@datarails-ai/dr-appspace-cli 0.12.27 → 0.12.28

package/dist/cli.js

@@ -13,7 +13,7 @@ import { fileURLToPath as fileURLToPath6 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-appspace-cli",
-  version: "0.12.27",
+  version: "0.12.28",
   description: "Datarails App Space CLI \u2014 build, try, push and publish App Space apps",
   type: "module",
   engines: {
@@ -57,7 +57,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-10-25T11:18:27.773Z";
+var BUILD_TIME = "2026-10-25T11:21:22.420Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -3803,7 +3803,7 @@ function parseHtml(html) {
     elements.push({ tag, attrs, line: line2 });
     if (tag === "script" && !("src" in attrs)) {
       const bodyStart = match.index + whole.length;
-      const end = html.indexOf("</script", bodyStart);
+      const end = rawTextEnd(html, "script", bodyStart);
       const body = html.slice(bodyStart, end === -1 ? void 0 : end);
       scripts.push({ text: body, line: lineAt(html, bodyStart) });
       if (end !== -1) TAG.lastIndex = end;
@@ -3811,6 +3811,25 @@ function parseHtml(html) {
   }
   return { elements, scripts };
 }
+function rawTextEnd(html, tag, from) {
+  const end = new RegExp(`</${tag}(?=[\\t\\n\\f\\r />])`, "gi");
+  end.lastIndex = from;
+  const found = end.exec(html);
+  return found === null ? -1 : found.index;
+}
+var CONTRACT_ID = "dr-contract";
+var JSON_TYPE = "application/json";
+function contractBlockOf(elements) {
+  const first = elements.find((el) => el.attrs.id === CONTRACT_ID);
+  if (first === void 0 || first.tag !== "script" || first.attrs.src !== void 0) return null;
+  return (first.attrs.type ?? "").trim().toLowerCase() === JSON_TYPE ? first : null;
+}
+function contractBlockText(html) {
+  const { elements, scripts } = parseHtml(html);
+  const block = contractBlockOf(elements);
+  if (block === null) return null;
+  return scripts[elements.filter((el) => el.tag === "script" && !("src" in el.attrs)).indexOf(block)]?.text ?? null;
+}
 function parseTree(html) {
   const nodes = [];
   const roots = [];
@@ -3849,7 +3868,7 @@ function parseTree(html) {
     else nodes[parent].children.push(node.index);
     if (tag === "script" || tag === "style") {
       if (selfClosed) continue;
-      const end = html.indexOf(`</${tag}`, match.index + whole.length);
+      const end = rawTextEnd(html, tag, match.index + whole.length);
       if (end === -1) {
         wellFormed = false;
         continue;
@@ -6080,7 +6099,6 @@ function readPage(app, page, spec, elements, problems) {
     pins: pinsOf(page, tree)
   };
 }
-var EMBEDDED_CONTRACT = /<script\b[^>]*\bid\s*=\s*["']dr-contract["'][^>]*>([\s\S]*?)<\/script>/i;
 function paramsOf(page) {
   const entry = embeddedPageOf(page);
   return Array.isArray(entry?.params) ? { params: entry.params } : {};
@@ -6096,10 +6114,10 @@ function mountOf(page) {
   };
 }
 function embeddedContractOf(page) {
-  const found = EMBEDDED_CONTRACT.exec(page?.text ?? "");
-  if (found === null) return null;
+  const text3 = contractBlockText(page?.text ?? "");
+  if (text3 === null) return null;
   try {
-    const embedded = JSON.parse((found[1] ?? "").replace(/<\\\//g, "</"));
+    const embedded = JSON.parse(text3.replace(/<\\\//g, "</"));
     return isPlainObject(embedded) ? embedded : null;
   } catch {
     return null;
@@ -6441,7 +6459,7 @@ function pageScripts(app, page, tree) {
   for (const node of tree.nodes) {
     if (node.tag !== "script") continue;
     if (!node.attrs.src) {
-      const end = page.text.indexOf("</script", node.end);
