@ashlr/hub 2.2.0

package/dist/core/web/server.d.ts

@@ -0,0 +1,18 @@
+/**
+ * core/web/server.ts — M14 local web dashboard HTTP server.
+ *
+ * Starts a localhost-only HTTP server bound to 127.0.0.1 ONLY. Zero new
+ * runtime deps (Node http/crypto/fs/path/url builtins). No CDN — all assets
+ * served from the bundled public dir.
+ *
+ * Security pipeline per request (in order):
+ *   1. Host-header allowlist  → 403 on mismatch  (anti DNS-rebinding)
+ *   2. handleApi(...)         → true means handled, stop
+ *   3. serveStatic(...)       → 404 if asset not found
+ *
+ * The dispatch route (POST /api/run) is registered ONLY when
+ * opts.allowDispatch is true and is token-guarded inside handleApi.
+ */
+import type { AshlrConfig, WebServerOptions, WebServerHandle } from '../types.js';
+export declare function assetsDir(): string;
+export declare function startServer(cfg: AshlrConfig, opts: WebServerOptions): Promise<WebServerHandle>;

package/dist/core/web/server.js

@@ -0,0 +1,122 @@
+/**
+ * core/web/server.ts — M14 local web dashboard HTTP server.
+ *
+ * Starts a localhost-only HTTP server bound to 127.0.0.1 ONLY. Zero new
+ * runtime deps (Node http/crypto/fs/path/url builtins). No CDN — all assets
+ * served from the bundled public dir.
+ *
+ * Security pipeline per request (in order):
+ *   1. Host-header allowlist  → 403 on mismatch  (anti DNS-rebinding)
+ *   2. handleApi(...)         → true means handled, stop
+ *   3. serveStatic(...)       → 404 if asset not found
+ *
+ * The dispatch route (POST /api/run) is registered ONLY when
+ * opts.allowDispatch is true and is token-guarded inside handleApi.
+ */
+import { createServer } from 'node:http';
+import { randomBytes } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { join, dirname } from 'node:path';
+import { handleApi, drainSseConnections } from './api.js';
+import { serveStatic } from './static.js';
+// ---------------------------------------------------------------------------
+// Host-header allowlist (anti DNS-rebinding)
+// Accepts: localhost, 127.0.0.1, [::1] — with or without :port suffix.
+// ---------------------------------------------------------------------------
+const HOST_RE = /^(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/i;
+function isAllowedHost(host) {
+    if (!host)
+        return false;
+    return HOST_RE.test(host);
+}
+// ---------------------------------------------------------------------------
+// assetsDir: resolve the bundled SPA assets directory relative to this module.
+// Works from both:
+//   src/  (tsx / ts-node dev)  → <repo>/src/core/web/public
+//   dist/ (compiled)           → <repo>/dist/core/web/public
+// ---------------------------------------------------------------------------
+export function assetsDir() {
+    // import.meta.url points to this file (server.ts / server.js after build)
+    const thisFile = fileURLToPath(import.meta.url);
+    return join(dirname(thisFile), 'public');
+}
+// ---------------------------------------------------------------------------
+// startServer
+// ---------------------------------------------------------------------------
+export async function startServer(cfg, opts) {
+    // Per-session secret token (32 bytes → 64 hex chars). Used only when
+    // allowDispatch is true, but always generated so the shape is consistent.
+    const token = randomBytes(32).toString('hex');
+    const server = createServer((req, res) => {
+        // ── 1. Host-header allowlist (anti DNS-rebinding) ──────────────────────
+        if (!isAllowedHost(req.headers.host)) {
+            res.writeHead(403, { 'Content-Type': 'text/plain' });
+            res.end('Forbidden: invalid Host header');
+            return;
+        }
+        // ── 2. API routes ──────────────────────────────────────────────────────
+        // handleApi is async; wrap to catch errors without crashing the server.
+        handleApi(req, res, cfg, { token, allowDispatch: opts.allowDispatch })
+            .then((handled) => {
+            if (handled)
+                return;
+            // ── 3. Static assets ───────────────────────────────────────────────
+            const served = serveStatic(req, res, assetsDir());
+            if (!served) {
+                res.writeHead(404, { 'Content-Type': 'text/plain' });
+                res.end('Not found');
+            }
+        })
+            .catch(() => {
+            // Never let an unhandled rejection crash the server.
+            if (!res.headersSent) {
+                res.writeHead(500, { 'Content-Type': 'text/plain' });
+            }
+            if (!res.writableEnded) {
+                res.end('Internal server error');
+            }
+        });
+    });
+    // ── Socket-level timeouts (anti slow-loris) ─────────────────────────────
+    // Reap partial/stalled requests so a client trickling headers/body on the
+    // loopback interface cannot tie up resources indefinitely. The readBody()
+    // 64 KB cap bounds body size; these bound time. Loopback-only scope keeps
+    // this low-severity, but it is cheap insurance for a server that can spawn
+    // agents. Note: SSE responses are server-pushed and do not rely on the
+    // client keeping the request open past header receipt.
+    server.requestTimeout = 30_000;
+    server.headersTimeout = 10_000;
+    // ── Bind to loopback only — never 0.0.0.0 ───────────────────────────────
+    const port = await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(opts.port, '127.0.0.1', () => {
+            const addr = server.address();
+            if (addr && typeof addr === 'object') {
+                resolve(addr.port);
+            }
+            else {
+                reject(new Error('Failed to determine bound port'));
+            }
+        });
+    });
+    const url = `http://127.0.0.1:${port}`;
+    // ── Handle object ────────────────────────────────────────────────────────
+    const handle = {
+        port,
+        token,
+        url,
+        close() {
+            return new Promise((resolve) => {
+                // Drain all open SSE response streams registered by handleApi, then
+                // close the HTTP server (stops accepting new connections).
+                drainSseConnections();
+                if (typeof server.closeAllConnections === 'function') {
+                    server.closeAllConnections();
+                }
+                server.close(() => resolve());
+            });
+        },
+    };
+    return handle;
+}
+//# sourceMappingURL=server.js.map

