@cs-object/cli 0.1.0

package/dist/dev-server-BVY4Q6R6.js

@@ -0,0 +1,732 @@
+import {
+  UsageError
+} from "./chunk-OYQDZWT7.js";
+import {
+  LayoutInspectionError,
+  buildPreparedHtml,
+  captureAssets,
+  jsonBytes,
+  renderPreparedPdf,
+  sha256
+} from "./chunk-7XCJ6AF3.js";
+import {
+  executeAndVerify,
+  parseStrictJson
+} from "./chunk-KYWIVB2V.js";
+import "./chunk-MOM6Q2VG.js";
+
+// src/dev-server.ts
+import {
+  createServer
+} from "http";
+import { resolve } from "path";
+import {
+  PythonIdentifierSchema
+} from "@cs-object/core";
+
+// src/dev-errors.ts
+var HttpError = class extends Error {
+  constructor(status, message, diagnostics = []) {
+    super(message);
+    this.status = status;
+    this.diagnostics = diagnostics;
+  }
+};
+
+// src/dev-runtime.ts
+import { spawnSync } from "child_process";
+import { randomUUID } from "crypto";
+import {
+  CalculationDefinitionResponseSchema
+} from "@cs-object/core";
+import {
+  prepareExecutionDocument,
+  DocumentPreparationError
+} from "@cs-object/react";
+var defaults = {
+  maximumRuns: 10,
+  maximumBytes: 128 * 1024 * 1024,
+  maximumAgeMs: 30 * 6e4
+};
+function describe(options) {
+  const env = { ...process.env };
+  for (const key of ["PYTHONPATH", "PYTHONHOME", "NODE_PATH"])
+    Reflect.deleteProperty(env, key);
+  const result = spawnSync(
+    process.env.PYTHON ?? "python3",
+    [
+      "-I",
+      "-m",
+      "cso_python",
+      "describe",
+      options.sourcePath,
+      "--function",
+      options.functionName
+    ],
+    {
+      env,
+      timeout: 3e4,
+      killSignal: "SIGKILL",
+      maxBuffer: 4 * 1024 * 1024
+    }
+  );
+  if (result.error || result.signal)
+    throw new HttpError(
+      422,
+      result.error?.message ?? `Python terminated by ${result.signal}`
+    );
+  const response = CalculationDefinitionResponseSchema.parse(
+    parseStrictJson(
+      new TextDecoder("utf-8", { fatal: true }).decode(result.stdout)
+    )
+  );
+  if (!response.ok)
+    throw new HttpError(
+      422,
+      "Cannot describe the calculation",
+      response.diagnostics
+    );
+  if (result.status !== 0)
+    throw new HttpError(422, "Python describe did not exit successfully");
+  return response.definition;
+}
+function createDevRuntime(options, limits = defaults) {
+  describe(options);
+  const runs = /* @__PURE__ */ new Map();
+  let activePdf;
+  let closed = false;
+  const retainedBytes = () => [...runs.values()].reduce((sum, run) => sum + run.bytes, 0);
+  function prune(extraBytes = 0, extraRuns = 0, keep) {
+    if (extraBytes + (keep?.bytes ?? 0) > limits.maximumBytes || extraRuns > limits.maximumRuns)
+      throw new HttpError(
+        413,
+        "The retained report exceeds the local session limit"
+      );
+    for (const [id, run] of runs)
+      if (run.expires <= Date.now() && run !== activePdf?.run && run !== keep)
+        runs.delete(id);
+    for (const [id, run] of runs) {
+      if (retainedBytes() + extraBytes <= limits.maximumBytes && runs.size + extraRuns <= limits.maximumRuns)
+        break;
+      if (run !== activePdf?.run && run !== keep) runs.delete(id);
+    }
+    if (retainedBytes() + extraBytes > limits.maximumBytes || runs.size + extraRuns > limits.maximumRuns)
+      throw new HttpError(
+        413,
+        "The retained report exceeds the local session limit"
+      );
+  }
+  async function renderPdf(run) {
+    if (run.pdf.kind === "ready") return run.pdf.bytes;
+    if (run.pdf.kind === "rendering") return run.pdf.promise;
+    if (run.pdf.kind === "failed") throw run.pdf.error;
+    if (activePdf)
+      throw new HttpError(429, "Another PDF is rendering; retry shortly");
+    const abort = new AbortController();
+    const timer = setTimeout(
+      () => abort.abort(new Error("PDF rendering timed out")),
+      9e4
+    );
+    const promise = renderPreparedPdf(
+      run.document,
+      run.html.toString("utf8"),
+      abort.signal
+    ).then((rendered) => {
+      const addedBytes = rendered.pdf.length + jsonBytes(rendered.presentation).length;
+      prune(addedBytes, 0, run);
