@derive-to/artifacts 0.0.0-stage → 0.6.1

package/dist/server/plugins/editing/source-text.js

@@ -0,0 +1,10 @@
+import { pageTextParts, sourceTextRange } from "../../../protocol/source.js";
+/** Shared projection: source offsets use runs rather than a map entry for every character. */
+export const sourceText = (html) => {
+    const page = pageTextParts(html);
+    return {
+        text: page.text,
+        sourceOf: (start, end) => sourceTextRange(page, start, end),
+    };
+};
+//# sourceMappingURL=source-text.js.map

package/dist/server/plugins/editing/source-text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-text.js","sourceRoot":"","sources":["../../../../src/server/plugins/editing/source-text.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAE5E,8FAA8F;AAC9F,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE;IACzC,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAChC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,CAAC,KAAa,EAAE,GAAW,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KAC5E,CAAA;AACH,CAAC,CAAA"}

package/dist/server/plugins/editing/source.d.ts

@@ -0,0 +1,18 @@
+import type { ArtifactLayout, TextEdit } from "../../../protocol/index.js";
+import type { SourceContent } from "../../core/source.js";
+import type { ArtifactRow } from "../../ports.js";
+/** A host codec edits original bytes. It cannot change their format, CSP, or metadata. */
+export type SourceEditor = (input: {
+    source: SourceContent;
+    edits: readonly TextEdit[];
+    layout?: ArtifactLayout | undefined;
+    context: {
+        artifact: ArtifactRow;
+        version: number;
+    };
+}) => Uint8Array<ArrayBuffer> | Promise<Uint8Array<ArrayBuffer>>;
+export interface InlineEditingOptions {
+    editSource?: SourceEditor | undefined;
+}
+export declare const editOriginalSource: (input: Parameters<SourceEditor>[0], editor: SourceEditor | undefined) => Promise<SourceContent>;
+//# sourceMappingURL=source.d.ts.map

package/dist/server/plugins/editing/source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../../src/server/plugins/editing/source.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAA;AAE1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAIjD,0FAA0F;AAC1F,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE;IACjC,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAA;IAC1B,MAAM,CAAC,EAAE,cAAc,GAAG,SAAS,CAAA;IACnC,OAAO,EAAE;QAAE,QAAQ,EAAE,WAAW,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CACpD,KAAK,UAAU,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAA;AAEhE,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,YAAY,GAAG,SAAS,CAAA;CACtC;AAED,eAAO,MAAM,kBAAkB,UACtB,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,UAC1B,YAAY,GAAG,SAAS,KAC/B,OAAO,CAAC,aAAa,CASvB,CAAA"}

package/dist/server/plugins/editing/source.js

@@ -0,0 +1,15 @@
+import { badRequest } from "../../core/errors.js";
+import { applyTextEdits } from "./apply.js";
+import { applyLayout } from "./layout.js";
+export const editOriginalSource = async (input, editor) => {
+    const source = input.source;
+    if (editor)
+        return { ...source, bytes: Uint8Array.from(await editor(structuredClone(input))) };
+    if (source.contentType.split(";")[0]?.trim() !== "text/html")
+        throw badRequest(`No source editor is configured for ${source.contentType}.`);
+    const html = new TextDecoder("utf-8", { ignoreBOM: true }).decode(source.bytes);
+    const text = applyTextEdits(html, input.edits);
+    const edited = input.layout ? applyLayout(text, input.layout) : text;
+    return { ...source, bytes: new TextEncoder().encode(edited) };
+};
+//# sourceMappingURL=source.js.map

package/dist/server/plugins/editing/source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.js","sourceRoot":"","sources":["../../../../src/server/plugins/editing/source.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAGjD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAczC,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,KAAkC,EAClC,MAAgC,EACR,EAAE;IAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC3B,IAAI,MAAM;QAAE,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9F,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,WAAW;QAC1D,MAAM,UAAU,CAAC,sCAAsC,MAAM,CAAC,WAAW,GAAG,CAAC,CAAA;IAC/E,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC/E,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;IAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACpE,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAA;AAC/D,CAAC,CAAA"}