package/dist/core/web/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/core/web/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,8EAA8E;AAC9E,6CAA6C;AAC7C,uEAAuE;AACvE,8EAA8E;AAE9E,MAAM,OAAO,GAAG,4CAA4C,CAAC;AAE7D,SAAS,aAAa,CAAC,IAAwB;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,8EAA8E;AAC9E,+EAA+E;AAC/E,mBAAmB;AACnB,4DAA4D;AAC5D,6DAA6D;AAC7D,8EAA8E;AAE9E,MAAM,UAAU,SAAS;IACvB,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAgB,EAChB,IAAsB;IAEtB,qEAAqE;IACrE,0EAA0E;IAC1E,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE9C,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;QACxE,0EAA0E;QAC1E,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,0EAA0E;QAC1E,wEAAwE;QACxE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;aACnE,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAChB,IAAI,OAAO;gBAAE,OAAO;YAEpB,sEAAsE;YACtE,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;YAClD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;gBACrD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACvB,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACV,qDAAqD;YACrD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACvD,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;gBACvB,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACnC,CAAC;QACH,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,uEAAuE;IACvE,uDAAuD;IACvD,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;IAC/B,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;IAE/B,2EAA2E;IAC3E,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;YACzC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;YACtD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,oBAAoB,IAAI,EAAE,CAAC;IAEvC,4EAA4E;IAC5E,MAAM,MAAM,GAAoB;QAC9B,IAAI;QACJ,KAAK;QACL,GAAG;QACH,KAAK;YACH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC7B,oEAAoE;gBACpE,2DAA2D;gBAC3D,mBAAmB,EAAE,CAAC;gBACtB,IAAI,OAAO,MAAM,CAAC,mBAAmB,KAAK,UAAU,EAAE,CAAC;oBACrD,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBAC/B,CAAC;gBACD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/core/web/static.d.ts

@@ -0,0 +1,18 @@
+/**
+ * core/web/static.ts — M14 path-traversal-safe static file server.
+ *
+ * serveStatic(req, res, dir) serves a file from `dir` for the request URL.
+ *
+ * Returns true if a response was written (file served), false if the asset
+ * was not found / the path was rejected (caller writes its own 404).
+ *
+ * SECURITY:
+ *  - Resolves the requested path WITHIN `dir`; any path that escapes `dir`
+ *    (`..`, absolute paths, encoded traversal) is rejected -> returns false.
+ *  - Rejects null-byte injection.
+ *  - Never serves directories (only regular files); "/" maps to index.html.
+ *  - NEVER throws — all errors are caught and surface as `false`.
+ *  - No outward calls; pure local fs read bounded to the assets dir.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+export declare function serveStatic(req: IncomingMessage, res: ServerResponse, dir: string): boolean;