+      run.bytes += addedBytes;
+      run.pdf = {
+        kind: "ready",
+        bytes: rendered.pdf,
+        presentation: rendered.presentation
+      };
+      run.checks.rendering = { status: "passed" };
+      return rendered.pdf;
+    }).catch((error) => {
+      if (error instanceof HttpError && error.status === 413) {
+        run.pdf = { kind: "pending" };
+        throw error;
+      }
+      const message = error instanceof Error ? error.message : "PDF rendering failed";
+      const failure = new HttpError(
+        422,
+        message,
+        error instanceof LayoutInspectionError ? error.diagnostics : []
+      );
+      run.pdf = { kind: "failed", error: failure };
+      run.checks.rendering = { status: "failed" };
+      throw failure;
+    }).finally(() => {
+      clearTimeout(timer);
+      activePdf = void 0;
+    });
+    run.pdf = { kind: "rendering", promise };
+    activePdf = { run, abort, promise };
+    return promise;
+  }
+  function assertOpen() {
+    if (closed) throw new HttpError(503, "Server is shutting down");
+  }
+  function execute({ definition, inputs }) {
+    assertOpen();
+    const verified = executeAndVerify(
+      { ...options, command: "verify", inputs },
+      3e4
+    );
+    if (verified.kind === "failed")
+      throw new HttpError(
+        422,
+        "Calculation failed verification",
+        verified.outcome.report.diagnostics
+      );
+    const { execution } = verified.capture;
+    if (execution.entry.moduleId !== definition.entryModuleId || execution.entry.sourceHash !== definition.entrySourceHash || execution.sourceClosureHash !== definition.sourceClosureHash || execution.entry.function !== definition.function)
+      throw new HttpError(
+        409,
+        "Calculation source changed during the request; calculate again"
+      );
+    if (!execution.authoring)
+      throw new HttpError(422, "Public output evidence is required");
+    const outputs = Object.fromEntries(
+      execution.authoring.outputs.filter(
+        (output) => output.invocationId === execution.entry.invocationId
+      ).map((output) => [output.name, output.value])
+    );
+    return { verified, execution, outputs };
+  }
+  function lookup(id) {
+    assertOpen();
+    prune();
+    const run = runs.get(id);
+    if (!run)
+      throw new HttpError(
+        404,
+        "Run expired or does not exist; calculate again"
+      );
+    return run;
+  }
+  function summary(run) {
+    return structuredClone({
+      id: run.id,
+      outputs: run.outputs,
+      checks: run.checks
+    });
+  }
+  function createRun(invocation) {
+    const { verified, execution, outputs } = execute(invocation);
+    try {
+      const document = prepareExecutionDocument({
+        execution,
+        assets: captureAssets(options.sourcePath, execution)
+      });
+      const independent = verified.report.checks.independentReferenceAgreement.status;
+      const notice = `Source-to-document consistency passed. Independent numerical reference: ${independent === "passed" ? "passed" : "pending, no matching reference"}. Human visual inspection is pending. These checks do not establish engineering approval.`;
+      const html = Buffer.from(buildPreparedHtml(document, notice));
+      const bytes = html.length + jsonBytes(document).length + verified.capture.executionBytes.length + (verified.capture.referenceBytes?.length ?? 0) + jsonBytes(verified.capture.verification).length;
+      prune(bytes, 1);
+      const run = {
+        id: randomUUID(),
+        outputs,
+        checks: {
+          ...verified.report.checks,
+          documentContent: { status: "passed" },
+          visualInspection: { status: "pending" }
+        },
+        capture: verified.capture,
+        document,
+        html,
+        bytes,
+        expires: Date.now() + limits.maximumAgeMs,
+        pdf: { kind: "pending" }
+      };
+      runs.set(run.id, run);
+      return summary(run);
+    } catch (error) {
+      if (error instanceof DocumentPreparationError)
+        throw new HttpError(422, error.message, error.diagnostics);
+      throw error;
+    }
+  }
