npm - @augurworks/augur - Versions diffs - 0.15.6 → 0.15.7 - Mend

@augurworks/augur 0.15.6 → 0.15.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7) hide show

package/agents/drafts.md CHANGED Viewed

@@ -55,7 +55,8 @@ saves on every burst of changes; `augur save` saves once.
 ## Landing
 `augur land` replaces the prototype's real URL with your draft, records who landed it and
-when, and closes the draft. It is refused in exactly one case: somebody landed on this
+when — and whose draft it was, when a member lands somebody else's from the site — and
+closes the draft. It is refused in exactly one case: somebody landed on this
 prototype since you opened yours. Then:
 ```

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@augurworks/augur",
-  "version": "0.15.6",
+  "version": "0.15.7",
   "files": [
     "scripts/",
     "build.js",

package/scripts/restore.mjs CHANGED Viewed

@@ -292,6 +292,14 @@ if (STATE) {
     })).json();
     if (!res.ok) die(`the instance refused the state: ${res.reason}${res.failed ? ` (${res.failed.join(", ")})` : ""}`);
     if (res.skipped && res.skipped.length) log(`\x1b[33mskipped (not in the instance's inventory): ${res.skipped.join(", ")}\x1b[0m`);
+    // A restore says "at least this": a member the copy does not name stays, and the
+    // instance names them so a keep is never mistaken for a replace.
+    if (res.members && res.members.kept && res.members.kept.length) {
+      log(`\x1b[33mkept ${res.members.kept.length} member(s) this copy does not name (a restore removes nobody): ${res.members.kept.join(", ")} — remove them in the people panel if they should go\x1b[0m`);
+    }
+    if (res.members && res.members.removed && res.members.removed.length) {
+      log(`removed ${res.members.removed.length} member(s) this copy does not name: ${res.members.removed.join(", ")}`);
+    }
     stateReport = res;
   }
 }

package/src/_worker.js CHANGED Viewed

@@ -5219,7 +5219,11 @@ function personFace(users, id) {
     : { name: null, initials: null, color: null };
 }
 const decorateDrafts = (drafts, users) => (drafts || []).map((d) => ({ ...d, ...personFace(users, d.owner) }));
-const decorateLandings = (landings, users) => (landings || []).map((l) => ({ ...l, ...personFace(users, l.by) }));
+const decorateLandings = (landings, users) => (landings || []).map((l) => ({
+  ...l, ...personFace(users, l.by),
+  // The draft's owner, with a face, when the landing was made from somebody else's draft.
+  draft: l.draftOwner && l.draftOwner !== l.by ? { owner: l.draftOwner, session: l.draftSession || "", ...personFace(users, l.draftOwner) } : null,
+}));
 /** How many units the gallery's index will ask about in one answer. */
 const DRAFTS_INDEX_MAX = 50;
@@ -6916,6 +6920,7 @@ function loginPage(tctx, redirect, error, requestUrl, opts = {}) {
 <head>
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <meta name="description" content="A sign-in gate. Assistants and scripts: GET /llms.txt says how to get in." />
   <meta name="robots" content="noindex, nofollow" />
   ${previewHead(tctx, requestUrl)}
   <link rel="preload" href="/fonts/inter-latin-wght-normal.woff2" as="font" type="font/woff2" crossorigin />
@@ -7022,6 +7027,7 @@ function loginPage(tctx, redirect, error, requestUrl, opts = {}) {
     </div>
     ${formBody}
     ${tctx.LOGIN_HINT && !passwordless ? `<p class="hint">${escapeHtml(tctx.LOGIN_HINT)}</p>` : ""}
+    <p class="hint door">Connecting an assistant or a script? It reads <a href="/llms.txt">/llms.txt</a>.</p>
   </main>
 </body>
 </html>`;
@@ -7359,8 +7365,78 @@ async function withDraftUi(tctx, res, url, me, env) {
   return new Response(html, { status: res.status, statusText: res.statusText, headers });
 }
 /** A content response, dressed: the live-reload poll, the current chrome, the draft bar, the cache policy. */
-async function serveContent(tctx, asset, url, me, env) {
-  return withAssetCache(await withDraftUi(tctx, await composeChrome(tctx, withLiveReload(tctx, asset, url), url), url, me, env), url);
+async function serveContent(tctx, asset, url, me, env, request = null) {
+  return withAgentPreface(withDoorLink(withAssetCache(await withDraftUi(tctx, await composeChrome(tctx, withLiveReload(tctx, asset, url), url), url, me, env), url)), request, url, me);
+}
+/**
+ * Is this fetch a BROWSER's? Every browser sends `Sec-Fetch-Dest` (and `-Mode`) on every
+ * request it makes — a navigation, an iframe, an image, a prefetch — and no scripted
+ * fetcher does: curl, node, Python, the fetch behind a summarising tool. The headers are
+ * forbidden to page script, so a page cannot fake them off; a fetcher can only fake them
+ * ON, which is the harmless direction. A `Mozilla/` user agent counts as a browser too,
+ * for the browser old enough to send no Sec-Fetch at all and for the fetcher that dresses
+ * as one — both get the page a person gets, which is the conservative side of the line.
