@crvouga/atlas 0.5.0 → 0.6.0

package/dist/schema/src/manifest.d.ts

@@ -444,9 +444,9 @@ export declare const PathRecordSchema: z.ZodObject<{
         "not-reached": "not-reached";
     }>;
     progress: z.ZodOptional<z.ZodEnum<{
-        complete: "complete";
-        running: "running";
         queued: "queued";
+        running: "running";
+        complete: "complete";
     }>>;
     attempts: z.ZodOptional<z.ZodArray<z.ZodObject<{
         status: z.ZodString;

package/dist/schema/src/project.d.ts

@@ -0,0 +1,20 @@
+/** @module Project identity
+ * Project slugs partition every report, spec, recording and live run on an Atlas node.
+ */
+import { z } from 'zod/v4';
+/** A portable project namespace: 1–64 lowercase letters, digits or hyphens, starting and ending with a letter or digit. */
+export declare const ProjectSlugSchema: z.ZodString;
+/** One project advertised by a node. The default project contains uploads from older clients. */
+export declare const ProjectSchema: z.ZodObject<{
+    slug: z.ZodString;
+    name: z.ZodString;
+}, z.core.$strip>;
+/** Project discovery response. */
+export declare const ProjectsSchema: z.ZodObject<{
+    projects: z.ZodArray<z.ZodObject<{
+        slug: z.ZodString;
+        name: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/** A project's public identity. */
+export type Project = z.output<typeof ProjectSchema>;

package/dist/schema/src/project.js

@@ -0,0 +1,10 @@
+/** @module Project identity
+ * Project slugs partition every report, spec, recording and live run on an Atlas node.
+ */
+import { z } from 'zod/v4';
+/** A portable project namespace: 1–64 lowercase letters, digits or hyphens, starting and ending with a letter or digit. */
+export const ProjectSlugSchema = z.string().min(1).max(64).regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/);
+/** One project advertised by a node. The default project contains uploads from older clients. */
+export const ProjectSchema = z.object({ slug: ProjectSlugSchema, name: z.string().min(1).max(200) });
+/** Project discovery response. */
+export const ProjectsSchema = z.object({ projects: z.array(ProjectSchema) });

package/dist/schema/src/report-sources.d.ts

@@ -91,6 +91,7 @@ export declare const AtlasChangeSchema: z.ZodObject<{
     files: z.ZodDefault<z.ZodArray<z.ZodString>>;
     runIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
     sourceId: z.ZodOptional<z.ZodString>;
+    liveRunId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 /** A parsed `AtlasChangeSchema` value. */
 export type AtlasChange = z.infer<typeof AtlasChangeSchema>;

package/dist/schema/src/report-sources.js

@@ -74,5 +74,6 @@ export const AtlasChangeSchema = z.object({
     scope: z.enum(['specs', 'runs']),
     files: z.array(z.string()).default([]),
     runIds: z.array(z.string()).default([]),
-    sourceId: z.string().optional()
+    sourceId: z.string().optional(),
+    liveRunId: z.string().optional().describe('A live lease changed; its bounded snapshot is also sent as a run event')
 });

package/dist/schema/src/runs-index.d.ts

@@ -24,8 +24,8 @@ export declare const RunSummarySchema: z.ZodObject<{
     durationMs: z.ZodOptional<z.ZodNumber>;
     specVersion: z.ZodOptional<z.ZodString>;
     progress: z.ZodOptional<z.ZodEnum<{
-        complete: "complete";
         running: "running";
+        complete: "complete";
     }>>;
     execution: z.ZodOptional<z.ZodObject<{
         totalPaths: z.ZodNumber;