+  const expiry = setInterval(
+    () => prune(),
+    Math.min(limits.maximumAgeMs, 6e4)
+  );
+  expiry.unref();
+  return {
+    definition() {
+      assertOpen();
+      return describe(options);
+    },
+    calculate(invocation) {
+      return execute(invocation).outputs;
+    },
+    createRun,
+    summary(id) {
+      return summary(lookup(id));
+    },
+    html(id) {
+      return lookup(id).html;
+    },
+    async pdf(id) {
+      const bytes = await renderPdf(lookup(id));
+      return { bytes, sha256: sha256(bytes) };
+    },
+    evidence(id) {
+      const run = lookup(id);
+      return jsonBytes({
+        runId: run.id,
+        execution: parseStrictJson(run.capture.executionBytes.toString("utf8")),
+        document: run.document,
+        verification: run.capture.verification,
+        reference: run.capture.referenceBytes ? {
+          sha256: sha256(run.capture.referenceBytes),
+          content: parseStrictJson(
+            run.capture.referenceBytes.toString("utf8")
+          )
+        } : null,
+        checks: run.checks,
+        artifacts: {
+          html: { sha256: sha256(run.html) },
+          pdf: run.pdf.kind === "ready" ? { sha256: sha256(run.pdf.bytes) } : null
+        },
+        presentation: run.pdf.kind === "ready" ? run.pdf.presentation : []
+      });
+    },
+    async close() {
+      closed = true;
+      clearInterval(expiry);
+      const rendering = activePdf;
+      rendering?.abort.abort(new Error("Server is shutting down"));
+      if (rendering) await Promise.allSettled([rendering.promise]);
+      runs.clear();
+    }
+  };
+}
+
+// src/dev-ui.ts
+var devPage = {
+  html: `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Calculation report</title><style>
+*{box-sizing:border-box}body{margin:0;background:#f5f6f8;color:#17212b;font:16px system-ui,sans-serif}main{max-width:1500px;margin:auto;padding:28px}h1{font-size:28px;margin-top:0}.workspace{display:grid;grid-template-columns:minmax(260px,340px) minmax(0,1fr);gap:24px}.controls,section{background:white;border:1px solid #d9dee5;border-radius:8px;padding:22px}label{display:block;margin:18px 0 6px}label small{display:block;color:#536172}input{width:100%;padding:10px;border:1px solid #a8b3c0;border-radius:4px;font:inherit}button,.download{display:inline-block;margin:18px 8px 0 0;padding:10px 14px;border:0;border-radius:4px;background:#164d87;color:white;font:inherit;cursor:pointer;text-decoration:none}button:disabled{opacity:.55;cursor:wait}a[hidden],iframe[hidden]{display:none}#status{line-height:1.5;min-height:24px}#checks{padding-left:20px;font-size:14px;line-height:1.6}#outputs{display:grid;grid-template-columns:1fr auto;gap:6px}#outputs dt,#outputs dd{margin:0}#report{width:100%;height:1000px;border:1px solid #d9dee5;background:white}pre{overflow:auto;padding:14px;background:#edf1f6;border-radius:4px;font-size:12px;white-space:pre-wrap;overflow-wrap:anywhere}h2{font-size:19px}@media(max-width:900px){main{padding:16px}.workspace{grid-template-columns:1fr}#report{height:850px}}:focus-visible{outline:3px solid #d99726;outline-offset:2px}
+</style></head><body><main><h1>Calculation report</h1><div class="workspace"><div class="controls"><form id="inputs"><div id="fields"></div><button id="calculate" type="submit" disabled>Calculate</button></form><p id="status" role="status" aria-live="polite">Loading calculation\u2026</p><p>Reload this page after changing the calculation input definitions.</p><h2>Outputs</h2><dl id="outputs"></dl><ul id="checks"></ul><a id="pdf" class="download" hidden>Download PDF</a><a id="evidence" hidden>Download evidence</a><h2>Calculate with curl</h2><pre id="curl"></pre></div><section aria-label="Calculation report preview"><iframe id="report" title="Calculation report" sandbox="" hidden></iframe></section></div></main><script src="/app.js"></script></body></html>`,
+  script: String.raw`
+const form = document.querySelector('#inputs');
+const fields = document.querySelector('#fields');
+const button = document.querySelector('#calculate');
+const status = document.querySelector('#status');
+const outputs = document.querySelector('#outputs');