+ */
+function browserFetch(request) {
+  if (!request || !request.headers) return true;
+  if (request.headers.has("Sec-Fetch-Dest") || request.headers.has("Sec-Fetch-Mode")) return true;
+  return /^Mozilla\//.test(request.headers.get("User-Agent") || "");
+}
+/** The one paragraph a non-browser fetch of a prototype is given, first in the body. */
+function agentPreface(url) {
+  const origin = escapeHtml(url.origin);
+  return `<p data-augur-door>This prototype is served by an Augur workspace at ${origin}. `
+    + `Assistants and scripts: <a href="${DOOR_DOCS}">${origin}${DOOR_DOCS}</a> says how to change it — `
+    + `a terminal is paired with the person's approval, and nobody is ever asked for a password.</p>`;
+}
+/**
+ * A prototype fetched by something that is not a browser opens with the door.
+ *
+ * An agent handed a prototype's URL fetches the page and finds a finished site with
+ * nothing on it about how it is edited — the customer's own HTML, and on a public
+ * prototype never the gate. The `Link` header (below) reaches a scripted agent; a
+ * summarising fetch keeps only the text. So a fetch that carries no browser headers gets
+ * ONE paragraph prepended to the body, naming the origin and `/llms.txt`, and a browser
+ * gets the page byte for byte as published — a person never sees it, an embed never
+ * carries it, and the design is not touched. Decided 6 Sep 2026 after two of four cold
+ * agents fetched the prototype rather than the workspace and told the person to ask a
+ * developer.
+ *
+ * `no-store`, so the agent's variant is never what a cache hands a browser; the wrap is
+ * the outermost on the serving path for the same reason — nothing below it stores what
+ * this adds. Only a 200 HTML page: an error page, a redirect and a stylesheet are left alone.
+ * Only a SIGNED-OUT fetch: a request carrying a member's session is already inside, and
+ * what it is served — the gallery, a gated prototype — stays byte for byte what it was.
+ */
+async function withAgentPreface(res, request, url, me = null) {
+  if (!res || res.status !== 200 || !/text\/html/.test(res.headers.get("Content-Type") || "")) return res;
+  if (me || browserFetch(request)) return res;
+  const html = await res.text();
+  const m = /<body[^>]*>/i.exec(html);
+  const out = m ? html.slice(0, m.index + m[0].length) + agentPreface(url) + html.slice(m.index + m[0].length) : agentPreface(url) + html;
+  const headers = new Headers(res.headers);
+  headers.delete("Content-Length");
+  headers.delete("ETag");
+  headers.set("Cache-Control", "no-store");
+  headers.set("Vary", "Sec-Fetch-Dest, User-Agent");
+  return new Response(out, { status: res.status, statusText: res.statusText, headers });
+}
+/**
+ * A served page carries the same `Link: </llms.txt>; rel="help"` the gate carries. An agent
+ * handed the URL of a PUBLIC prototype never meets the gate — it fetches the page, finds a
+ * finished site with nothing on it about how it is edited, and gives up. The header is the
+ * one pointer that costs the page no bytes and no pixels; a scripted agent reads it, and a
+ * summarising one at least reaches the gate's own words at the workspace root.
