@arshdelight/practi 0.9.0

package/dist/oauth.js

@@ -0,0 +1,244 @@
+import http from 'node:http';
+import { createHash, randomBytes } from 'node:crypto';
+import { openBrowser } from './web.js';
+/**
+ * OAuth 2.1 client（practi cli ↔ practihub 的 Authorization Server）：
+ * 发现 AS metadata → DCR 注册 loopback client → PKCE S256 → 浏览器授权 →
+ * loopback 回调收 code → token 端点换 access/refresh。全部走标准端点。
+ *
+ * 登录流程分步组合（login.ts）：
+ *   session = createLoopbackSession()          // 绑定端口，得到 redirectUri + state
+ *   { client_id } = registerClient(remote, session.redirectUri)
+ *   authorizeUrl = buildAuthorizeUrl(...)      // 含 PKCE challenge + resource + state
+ *   code = await session.waitForCode()         // 浏览器授权回调
+ *   tokens = await exchangeCode(...)           // code + verifier → access/refresh
+ */
+export const LOGIN_SCOPES = 'pop:read pop:write pop:publish pop:delete';
+const CALLBACK_PATH = '/callback';
+const TIMEOUT_MS = 5 * 60 * 1000; // 授权页等待上限
+/** CLI 的 resource（RFC 8707 audience）= remote origin + /cli */
+export function cliResource(remote) {
+    return `${new URL(remote).origin}/cli`;
+}
+/** 从 AS metadata 或约定路径发现端点；缺失时按 practihub 约定回退 */
+export async function discoverAs(remote) {
+    const origin = new URL(remote).origin;
+    const defaults = {
+        authorization_endpoint: `${origin}/oauth/authorize`,
+        token_endpoint: `${origin}/api/auth/oauth/token`,
+        registration_endpoint: `${origin}/api/auth/oauth/register`,
+        revocation_endpoint: `${origin}/api/auth/oauth/revoke`,
+    };
+    try {
+        const res = await fetch(`${origin}/.well-known/oauth-authorization-server`, {
+            headers: { accept: 'application/json' },
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!res.ok)
+            return defaults;
+        const meta = (await res.json());
+        return {
+            authorization_endpoint: meta.authorization_endpoint ?? defaults.authorization_endpoint,
+            token_endpoint: meta.token_endpoint ?? defaults.token_endpoint,
+            registration_endpoint: meta.registration_endpoint ?? defaults.registration_endpoint,
+            revocation_endpoint: meta.revocation_endpoint ?? defaults.revocation_endpoint,
+        };
+    }
+    catch {
+        return defaults;
+    }
+}
+/** DCR（RFC 7591）：注册一个 loopback 回调的 public client */
+export async function registerClient(remote, redirectUri) {
+    const meta = await discoverAs(remote);
+    const res = await fetch(meta.registration_endpoint, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+            client_name: 'practi cli',
+            redirect_uris: [redirectUri],
+            token_endpoint_auth_method: 'none',
+            grant_types: ['authorization_code', 'refresh_token'],
+            response_types: ['code'],
+            scope: LOGIN_SCOPES,
+        }),
+        signal: AbortSignal.timeout(15_000),
+    });
+    if (!res.ok) {
+        throw new Error(`client registration failed (HTTP ${res.status}): ${await res.text()}`);
+    }
+    return (await res.json());
+}
+/** PKCE S256：verifier + challenge */
+export function generatePkcePair() {
+    const verifier = randomBytes(32).toString('base64url');
+    const challenge = createHash('sha256').update(verifier).digest('base64url');
+    return { verifier, challenge };
+}
+/**
+ * 起 loopback server（RFC 8252）并绑定端口。
+ * 必须在 DCR 注册前创建（redirectUri 含端口，注册与授权必须一致）。
+ */
+export function createLoopbackSession() {
+    let settled = false;
+    let timer;
+    const state = randomBytes(16).toString('hex');
+    let resolveCode = null;
+    let rejectCode = null;
+    const codePromise = new Promise((res, rej) => {
+        resolveCode = res;
+        rejectCode = rej;
+    });
+    let port = 0;
+    const server = http.createServer((req, res) => {
+        const url = new URL(req.url ?? '/', 'http://127.0.0.1');
+        if (url.pathname !== CALLBACK_PATH) {
+            res.writeHead(404, { 'content-type': 'text/plain' });
+            res.end('not found');
+            return;
+        }
+        const error = url.searchParams.get('error');
+        if (error) {
+            res.writeHead(400, { 'content-type': 'text/html' });