+const checks = document.querySelector('#checks');
+const report = document.querySelector('#report');
+const pdf = document.querySelector('#pdf');
+const evidence = document.querySelector('#evidence');
+let revision = 0;
+let currentRun;
+let definition;
+const numberText = value => Object.is(value, -0) ? '-0.0' : Number.isInteger(value) && !Number.isSafeInteger(value) ? value.toExponential() : JSON.stringify(value);
+function inputJson() {
+  const entries = Array.from(fields.querySelectorAll('input'), input => {
+    if (input.value.trim() === '' || !Number.isFinite(Number(input.value))) throw new Error('Enter a finite value for ' + input.name);
+    return JSON.stringify(input.name) + ':' + numberText(Number(input.value));
+  });
+  return '{"inputs":{' + entries.join(',') + '}}';
+}
+function updateCurl() {
+  try {
+    const body = inputJson().replaceAll("'", "'\\''");
+    document.querySelector('#curl').textContent = 'curl -sS --fail-with-body ' + location.origin + '/api/calculate -H \'Content-Type: application/json\' -d \'' + body + '\'';
+  } catch { document.querySelector('#curl').textContent = 'Enter input values to show the request.'; }
+}
+function invalidate() {
+  revision += 1; currentRun = undefined;
+  report.hidden = true; report.removeAttribute('src');
+  pdf.hidden = true; pdf.removeAttribute('href');
+  evidence.hidden = true; evidence.removeAttribute('href');
+  outputs.replaceChildren(); checks.replaceChildren();
+  status.textContent = 'Inputs changed. Calculate again to update the report.';
+  updateCurl();
+}
+function showChecks(values) {
+  checks.replaceChildren();
+  const labels = [
+    ['sourceToDocumentConsistency', 'Source-to-document consistency'],
+    ['independentReferenceAgreement', 'Independent reference agreement'],
+    ['rendering', 'PDF layout'],
+    ['visualInspection', 'Human visual inspection'],
+  ];
+  for (const [key, label] of labels) {
+    const item = document.createElement('li');
+    const state = values[key].status;
+    item.textContent = label + ': ' + (state === 'not_applicable' ? key === 'independentReferenceAgreement' ? 'pending, no matching reference' : 'pending' : state);
+    checks.append(item);
+  }
+}
+async function readJson(response) {
+  const body = await response.json();
+  if (!response.ok) throw new Error([body.error, ...(body.diagnostics ?? []).map(item => item.message)].join('\n'));
+  return body;
+}
+form.addEventListener('input', invalidate);
+form.addEventListener('submit', async event => {
+  event.preventDefault();
+  invalidate();
+  const started = revision;
+  button.disabled = true;
+  status.textContent = 'Calculating…';
+  try {
+    const run = await readJson(await fetch('/api/runs', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: inputJson() }));
+    if (started !== revision) return;
+    currentRun = run;
+    for (const [name, value] of Object.entries(run.outputs)) {
+      const metadata = definition.outputs.find(item => item.name === name);
+      const term = document.createElement('dt'); term.textContent = name;
+      const result = document.createElement('dd'); result.textContent = numberText(value) + (metadata?.unit ? ' ' + metadata.unit : '');
+      outputs.append(term, result);
+    }
+    showChecks(run.checks);
+    report.src = run.html; report.hidden = false;
+    pdf.href = run.pdf; pdf.hidden = false;
+    evidence.href = run.evidence; evidence.hidden = true;
+    status.textContent = 'Report ready. Review its assumptions and results.';
+  } catch (error) { if (started === revision) status.textContent = error.message; }
+  finally { button.disabled = false; }
+});
+pdf.addEventListener('click', async event => {
+  event.preventDefault();
+  const run = currentRun;
+  if (!run) return;
+  const started = revision;
+  pdf.hidden = true;
+  status.textContent = 'Preparing PDF…';
+  try {
+    const response = await fetch(run.pdf);
+    if (!response.ok) await readJson(response);
+    const blob = await response.blob();
+    if (started !== revision) return;
+    const url = URL.createObjectURL(blob);