package/dist/schema/src/server-config.d.ts

@@ -84,6 +84,8 @@ export declare const ServerConfigSchema: z.ZodObject<{
         maxJsonMiB: z.ZodDefault<z.ZodNumber>;
         maxStreams: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strict>>;
+    runTimeoutSeconds: z.ZodDefault<z.ZodNumber>;
+    runStallSeconds: z.ZodDefault<z.ZodNumber>;
     heartbeatSeconds: z.ZodDefault<z.ZodNumber>;
     log: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strict>;
@@ -91,3 +93,85 @@ export declare const ServerConfigSchema: z.ZodObject<{
 export type ServerConfig = z.output<typeof ServerConfigSchema>;
 /** A server configuration as written, before defaults are applied. */
 export type ServerConfigInput = z.input<typeof ServerConfigSchema>;
+/** Storage and report settings editable by an admin. Authentication, listeners and the served site stay deployment-owned. Replaces the editable portion of the file; omitted fields use defaults after restart. */
+export declare const ServerEditableSettingsSchema: z.ZodObject<{
+    data: z.ZodOptional<z.ZodDefault<z.ZodString>>;
+    backends: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodOptional<z.ZodString>;
+        url: z.ZodString;
+        write: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>>>;
+    log: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    write: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    outlineBranch: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    include: z.ZodOptional<z.ZodDefault<z.ZodObject<{
+        branches: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        ignoreModified: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>>;
+    refreshSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+    limits: z.ZodOptional<z.ZodDefault<z.ZodObject<{
+        maxObjectMiB: z.ZodDefault<z.ZodNumber>;
+        maxJsonMiB: z.ZodDefault<z.ZodNumber>;
+        maxStreams: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strict>>>;
+    runTimeoutSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+    runStallSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+    heartbeatSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+}, z.core.$strict>;
+/** The settings API response: persisted editable configuration, active values, concurrency revision and restart/precedence guidance. Authentication token settings are excluded. */
+export declare const ServerSettingsSnapshotSchema: z.ZodObject<{
+    revision: z.ZodString;
+    settings: z.ZodObject<{
+        data: z.ZodOptional<z.ZodDefault<z.ZodString>>;
+        backends: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            label: z.ZodOptional<z.ZodString>;
+            url: z.ZodString;
+            write: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>>>;
+        log: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        write: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+        outlineBranch: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+        include: z.ZodOptional<z.ZodDefault<z.ZodObject<{
+            branches: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            ignoreModified: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>>;
+        refreshSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+        limits: z.ZodOptional<z.ZodDefault<z.ZodObject<{
+            maxObjectMiB: z.ZodDefault<z.ZodNumber>;
+            maxJsonMiB: z.ZodDefault<z.ZodNumber>;
+            maxStreams: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strict>>>;
+        runTimeoutSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+        runStallSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+        heartbeatSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+    }, z.core.$strict>;
+    active: z.ZodObject<{
+        data: z.ZodOptional<z.ZodDefault<z.ZodString>>;
+        backends: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            label: z.ZodOptional<z.ZodString>;
+            url: z.ZodString;
+            write: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>>>;
+        log: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        write: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+        outlineBranch: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+        include: z.ZodOptional<z.ZodDefault<z.ZodObject<{
+            branches: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            ignoreModified: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>>;
+        refreshSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+        limits: z.ZodOptional<z.ZodDefault<z.ZodObject<{
+            maxObjectMiB: z.ZodDefault<z.ZodNumber>;
+            maxJsonMiB: z.ZodDefault<z.ZodNumber>;
+            maxStreams: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strict>>>;
+        runTimeoutSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+        runStallSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+        heartbeatSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+    }, z.core.$strict>;
+    restartRequired: z.ZodBoolean;
+    precedence: z.ZodString;
+}, z.core.$loose>;

package/dist/schema/src/server-config.js

@@ -68,6 +68,18 @@ export const ServerConfigSchema = z.strictObject({
         maxStreams: z.number().int().positive().default(500).describe('Viewers that may be connected for live updates at once')
     })
         .default({ maxObjectMiB: 256, maxJsonMiB: 32, maxStreams: 500 }),
+    runTimeoutSeconds: z.number().min(10).max(3600).default(30).describe('Interrupt a live run after this many seconds without a producer heartbeat'),
+    runStallSeconds: z.number().min(0).max(86400).default(900).describe('Interrupt after this many seconds without test progress; 0 disables progress expiry'),
     heartbeatSeconds: z.number().min(1).default(15).describe('How often a live connection is touched, so proxies keep it open'),
     log: z.boolean().default(true).describe('One JSON line per request')
 });
+/** Storage and report settings editable by an admin. Authentication, listeners and the served site stay deployment-owned. Replaces the editable portion of the file; omitted fields use defaults after restart. */
+export const ServerEditableSettingsSchema = ServerConfigSchema.pick({ data: true, backends: true, write: true, outlineBranch: true, include: true, refreshSeconds: true, limits: true, heartbeatSeconds: true, runTimeoutSeconds: true, runStallSeconds: true, log: true }).partial();
+/** The settings API response: persisted editable configuration, active values, concurrency revision and restart/precedence guidance. Authentication token settings are excluded. */
+export const ServerSettingsSnapshotSchema = z.looseObject({
+    revision: z.string().regex(/^[a-f0-9]{64}$/),
+    settings: ServerEditableSettingsSchema,
+    active: ServerEditableSettingsSchema,
+    restartRequired: z.boolean(),
+    precedence: z.string()
+});