package/dist/core/web/static.js

@@ -0,0 +1,122 @@
+/**
+ * core/web/static.ts — M14 path-traversal-safe static file server.
+ *
+ * serveStatic(req, res, dir) serves a file from `dir` for the request URL.
+ *
+ * Returns true if a response was written (file served), false if the asset
+ * was not found / the path was rejected (caller writes its own 404).
+ *
+ * SECURITY:
+ *  - Resolves the requested path WITHIN `dir`; any path that escapes `dir`
+ *    (`..`, absolute paths, encoded traversal) is rejected -> returns false.
+ *  - Rejects null-byte injection.
+ *  - Never serves directories (only regular files); "/" maps to index.html.
+ *  - NEVER throws — all errors are caught and surface as `false`.
+ *  - No outward calls; pure local fs read bounded to the assets dir.
+ */
+import { readFileSync, statSync } from 'node:fs';
+import { resolve, join, sep, normalize, extname } from 'node:path';
+// ---------------------------------------------------------------------------
+// Content-Type mapping (only the handful of extensions the SPA ships).
+// ---------------------------------------------------------------------------
+const CONTENT_TYPES = {
+    '.html': 'text/html; charset=utf-8',
+    '.js': 'application/javascript; charset=utf-8',
+    '.mjs': 'application/javascript; charset=utf-8',
+    '.css': 'text/css; charset=utf-8',
+    '.json': 'application/json; charset=utf-8',
+    '.svg': 'image/svg+xml',
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.ico': 'image/x-icon',
+    '.webp': 'image/webp',
+    '.woff': 'font/woff',
+    '.woff2': 'font/woff2',
+    '.txt': 'text/plain; charset=utf-8',
+    '.map': 'application/json; charset=utf-8',
+};
+function contentTypeFor(filePath) {
+    const ext = extname(filePath).toLowerCase();
+    return CONTENT_TYPES[ext] ?? 'application/octet-stream';
+}
+// ---------------------------------------------------------------------------
+// Path extraction — pull the pathname from the request URL, never throws.
+// ---------------------------------------------------------------------------
+function extractPathname(rawUrl) {
+    try {
+        const raw = rawUrl ?? '/';
+        // Prepend a dummy base so the URL parser can handle path-only inputs.
+        const parsed = new URL(raw, 'http://localhost');
+        // parsed.pathname is already percent-decoded for path segments by URL,
+        // but %2e etc. inside a single-encoded path are decoded here, which is
+        // exactly what we want to inspect for traversal.
+        let pathname = decodeURIComponent(parsed.pathname);
+        // Null-byte injection — reject outright.
+        if (pathname.includes('\x00'))
+            return null;
+        if (!pathname.startsWith('/'))
+            pathname = '/' + pathname;
+        return pathname;
+    }
+    catch {
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// serveStatic
+// ---------------------------------------------------------------------------
+export function serveStatic(req, res, dir) {
+    try {
+        const rootDir = resolve(dir);
+        const pathname = extractPathname(req.url);
+        if (pathname === null)
+            return false;
+        // "/" (or empty) -> index.html (SPA shell).
+        let rel = pathname === '/' ? '/index.html' : pathname;
+        // Reject null bytes anywhere in the relative path.
+        if (rel.includes('\x00'))
+            return false;
+        // Strip the leading slash so join treats it as relative to rootDir.
+        // Normalize collapses ".." / "." segments so we can detect escapes.
+        const cleaned = normalize(rel).replace(/^(\.\.(\/|\\|$))+/, '');
+        rel = cleaned.replace(/^[/\\]+/, '');
+        // Resolve the candidate path and confirm it stays within rootDir.
+        const candidate = resolve(join(rootDir, rel));
+        // Containment check: candidate must equal rootDir or live under it
+        // (rootDir + path separator). Defends against `..` escapes and prefix
+        // collisions (e.g. /assets vs /assets-secret).
+        const rootWithSep = rootDir.endsWith(sep) ? rootDir : rootDir + sep;
+        if (candidate !== rootDir && !candidate.startsWith(rootWithSep)) {
+            return false;
+        }
+        // Stat — must be an existing regular file (never a directory).
+        let stat;
+        try {
+            stat = statSync(candidate);
+        }
+        catch {
+            return false; // ENOENT and friends -> not found.
+        }
+        if (!stat.isFile())
+            return false;
+        const body = readFileSync(candidate);
+        // Set Content-Type via setHeader (case-insensitive in real Node http) so
+        // downstream readers can look it up by the canonical lowercase name.
+        res.setHeader('Content-Type', contentTypeFor(candidate));
+        res.writeHead(200, {
+            'Content-Type': contentTypeFor(candidate),
+            'Content-Length': String(body.byteLength),
+            'Cache-Control': 'no-cache',
+            'X-Content-Type-Options': 'nosniff',
+        });
+        res.end(body);
+        return true;
+    }
+    catch {
+        // NEVER throw — any unexpected error means "not served".
+        return false;
+    }
+}
+//# sourceMappingURL=static.js.map