+      const end = rawTextEnd(page.text, "script", node.end);
       inline.push({ path: page.path, text: page.text.slice(node.end, end === -1 ? void 0 : end) });
       continue;
     }
@@ -8604,7 +8622,7 @@ function payloadProducers(contract, { moduleSource = () => void 0, pageSource =
 }
 var SCRIPT_TAG = /<script\b([^>]*)>([\s\S]*?)<\/script\s*>/gi;
 var SRC_ATTR = /\bsrc\s*=\s*["']([^"']+)["']/i;
-var JSON_TYPE = /\btype\s*=\s*["']application\/json["']/i;
+var JSON_TYPE2 = /\btype\s*=\s*["']application\/json["']/i;
 var MOUNT_ONLY = /^\s*drApp\.mount\(\s*\{[^}]*\}\s*\)\s*;?\s*$/;
 function pageCode(html, path3, modules, pageSource) {
   const out = [];
@@ -8612,7 +8630,7 @@ function pageCode(html, path3, modules, pageSource) {
     const attrs = match[1] ?? "";
     const src = SRC_ATTR.exec(attrs)?.[1];
     if (src === void 0) {
-      if (JSON_TYPE.test(attrs) || MOUNT_ONLY.test(match[2] ?? "") || (match[2] ?? "").trim() === "") continue;
+      if (JSON_TYPE2.test(attrs) || MOUNT_ONLY.test(match[2] ?? "") || (match[2] ?? "").trim() === "") continue;
       out.push(match[2]);
       continue;
     }
@@ -11098,13 +11116,25 @@ function restateDashboard(composed, pages, handlerName, handler, { refuse, note,
       slots: {},
       binding: null
     });
-    const header = regions("header")[0] ?? fresh();
-    const chrome = HEADER_CHROME.map((role) => regions(role)[0] ?? fresh());
+    const duplicates = /* @__PURE__ */ new Set();
+    const onlyOne = (uids, what) => {
+      for (const uid of uids.slice(1)) {
+        duplicates.add(uid);
+        refuse(
+          "chrome_duplicate",
+          `/elements/${escapePointer3(uid)}`,
+          `"${uid}" is a second ${what} on ${path3}, after "${uids[0]}"; a dashboard page has one of each piece of chrome \u2014 remove it, or merge it into "${uids[0]}"`
+        );
+      }
+      return uids[0];
+    };
+    const header = onlyOne(regions("header"), "header region") ?? fresh();
+    const chrome = HEADER_CHROME.map((role) => onlyOne(regions(role), `${role} region`) ?? fresh());
     elements[header] = region(header, "header", "header", chrome);
     chrome.forEach((uid, index) => {
       elements[uid] = region(uid, HEADER_CHROME[index], "section", [], header);
     });
-    let nav = own2.find((uid) => typed[uid].type === "nav");
+    let nav = onlyOne(own2.filter((uid) => typed[uid].type === "nav"), "nav");
     const declaredTabs = own2.filter((uid) => typed[uid].type === "tab").sort((a, b) => orderOf(typed[a]) - orderOf(typed[b]) || natural3(a, b));
     let tabs = [];
     if (declaredTabs.length > 0) {
@@ -11159,7 +11189,7 @@ function restateDashboard(composed, pages, handlerName, handler, { refuse, note,
         };
       });
     }
-    const filters = regions("filters")[0] ?? fresh();
+    const filters = onlyOne(regions("filters"), "filters region") ?? fresh();
     elements[filters] = region(filters, "filters", "section", []);
     const params = (Array.isArray(page.params) ? page.params : []).filter(isPlainObject7).map(canonical);
     const parts = [];
@@ -11195,7 +11225,7 @@ function restateDashboard(composed, pages, handlerName, handler, { refuse, note,
       if (conflicts.has(uid) && (parent !== null || kept.includes(typed[uid].parent))) refuse(conflicts.get(uid).code, conflicts.get(uid).pointer, conflicts.get(uid).message);
       elements[uid] = cardOf(typed[uid], uid, path3, handlerName, sections, refuse, parent);
     }
-    const otherRegions = own2.filter((uid) => typed[uid].type === "region" && !handled.has(uid) && !dropped.has(uid));