package/dist/server/src/app.d.ts

@@ -11,7 +11,9 @@
  */
 import { type BackendInput } from '../../reports/src/compose.js';
 import type { LayerHeader } from '../../reports/src/evidence-types.js';
+import type { ObjectStore } from '../../reports/src/object-store.js';
 import { ReportIndex } from '../../reports/src/report-index.js';
+import { type ServerSettings } from './settings.js';
 import type { ResolvedToken } from './config.js';
 import { EventHub } from './events.js';
 /** What the server is built from: its `backends` (read together) and which one takes uploads (`write`), `tokens`, the built `site`, the report's filters (`include`, `outlineBranch`), `limits`, timings, `log`, and `now` for tests. */
@@ -20,6 +22,8 @@ export type AtlasServerOptions = {
     readonly backends: readonly BackendInput[];
     /** The id of the backend uploads go to. */
     readonly write: string;
+    /** Operational lease storage. Defaults to the write backend; HTTP relays use their own local store. */
+    readonly liveStore?: ObjectStore;
     readonly tokens?: readonly ResolvedToken[];
     readonly anonymousRead?: boolean;
     /** The built viewer. Without it, only the API is served. */
@@ -33,9 +37,15 @@ export type AtlasServerOptions = {
         readonly maxStreams?: number;
     };
     readonly heartbeatMs?: number;
+    /** Producer lease timeout; default 30 seconds. */
+    readonly runTimeoutMs?: number;
+    /** Maximum time without progress; default 15 minutes, 0 disables. */
+    readonly runStallMs?: number;
     readonly log?: (line: Record<string, unknown>) => void;
     readonly now?: () => number;
     readonly version?: string;
+    /** Admin configuration persistence, supplied by atlas serve. Changes apply on restart. */
+    readonly settings?: ServerSettings;
     /** Extra runtime configuration written into the page. */
     readonly page?: Record<string, unknown>;
 };