+ */
+function withDoorLink(res) {
+  if (!res || !/text\/html/.test(res.headers.get("Content-Type") || "")) return res;
+  if (res.headers.get("Link")) return res;
+  const headers = new Headers(res.headers);
+  headers.set("Link", `<${DOOR_DOCS}>; rel="help"`);
+  return new Response(res.body, { status: res.status, statusText: res.statusText, headers });
 }
 // Test seam: loadConfig fills the chrome pointer, the workspace list and the runtime-
@@ -8386,6 +8462,43 @@ async function readStateFamily(tctx, env, entry, store, kv) {
     }
     return await store.read(family, "");
   }
+  // ── the identity families the workspace OBJECT holds since the cut-over ──────────
+  //
+  // `publish:tokens` is read by the publish path from the object FIRST and KV second, and a
+  // mint writes both — so a row can be in one store and not the other. Reading KV alone
+  // here (which is what this did) produced a `--full` copy that omitted tokens which were
+  // live and answering; a restore from it would have dropped them without a word. The copy
+  // is the union of both stores.
+  //
+  // ⚠️ FOR A HASH BOTH STORES HOLD, KV'S RECORD IS THE ONE COPIED, VERBATIM. The object's
+  // row is a projection into columns — it stamps a `createdAt` on a record the copy never
+  // carried and spells `label` as null where the record had none — and a copy that took
+  // the projection stopped verifying: `augur migrate` compares the target's export with the
+  // source's, and a KV→workspace migration reported `publish:tokens` as not matching on
+  // data that had landed. What the object ADDS is the rows KV lacks; what KV holds is what a
+  // restore wrote and what a verifier reads back. (The admin panel lists the same union the
+  // other way round — the object's row is what governs a publish — and that is a display
+  // question, not a copy question.)
+  //
+  // An object that CANNOT be asked throws, and the export files that under `failed` — a
+  // restore refuses such a copy. Answering from KV alone instead would be a copy that calls
+  // itself full while missing every object-held token, the exact thing this branch closes.
+  if (entry.id === PUBLISH_TOKENS_KEY) {
+    const ident = identityFor(env, tctx, "publishTokens");
+    if (ident) {
+      const listed = await ident.tokenList();
+      const held = (listed && listed.tokens && typeof listed.tokens === "object") ? listed.tokens : {};
+      let map = null;
+      if (kv) {
+        const raw = await kv.get(entry.id);
+        if (raw != null) { try { map = JSON.parse(raw); } catch (e) { map = null; } }
+      }
+      // Absent stays absent: no document in KV and no row in the object is the one answer a
+      // restore must LEAVE alone (it clears a `{}`). A seeded-but-empty object is `{}`.
+      if (map === null && !Object.keys(held).length && !(listed && listed.seeded)) return null;
+      return { ...held, ...(map || {}) };
+    }
+  }
   if (!kv) return null;
   if (STATE_KV_PREFIXED.includes(entry.id)) {
     const out = {};
@@ -8652,6 +8765,9 @@ async function importState(tctx, env, doc) {
       },
     );
+    // Whether the copy carried the roster overlay at all: the object counts the people
+    // the copy does not name only when the copy claims to say who belongs.
+    identity.rosterCarried = Object.prototype.hasOwnProperty.call(doc.families, "users:roster");
     const res = await stub.fetch("https://workspace/state/import", {
       method: "POST",
       headers: { "content-type": "application/json" },
@@ -8660,7 +8776,15 @@ async function importState(tctx, env, doc) {
       }),
     });
     if (!res.ok) return { ok: false, reason: "workspace-refused", status: res.status };
-    const { atomic, refused } = await res.json();
+    const { atomic, refused, members } = await res.json();
+    // The people `prune` removed from the object are removed the way the admin panel
+    // removes them: the session, the KV-side token and invite copies go too. Best-effort
+    // and after the object's transaction — the row is the fact, these are its consequences.
+    for (const email of (members && members.removed) || []) {
+      try { await revokeSecret(env, email, tctx); } catch (e) { /* no KV binding: nothing to revoke there */ }
+      await revokePublishTokens(tctx, env, email);
+      await revokeInvitesFor(tctx, env, email);
+    }
     // ⚠️ THE IDENTITY FAMILIES GO TO BOTH, AND THAT IS THE POINT OF THE SPLIT.
     // The object gets a faithful copy and KV stays exactly what the KV path reads, so a
     // restore cannot take an instance down whichever store is currently answering. With the
@@ -8681,6 +8805,9 @@ async function importState(tctx, env, doc) {
       // from a complete one, which is the failure this whole path exists to avoid.
       unmapped: identitySkipped,
       refusedRows: refused || [],
+      // Who the copy did not name and what became of them — `kept` on a plain restore,
+      // `removed` under `prune`. Absent when the copy carried no roster.