+    const otherRegions = own2.filter((uid) => typed[uid].type === "region" && !handled.has(uid) && !dropped.has(uid) && !duplicates.has(uid));
     for (const uid of otherRegions) elements[uid] = region(uid, typed[uid].role ?? "header", "section", []);
     const indexOfSection = (uid) => sections.findIndex((entry) => entry.id === elements[uid]?.section);
     const ownRoots = [...parts, ...kept.filter((uid) => elements[uid].parent === null), ...otherRegions].sort((a, b) => rank(a) - rank(b) || natural3(a, b));
@@ -21730,14 +21760,57 @@ function endOfQuote(source, start, quote) {
   }
   return source.length;
 }
+function withoutRegexLiterals(code) {
+  const out = code.split("");
+  let opens3 = true;
+  let i = 0;
+  while (i < code.length) {
+    const ch = code[i];
+    if (/\s/.test(ch)) {
+      i += 1;
+      continue;
+    }
+    if (WORD.test(ch)) {
+      let j = i;
+      while (j < code.length && WORD.test(code[j])) j += 1;
+      opens3 = BEFORE_LITERAL_WORDS.has(code.slice(i, j));
+      i = j;
+      continue;
+    }
+    const end = ch === "/" && opens3 ? literalEnd(code, i) : -1;
+    if (end !== -1) {
+      blank2(out, i + 1, end);
+      i = end + 1;
+      while (i < code.length && WORD.test(code[i])) i += 1;
+      opens3 = false;
+      continue;
+    }
+    opens3 = ch === "/" || BEFORE_LITERAL.includes(ch);
+    i += 1;
+  }
+  return out.join("");
+}
+var WORD = /[\w$]/;
+var BEFORE_LITERAL = "(,=:[!&|?{};+-*%<>~^}";
+var BEFORE_LITERAL_WORDS = /* @__PURE__ */ new Set(["return", "typeof", "instanceof", "in", "of", "new", "delete", "void", "throw", "case", "do", "else", "yield", "await"]);
+function literalEnd(code, start) {
+  let inClass = false;
+  for (let i = start + 1; i < code.length; i++) {
+    const ch = code[i];
+    if (ch === "\n") return -1;
+    if (ch === "\\") i += 1;
+    else if (ch === "[") inClass = true;
+    else if (ch === "]") inClass = false;
+    else if (ch === "/" && !inClass) return i;
+  }
+  return -1;
+}
 
 // ../flows/insights-builder/kit/checks/rules/runtime.mjs
 var RUNTIME_RENDERER3 = "runtime";
 var CARD_COMPONENT = "widget";
 var SPEC_CARD = "data-dr-spec-card";
 var COMPONENT_ATTR2 = "data-dr-component";
-var CONTRACT_ID = "dr-contract";
-var JSON_TYPE2 = "application/json";
 var MOUNT_CALL = /\bdrApp\s*\.\s*mount\s*\(/;
 var RUNTIME_LIBRARIES = [
   {
@@ -21772,19 +21845,15 @@ function compareVersions(a, b) {
   return 0;
 }
 function contractBlock(elements) {
-  const first = elements.find((el) => el.tag === "script" && el.attrs.id === CONTRACT_ID);
-  if (first === void 0 || first.attrs.src !== void 0) return null;
-  return (first.attrs.type ?? "").trim().toLowerCase() === JSON_TYPE2 ? first : null;
+  return contractBlockOf(elements);
 }
 function isEmbeddedContract(el, elements) {
   return el === contractBlock(elements);
 }
 function runtimeContractOf(app, page) {
   if (app.manifest?.kind !== "dashboard") return null;
-  const { elements, scripts } = parseHtml(page.text ?? "");
-  const block = contractBlock(elements);
-  if (block === null) return null;
-  const body = scripts[elements.filter((el) => el.tag === "script" && !("src" in el.attrs)).indexOf(block)]?.text ?? "";
+  const body = contractBlockText(page.text ?? "");
+  if (body === null) return null;
   let embedded;
   try {
     embedded = JSON.parse(body.replace(/<\\\//g, "</"));
@@ -21798,7 +21867,7 @@ function contractCards(embedded, path3) {
     const props = isPlainObject11(element.props) ? element.props : {};
     const id = named6(props.id) ? props.id.trim() : "";
     const card = named6(props.card) ? props.card.trim() : null;