package/dist/core/web/static.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static.js","sourceRoot":"","sources":["../../../src/core/web/static.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnE,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAE9E,MAAM,aAAa,GAA2B;IAC5C,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,uCAAuC;IAC9C,MAAM,EAAE,uCAAuC;IAC/C,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,cAAc;IACtB,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,2BAA2B;IACnC,MAAM,EAAE,iCAAiC;CAC1C,CAAC;AAEF,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;AAC1D,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAE9E,SAAS,eAAe,CAAC,MAA0B;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,GAAG,CAAC;QAC1B,sEAAsE;QACtE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAChD,uEAAuE;QACvE,uEAAuE;QACvE,iDAAiD;QACjD,IAAI,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnD,yCAAyC;QACzC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,QAAQ,GAAG,GAAG,GAAG,QAAQ,CAAC;QACzD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,MAAM,UAAU,WAAW,CACzB,GAAoB,EACpB,GAAmB,EACnB,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAE7B,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAEpC,4CAA4C;QAC5C,IAAI,GAAG,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;QAEtD,mDAAmD;QACnD,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAEvC,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;QAChE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAErC,kEAAkE;QAClE,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAE9C,mEAAmE;QACnE,sEAAsE;QACtE,+CAA+C;QAC/C,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,GAAG,CAAC;QACpE,IAAI,SAAS,KAAK,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAChE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,+DAA+D;QAC/D,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,CAAC,mCAAmC;QACnD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,OAAO,KAAK,CAAC;QAEjC,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QAErC,yEAAyE;QACzE,qEAAqE;QACrE,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;QACzD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,cAAc,CAAC,SAAS,CAAC;YACzC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YACzC,eAAe,EAAE,UAAU;YAC3B,wBAAwB,EAAE,SAAS;SACpC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,yDAAyD;QACzD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/tui/app.d.ts

@@ -0,0 +1,33 @@
+/**
+ * src/tui/app.ts — M13 interactive TUI driver.
+ *
+ * Wires the pure renderer (src/tui/render.ts) to the data aggregator
+ * (src/core/dashboard.ts buildSnapshot) and the terminal. Handles all the
+ * impure concerns the renderer deliberately avoids:
+ *
+ *   - Alt-screen buffer enter/leave, cursor hide/show, raw-mode toggling.
+ *   - Raw keypress decoding (tab/shift-tab, 1-5, j/k, r, enter, q, Ctrl-C).
+ *   - Auto-refresh tick (~2s) that re-reads data sources without blocking.
+ *   - Resize awareness (re-render on SIGWINCH).
+ *   - GUARANTEED terminal restoration on quit / signal / throw.
+ *
+ * `runTui(cfg, { once })`:
+ *   - once === true  OR  stdout is not a TTY  →  render exactly one frame to
+ *     stdout and resolve 0. NEVER enters raw mode or the alt-screen. This is
+ *     the headless / scripting / test path (and the safe degraded path for
+ *     piped output).
+ *   - otherwise → enter the interactive loop and resolve when the user quits.
+ *
+ * Zero new runtime deps: Node built-ins + cli/ui.ts helpers only.
+ */
+import type { AshlrConfig } from '../core/types.js';
+/**
+ * Drive the TUI.
+ *
+ * @param cfg   Loaded hub config (passed straight through to buildSnapshot).
+ * @param opts  { once } — render a single frame and exit when true.
+ * @returns     Process exit code (0 on success). Never rejects.
+ */
+export declare function runTui(cfg: AshlrConfig, opts: {
+    once: boolean;
+}): Promise<number>;