+            res.end(simplePage('Authorization failed', `The authorization server returned an error: ${escapeHtml(error)}`));
+            finish(new Error(`authorization denied: ${error}`));
+            return;
+        }
+        const code = url.searchParams.get('code');
+        const stateParam = url.searchParams.get('state');
+        if (!code || stateParam !== state) {
+            res.writeHead(400, { 'content-type': 'text/html' });
+            res.end(simplePage('Authorization failed', 'Missing or mismatched code/state.'));
+            finish(new Error('authorization callback missing code or state mismatch'));
+            return;
+        }
+        res.writeHead(200, { 'content-type': 'text/html' });
+        res.end(simplePage('Logged in', 'You can close this window and return to the terminal.'));
+        finish(null, code);
+    });
+    server.on('error', (err) => finish(err));
+    server.listen(0, '127.0.0.1', () => {
+        const addr = server.address();
+        port = typeof addr === 'object' && addr ? addr.port : 0;
+        timer = setTimeout(() => finish(new Error('authorization timed out — no browser callback received')), TIMEOUT_MS);
+    });
+    function finish(err, code) {
+        if (settled)
+            return;
+        settled = true;
+        if (timer)
+            clearTimeout(timer);
+        server.close(() => { });
+        if (err)
+            rejectCode?.(err);
+        else
+            resolveCode?.(code ?? '');
+    }
+    return {
+        get redirectUri() {
+            return `http://127.0.0.1:${port}${CALLBACK_PATH}`;
+        },
+        state,
+        waitForCode: () => codePromise,
+        close: () => finish(new Error('login aborted')),
+    };
+}
+/** 组装授权 URL（浏览器打开用） */
+export function buildAuthorizeUrl(opts) {
+    const url = new URL(opts.authorizationEndpoint);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('client_id', opts.clientId);
+    url.searchParams.set('redirect_uri', opts.redirectUri);
+    url.searchParams.set('code_challenge', opts.codeChallenge);
+    url.searchParams.set('code_challenge_method', 'S256');
+    url.searchParams.set('state', opts.state);
+    url.searchParams.set('scope', LOGIN_SCOPES);
+    url.searchParams.set('resource', opts.resource);
+    return url.toString();
+}
+/** 打开浏览器（或打印 URL 供手动打开） */
+export function openAuthorizeUrl(url, open) {
+    if (open)
+        openBrowser(url);
+    else
+        console.log(`open this URL in your browser:\n  ${url}`);
+}
+/** authorization_code grant：code + verifier → access/refresh */
+export async function exchangeCode(remote, opts) {
+    const meta = await discoverAs(remote);
+    const body = new URLSearchParams({
+        grant_type: 'authorization_code',
+        client_id: opts.clientId,
+        redirect_uri: opts.redirectUri,
+        code: opts.code,
+        code_verifier: opts.verifier,
+    });
+    return postToken(meta.token_endpoint, body);
+}
+/** 用 refresh token 换新的 access/refresh 对（rotation） */
+export async function refreshAccessToken(remote, clientId, refreshToken) {
+    const meta = await discoverAs(remote);
+    const body = new URLSearchParams({
+        grant_type: 'refresh_token',
+        client_id: clientId,
+        refresh_token: refreshToken,
+    });
+    return postToken(meta.token_endpoint, body);
+}
+async function postToken(tokenEndpoint, body) {
+    const res = await fetch(tokenEndpoint, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: body.toString(),
+        signal: AbortSignal.timeout(15_000),
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        let detail = text;
+        try {
+            const j = JSON.parse(text);
+            detail = j.error_description ?? j.error ?? text;
+        }
+        catch {
+            // 保留原文
+        }
+        throw new Error(`token endpoint failed (HTTP ${res.status}): ${detail}`);
+    }
+    const data = (await res.json());
+    if (!data.access_token || !data.refresh_token) {
+        throw new Error('token endpoint returned an invalid response (missing access_token/refresh_token)');
+    }
+    return {
+        access_token: data.access_token,