-    return { key: id || card || "", id, card, source: named6(props.source) ? props.source.trim() : "" };
+    return { key: id || card || "", id, card, source: named6(props.source) ? props.source : "" };
   });
 }
 function contractParams(embedded, path3) {
@@ -21826,8 +21895,7 @@ function libraryOrderProblems(page) {
   const { elements, scripts } = parseHtml(page.text);
   const indexOf = (module) => elements.findIndex((el) => el.tag === "script" && el.attrs.src !== void 0 && RUNTIME_LIBRARIES.find((one) => one.module === module).pattern.test(resolveFromPlatformRoot(page.path, el.attrs.src) ?? ""));
   const inline = elements.filter((el) => el.tag === "script" && !("src" in el.attrs));
-  const block = contractBlock(elements);
-  const mountScript = inline.find((el, index) => el !== block && MOUNT_CALL.test(executableText(scripts[index]?.text ?? "")));
+  const mountScript = inline.find((el, index) => runsInPlace(el) && MOUNT_CALL.test(withoutRegexLiterals(executableText(scripts[index]?.text ?? ""))));
   const mount = mountScript === void 0 ? -1 : elements.indexOf(mountScript);
   const runtime = indexOf("dr-app-runtime");
   const problems = [];
@@ -21851,6 +21919,28 @@ function libraryOrderProblems(page) {
   }
   return problems;
 }
+function runsInPlace(el) {
+  const type = (el.attrs.type ?? "").trim().toLowerCase();
+  return type === "" || JAVASCRIPT_TYPES.has(type);
+}
+var JAVASCRIPT_TYPES = /* @__PURE__ */ new Set([
+  "application/ecmascript",
+  "application/javascript",
+  "application/x-ecmascript",
+  "application/x-javascript",
+  "text/ecmascript",
+  "text/javascript",
+  "text/javascript1.0",
+  "text/javascript1.1",
+  "text/javascript1.2",
+  "text/javascript1.3",
+  "text/javascript1.4",
+  "text/javascript1.5",
+  "text/jscript",
+  "text/livescript",
+  "text/x-ecmascript",
+  "text/x-javascript"
+]);
 function deferralOf(el) {
   if ("async" in el.attrs) return "async";
   if ("defer" in el.attrs) return "defer";
@@ -22085,9 +22175,13 @@ function checkMount(page, embedded, declared) {
   return [{ rule: "R2.2", where: page.path, message: `${page.path}'s mount names handler "${handler}", which this package does not declare; the filter bar's catalog and saved filters would reach no handler` }];
 }
 function runtimeSpecKeys(app) {
-  const spec = readSpec(app.handlers);
-  if (!spec.found || spec.unresolved.length > 0) return null;
-  return new Set(Object.keys(spec.table).filter((key) => !key.startsWith("_") && !key.startsWith("$")));
+  const keys2 = /* @__PURE__ */ new Map();
+  for (const handler of app.handlers) {
+    const spec = readSpec([handler]);
+    if (!spec.found || spec.unresolved.length > 0) continue;
+    keys2.set(handler.name, new Set(Object.keys(spec.table).filter((key) => !key.startsWith("_") && !key.startsWith("$"))));
+  }
+  return keys2.size === 0 ? null : keys2;
 }
 function checkScripts(scripts) {
   const violations = [];
@@ -22265,7 +22359,8 @@ function checkRuntimeCards(app, page, elements, runtime, violations) {
       continue;
     }
     if (drawn2 !== own2) {
-      const unknown = runtime.specKeys !== null && !runtime.specKeys.has(drawn2) ? `, and "${drawn2}" is no row of the handler's SPEC` : "";
+      const keys2 = runtime.specKeys?.get(twin.source);
+      const unknown = keys2 !== void 0 && !keys2.has(drawn2) ? `, and "${drawn2}" is no row of the handler's SPEC` : "";