+    const download = document.createElement('a'); download.href = url; download.download = 'calculation.pdf'; download.click();
+    setTimeout(() => URL.revokeObjectURL(url), 1000);
+    const latest = await readJson(await fetch('/api/runs/' + run.id));
+    if (started === revision) { showChecks(latest.checks); evidence.href = run.evidence; evidence.hidden = false; status.textContent = 'PDF ready. Human review remains pending.'; }
+  } catch (error) {
+    if (started === revision) {
+      try {
+        const latest = await readJson(await fetch('/api/runs/' + run.id));
+        if (started === revision) showChecks(latest.checks);
+      } catch { /* Keep the original PDF failure if the run is unavailable. */ }
+      if (started === revision) status.textContent = error.message;
+    }
+  }
+  finally { if (started === revision) pdf.hidden = false; }
+});
+(async () => {
+  try {
+    definition = await readJson(await fetch('/api/definition'));
+    for (const [index, input] of definition.inputs.entries()) {
+      const label = document.createElement('label'); label.htmlFor = 'input-' + index;
+      label.textContent = input.description + (input.unit ? ' (' + input.unit + ')' : '');
+      const name = document.createElement('small'); name.textContent = input.name; label.append(name);
+      const field = document.createElement('input'); field.id = label.htmlFor; field.name = input.name; field.type = 'number'; field.step = input.numericType === 'int' ? '1' : 'any'; field.required = true;
+      if (input.default !== undefined) field.value = Object.is(input.default, -0) ? '-0' : String(input.default);
+      fields.append(label, field);
+    }
+    button.disabled = false; status.textContent = 'Enter inputs and calculate.'; updateCurl();
+    if (definition.inputs.every(input => input.default !== undefined)) form.requestSubmit();
+  } catch (error) { status.textContent = error.message; }
+})();
+`
+};
+
+// src/dev-server.ts
+var devHelp = `Usage: cso dev <file.cso.py> --function <name> [--port <0-65535>] [--reference <file.json>]
+
+Serve a verified calculation on 127.0.0.1. Port 0 chooses an available port.
+PYTHON selects the installed cso-python interpreter. Source path and function are fixed at startup.
+`;
+function parseDevArgs(args) {
+  const [source, ...rest] = args;
+  if (!source || source.startsWith("-")) throw new UsageError(devHelp);
+  const values = /* @__PURE__ */ new Map();
+  for (let index = 0; index < rest.length; index += 2) {
+    const key = rest[index];
+    const value = rest[index + 1];
+    if (!["--function", "--port", "--reference"].includes(key) || values.has(key) || !value || value.startsWith("--"))
+      throw new UsageError(devHelp);
+    values.set(key, value);
+  }
+  const functionName = values.get("--function");
+  if (!functionName || !PythonIdentifierSchema.safeParse(functionName).success)
+    throw new UsageError("--function requires a Python identifier");
+  const normalizedFunction = functionName.normalize("NFKC");
+  if (!PythonIdentifierSchema.safeParse(normalizedFunction).success)
+    throw new UsageError(
+      "--function does not normalize to a valid Python identifier"
+    );
+  const spelling = values.get("--port") ?? "3000";
+  const port = Number(spelling);
+  if (!/^\d+$/.test(spelling) || !Number.isInteger(port) || port > 65535)
+    throw new UsageError("--port must be an integer between 0 and 65535");
+  const reference = values.get("--reference");
+  return {
+    sourcePath: resolve(source),
+    functionName: normalizedFunction,
+    port,
+    ...reference ? { referencePath: resolve(reference) } : {}
+  };
+}
+function parseDevInputs(text, definition) {
+  let body;
+  try {
+    body = parseStrictJson(text);
+  } catch (error) {
+    throw new HttpError(
+      400,
+      error instanceof Error ? error.message : "Invalid JSON"
+    );
+  }
+  if (!body || typeof body !== "object" || Array.isArray(body) || Object.keys(body).length !== 1 || !("inputs" in body))
+    throw new HttpError(400, "Request must contain only an inputs object");
+  const values = body.inputs;
+  if (!values || typeof values !== "object" || Array.isArray(values))