+        refresh_token: data.refresh_token,
+        expires_in: data.expires_in ?? 3600,
+        scope: data.scope ?? '',
+    };
+}
+/** 撤销 token（RFC 7009，best-effort：失败不抛错） */
+export async function revokeToken(remote, clientId, token, tokenTypeHint) {
+    try {
+        const meta = await discoverAs(remote);
+        const body = new URLSearchParams({ token, client_id: clientId });
+        if (tokenTypeHint)
+            body.set('token_type_hint', tokenTypeHint);
+        await fetch(meta.revocation_endpoint, {
+            method: 'POST',
+            headers: { 'content-type': 'application/x-www-form-urlencoded' },
+            body: body.toString(),
+            signal: AbortSignal.timeout(10_000),
+        });
+    }
+    catch {
+        // best-effort：本地凭证已删，revoke 失败不阻塞 logout
+    }
+}
+function simplePage(title, body) {
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>${title}</title></head>
+<body style="font:16px/1.6 system-ui,sans-serif;margin:40px auto;max-width:480px;text-align:center">
+<h1>${title}</h1><p>${body}</p></body></html>`;
+}
+function escapeHtml(s) {
+    return s.replace(/[&<>"']/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
+}
+//# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvC;;;;;;;;;;;GAWG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,2CAA2C,CAAC;AACxE,MAAM,aAAa,GAAG,WAAW,CAAC;AAClC,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAqB5C,8DAA8D;AAC9D,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC;AACzC,CAAC;AAED,kDAAkD;AAClD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAc;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACtC,MAAM,QAAQ,GAAe;QAC3B,sBAAsB,EAAE,GAAG,MAAM,kBAAkB;QACnD,cAAc,EAAE,GAAG,MAAM,uBAAuB;QAChD,qBAAqB,EAAE,GAAG,MAAM,0BAA0B;QAC1D,mBAAmB,EAAE,GAAG,MAAM,wBAAwB;KACvD,CAAC;IACF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,yCAAyC,EAAE;YAC1E,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;QACvD,OAAO;YACL,sBAAsB,EAAE,IAAI,CAAC,sBAAsB,IAAI,QAAQ,CAAC,sBAAsB;YACtF,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,QAAQ,CAAC,cAAc;YAC9D,qBAAqB,EAAE,IAAI,CAAC,qBAAqB,IAAI,QAAQ,CAAC,qBAAqB;YACnF,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,IAAI,QAAQ,CAAC,mBAAmB;SAC9E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,WAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,qBAAqB,EAAE;QAClD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,WAAW,EAAE,YAAY;YACzB,aAAa,EAAE,CAAC,WAAW,CAAC;YAC5B,0BAA0B,EAAE,MAAM;YAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,KAAK,EAAE,YAAY;SACpB,CAAC;QACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,CAAC,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;AACrD,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAaD;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,KAAiC,CAAC;IACtC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE9C,IAAI,WAAW,GAAoC,IAAI,CAAC;IACxD,IAAI,UAAU,GAAkC,IAAI,CAAC;IACrD,MAAM,WAAW,GAAG,IAAI,OAAO,CAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACnD,WAAW,GAAG,GAAG,CAAC;QAClB,UAAU,GAAG,GAAG,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;YACnC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,sBAAsB,EAAE,+CAA+C,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YAChH,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YAClC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,sBAAsB,EAAE,mCAAmC,CAAC,CAAC,CAAC;YACjF,MAAM,CAAC,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;QACpD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,uDAAuD,CAAC,CAAC,CAAC;QAC1F,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACpH,CAAC,CAAC,CAAC;IAEH,SAAS,MAAM,CAAC,GAAiB,EAAE,IAAa;QAC9C,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvB,IAAI,GAAG;YAAE,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC;;YACtB,WAAW,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,OAAO;QACL,IAAI,WAAW;YACb,OAAO,oBAAoB,IAAI,GAAG,aAAa,EAAE,CAAC;QACpD,CAAC;QACD,KAAK;QACL,WAAW,EAAE,GAAG,EAAE,CAAC,WAAW;QAC9B,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,uBAAuB;AACvB,MAAM,UAAU,iBAAiB,CAAC,IAOjC;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,2BAA2B;AAC3B,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