package/dist/server/src/app.js

@@ -9,7 +9,8 @@
  *
  * @see docs/server.md
  */
-import { readFile, stat } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { readFile, stat, realpath } from 'node:fs/promises';
 import path from 'node:path';
 import { promisify } from 'node:util';
 import { brotliCompress, constants as zlibConstants, gzip } from 'node:zlib';
@@ -27,9 +28,14 @@ import { latestSpecSet, readSpecBody } from '../../reports/src/spec-set.js';
 import { llmsTxt } from './llms.js';
 import { openApiDocument } from './openapi.js';
 import { asProblem, problemResponse } from './problem.js';
+import { LiveRunStartSchema, LiveRunUpdateSchema } from '../../schema/src/live-run.js';
+import { LiveRuns, LiveRunError } from './live-runs.js';
+import { ConfigError } from './config.js';
+import { renderSettingsPage } from './settings.js';
 import { Refusal } from './validate.js';
 import { createAuth } from './auth.js';
 import { EventHub } from './events.js';
+import { projectServer } from './projects.js';
 import { readLimited, storeApi } from './store-api.js';
 const gzipAsync = promisify(gzip);
 const brotliAsync = promisify(brotliCompress);
@@ -46,6 +52,9 @@ const MiB = 1024 * 1024;
  * What it knows lives in its backends (by default a folder on its own disk), so replacing it loses nothing.
  */
 export function createAtlasServer(options) {
+    return projectServer(options, createProjectApplication);
+}
+function createProjectApplication(options) {
     const now = options.now ?? Date.now;
     const backends = options.backends;
     const writeBackend = backends.find(backend => backend.id === options.write);
@@ -56,6 +65,14 @@ export function createAtlasServer(options) {
     const limits = { object: (options.limits?.maxObjectMiB ?? 256) * MiB, json: (options.limits?.maxJsonMiB ?? 32) * MiB };
     const index = new ReportIndex(backends, { now, ...(options.include ? { include: options.include } : {}) });
     const events = new EventHub({ maxSubscribers: options.limits?.maxStreams ?? 500, heartbeatMs: options.heartbeatMs ?? 15_000 });
+    const live = new LiveRuns({ store: options.liveStore ?? writeBackend.store, now, timeoutMs: options.runTimeoutMs ?? 30_000, stalledMs: options.runStallMs ?? 900_000,
+        onChange: run => {
+            events.publish('run', run);
+            events.publish('atlas:change', { scope: 'runs', files: [], runIds: [], liveRunId: run.id });
+        },
+        onLayer: (key, layer) => index.accept(writeBackend.id, key, layer) });
+    const leaseTimer = setInterval(() => { void live.sweep().catch(error => options.log?.({ level: 'error', error: String(error) })); }, Math.min(5000, options.runTimeoutMs ?? 30_000));
+    leaseTimer.unref?.();
     const compressed = new Map();
     const assets = new Map();
     // Spec sets and runs change rarely: answer from memory, look again in the background, and look at once when
@@ -146,7 +163,15 @@ export function createAtlasServer(options) {
     async function body(c, data, contentType, headers, cacheKey, slow = false) {
         const bytes = typeof data === 'string' ? new TextEncoder().encode(data) : data;
         const accepts = c.req.header('accept-encoding') ?? '';
-        const encoding = COMPRESSIBLE.test(contentType) && bytes.length > 1024 ? (slow && /\bbr\b/.test(accepts) ? 'br' : /\bgzip\b/.test(accepts) ? 'gzip' : null) : null;
+        const qualities = new Map(accepts.toLowerCase().split(',').map(part => {
+            const [name, ...parameters] = part.trim().split(';');
+            const q = parameters.map(parameter => /^\s*q\s*=\s*(0(?:\.\d+)?|1(?:\.0+)?)\s*$/.exec(parameter)).find(Boolean);
+            return [name, q ? Number(q[1]) : parameters.some(parameter => /^\s*q\s*=/.test(parameter)) ? 0 : 1];
+        }));
+        const quality = (name) => qualities.get(name) ?? qualities.get('*') ?? 0;
+        const encoding = COMPRESSIBLE.test(contentType) && bytes.length > 1024
+            ? slow && quality('br') > 0 && quality('br') >= quality('gzip') ? 'br' : quality('gzip') > 0 ? 'gzip' : null
+            : null;
         let out = bytes;
         if (encoding) {
             const key = cacheKey ? `${encoding}|${cacheKey}|${bytes.length}` : null;
@@ -173,6 +198,13 @@ export function createAtlasServer(options) {
     app.use('*', async (c, next) => {
         const started = now();
         const pathname = new URL(c.req.url).pathname;
+        if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(c.req.method)) {
+            const origin = c.req.header('origin');
+            const site = c.req.header('sec-fetch-site');
+            // Browsers identify same-origin requests even when a TLS proxy forwards HTTP to Atlas.
+            if (site === 'cross-site' || (origin && origin !== new URL(c.req.url).origin && site !== 'same-origin'))
+                return problemResponse(403, 'Changes must come from this server origin.');
+        }
         const open = pathname === '/healthz' || pathname === '/readyz' || pathname === '/llms.txt' || pathname === '/api/openapi.json' || pathname.startsWith('/api/store');
         if (!open) {
             const verdict = auth.check(c.req.raw, 'read');
@@ -185,8 +217,12 @@ export function createAtlasServer(options) {
         else
             await next();
         // Every error, whichever handler made it, leaves as a problem document.
-        if (c.res.status >= 400)
+        if (c.res.status >= 400) {
             c.res = await asProblem(c.res);
+            c.res.headers.set('cache-control', 'no-store');
+        }
+        if (!auth.open && c.res.headers.get('cache-control')?.startsWith('public'))
+            c.res.headers.set('cache-control', c.res.headers.get('cache-control').replace(/^public/, 'private'));
         if (pathname !== '/healthz' && pathname !== '/readyz')
             options.log?.({ at: new Date(started).toISOString(), method: c.req.method, path: pathname, status: c.res.status, ms: now() - started });
     });
@@ -215,11 +251,93 @@ export function createAtlasServer(options) {
             name: 'atlas', version: options.version ?? null, role: identity?.role ?? 'read', open: auth.open,
             write: options.write, ready: index.ready, viewers: events.count, time: now(),
             backends: snapshot.backends.map(({ id, label, available }) => ({ id, label, available, write: id === options.write })),
-            ...(({ backends: _unused, ...rest }) => rest)(index.stats()), capabilities: { events: true, ingest: true, store: true, checks: true, status: true, effective: true }
+            ...(({ backends: _unused, ...rest }) => rest)(index.stats()), capabilities: { events: true, ingest: true, store: true, checks: true, status: true, effective: true, live: true }
         });
     });
+    app.get('/api/live', async (c) => c.json({ runs: await live.list() }, 200, { 'cache-control': 'no-store' }));
+    const writeLive = async (c, action) => {
+        const verdict = auth.check(c.req.raw, 'publish');
+        if (!verdict.ok)
+            return unauthorized(verdict);
+        const owner = createHash('sha256').update(c.req.header('authorization') ?? 'open').digest('hex');
+        const id = c.req.param('id');
+        if (!/^[a-f0-9-]{36}$/.test(id))
+            return problemResponse(422, 'Invalid live run id.');
+        try {
+            if (action === 'heartbeat') {
+                await live.heartbeat(id, owner);