+      ...(members ? { members } : {}),
     };
   }
@@ -12247,7 +12374,7 @@ async function handleRequest(request, env, ctx, url, trace) {
       }
       const asset = await assetFetch(tctx.tenantId, env, request);
       if (asset.status === 404) return notFoundResponse(tctx);
-      return serveContent(tctx, asset, url, me, env);
+      return serveContent(tctx, asset, url, me, env, request);
     }
     // Published prototypes are public — never gated, regardless of the cookie.
@@ -12256,7 +12383,7 @@ async function handleRequest(request, env, ctx, url, trace) {
     if (isPublicPath(tctx, url.pathname)) {
       const asset = await assetFetch(tctx.tenantId, env, request);
       if (asset.status === 404) return notFoundResponse(tctx);
-      const res = await serveContent(tctx, asset, url, me, env);
+      const res = await serveContent(tctx, asset, url, me, env, request);
       const out = new Response(res.body, res);
       out.headers.set("X-Robots-Tag", "noindex, nofollow, noarchive");
       return out;
@@ -12287,14 +12414,14 @@ async function handleRequest(request, env, ctx, url, trace) {
       // Where drafts are served, the gallery and its indexes are derived from the live
       // store rather than read from it — a landing is on them at once.
       const derived = await derivedPage(tctx, env, url);
-      if (derived) return stamp(derived.status === 308 ? derived : await serveContent(tctx, derived, url, me, env));
+      if (derived) return stamp(derived.status === 308 ? derived : await serveContent(tctx, derived, url, me, env, request));
       const asset = await assetFetch(tctx.tenantId, env, request, { dsDraft: ds.draft });
       if (asset.status === 404) {
         const virt = await virtualCanvas(tctx, request, env, url);
         if (virt) return stamp(virt);
         return stamp(notFoundResponse(tctx));
       }
-      return stamp(await serveContent(tctx, asset, url, me, env));
+      return stamp(await serveContent(tctx, asset, url, me, env, request));
     }
     // Created canvas boards are public like published prototypes — same obscure
@@ -12376,7 +12503,7 @@ export const __testables = Object.freeze({
   doorFacts, doorText, wantsMachineDoor, gateResponse, DOOR_DOCS, DOOR_WELL_KNOWN,
   resumeAfterDormancy,
   PITI_VIEW_KEY, PITI_REMARKS_KEY,
-  publishAuthDetailed, unitApi, unitCaller, personFace, withDraftUi, draftUiBoot, derivedPage, dsOverlay, isEngineChrome, publishRefusalBody, splitDraftPath,
+  publishAuthDetailed, unitApi, unitCaller, personFace, withDoorLink, withAgentPreface, browserFetch, withDraftUi, draftUiBoot, derivedPage, dsOverlay, isEngineChrome, publishRefusalBody, splitDraftPath,
   adminStorageApi,
   adminCustomDomainApi,
   isPrefixBacked, backedPublicPrefixes,

package/src/drafts/drafts.js CHANGED Viewed

@@ -223,6 +223,7 @@
         row.appendChild(face(l));
         var text = el("div");
         var who = l.by === "live" ? "Adopted from the live site" : label(l);
+        if (l.draft && l.draft.owner) who += " · draft by " + label(l.draft);
         text.appendChild(el("div", null, "#" + l.revision + " · " + who));
         var meta = (l.note ? l.note + " · " : "") + ago(l.at, "landed")
           + (l.restoredFrom ? " · restored from #" + l.restoredFrom : "")

package/src/tenant-do.js CHANGED Viewed

@@ -739,7 +739,7 @@ function seedCount(seed) {
  * `users:roster`'s `remove` list, and dropping the person here instead would let a
  * re-invite inherit the role the last holder of that address had.