,IAAa;IACzD,IAAI,IAAI;QAAE,WAAW,CAAC,GAAG,CAAC,CAAC;;QACtB,OAAO,CAAC,GAAG,CAAC,qCAAqC,GAAG,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,IAA+E;IAE/E,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,aAAa,EAAE,IAAI,CAAC,QAAQ;KAC7B,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,qDAAqD;AACrD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,QAAgB,EAChB,YAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,QAAQ;QACnB,aAAa,EAAE,YAAY;KAC5B,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,aAAqB,EAAE,IAAqB;IACnE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;QACrC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;QACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmD,CAAC;YAC7E,MAAM,GAAG,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,MAAM,MAAM,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAC;IAC1D,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACtG,CAAC;IACD,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;QACnC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;KACxB,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,QAAgB,EAChB,KAAa,EACb,aAAgD;IAEhD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjE,IAAI,aAAa;YAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAC9D,MAAM,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,IAAY;IAC7C,OAAO,qEAAqE,KAAK;;MAE7E,KAAK,WAAW,IAAI,oBAAoB,CAAC;AAC/C,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;AACnH,CAAC"}

package/dist/render.js

@@ -0,0 +1,25 @@
+/** Compact display hash: first 12 hex chars of the payload */
+export function shortHash(hash) {
+    return hash.slice('sha256:'.length, 'sha256:'.length + 12);
+}
+export function nodeTag(node) {
+    return node.type === 'practice' ? `practice·${node.op}` : 'action';
+}
+/** Render a standard view's header line, e.g. "● Name  [practice·seq]  abc123def456" */
+export function viewHeader(view) {
+    const tag = view.type === 'practice' ? `practice·${view.op}` : 'action';
+    return `● ${view.name}  [${tag}]  ${shortHash(view.hash)}`;
+}
+/** Render aggregate steps as an indented tree (depth from the view, normalized to 0) */
+export function renderSteps(steps, nodes) {
+    const lines = [];
+    for (const s of steps) {
+        const n = nodes.get(s.refHash);
+        const tag = n ? `[${nodeTag(n)}]` : '';
+        const note = s.note ? `  (${s.note})` : '';
+        const desc = s.description !== undefined ? `  — ${s.description}` : '';
+        lines.push(`${'  '.repeat(s.depth)}${s.name}  ${tag}  ${shortHash(s.refHash)}${note}${desc}`);
+    }
+    return lines;
+}
+//# sourceMappingURL=render.js.map

package/dist/render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.js","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAEA,8DAA8D;AAC9D,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAW;IACjC,OAAO,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AACrE,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,UAAU,CAAC,IAAkB;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IACxE,OAAO,KAAK,IAAI,CAAC,IAAI,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,WAAW,CAAC,KAAiB,EAAE,KAAyB;IACtE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/state.js

@@ -0,0 +1,74 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+/** CLI bookkeeping file inside the data directory (the data dir IS a POP workspace).
+ *  旧名 pop.json 仍可读（读旧写新），写入一律走 practi.json。 */
+export const STATE_FILE = 'practi.json';
+const LEGACY_STATE_FILE = 'pop.json';
+export const HASH_RE = /^sha256:[0-9a-f]{64}$/;
+/** 默认 remote：开箱即连官方 hub；自建/本地 hub 用 `practi remote set <url>` 覆盖 */
+export const DEFAULT_REMOTE_URL = 'https://practihub.com';
+/** Default data directory: $PRACTI_HOME (legacy $POP_HOME still honored), else
+ *  ~/.practi on every platform. Deliberately NOT %APPDATA%\practi — that path
+ *  belongs to the unrelated "practi" Electron app's data on Windows. When
+ *  ~/.practi doesn't exist yet but a pre-rename workspace does (%APPDATA%\pop
+ *  or ~/.pop), adopt it silently. */
+export function defaultDataDir() {
+    if (process.env.PRACTI_HOME)
+        return path.resolve(process.env.PRACTI_HOME);
+    if (process.env.POP_HOME)