+                return c.json({ ok: true });
+            }
+            const bytes = await readLimited(c.req.raw, Math.min(limits.json, 2 * MiB));
+            let input;
+            try {
+                input = JSON.parse(new TextDecoder().decode(bytes));
+            }
+            catch {
+                return problemResponse(422, 'The body is not JSON.');
+            }
+            const schema = action === 'start' ? LiveRunStartSchema : LiveRunUpdateSchema;
+            const parsed = schema.safeParse(input);
+            if (!parsed.success)
+                return problemResponse(422, parsed.error.message);
+            if (action === 'start') {
+                const start = LiveRunStartSchema.parse(parsed.data);
+                if (start.id !== id)
+                    return problemResponse(422, 'Run ids must match.');
+                return c.json(await live.start(start, owner), 201);
+            }
+            return c.json(await live.update(id, LiveRunUpdateSchema.parse(parsed.data), owner));
+        }
+        catch (error) {
+            if (error instanceof LiveRunError)
+                return problemResponse(error.status, error.message);
+            if (error instanceof Refusal)
+                return problemResponse(error.status, error.message);
+            throw error;
+        }
+    };
+    app.post('/api/live/:id', c => writeLive(c, 'start'));
+    app.patch('/api/live/:id', c => writeLive(c, 'update'));
+    app.post('/api/live/:id/heartbeat', c => writeLive(c, 'heartbeat'));
+    app.get('/admin', async (c) => c.html(await renderSettingsPage(), 200, { 'cache-control': 'no-store', 'x-frame-options': 'DENY', 'x-content-type-options': 'nosniff' }));
+    app.get('/api/settings', async (c) => {
+        const verdict = auth.check(c.req.raw, 'admin');
+        if (!verdict.ok)
+            return unauthorized(verdict);
+        if (!options.settings)
+            return problemResponse(503, 'Settings are managed by the embedding application.');
+        return c.json(await options.settings.read(), 200, { 'cache-control': 'no-store' });
+    });
+    app.put('/api/settings', async (c) => {
+        const verdict = auth.check(c.req.raw, 'admin');
+        if (!verdict.ok)
+            return unauthorized(verdict);
+        if (!options.settings)
+            return problemResponse(503, 'Settings are managed by the embedding application.');
+        const revision = /^"([a-f0-9]{64})"$/.exec(c.req.header('if-match') ?? '')?.[1];
+        if (!revision)
+            return problemResponse(428, 'Load settings first and send their revision in If-Match.');
+        try {
+            const bytes = await readLimited(c.req.raw, Math.min(limits.json, 64 * 1024));
+            let input;
+            try {
+                input = JSON.parse(new TextDecoder().decode(bytes));
+            }
+            catch {
+                return problemResponse(422, 'The body is not JSON.');
+            }
+            return c.json(await options.settings.save(input, revision), 200, { 'cache-control': 'no-store' });
+        }
+        catch (error) {
+            if (error instanceof ConfigError)
+                return problemResponse(error.message.startsWith('Settings changed') ? 409 : 422, error.message);
+            if (error instanceof Refusal)
+                return problemResponse(error.status, error.message);
+            throw error;
+        }
+    });
     // Live updates: told when the report changes, and when specs or runs do.
-    app.get('/api/events', c => events.stream(c.req.raw, () => ({ version: index.snapshot().version, ready: index.ready, time: now() })));
+    app.get('/api/events', c => events.stream(c.req.raw, () => ({ version: index.snapshot().version, ready: index.ready, time: now(), heartbeatMs: options.heartbeatMs ?? 15_000 })));
     // The report as it stands: one request, only what wins. Everything else about a layer is history.
     app.get('/api/reports/evidence/effective', async (c) => {
         if (!index.ready)
@@ -367,7 +485,9 @@ export function createAtlasServer(options) {
     // The viewer, with this server's address book written into its page.
     if (options.site) {
         const root = path.resolve(options.site);
-        const config = JSON.stringify({ api: './api', reportsUrl: './api/reports', dataUrl: './api/data/', eventsUrl: './api/events', effective: true, ...(options.page ?? {}) });
+        const config = JSON.stringify({ api: './api', reportsUrl: './api/reports', dataUrl: './api/data/', eventsUrl: './api/events', projectsUrl: './api/projects', effective: true, ...(options.page ?? {}) }).replaceAll('<', '\\u003c');
+        const pageDigest = createHash('sha256').update(config).digest('hex').slice(0, 16);
+        const files = new Map();
         app.get('*', async (c) => {
             const pathname = new URL(c.req.url).pathname;
             // An API path that nothing answered is an error, not a page.
@@ -394,12 +514,30 @@ export function createAtlasServer(options) {
             }
             if (!info?.isFile())
                 return c.notFound();
+            const resolved = await realpath(file);
+            const realRoot = await realpath(root);
+            if (!resolved.startsWith(`${realRoot}${path.sep}`))
+                return c.notFound();
             const isIndex = path.basename(file) === 'index.html';
-            let data = new Uint8Array(await readFile(file));
+            const stamp = `${info.mtimeMs}|${info.size}`;
+            const etag = `"${info.mtimeMs}-${info.size}${isIndex ? `-${pageDigest}` : ''}"`;
+            const hashed = /(^|\/)assets\//.test(relative);
+            const headers = { etag, 'x-content-type-options': 'nosniff', 'cache-control': hashed ? 'public, max-age=31536000, immutable' : 'no-cache' };
+            if (c.req.header('if-none-match') === etag)
+                return new Response(null, { status: 304, headers });
+            let kept = files.get(file);
+            if (!kept || kept.stamp !== stamp) {
+                kept = { stamp, bytes: new Uint8Array(await readFile(file)) };
+                if (files.size >= 128)
+                    files.delete(files.keys().next().value);
+                // Keep only small assets; large downloads do not occupy the viewer cache.
+                if (kept.bytes.length <= 2 * MiB)
+                    files.set(file, kept);
+            }
+            let data = kept.bytes;
             if (isIndex)
                 data = new TextDecoder().decode(data).replace('</head>', `<script>window.__ATLAS_CONFIG__=${config}</script></head>`);
-            const hashed = /(^|\/)assets\//.test(relative);
-            return body(c, data, typeOf(file), { 'cache-control': hashed ? 'public, max-age=31536000, immutable' : 'no-cache' }, `${file}|${info.mtimeMs}`, true);
+            return body(c, data, typeOf(file), headers, `${file}|${stamp}`, true);
         });
     }
     // An API path that nothing answered is an error a client can read, whether or not a viewer is served.
@@ -414,6 +552,6 @@ export function createAtlasServer(options) {
         index,
         events,
         ready: index.start(options.refreshMs ?? 10_000),
-        close: () => { stopListening(); index.stop(); events.close(); }
+        close: () => { clearInterval(leaseTimer); stopListening(); index.stop(); events.close(); }
     };
 }