+    throw new HttpError(400, "inputs must be an object");
+  const parameters = new Map(
+    definition.inputs.map((input) => [input.name, input])
+  );
+  const entries = [];
+  for (const [name, value] of Object.entries(values)) {
+    const input = parameters.get(name);
+    if (!input) throw new HttpError(400, `Unknown input ${name}`);
+    if (typeof value !== "number" || !Number.isFinite(value) || input.numericType === "int" && !Number.isSafeInteger(value))
+      throw new HttpError(
+        400,
+        `${name} requires a finite ${input.numericType === "int" ? "safe integer" : "number"}`
+      );
+    entries.push([
+      name,
+      input.numericType === "int" && Object.is(value, -0) ? 0 : value
+    ]);
+  }
+  for (const match of text.matchAll(
+    /("(?:[^"\\]|\\.)*")\s*:\s*(-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?)/g
+  )) {
+    const name = JSON.parse(match[1]);
+    const token = match[2];
+    if (typeof name === "string" && parameters.get(name)?.numericType === "int" && /[.eE]/.test(token))
+      throw new HttpError(
+        400,
+        `${name} requires an integer token without a decimal or exponent`
+      );
+    if (!/[.eE]/.test(token) && !Number.isSafeInteger(Number(token)))
+      throw new HttpError(
+        400,
+        "Integer tokens must be within the safe integer range; use a decimal or exponent for floats"
+      );
+  }
+  for (const input of definition.inputs) {
+    if (!Object.hasOwn(values, input.name) && input.default === void 0)
+      throw new HttpError(400, `Missing input ${input.name}`);
+  }
+  return Object.fromEntries(entries);
+}
+function withLinks(summary) {
+  const base = `/api/runs/${summary.id}`;
+  return {
+    ...summary,
+    html: `${base}/report.html`,
+    pdf: `${base}/report.pdf`,
+    evidence: `${base}/evidence.json`
+  };
+}
+function send(response, status, data, type) {
+  response.writeHead(status, {
+    "Content-Type": type,
+    "Content-Length": data.length,
+    "Cache-Control": "no-store",
+    "X-Content-Type-Options": "nosniff"
+  });
+  response.end(data);
+}
+async function readBody(request) {
+  const chunks = [];
+  let length = 0;
+  for await (const chunk of request.iterator({ destroyOnReturn: false })) {
+    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    length += bytes.length;
+    if (length > 64 * 1024) {
+      request.resume();
+      throw new HttpError(413, "Request body exceeds 64 KiB");
+    }
+    chunks.push(bytes);
+  }
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(
+      Buffer.concat(chunks)
+    );
+  } catch {
+    throw new HttpError(400, "Request must be UTF-8 JSON");
+  }
+}
+async function startDevServer(options, limits) {
+  const runtime = createDevRuntime(options, limits);
+  let origin = "";
+  let stopping = false;
+  const server = createServer(async (request, response) => {
+    try {
+      if (stopping) throw new HttpError(503, "Server is shutting down");
+      if (request.headers.host !== new URL(origin).host || request.headers.origin !== void 0 && request.headers.origin !== origin)
+        throw new HttpError(
+          403,
+          "Only same-origin localhost requests are accepted"
+        );
+      const url = new URL(request.url ?? "/", origin);
+      if (url.origin !== origin)
+        throw new HttpError(403, "Invalid request origin");
+      if (request.method === "GET" && url.pathname === "/") {
+        response.setHeader(
+          "Content-Security-Policy",
+          "default-src 'self'; script-src 'self'; style-src 'unsafe-inline'; frame-src 'self'; object-src 'none'; base-uri 'none'"
+        );
+        return send(
+          response,
+          200,
+          Buffer.from(devPage.html),
+          "text/html; charset=utf-8"
+        );
+      }
+      if (request.method === "GET" && url.pathname === "/app.js")
+        return send(
+          response,
+          200,
+          Buffer.from(devPage.script),
+          "text/javascript; charset=utf-8"
+        );
+      if (request.method === "GET" && url.pathname === "/api/definition")
+        return send(