+        return path.resolve(process.env.POP_HOME);
+    const fresh = path.join(os.homedir(), '.practi');
+    if (fs.existsSync(fresh))
+        return fresh;
+    const legacyCandidates = [
+        process.env.APPDATA ? path.join(process.env.APPDATA, 'pop') : null,
+        path.join(os.homedir(), '.pop'),
+    ].filter((p) => p !== null);
+    for (const legacy of legacyCandidates) {
+        if (fs.existsSync(legacy))
+            return legacy;
+    }
+    return fresh;
+}
+export function statePath(dataDir) {
+    return path.join(dataDir, STATE_FILE);
+}
+/** 旧版（改名前）状态文件路径；存在则优先级低于 practi.json */
+export function legacyStatePath(dataDir) {
+    return path.join(dataDir, LEGACY_STATE_FILE);
+}
+function asRecord(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v) ? v : null;
+}
+function asString(v) {
+    return typeof v === 'string' ? v : undefined;
+}
+export function loadState(dataDir) {
+    // 未配置（或 practi.json 不存在/损坏）时回落默认 remote：开箱即连官方 hub
+    const base = { schema: 1, direct: [], remote: { url: DEFAULT_REMOTE_URL } };
+    const p = statePath(dataDir);
+    const legacy = legacyStatePath(dataDir);
+    const file = fs.existsSync(p) ? p : fs.existsSync(legacy) ? legacy : null;
+    if (file === null)
+        return base;
+    try {
+        const rec = asRecord(JSON.parse(fs.readFileSync(file, 'utf8')));
+        if (rec === null)
+            return base;
+        const state = { schema: 1, direct: [] };
+        const remoteUrl = asString(asRecord(rec.remote)?.url);
+        state.remote = remoteUrl ? { url: remoteUrl } : { url: DEFAULT_REMOTE_URL };
+        if (Array.isArray(rec.direct)) {
+            state.direct = rec.direct.filter((x) => typeof x === 'string' && HASH_RE.test(x));
+        }
+        return state;
+    }
+    catch {
+        return base;
+    }
+}
+export function saveState(dataDir, state) {
+    fs.writeFileSync(statePath(dataDir), JSON.stringify(state, null, 2) + '\n', 'utf8');
+}
+//# sourceMappingURL=state.js.map

package/dist/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;+CAC+C;AAC/C,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CAAC;AACxC,MAAM,iBAAiB,GAAG,UAAU,CAAC;AACrC,MAAM,CAAC,MAAM,OAAO,GAAG,uBAAuB,CAAC;AAE/C,oEAAoE;AACpE,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AAU1D;;;;qCAIqC;AACrC,MAAM,UAAU,cAAc;IAC5B,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACjD,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,gBAAgB,GAAG;QACvB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;QAClE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC;KAChC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACzC,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACtC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACxC,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1G,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,mDAAmD;IACnD,MAAM,IAAI,GAAU,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,EAAE,CAAC;IACnF,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,KAAK,GAAU,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACtD,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC;QAC5E,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,KAAY;IACrD,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AACtF,CAAC"}

package/dist/version.js

@@ -0,0 +1,12 @@
+import { createRequire } from 'node:module';
+import { POP_SPEC_VERSION } from '@arshdelight/pop-sdk';
+/**
+ * 版本单一来源：CLI 版本运行时读 package.json（不硬编码，防漂移），
+ * 协议版本来自 SDK 导出的 POP_SPEC_VERSION（spec 升版只改 SDK 一处）。
+ * src/ 与 dist/ 同深（../package.json 均指向 cli/package.json）。
+ */
+const require = createRequire(import.meta.url);
+const pkg = require('../package.json');
+export const CLI_VERSION = pkg.version;
+export { POP_SPEC_VERSION };
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD;;;;GAIG;AACH,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;AAE9D,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/web.js

@@ -0,0 +1,243 @@
+import http from 'node:http';
+import { spawn } from 'node:child_process';
+import { aggregateView, exportSubtree, readBlob, resolveNodeRef, PracticeError } from '@arshdelight/pop-sdk';