package/dist/server/src/config.d.ts

@@ -71,7 +71,7 @@ export type ServerSetting = {
  */
 export declare const SERVER_SETTINGS: readonly ServerSetting[];
 /** The text `atlas serve --help` prints. Also the source of the `atlas serve` section of `docs/reference/cli.md`. */
-export declare const SERVER_USAGE = "atlas serve: the Atlas server\n\n  atlas serve [--config atlas.server.json] [--data <dir>] [--port 8080] [--host 127.0.0.1]\n              [--store <url|id=url>]... [--write <id>] [--site <dir>]\n              [--outline-branch <b>] [--branch <name>]... [--ignore-modified] [--refresh <seconds>]\n              [--anonymous-read] [--insecure] [--no-log]\n\n  One process serves the viewer and the API. Test results are uploaded to it from anywhere (laptops, CI) and it\n  shows everyone the combined report, live. It keeps its data in --data (default ./atlas-data) and can read more\n  backends (--store): S3, other servers, folders. Uploads go to the data folder unless --write names another.\n\n  Tokens (ATLAS_TOKEN admin, ATLAS_PUBLISH_TOKEN, ATLAS_READ_TOKEN, or \"auth.tokens\" in the config) are required\n  to listen beyond this machine unless --insecure. Every option has an environment variable (docs/deploying.md).\n";
+export declare const SERVER_USAGE = "atlas serve: the Atlas server\n\n  atlas serve [--config atlas.server.json] [--data <dir>] [--port 8080] [--host 127.0.0.1]\n              [--store <url|id=url>]... [--write <id>] [--site <dir>]\n              [--outline-branch <b>] [--branch <name>]... [--ignore-modified] [--refresh <seconds>]\n              [--anonymous-read] [--insecure] [--no-log]\n\n  One process serves the client and the API. Test results are uploaded to it from anywhere (laptops, CI) and it\n  shows everyone the combined report, live. It keeps its data in --data (default ./atlas-data) and can read more\n  backends (--store): S3, other servers, folders. Uploads go to the data folder unless --write names another.\n\n  Tokens (ATLAS_TOKEN admin, ATLAS_PUBLISH_TOKEN, ATLAS_READ_TOKEN, or \"auth.tokens\" in the config) are required\n  to listen beyond this machine unless --insecure. Every option has an environment variable (docs/deploying.md).\n";
 /**
  * Read the file named by `--config`/`ATLAS_CONFIG`, or `atlas.server.json` in the folder if there is one, lay the
  * environment and then the flags over it, and check the result. Every problem is a {@link ConfigError} that says