  */
-function writeIdentity(sql, identity, at, written = [], refused = []) {
+function writeIdentity(sql, identity, at, written = [], refused = [], { prune = false } = {}) {
   if (!identity || typeof identity !== "object") return { written, refused };
   const list = (k) => (Array.isArray(identity[k]) ? identity[k] : []);
   const touched = (family, n) => { if (n) written.push(family); };
@@ -775,6 +775,39 @@ function writeIdentity(sql, identity, at, written = [], refused = []) {
   touched("members", n);
   if (n) markSeeded(sql, "roster", at);
+  // ── the people the copy does NOT name ──────────────────────────────────────────
+  //
+  // On KV the roster overlay is one document and an import replaces it, so anybody the
+  // copy does not name is gone. Here the rows above were upserted and every other row was
+  // left as it was — a member the copy does not name STAYS, with their session and their
+  // tokens, and for a while this reported `users:roster` as written and said nothing else,
+  // which read as a replace. So the ones left are counted and named:
+  //
+  //   · a plain restore says "at least this" and KEEPS them — `kept` says who, so a person
+  //     reading the result cannot mistake a keep for a replace;
+  //   · `prune` says "exactly this" and REMOVES them the way the admin panel's remove
+  //     does — a tombstone (a re-invite must not inherit the old role), no publish token,
+  //     no outstanding invite. The worker revokes the session and the KV-side copies.
+  //
+  // Only overlay rows: a config member is the durable roster, not the copy's to remove.
+  // Only when the copy CARRIED the roster family — a copy of nothing but statuses says
+  // nothing about who belongs. `rosterCarried` is the worker's word for that.
+  let members;
+  if (identity.rosterCarried) {
+    const named = new Set(list("members").map((m) => lcAddr(m && m.email)).filter(Boolean));
+    const left = [...sql.exec(
+      `SELECT email FROM members WHERE source = 'overlay' AND removed_at IS NULL ORDER BY email`,
+    )].map((r) => String(r.email)).filter((e) => !named.has(e));
+    members = { kept: [], removed: [] };
+    for (const e of left) {
+      if (!prune) { members.kept.push(e); continue; }
+      sql.exec(`UPDATE members SET removed_at = ? WHERE email = ?`, at, e);
+      sql.exec(`DELETE FROM publish_tokens WHERE LOWER(label) = ?`, e);
+      sql.exec(`DELETE FROM invites WHERE email = ?`, e);
+      members.removed.push(e);
+    }
+  }
   n = 0;
   for (const i of list("invites")) {
     if (!i || !i.tokenHash) continue;
@@ -838,7 +871,7 @@ function writeIdentity(sql, identity, at, written = [], refused = []) {
   }
   touched("blobs", n);
-  return { written, refused };
+  return { written, refused, members };
 }
 /**
@@ -2550,11 +2583,12 @@ export class TenantStore {
           written.push(scope ? `${family}/${scope}` : family);
         }
       }
-      writeIdentity(this.sql, identity, stamp, written, refused);
+      members = writeIdentity(this.sql, identity, stamp, written, refused, { prune }).members;
     };
+    let members;
     const atomic = typeof this.ctx.storage.transactionSync === "function";
     if (atomic) this.ctx.storage.transactionSync(body); else body();
-    return { written, refused, atomic };
+    return members ? { written, refused, atomic, members } : { written, refused, atomic };
   }
   /**

package/src/unit-object.mjs CHANGED Viewed

@@ -265,11 +265,17 @@ export class UnitObject {
     const rows = [...this.sql.exec(`SELECT * FROM landings ORDER BY revision DESC`)];
     return {
       revision: this.mainRevision(),
-      landings: rows.map((r) => ({
-        revision: Number(r.revision), by: r.by || null, session: r.session || "", at: r.at, note: r.note || "",
-        draftId: r.draft_id || null, restoredFrom: r.restored_from == null ? null : Number(r.restored_from),
-        files: Object.keys(JSON.parse(r.tbl)).length,
-      })),
+      landings: rows.map((r) => {
+        // Any member may land any draft from the bar, so a landing has two people on it:
+        // who pressed Land (`by`) and whose draft it was. The draft row keeps the second.
+        const d = r.draft_id ? this.draft(r.draft_id) : null;
+        return {
+          revision: Number(r.revision), by: r.by || null, session: r.session || "", at: r.at, note: r.note || "",
+          draftId: r.draft_id || null, restoredFrom: r.restored_from == null ? null : Number(r.restored_from),
+          draftOwner: d ? d.owner : null, draftSession: d ? d.session : "",
+          files: Object.keys(JSON.parse(r.tbl)).length,
+        };
+      }),
     };
   }