@blotout/qinto-cli 0.1.3 → 0.1.4

package/dist/index.js

@@ -1240,7 +1240,7 @@ var Kn = Nn((e, t) => {
 	].filter(Boolean).join("\n").trimEnd()}${yn}`;
 }), qn = {
 	name: "@blotout/qinto-cli",
-	version: "0.1.3",
+	version: "0.1.4",
 	type: "module",
 	description: "Qinto CLI: authenticate against the Qinto platform and operate it from the terminal or from an agent.",
 	repository: {
@@ -8211,62 +8211,62 @@ ${Ag()}
   <p class="lede">Settings the platform stores against the domain. They ride the site worker's bindings, so saving one recomposes the
   local workerd stack the same way a redeploy carries them to the edge.</p>
   ${Mg(e)}
-</div>`, Pg = (e, t) => e.enabled && t.enabled, Fg = (e, t, n) => `<iframe class="panel" data-install="${t.appInstallId}" src="${Q(e.iframeUrl)}"
-  title="${Q(n)}" sandbox="allow-scripts allow-same-origin allow-forms"></iframe>`, Ig = (e, t) => {
-	let n = Q(e.manifest.name), r = `${$}/${Q(e.manifest.slug)}`, i = e.state.installs.filter((t) => Pg(e.state, t)), a = i.length === 0 ? `<div class="card"><p class="hint">${e.state.enabled ? `Every install of ${n} is disabled, so there is no panel to open.` : `${n} is disabled on this site, so there is no panel to open.`} Enable one on the <a class="link" href="${r}">app's own page</a>.</p></div>` : i.map((n) => `<section class="rows">${i.length === 1 ? "" : `<h2 class="section-title">${Q(n.label)}</h2>`}
-    ${Fg(t, n, `${e.manifest.name} — ${n.label}`)}
-  </section>`).join("");
+</div>`, Pg = (e, t) => e.enabled && t.enabled, Fg = (e, t) => `<iframe class="panel" src="${Q(e.iframeUrl)}"
+  title="${Q(t)}" sandbox="allow-scripts allow-same-origin allow-forms"></iframe>`, Ig = (e) => e.installs.find((t) => Pg(e, t)), Lg = (e, t) => {
+	let n = Q(e.manifest.name), r = `${$}/${Q(e.manifest.slug)}`, i = Ig(e.state) === void 0 ? `<div class="card"><p class="hint">${e.state.enabled ? `Every install of ${n} is disabled, so there is no panel to open.` : `${n} is disabled on this site, so there is no panel to open.`} Enable one on the <a class="link" href="${r}">app's own page</a>.</p></div>` : Fg(t, e.manifest.name);
 	return `<div class="stack">
   <p class="lede">Served from <code>${Q(t.origin)}</code> — a different origin to this console, so the panel's
   <code>postMessage</code> checks are the ones a deployed panel makes.</p>
-  ${a}
+  ${i}
 </div>`;
-}, Lg = (e) => `
+}, Rg = (e) => `
 const ORIGIN = ${JSON.stringify(e.iframeOrigin)}
 const TOKEN_PATH = ${JSON.stringify(e.tokenPath)}
-const frames = [...document.querySelectorAll('iframe.panel')]
+const frame = document.querySelector('iframe.panel')
+
+const send = async () => {
+  const response = await fetch(TOKEN_PATH, { headers: { accept: 'application/json' } }).catch(() => null)
+  // Answer the refusal: the panel waits on this token, and silence leaves that wait pending forever.
+  if (response === null || !response.ok) {
+    frame.contentWindow.postMessage({ type: 'qinto:token-error' }, ORIGIN)
+    return
+  }
 
-const send = async (frame) => {
-  const response = await fetch(TOKEN_PATH + '?appInstallId=' + encodeURIComponent(frame.dataset.install), {
-    headers: { accept: 'application/json' }
-  })
-  if (!response.ok) { return }
   const { context, token } = await response.json()
   frame.contentWindow.postMessage({ type: 'qinto:init', context, token }, ORIGIN)
 }
 
 window.addEventListener('message', (event) => {
   if (event.origin !== ORIGIN) { return }
-  const frame = frames.find((candidate) => candidate.contentWindow !== null && candidate.contentWindow === event.source)
-  if (frame === undefined) { return }
+  if (frame === null || frame.contentWindow === null || frame.contentWindow !== event.source) { return }
 
   const message = event.data
   if (message === null || typeof message !== 'object') { return }
 