+import { defaultDataDir, loadState } from './state.js';
+import { openWorkspace } from './workspace.js';
+import { nodeTag, shortHash } from './render.js';
+export function runWeb(opts) {
+    const dataDir = opts.dataDir ?? defaultDataDir();
+    // validate the data dir up front so a typo fails fast instead of on first request
+    const ws = openWorkspace(dataDir);
+    const url = `http://127.0.0.1:${opts.port}/`;
+    const server = http.createServer((req, res) => {
+        try {
+            handle(req, res, dataDir, ws);
+        }
+        catch (e) {
+            if (e instanceof PracticeError) {
+                send(res, 404, 'text/plain; charset=utf-8', `${e.code}: ${e.message}`);
+            }
+            else {
+                res.writeHead(500, { 'content-type': 'text/plain; charset=utf-8' });
+                res.end(e instanceof Error ? e.message : String(e));
+            }
+        }
+    });
+    server.listen(opts.port, '127.0.0.1', () => {
+        console.log(`practi web: ${url}`);
+        console.log(`data dir: ${dataDir}`);
+        console.log('press Ctrl-C to stop');
+        if (opts.open)
+            openBrowser(url);
+    });
+    return 0;
+}
+function handle(req, res, dataDir, ws) {
+    const pathname = (req.url ?? '/').split('?')[0];
+    const state = loadState(dataDir);
+    if (pathname === '/' || pathname === '/index.html') {
+        send(res, 200, 'text/html; charset=utf-8', indexHtml(ws, state.direct));
+        return;
+    }
+    const pop = pathname.match(/^\/pop\/(.+)$/);
+    if (pop) {
+        const hash = decodeURIComponent(pop[1]).replace(/\.json$/, '');
+        const resolved = resolveNodeRef(ws, hash);
+        if (pathname.endsWith('.json')) {
+            const view = aggregateView(resolved, ws.nodes);
+            send(res, 200, 'application/json; charset=utf-8', JSON.stringify(view, null, 2));
+            return;
+        }
+        const view = aggregateView(resolved, ws.nodes, { full: true });
+        send(res, 200, 'text/html; charset=utf-8', detailHtml(ws, view));
+        return;
+    }
+    const blob = pathname.match(/^\/blobs\/(sha256:[0-9a-f]{64})$/);
+    if (blob) {
+        const bytes = readBlob(ws.root, blob[1]);
+        if (bytes === null) {
+            send(res, 404, 'text/plain; charset=utf-8', 'E_BLOB_MISSING: blob not present in this workspace');
+            return;
+        }
+        sendBytes(res, mimeFor(ws, blob[1]), bytes);
+        return;
+    }
+    const doc = pathname.match(/^\/doc\/(.+)$/);
+    if (doc) {
+        const hash = decodeURIComponent(doc[1]).replace(/\.json$/, '');
+        const node = ws.nodes.get(resolveNodeRef(ws, hash));
+        if (node) {
+            send(res, 200, 'application/json; charset=utf-8', JSON.stringify(exportSubtree(node, ws.nodes), null, 2));
+            return;
+        }
+    }
+    if (pathname === '/healthz') {
+        send(res, 200, 'text/plain', 'ok');
+        return;
+    }
+    send(res, 404, 'text/plain; charset=utf-8', 'not found');
+}
+function send(res, code, type, body) {
+    res.writeHead(code, { 'content-type': type });
+    res.end(body);
+}
+function sendBytes(res, type, body) {
+    res.writeHead(200, { 'content-type': type, 'cache-control': 'public, max-age=31536000, immutable' });
+    res.end(body);
+}
+/** Best-effort mime for a local blob, looked up from any action that references it */
+function mimeFor(ws, hash) {
+    for (const n of ws.nodes.values()) {
+        if (n.type !== 'action')
+            continue;
+        for (const a of n.attachments ?? []) {
+            if (a.hash === hash && a.mime)
+                return a.mime;
+        }
+    }
+    return 'application/octet-stream';
+}
+export function openBrowser(url) {
+    if (process.platform === 'win32') {
+        // cmd 把 & 当命令分隔符，URL 必须整体加引号（否则带 query 的 OAuth 授权 URL 被截断在首个 &）；
+        // start 的首个引号参数是窗口标题占位；/d /s + verbatim 让 cmd 按原样解析这条命令行
+        spawn('cmd', ['/d', '/s', '/c', `start "" "${url}"`], {
+            windowsVerbatimArguments: true,
+            stdio: 'ignore',
+            detached: true,
+        }).unref();
+        return;
+    }
+    const cmd = process.platform === 'darwin' ? 'open' : 'xdg-open';