       violations.push({ rule: "R2.5", where: where2(el.line), message: `the card${id === "" ? "" : ` with data-dr-id "${id}"`} draws "${own2}" in the skeleton and "${drawn2}" in #dr-contract, which the runtime mounts from${unknown}; the two name one SPEC card, or the page shows one card and a round trip writes back another` });
       claim(id, own2, drawn2);
       continue;
@@ -22288,12 +22383,22 @@ function checkRuntimeCards(app, page, elements, runtime, violations) {
     if (!(el.attrs[SPAN_MARK] ?? "").trim()) {
       violations.push({ rule: "R2.7", where: where2(el.line), message: `widget "${own2}" declares no ${SPAN_MARK}; every card on the kit's 12-column grid says how many columns it takes` });
     }
-    const handler = twin.source || (el.attrs["data-dr-source"] ?? "").trim();
-    for (const name of new Set([handler, (el.attrs["data-dr-source"] ?? "").trim()].filter((one) => one !== ""))) {
+    const handler = twin.source;
+    const written = (el.attrs["data-dr-source"] ?? "").trim();
+    for (const name of new Set([handler, written].filter((one) => one !== ""))) {
       if (!runtime.declared.has(name)) {
         violations.push({ rule: "R2.2", where: where2(el.line), message: `widget "${own2}" is posted to handler "${name}", which this package does not declare; the runtime's request for it would reach no handler` });
+        claim(own2);
       }
     }
+    if (handler === "") {
+      violations.push({
+        rule: "R2.2",
+        where: where2(el.line),
+        message: `widget "${own2}" is posted to no handler: its props.source in #dr-contract, which the runtime mounts from, names none${written === "" ? "" : ` (the skeleton's data-dr-source "${written}" is not what the runtime reads)`}, so the runtime never loads it`
+      });
+      claim(own2);
+    }
     const source = specSource(runtime.data, own2);
     widgets.push({
       id: own2,
@@ -22505,20 +22610,26 @@ function checkAgainstSpec(app, pages, contract, specKeys = null) {
     );
   }
   if (!runtime || specKeys === null) return orphans;
-  const runtimeOrphans = pages.filter((page) => runtimePages.has(page.path)).flatMap(
-    (page) => page.widgets.filter((widget) => !specKeys.has(widget.id)).map((widget) => ({ rule: "R2.5", where: `${page.path}:${widget.line}`, message: `widget "${widget.id}" is not a key in the handler's SPEC; the page would ask for a widget the handler cannot answer for` }))
-  );
-  const drawn2 = new Set(pages.flatMap((page) => [...page.widgets.map((widget) => widget.id), ...page.claimed ?? []]));
-  return [...orphans, ...runtimeOrphans, ...orphanSpecRows(app, [...specKeys].filter((key) => !drawn2.has(key)).sort())];
-}
-function orphanSpecRows(app, keys2) {
-  const handler = app.handlers.find((one) => SPEC_TABLE.test(one.source)) ?? app.handlers[0];
-  const file = handler?.file || app.handlersSource;
-  return keys2.map((key) => ({
+  const cards = pages.filter((page) => runtimePages.has(page.path)).flatMap((page) => page.widgets.map((widget) => ({ page, widget })));
+  const unanswered = cards.filter(({ widget }) => specKeys.has(widget.handler) && !specKeys.get(widget.handler).has(widget.id));
+  const runtimeOrphans = unanswered.map(({ page, widget }) => ({
     rule: "R2.5",
-    where: `${file}#SPEC.${key}`,
-    message: `the SPEC declares "${key}", and no card on any page draws it (no [data-dr-component="widget"] names it, in ${SPEC_CARD} or in #dr-contract); the handler answers for a figure the dashboard never shows`
+    where: `${page.path}:${widget.line}`,
+    message: `widget "${widget.id}" is not a key in the handler's SPEC; the page would ask for a widget the handler cannot answer for`
   }));