-  if (message.type === 'qinto:ready' || message.type === 'qinto:token') { void send(frame); return }
+  if (message.type === 'qinto:ready' || message.type === 'qinto:token') { void send(); return }
   if (message.type === 'qinto:resize' && typeof message.height === 'number') {
     frame.style.height = Math.max(120, Math.min(4000, Math.round(message.height))) + 'px'
   }
 })
-`, Rg = "dev-user", zg = 64 * 1024, Bg = (e, t, n) => new Promise((r, i) => {
+`, zg = "dev-user", Bg = 64 * 1024, Vg = (e, t, n) => new Promise((r, i) => {
 	e.once("error", i), e.listen(n, t, () => {
 		e.off("error", i), r();
 	});
-}), Vg = async (e) => {
+}), Hg = async (e) => {
 	let t = [], n = 0;
 	for await (let r of e) {
-		if (n += r.length, n > zg) throw Error("The submitted form is too large.");
+		if (n += r.length, n > Bg) throw Error("The submitted form is too large.");
 		t.push(r);
 	}
 	return Buffer.concat(t).toString("utf8");
-}, Hg = async (e) => Object.fromEntries(new URLSearchParams(await Vg(e))), Ug = /* @__PURE__ */ new Set([
+}, Ug = async (e) => Object.fromEntries(new URLSearchParams(await Hg(e))), Wg = /* @__PURE__ */ new Set([
 	"127.0.0.1",
 	"localhost",
 	"[::1]"
-]), Wg = (e, t) => {
+]), Gg = (e, t) => {
 	let n = e === void 0 ? null : URL.parse(e.includes("//") ? e : `http://${e}`);
-	return n !== null && Ug.has(n.hostname) && n.port === String(t);
-}, Gg = {
+	return n !== null && Wg.has(n.hostname) && n.port === String(t);
+}, Kg = {
 	[$h]: {
 		title: "Apps",
 		width: "full",
@@ -8288,26 +8288,23 @@ window.addEventListener('message', (event) => {
 		width: "form",
 		body: Ng
 	}
-}, Kg = (e, t) => {
-	let n = e.state.installs.find((e) => e.appInstallId === t);
-	return n === void 0 || !Pg(e.state, n) ? null : n;
 }, qg = (e) => e.state.installs.map((e) => ({
 	id: e.appInstallId,
 	label: e.label,
 	enabled: e.enabled,
 	variables: e.variables
-})), Jg = async (e, t, n) => {
-	let r = Kg(t, n);
-	return !t.state.installed || r === null || e.appUi === null ? null : {
+})), Jg = async (e, t) => {
+	let n = Ig(t.state);
+	return !t.state.installed || n === void 0 || e.appUi === null ? null : {
 		token: await Mp({
 			kid: e.keys.appUiKeyId,
 			key: e.keys.appUiKey,
 			now: /* @__PURE__ */ new Date(),
 			slug: t.manifest.slug,
-			userId: Rg,
+			userId: zg,
 			domainId: t.state.domainId,
 			appId: t.state.appId,
-			appInstallId: r.appInstallId,
+			appInstallId: n.appInstallId,
 			appVersionId: yh,
 			access: "write"
 		}),
@@ -8317,7 +8314,7 @@ window.addEventListener('message', (event) => {
 			siteOrigin: e.origin,
 			appSlug: t.manifest.slug,
 			appVersion: yh,
-			appInstallId: r.appInstallId,
+			appInstallId: n.appInstallId,
 			installs: qg(t),
 			theme: "light"
 		}
@@ -8337,12 +8334,12 @@ window.addEventListener('message', (event) => {
 	return e === `${t}/ui` && n.state.installed && i !== null ? {
 		title: n.manifest.name,
 		width: "full",
-		body: (e) => Ig(e, i),
-		script: Lg({
+		body: (e) => Lg(e, i),
+		script: Rg({
 			iframeOrigin: i.origin,
 			tokenPath: r
 		})
-	} : Gg[e];
+	} : Kg[e];
 }, Xg = async (e) => {
 	let t = e.port, n = () => `http://${e.host}:${t}`, r = () => ({
 		manifest: e.stack.manifest(),
@@ -8378,46 +8375,46 @@ window.addEventListener('message', (event) => {
 		e.on("close", () => {
 			o.delete(e), n();
 		});
-	}, c = /* @__PURE__ */ new Set(), l = async (t, n, o) => {
+	}, c = /* @__PURE__ */ new Set(), l = async (t, n) => {
 		if (t === "/") {
-			o.writeHead(303, { location: $ }).end();
+			n.writeHead(303, { location: $ }).end();
 			return;
 		}
 		if (t === "/site/logs/stream") {
-			s(o, (t) => e.stack.logs.subscribe((e) => {
