;QACnC,kEAAkE;QAClE,0CAA0C,gBAAgB,GAAG;QAC7D,0EAA0E;QAC1E,+EAA+E;QAC/E,yDAAyD;QACzD,gDAAgD;QAChD,6BAA6B;QAC7B,sDAAsD;QACtD,2DAA2D;QAC3D,yCAAyC;QACzC,qDAAqD;QACrD,WAAW;QACX,6CAA6C;QAC7C,iDAAiD;QACjD,SAAS;QACT,yBAAyB;QACzB,QAAQ;QACR,MAAM;QACN,qCAAqC;QACrC,QAAQ,eAAe,iBAAiB;QACxC,wCAAwC;QACxC,cAAc,mBAAmB,QAAQ;QACzC,mDAAmD;QACnD,kBAAkB,mBAAmB,QAAQ;QAC7C,KAAK;QACL,OAAO;KACR,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,MAAc;IACvC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,iFAAiF;IACjF,6EAA6E;IAC7E,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAC3D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAAC,IAAc;IAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,cAAc,CAAC;IAC7C,MAAM,KAAK,GAAa;QACtB,+EAA+E;QAC/E,kBAAkB;QAClB,qCAAqC;KACtC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACzD,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,OAAO,WAAW;IACb,SAAS,GAAc,MAAM,CAAC;IAEvC;;;;OAIG;IACM,eAAe,GAAa,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAEjE;;;;;OAKG;IACM,eAAe,GAAW;QACjC,wBAAwB;QACxB,4EAA4E;YAC1E,0EAA0E;KAC7E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb;;;;;OAKG;IACH,YAAY,CAAC,KAAkB;QAC7B,OAAO;YACL,IAAI,EAAE,aAAa,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,aAAa,OAAO,CAAC;YACzD,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,QAAQ,EAAE,WAAW;SACtB,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,aAAa,CAAC,KAAkB;QAC9B,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,IAAI,EAAE,aAAa,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,aAAa,aAAa,CAAC;YAC/D,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC;YAC3B,QAAQ,EAAE,iBAAiB;SAC5B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACH,UAAU,CAAC,KAAkB;QAC3B,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,IAAI,EAAE,aAAa,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,aAAa,OAAO,CAAC;YACzD,OAAO,EAAE,oBAAoB,CAAC,IAAI,CAAC;YACnC,QAAQ,EAAE,YAAY;SACvB,CAAC,CAAC;IACL,CAAC;CACF"}