+    spawn(cmd, [url], { stdio: 'ignore', detached: true }).unref();
+}
+const CSS = `
+  :root { color-scheme: light; }
+  * { box-sizing: border-box; }
+  body { font: 15px/1.5 system-ui, -apple-system, "Segoe UI", sans-serif; margin: 0; color: #1a1a1a; background: #fafafa; }
+  header { background: #111; color: #fff; padding: 14px 24px; display: flex; gap: 16px; align-items: baseline; }
+  header .brand { font-weight: 700; letter-spacing: .5px; }
+  header .sub { color: #999; font-size: 13px; }
+  main { max-width: 860px; margin: 24px auto; padding: 0 24px 60px; }
+  a { color: #0b57d0; text-decoration: none; }
+  a:hover { text-decoration: underline; }
+  .card { background: #fff; border: 1px solid #e3e3e3; border-radius: 8px; padding: 14px 18px; margin-bottom: 12px; }
+  .card .title { font-weight: 600; font-size: 16px; }
+  .tag { font-size: 12px; color: #666; background: #f0f0f0; border-radius: 4px; padding: 1px 6px; margin-left: 6px; }
+  .hash { font-family: ui-monospace, "Cascadia Code", Consolas, monospace; font-size: 12px; color: #888; }
+  pre { background: #fff; border: 1px solid #e3e3e3; border-radius: 8px; padding: 14px; overflow-x: auto; font-size: 13px; }
+  table { border-collapse: collapse; width: 100%; font-size: 14px; }
+  th, td { text-align: left; padding: 6px 10px; border-bottom: 1px solid #eee; }
+  th { color: #666; font-weight: 600; }
+  .muted { color: #888; }
+  .breadcrumb { margin-bottom: 12px; font-size: 13px; }
+  .section { margin-top: 22px; }
+  .section h2 { font-size: 14px; text-transform: uppercase; letter-spacing: .4px; color: #666; margin: 0 0 8px; }
+  .step { padding: 2px 0; }
+  .step .n { color: #999; }
+  .stepbody { margin: 6px 0 12px 0; padding-left: 20px; }
+  .prose { font-size: 14px; color: #333; }
+  .prose figure { margin: 10px 0; }
+  .prose img { max-width: 100%; border: 1px solid #e3e3e3; border-radius: 6px; }
+  .prose figcaption { font-size: 12px; color: #888; text-align: center; margin-top: 4px; }
+`;
+function page(title, body, dataDir) {
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>${title}</title>
+<style>${CSS}</style></head><body>
+<header><span class="brand">POP</span><span class="sub">local registry</span><span class="sub">${dataDir}</span></header>
+<main>${body}</main></body></html>`;
+}
+function indexHtml(ws, direct) {
+    const roots = direct.filter(h => ws.nodes.has(h));
+    const cards = roots
+        .map(h => {
+        const view = aggregateView(h, ws.nodes);
+        return `<div class="card">
+        <div class="title"><a href="/pop/${encodeURIComponent(h)}">${escapeHtml(view.name)}</a><span class="tag">${view.type === 'practice' ? `practice·${view.op}` : 'action'}</span></div>
+        <div class="hash">${view.hash}</div>
+        ${view.description ? `<div class="muted">${escapeHtml(view.description)}</div>` : ''}
+        <div class="muted">${view.steps.length} step${view.steps.length === 1 ? '' : 's'} · ${view.flow.length} flow edge${view.flow.length === 1 ? '' : 's'} · ${view.outputs.length} output${view.outputs.length === 1 ? '' : 's'}</div>
+      </div>`;
+    })
+        .join('\n');
+    const empty = roots.length === 0 ? '<p class="muted">no direct pops — create one with <code>pop new</code></p>' : '';
+    return page('POP — local registry', `<h1>Direct pops</h1>${empty}${cards}`, ws.root);
+}
+function detailHtml(ws, view) {
+    const esc = escapeHtml;
+    const steps = view.steps
+        .map(s => {
+        const n = ws.nodes.get(s.refHash);
+        const tag = n ? nodeTag(n) : '';
+        const body = s.content && s.content.trim() ? `<div class="stepbody">${renderContent(s.content, n, ws)}</div>` : '';
+        return `<div class="step"><span class="n">${'&nbsp;&nbsp;'.repeat(s.depth)}</span>${esc(s.name)} ${tag ? `<span class="tag">${esc(tag)}</span>` : ''}${s.note ? ` <span class="muted">(${esc(s.note)})</span>` : ''}${body}</div>`;
+    })
+        .join('\n');
+    const flowRows = view.flow
+        .map(e => `<tr><td>${esc(e.name)}</td><td class="hash">${shortHash(e.fromHash)}</td><td>${esc(e.fromName)}</td><td class="hash">${shortHash(e.toHash)}</td><td>${esc(e.toName)}</td></tr>`)