package/dist/server/src/config.js

@@ -38,7 +38,7 @@ export const SERVER_SETTINGS = [
     { summary: 'The server\'s own folder: the default backend and write target', key: 'data', flag: '--data <dir>', env: ['ATLAS_DATA'], default: '`./atlas-data`', example: { value: 'results', read: c => path.basename(c.data), expected: 'results' } },
     { summary: 'More backends, read together with the data folder', key: 'backends', flag: '--store <[id=]url>` (repeatable)', env: ['ATLAS_STORE'], default: 'none', example: { value: 'lab=https://lab.example.com', read: c => c.backends.map(backend => backend.id), expected: ['data', 'lab'] } },
     { summary: 'The backend uploads go to', key: 'write', flag: '--write <id>', env: ['ATLAS_WRITE'], default: '`data`', example: { value: 'data', read: c => c.writeId, expected: 'data' } },
-    { summary: 'The built viewer', key: 'site', flag: '--site <dir>', env: ['ATLAS_SITE'], default: '`./atlas-site`, else built once', example: { value: 'viewer', read: c => path.basename(c.site ?? ''), expected: 'viewer' } },
+    { summary: 'The built client', key: 'site', flag: '--site <dir>', env: ['ATLAS_SITE'], default: '`./atlas-site`, else built once', example: { value: 'client', read: c => path.basename(c.site ?? ''), expected: 'client' } },
     { summary: 'Whose specs the report is laid over', key: 'outlineBranch', flag: '--outline-branch <branch>', env: ['ATLAS_OUTLINE_BRANCH'], default: '`main`, then `master`, then the newest', example: { value: 'trunk', read: c => c.outlineBranch, expected: 'trunk' } },
     { summary: 'Only layers recorded on these branches take part', key: 'include.branches', flag: '--branch <name>` (repeatable)', env: ['ATLAS_ONLY_BRANCH'], default: 'all', example: { value: 'main', read: c => c.include.branches, expected: ['main'] } },
     { summary: 'Leave out layers from modified checkouts and unknown origins', key: 'include.ignoreModified', flag: '--ignore-modified', env: ['ATLAS_IGNORE_MODIFIED'], default: 'no', example: { value: '1', read: c => c.include.ignoreModified, expected: true } },
@@ -47,7 +47,13 @@ export const SERVER_SETTINGS = [
     { summary: 'Listen publicly with no tokens (something in front signs people in)', key: 'auth.insecure', flag: '--insecure', env: ['ATLAS_INSECURE'], default: 'no', example: { value: '1', read: c => c.insecure, expected: true } },
     { summary: 'The admin token (also `ATLAS_PUBLISH_TOKEN` and `ATLAS_READ_TOKEN` for the other roles, or `auth.tokens` in the file)', key: 'auth.tokens', flag: null, env: ['ATLAS_TOKEN'], default: 'none: the server is open and listens on this machine only', example: { value: 'admin-token-123456', read: c => c.tokens.map(token => token.role), expected: ['admin'] } },
     { summary: 'The configuration file', key: '(the file itself)', flag: '--config <file>', env: ['ATLAS_CONFIG'], default: '`./atlas.server.json` when it exists', example: { value: 'custom.json', read: c => path.basename(c.configFile ?? ''), expected: 'custom.json' } },
-    { summary: 'No request log', key: 'log', flag: '--no-log', env: [], default: 'one JSON line per request', example: { value: '', read: c => c.log, expected: false } }
+    { summary: 'Largest uploaded object in MiB', key: 'limits.maxObjectMiB', flag: null, env: ['ATLAS_MAX_OBJECT_MIB'], default: '`256`', example: { value: '64', read: c => c.limits.maxObjectMiB, expected: 64 } },
+    { summary: 'Largest JSON upload in MiB', key: 'limits.maxJsonMiB', flag: null, env: ['ATLAS_MAX_JSON_MIB'], default: '`32`', example: { value: '8', read: c => c.limits.maxJsonMiB, expected: 8 } },
+    { summary: 'Maximum simultaneous live viewers', key: 'limits.maxStreams', flag: null, env: ['ATLAS_MAX_STREAMS'], default: '`500`', example: { value: '100', read: c => c.limits.maxStreams, expected: 100 } },
+    { summary: 'Live connection heartbeat in seconds', key: 'heartbeatSeconds', flag: null, env: ['ATLAS_HEARTBEAT_SECONDS'], default: '`15`', example: { value: '20', read: c => c.heartbeatSeconds, expected: 20 } },
+    { summary: 'Live producer heartbeat timeout in seconds', key: 'runTimeoutSeconds', flag: null, env: ['ATLAS_RUN_TIMEOUT_SECONDS'], default: '`30`', example: { value: '60', read: c => c.runTimeoutSeconds, expected: 60 } },
+    { summary: 'Live run progress stall timeout in seconds (0 disables)', key: 'runStallSeconds', flag: null, env: ['ATLAS_RUN_STALL_SECONDS'], default: '`900`', example: { value: '0', read: c => c.runStallSeconds, expected: 0 } },
+    { summary: 'No request log', key: 'log', flag: '--no-log', env: ['ATLAS_LOG'], default: 'one JSON line per request', example: { value: 'false', read: c => c.log, expected: false } }
 ];
 /** The text `atlas serve --help` prints. Also the source of the `atlas serve` section of `docs/reference/cli.md`. */
 export const SERVER_USAGE = `atlas serve: the Atlas server
@@ -57,7 +63,7 @@ export const SERVER_USAGE = `atlas serve: the Atlas server
               [--outline-branch <b>] [--branch <name>]... [--ignore-modified] [--refresh <seconds>]
               [--anonymous-read] [--insecure] [--no-log]
 