+          response,
+          200,
+          jsonBytes(runtime.definition()),
+          "application/json"
+        );
+      if (request.method === "POST" && ["/api/calculate", "/api/runs"].includes(url.pathname)) {
+        if (!/^application\/json(?:\s*;.*)?$/i.test(
+          request.headers["content-type"] ?? ""
+        ))
+          throw new HttpError(415, "Content-Type must be application/json");
+        const body = await readBody(request);
+        const definition = runtime.definition();
+        const invocation = {
+          definition,
+          inputs: parseDevInputs(body, definition)
+        };
+        if (url.pathname === "/api/calculate")
+          return send(
+            response,
+            200,
+            jsonBytes(runtime.calculate(invocation)),
+            "application/json"
+          );
+        return send(
+          response,
+          201,
+          jsonBytes(withLinks(runtime.createRun(invocation))),
+          "application/json"
+        );
+      }
+      const match = /^\/api\/runs\/([\da-f-]{36})(?:\/(report\.html|report\.pdf|evidence\.json))?$/.exec(
+        url.pathname
+      );
+      if (request.method === "GET" && match) {
+        const id = match[1];
+        if (match[2] === "report.html")
+          return send(
+            response,
+            200,
+            runtime.html(id),
+            "text/html; charset=utf-8"
+          );
+        if (match[2] === "report.pdf") {
+          const artifact = await runtime.pdf(id);
+          response.setHeader(
+            "Content-Disposition",
+            'attachment; filename="calculation.pdf"'
+          );
+          response.setHeader("X-CSO-PDF-SHA256", artifact.sha256);
+          return send(response, 200, artifact.bytes, "application/pdf");
+        }
+        if (match[2] === "evidence.json") {
+          response.setHeader(
+            "Content-Disposition",
+            'attachment; filename="calculation-evidence.json"'
+          );
+          return send(response, 200, runtime.evidence(id), "application/json");
+        }
+        return send(
+          response,
+          200,
+          jsonBytes(withLinks(runtime.summary(id))),
+          "application/json"
+        );
+      }
+      throw new HttpError(404, "Not found");
+    } catch (error) {
+      if (response.destroyed || response.headersSent) return;
+      const failure = error instanceof HttpError ? error : new HttpError(
+        500,
+        error instanceof Error ? error.message : "Request failed"
+      );
+      if (failure.status === 413) response.setHeader("Connection", "close");
+      send(
+        response,
+        failure.status,
+        jsonBytes({ error: failure.message, diagnostics: failure.diagnostics }),
+        "application/json"
+      );
+    }
+  });
+  server.requestTimeout = 15e3;
+  server.headersTimeout = 1e4;
+  server.maxConnections = 16;
+  server.keepAliveTimeout = 5e3;
+  try {
+    await new Promise((success, failure) => {
+      server.once("error", failure);
+      server.listen(options.port, "127.0.0.1", () => {
+        server.off("error", failure);
+        success();
+      });
+    });
+  } catch (error) {
+    await runtime.close();
+    throw error;
+  }
+  const address = server.address();
+  if (!address || typeof address === "string")
+    throw new Error("Missing localhost address");
+  origin = `http://127.0.0.1:${address.port}`;
+  return {
+    origin,
+    close: async () => {
+      stopping = true;
+      const closed = new Promise((done) => server.close(() => done()));
+      server.closeAllConnections();
+      await Promise.allSettled([closed, runtime.close()]);
+    }
+  };
+}
+async function devCommand(args) {
+  const server = await startDevServer(parseDevArgs(args));
+  process.stdout.write(`CSO dev ${server.origin}
+`);
+  const stop = () => {
+    process.off("SIGINT", stop);
+    process.off("SIGTERM", stop);
+    void server.close();
+  };
+  process.on("SIGINT", stop);
+  process.on("SIGTERM", stop);
+}
+export {
+  devCommand,
+  devHelp,
+  parseDevArgs,
+  parseDevInputs,
+  startDevServer
+};