+        .join('\n');
+    const inputs = view.inputs.map(d => `<tr><td>${esc(d.name)}</td><td>${d.spec ? esc(d.spec) : ''}</td><td class="hash">${shortHash(d.refHash)}</td></tr>`).join('\n');
+    const outputs = view.outputs.map(d => `<tr><td>${esc(d.name)}</td><td>${d.spec ? esc(d.spec) : ''}</td><td class="hash">${shortHash(d.refHash)}</td></tr>`).join('\n');
+    const atts = view.attachments.map(a => `<tr><td>${esc(a.name)}</td><td>${a.mime ? esc(a.mime) : ''}</td><td>${a.size ?? ''}</td><td class="hash">${shortHash(a.hash)}</td></tr>`).join('\n');
+    const revs = (view.revisions ?? []).map(r => `<tr><td>${esc(r.when)}</td><td>${esc(r.what)}</td>${r.from ? `<td class="hash">${shortHash(r.from)}</td>` : '<td></td>'}</tr>`).join('\n');
+    return page(`${view.name} — POP`, `
+    <div class="breadcrumb"><a href="/">← all pops</a></div>
+    <h1>${esc(view.name)} <span class="tag">${view.type === 'practice' ? `practice·${view.op}` : 'action'}</span></h1>
+    <div class="hash">${view.hash}</div>
+    ${view.description ? `<p>${esc(view.description)}</p>` : ''}
+    ${view.content && view.content.trim() ? `<div class="section"><h2>Content</h2>${renderContent(view.content, ws.nodes.get(view.hash), ws)}</div>` : ''}
+    <div class="section"><h2>Steps (${view.steps.length})</h2>${steps || '<p class="muted">—</p>'}</div>
+    ${flowRows ? `<div class="section"><h2>Flow (${view.flow.length})</h2><table><tr><th>name</th><th>from</th><th></th><th>to</th><th></th></tr>${flowRows}</table></div>` : ''}
+    ${inputs ? `<div class="section"><h2>Declared inputs (needs)</h2><table><tr><th>name</th><th>spec</th><th>node</th></tr>${inputs}</table></div>` : ''}
+    ${outputs ? `<div class="section"><h2>Declared outputs (produces)</h2><table><tr><th>name</th><th>spec</th><th>node</th></tr>${outputs}</table></div>` : ''}
+    ${atts ? `<div class="section"><h2>Attachments</h2><table><tr><th>name</th><th>mime</th><th>size</th><th>hash</th></tr>${atts}</table></div>` : ''}
+    ${revs ? `<div class="section"><h2>Revisions</h2><table><tr><th>when</th><th>what</th><th>from</th></tr>${revs}</table></div>` : ''}
+    <div class="section"><h2>Links</h2>
+      <a href="/pop/${encodeURIComponent(view.hash)}.json">StandardView JSON</a> ·
+      <a href="/doc/${encodeURIComponent(view.hash)}.json">document JSON</a>
+    </div>
+  `, ws.root);
+}
+function escapeHtml(s) {
+    return s.replace(/[&<>"']/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
+}
+/**
+ * Render action content for the web UI: markdown image refs `![caption](name)`
+ * become real <figure><img> (name → attachment url or a local /blobs/:hash);
+ * http(s) URL targets are used as-is (external refs, spec §5.1); unresolved
+ * refs stay literal. Fenced code blocks are treated as prose-exempt (§5.1).
+ */
+function renderContent(content, node, ws) {
+    const blocks = [];
+    const prose = content.replace(/```[\s\S]*?```/g, m => {
+        blocks.push(m);
+        return `\u0000B${blocks.length - 1}\u0000`;
+    });
+    const parts = [];
+    let last = 0;
+    for (const m of prose.matchAll(/!\[([^\]]*)\]\(([^)]*)\)/g)) {
+        parts.push(escapeHtml(prose.slice(last, m.index)));
+        const caption = m[1];
+        const target = m[2];
+        const url = mediaUrl(target, node, ws);
+        if (url === null) {
+            parts.push(escapeHtml(m[0]));
+        }
+        else {
+            const cap = escapeHtml(caption);
+            parts.push(`<figure><img src="${escapeHtml(url)}" alt="${cap}"><figcaption>${cap}</figcaption></figure>`);
+        }
+        last = m.index + m[0].length;
+    }
+    parts.push(escapeHtml(prose.slice(last)));
+    return `<div class="prose">${parts.join('').replace(/\u0000B(\d+)\u0000/g, (_, i) => `<pre>${escapeHtml(blocks[Number(i)])}</pre>`)}</div>`;
+}
+function mediaUrl(target, node, ws) {
+    if (/^https?:\/\//i.test(target))
+        return target;
+    if (!node || node.type !== 'action')
+        return null;
+    const a = (node.attachments ?? []).find(x => x.name === target);
+    return a ? (a.url ?? `/blobs/${a.hash}`) : null;
+}
+//# sourceMappingURL=web.js.map