+			s(n, (t) => e.stack.logs.subscribe((e) => {
 				e.spans !== void 0 && t.write(`event: spans\ndata: ${JSON.stringify(e.spans)}\n\n`);
 			}));
 			return;
 		}
 		if (t === "/reload") {
-			s(o, (e) => (c.add(e), () => {
+			s(n, (e) => (c.add(e), () => {
 				c.delete(e);
 			}));
 			return;
 		}
 		if (t === `${i()}/token`) {
-			let t = await Jg(e.stack, r(), n.get("appInstallId") ?? "");
+			let t = await Jg(e.stack, r());
 			if (t === null) {
-				o.writeHead(409, { "content-type": "text/plain" }).end("no active install to open the panel for");
+				n.writeHead(409, { "content-type": "text/plain" }).end("no active install to open the panel for");
 				return;
 			}
-			o.writeHead(200, {
+			n.writeHead(200, {
 				"content-type": "application/json",
 				"cache-control": "no-store"
 			}).end(JSON.stringify(t));
 			return;
 		}
-		let l = a(t);
-		if (l === null) {
-			o.writeHead(404, { "content-type": "text/plain" }).end("not found");
+		let o = a(t);
+		if (o === null) {
+			n.writeHead(404, { "content-type": "text/plain" }).end("not found");
 			return;
 		}
-		o.writeHead(200, {
+		n.writeHead(200, {
 			"content-type": "text/html; charset=utf-8",
 			"cache-control": "no-store"
-		}), o.end(l);
+		}), n.end(o);
 	}, u = async (t) => {
-		let n = await Hg(t), r = t.url.slice(1);
+		let n = await Ug(t), r = t.url.slice(1);
 		if (r === "schedule-run") return await e.stack.runSchedule(n.scheduleId ?? ""), r;
 		let i = Mh({
 			action: r,
@@ -8429,7 +8426,7 @@ window.addEventListener('message', (event) => {
 		});
 		return await e.stack.apply(i), r;
 	}, d = (t) => t === "consent" ? tg : t === "app-variables" ? `${$h}/${e.stack.manifest().slug}` : e.stack.state().installed ? i() : $, f = async (t, n) => {
-		let r = t.headers.authorization, i = await Vg(t), a;
+		let r = t.headers.authorization, i = await Hg(t), a;
 		try {
 			a = JSON.parse(i);
 		} catch {
@@ -8456,13 +8453,13 @@ window.addEventListener('message', (event) => {
 			appValues: e.stack.appValues()
 		}), n.writeHead(202, { "content-type": "application/json" }).end(JSON.stringify({ accepted: !0 }));
 	}, p = async (r, i) => {
-		if (!Wg(r.headers.host, t)) {
+		if (!Gg(r.headers.host, t)) {
 			i.writeHead(403, { "content-type": "text/plain" }).end("this console answers loopback only");
 			return;
 		}
 		let a = new URL(r.url, n());
 		if (r.method === "GET") {
-			await l(a.pathname, a.searchParams, i);
+			await l(a.pathname, i);
 			return;
 		}
 		if (r.method !== "POST") {
@@ -8473,7 +8470,7 @@ window.addEventListener('message', (event) => {
 			await f(r, i);
 			return;
 		}
-		if (!Wg(r.headers.origin, t)) {
+		if (!Gg(r.headers.origin, t)) {
 			i.writeHead(403, { "content-type": "text/plain" }).end("cross-origin form posts are refused");
 			return;
 		}
@@ -8483,7 +8480,7 @@ window.addEventListener('message', (event) => {
 			t.writeHead(500, { "content-type": "text/plain" }).end(e instanceof Error ? e.message : String(e));
 		});
 	});
-	return await Bg(m, e.host, e.port), t = m.address().port, {
+	return await Vg(m, e.host, e.port), t = m.address().port, {
 		origin: n,
 		reload: () => {
 			for (let e of c) e.write("event: reload\ndata: {}\n\n");
@@ -9013,7 +9010,7 @@ ${Object.keys(e_).map((e) => `        <button class="outline" data-std="${e}">${
 	],
 	result: { type: "app-dev" },
 	run: async (e, t) => {
-		let n = e.positionals.at(0) ?? ".", r = e.options, i = {
+		let n = u(e.positionals.at(0) ?? "."), r = e.options, i = {
 			worker: g_("--worker-port", r.workerPort),
 			demo: g_("--demo-port", r.demoPort),
 			console: g_("--console-port", r.consolePort),