-  One process serves the viewer and the API. Test results are uploaded to it from anywhere (laptops, CI) and it
+  One process serves the client and the API. Test results are uploaded to it from anywhere (laptops, CI) and it
   shows everyone the combined report, live. It keeps its data in --data (default ./atlas-data) and can read more
   backends (--store): S3, other servers, folders. Uploads go to the data folder unless --write names another.
 
@@ -118,8 +124,19 @@ export function loadServerConfig(argv, env, cwd, read = file => readFileSync(fil
     set('site', flags.site ?? env.ATLAS_SITE);
     set('outlineBranch', flags['outline-branch'] ?? env.ATLAS_OUTLINE_BRANCH);
     set('refreshSeconds', flags.refresh !== undefined ? Number(flags.refresh) : env.ATLAS_REFRESH_SECONDS !== undefined ? Number(env.ATLAS_REFRESH_SECONDS) : undefined);
+    if (env.ATLAS_LOG !== undefined)
+        merged.log = truthy(env.ATLAS_LOG);
     if (flags['no-log'])
         merged.log = false;
+    set('runTimeoutSeconds', env.ATLAS_RUN_TIMEOUT_SECONDS === undefined ? undefined : Number(env.ATLAS_RUN_TIMEOUT_SECONDS));
+    set('runStallSeconds', env.ATLAS_RUN_STALL_SECONDS === undefined ? undefined : Number(env.ATLAS_RUN_STALL_SECONDS));
+    set('heartbeatSeconds', env.ATLAS_HEARTBEAT_SECONDS === undefined ? undefined : Number(env.ATLAS_HEARTBEAT_SECONDS));
+    const limits = { ...raw.limits };
+    for (const [key, variable] of [['maxObjectMiB', 'ATLAS_MAX_OBJECT_MIB'], ['maxJsonMiB', 'ATLAS_MAX_JSON_MIB'], ['maxStreams', 'ATLAS_MAX_STREAMS']]) {
+        if (env[variable] !== undefined)
+            limits[key] = Number(env[variable]);
+    }
+    merged.limits = limits;
     if (flags.insecure || truthy(env.ATLAS_INSECURE))
         auth.insecure = true;
     if (flags['anonymous-read'] || truthy(env.ATLAS_ANONYMOUS_READ))

package/dist/server/src/dev.d.ts

@@ -1,12 +1,12 @@
 /**
  * @module `atlas dev`
  *
- * Runs the same server as `atlas serve` on a port of its own, with the viewer's Vite dev server in front of it. Vite proxies
+ * Runs the same server as `atlas serve` on a port of its own, with the client's Vite dev server in front of it. Vite proxies
  * `/api` (server-sent events included) to the server and writes the same address book into the page, so the browser, the
- * uploaders and the viewer all use one host, exactly as in production, and a change to the viewer shows at once.
+ * uploaders and the client all use one host, exactly as in production, and a change to the client shows at once.
  */
 import { type ServeIo } from './main.js';
 /** The text `atlas dev --help` prints. Also the source of the `atlas dev` section of `docs/reference/cli.md`. */
-export declare const DEV_USAGE = "atlas dev: the Atlas server and the viewer, for working on either\n\n  atlas dev [--port 5180] [--host 127.0.0.1] [--data <dir>] [--store <url|id=url>]... [--config atlas.server.json]\n\n  Starts the server (API only, on a port of its own) and the viewer's dev server, which proxies /api to it, so the\n  browser talks to one host and a change to the viewer shows at once. In production `atlas serve` does both from\n  one process.\n";
+export declare const DEV_USAGE = "atlas dev: the Atlas server and the client, for working on either\n\n  atlas dev [--port 5180] [--host 127.0.0.1] [--data <dir>] [--store <url|id=url>]... [--config atlas.server.json]\n\n  Starts the server (API only, on a port of its own) and the client's dev server, which proxies /api to it, so the\n  browser talks to one host and a change to the client shows at once. In production `atlas serve` does both from\n  one process.\n";
 /** `atlas dev`. */
 export declare function devMain(argv: readonly string[], io: ServeIo): Promise<number>;