+  const drawn2 = new Set(cards.filter(({ widget }) => specKeys.has(widget.handler)).map(({ widget }) => `${widget.handler}\0${widget.id}`));
+  const claimed = /* @__PURE__ */ new Set([...pages.flatMap((page) => page.claimed ?? []), ...unanswered.map(({ widget }) => widget.id)]);
+  return [...orphans, ...runtimeOrphans, ...orphanSpecRows(app, specKeys, drawn2, claimed)];
+}
+function orphanSpecRows(app, specKeys, drawn2, claimed) {
+  return app.handlers.filter((handler) => specKeys.has(handler.name)).flatMap((handler) => {
+    const file = handler.file || app.handlersSource;
+    return [...specKeys.get(handler.name)].filter((key) => !drawn2.has(`${handler.name}\0${key}`) && !claimed.has(key)).sort().map((key) => ({
+      rule: "R2.5",
+      where: `${file}#SPEC.${key}`,
+      message: `the SPEC declares "${key}", and no card on any page draws it (no [data-dr-component="widget"] names it, in ${SPEC_CARD} or in #dr-contract); the handler answers for a figure the dashboard never shows`
+    }));
+  });
 }
 
 // ../flows/insights-builder/kit/checks/rules/handlers.mjs
@@ -23101,7 +23212,7 @@ function parseHtml2(html) {
     elements.push({ tag, attrs, line: line2 });
     if (tag === "script" && !("src" in attrs)) {
       const bodyStart = match.index + whole.length;
-      const end = html.indexOf("</script", bodyStart);
+      const end = rawTextEnd2(html, "script", bodyStart);
       const body = html.slice(bodyStart, end === -1 ? void 0 : end);
       scripts.push({ text: body, line: lineAt2(html, bodyStart) });
       if (end !== -1) TAG2.lastIndex = end;
@@ -23109,6 +23220,25 @@ function parseHtml2(html) {
   }
   return { elements, scripts };
 }
+function rawTextEnd2(html, tag, from) {
+  const end = new RegExp(`</${tag}(?=[\\t\\n\\f\\r />])`, "gi");
+  end.lastIndex = from;
+  const found = end.exec(html);
+  return found === null ? -1 : found.index;
+}
+var CONTRACT_ID2 = "dr-contract";
+var JSON_TYPE3 = "application/json";
+function contractBlockOf2(elements) {
+  const first = elements.find((el) => el.attrs.id === CONTRACT_ID2);
+  if (first === void 0 || first.tag !== "script" || first.attrs.src !== void 0) return null;
+  return (first.attrs.type ?? "").trim().toLowerCase() === JSON_TYPE3 ? first : null;
+}
+function contractBlockText2(html) {
+  const { elements, scripts } = parseHtml2(html);
+  const block = contractBlockOf2(elements);
+  if (block === null) return null;
+  return scripts[elements.filter((el) => el.tag === "script" && !("src" in el.attrs)).indexOf(block)]?.text ?? null;
+}
 function parseTree2(html) {
   const nodes = [];
   const roots = [];
@@ -23147,7 +23277,7 @@ function parseTree2(html) {
     else nodes[parent].children.push(node.index);
     if (tag === "script" || tag === "style") {
       if (selfClosed) continue;
-      const end = html.indexOf(`</${tag}`, match.index + whole.length);
+      const end = rawTextEnd2(html, tag, match.index + whole.length);
       if (end === -1) {
         wellFormed = false;
         continue;
@@ -24439,7 +24569,6 @@ function readPage2(app, page, spec, elements, problems) {
     pins: pinsOf2(page, tree)
   };
 }
-var EMBEDDED_CONTRACT2 = /<script\b[^>]*\bid\s*=\s*["']dr-contract["'][^>]*>([\s\S]*?)<\/script>/i;
 function paramsOf2(page) {
   const entry = embeddedPageOf2(page);
   return Array.isArray(entry?.params) ? { params: entry.params } : {};
@@ -24455,10 +24584,10 @@ function mountOf2(page) {
   };
 }
 function embeddedContractOf2(page) {
-  const found = EMBEDDED_CONTRACT2.exec(page?.text ?? "");
-  if (found === null) return null;
+  const text3 = contractBlockText2(page?.text ?? "");
+  if (text3 === null) return null;
   try {
-    const embedded = JSON.parse((found[1] ?? "").replace(/<\\\//g, "</"));
+    const embedded = JSON.parse(text3.replace(/<\\\//g, "</"));
     return isPlainObject12(embedded) ? embedded : null;
   } catch {
     return null;
@@ -24797,7 +24926,7 @@ function pageScripts2(app, page, tree) {
   for (const node of tree.nodes) {
     if (node.tag !== "script") continue;
     if (!node.attrs.src) {
-      const end = page.text.indexOf("</script", node.end);
+      const end = rawTextEnd2(page.text, "script", node.end);
       inline.push({ path: page.path, text: page.text.slice(node.end, end === -1 ? void 0 : end) });
       continue;
     }
@@ -26110,7 +26239,7 @@ function payloadProducers2(contract, { moduleSource = () => void 0, pageSource =
 }
 var SCRIPT_TAG2 = /<script\b([^>]*)>([\s\S]*?)<\/script\s*>/gi;
 var SRC_ATTR2 = /\bsrc\s*=\s*["']([^"']+)["']/i;
-var JSON_TYPE3 = /\btype\s*=\s*["']application\/json["']/i;
+var JSON_TYPE4 = /\btype\s*=\s*["']application\/json["']/i;
 var MOUNT_ONLY2 = /^\s*drApp\.mount\(\s*\{[^}]*\}\s*\)\s*;?\s*$/;
 function pageCode2(html, path3, modules, pageSource) {
   const out = [];
@@ -26118,7 +26247,7 @@ function pageCode2(html, path3, modules, pageSource) {
     const attrs = match[1] ?? "";
     const src = SRC_ATTR2.exec(attrs)?.[1];
     if (src === void 0) {
-      if (JSON_TYPE3.test(attrs) || MOUNT_ONLY2.test(match[2] ?? "") || (match[2] ?? "").trim() === "") continue;
+      if (JSON_TYPE4.test(attrs) || MOUNT_ONLY2.test(match[2] ?? "") || (match[2] ?? "").trim() === "") continue;
       out.push(match[2]);
       continue;
     }
@@ -28624,11 +28753,13 @@ var REFUSALS = /* @__PURE__ */ new Set([
   "card_not_for_apps",
   // a runtime dashboard (`dashboardPage.mjs`): a card bound to no SPEC row,
   // a control no part draws, a control whose param is declared otherwise,
-  // and a page route app.routes does not serve
+  // a page route app.routes does not serve, and a second piece of chrome
+  // (a header, asof, refresh, theme or filters region, or a nav) on a page
   "card_unnamed",
   "control_unsupported",
   "control_conflict",
-  "route_mismatch"
+  "route_mismatch",
+  "chrome_duplicate"
 ]);
 var APP_REFUSALS = {
   app_id_shape: 'app.id of an app with a data model is not lowercase letters, digits and "-" (e.g. "arr_test_9"); the push would take it and the first table read would fail with "invalid app_id" \u2014 rename it (e.g. "arr-test-9")',
@@ -30014,7 +30145,7 @@ async function ejectHandler(dir, contract, name) {
 function customRole(body) {
   const start = body.search(/^HANDLER = \{/m);
   if (start < 0) return null;
-  const end = literalEnd(body, body.indexOf("{", start));
+  const end = literalEnd2(body, body.indexOf("{", start));
   if (end < 0) return null;
   const literal = body.slice(start, end);
   const rewritten = literal.replace(/"role": "[^"]*"/, '"role": "custom"');
@@ -30025,7 +30156,7 @@ var EJECTED_DOCSTRING = 'Ejected with app-space eject: this file is yours now, a
 function authorsDocstring(body) {
   return body.replace(/Generated by [^\n]*compile[\s\S]*?not this file\./, EJECTED_DOCSTRING);
 }
-function literalEnd(text3, open2) {
+function literalEnd2(text3, open2) {
   let depth = 0;
   let quote = null;
   for (let i = open2; i < text3.length; i++) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-appspace-cli",
-  "version": "0.12.27",
+  "version": "0.12.28",
   "description": "Datarails App Space CLI — build, try, push and publish App Space apps",
   "type": "module",
   "engines": {