package/dist/server/plugins/index.d.ts

@@ -0,0 +1,25 @@
+import type { ArtifactPlugin } from "../kit/plugin.js";
+import { type CommentsOptions, comments } from "./comments/index.js";
+import { type Component, type ComponentPackOptions, componentPack } from "./components/index.js";
+import { type InlineEditingOptions, inlineEditing, type SourceEditor } from "./editing/index.js";
+import { type McpAuthOptions, mcpAuth } from "./mcp-auth.js";
+import { type MentionsOptions, mentions } from "./mentions.js";
+import { type ModerationInput, type ModerationOptions, moderation } from "./moderation.js";
+import { type Notice, type NotificationsOptions, notifications } from "./notifications.js";
+import { presence } from "./presence.js";
+import { type LimitedAction, type RateLimitOptions, rateLimit } from "./rate-limit.js";
+import { type SharedStateOptions, sharedState } from "./state/index.js";
+import { type WebhookOptions, webhook } from "./webhook.js";
+/** Turn parts of the starter kit off, Tiptap-style: `starterKit({ editing: false })`.
+ *  Presence (live cursors and who-is-here) is off unless asked for: `presence: true`, or add
+ *  `presence()` yourself. Without it no cursor is sent and no avatars are drawn. */
+export interface StarterKitOptions {
+    comments?: false;
+    state?: false;
+    presence?: boolean;
+    editing?: false;
+}
+/** What most apps want: comments, shared state and editing text in place. Presence is opt-in. */
+export declare const starterKit: (options?: StarterKitOptions) => ArtifactPlugin[];
+export { type CommentsOptions, type Component, type ComponentPackOptions, comments, componentPack, type InlineEditingOptions, inlineEditing, type LimitedAction, type McpAuthOptions, type MentionsOptions, type ModerationInput, type ModerationOptions, mcpAuth, mentions, moderation, type Notice, type NotificationsOptions, notifications, presence, type RateLimitOptions, rateLimit, type SharedStateOptions, type SourceEditor, sharedState, type WebhookOptions, webhook, };
+//# sourceMappingURL=index.d.ts.map

package/dist/server/plugins/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/plugins/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,KAAK,eAAe,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACpE,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,oBAAoB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAChG,OAAO,EAAE,KAAK,oBAAoB,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAChG,OAAO,EAAE,KAAK,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAC5D,OAAO,EAAE,KAAK,eAAe,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC9D,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,iBAAiB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC1F,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,oBAAoB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAC1F,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,gBAAgB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AACtF,OAAO,EAAE,KAAK,kBAAkB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACvE,OAAO,EAAE,KAAK,cAAc,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3D;;oFAEoF;AACpF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,KAAK,CAAA;IAChB,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,OAAO,CAAC,EAAE,KAAK,CAAA;CAChB;AAED,iGAAiG;AACjG,eAAO,MAAM,UAAU,aAAa,iBAAiB,KAAQ,cAAc,EAMpC,CAAA;AAEvC,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,oBAAoB,EACzB,QAAQ,EACR,aAAa,EACb,KAAK,oBAAoB,EACzB,aAAa,EACb,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,OAAO,EACP,QAAQ,EACR,UAAU,EACV,KAAK,MAAM,EACX,KAAK,oBAAoB,EACzB,aAAa,EACb,QAAQ,EACR,KAAK,gBAAgB,EACrB,SAAS,EACT,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,WAAW,EACX,KAAK,cAAc,EACnB,OAAO,GACR,CAAA"}

package/dist/server/plugins/index.js

@@ -0,0 +1,20 @@
+import { comments } from "./comments/index.js";
+import { componentPack } from "./components/index.js";
+import { inlineEditing } from "./editing/index.js";
+import { mcpAuth } from "./mcp-auth.js";
+import { mentions } from "./mentions.js";
+import { moderation } from "./moderation.js";
+import { notifications } from "./notifications.js";
+import { presence } from "./presence.js";
+import { rateLimit } from "./rate-limit.js";
+import { sharedState } from "./state/index.js";
+import { webhook } from "./webhook.js";
+/** What most apps want: comments, shared state and editing text in place. Presence is opt-in. */
+export const starterKit = (options = {}) => [
+    options.comments === false ? null : comments(),
+    options.state === false ? null : sharedState(),
+    options.presence === true ? presence() : null,
+    options.editing === false ? null : inlineEditing(),
+].filter((plugin) => plugin !== null);
+export { comments, componentPack, inlineEditing, mcpAuth, mentions, moderation, notifications, presence, rateLimit, sharedState, webhook, };
+//# sourceMappingURL=index.js.map

package/dist/server/plugins/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/plugins/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACpE,OAAO,EAA6C,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAChG,OAAO,EAA6B,aAAa,EAAqB,MAAM,oBAAoB,CAAA;AAChG,OAAO,EAAuB,OAAO,EAAE,MAAM,eAAe,CAAA;AAC5D,OAAO,EAAwB,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC9D,OAAO,EAAgD,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC1F,OAAO,EAA0C,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAC1F,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAA6C,SAAS,EAAE,MAAM,iBAAiB,CAAA;AACtF,OAAO,EAA2B,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACvE,OAAO,EAAuB,OAAO,EAAE,MAAM,cAAc,CAAA;AAY3D,iGAAiG;AACjG,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAO,GAAsB,EAAE,EAAoB,EAAE,CAC9E;IACE,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;IAC9C,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI;IAC7C,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE;CACnD,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAA;AAEvC,OAAO,EAIL,QAAQ,EACR,aAAa,EAEb,aAAa,EAMb,OAAO,EACP,QAAQ,EACR,UAAU,EAGV,aAAa,EACb,QAAQ,EAER,SAAS,EAGT,WAAW,EAEX,OAAO,GACR,CAAA"}

package/dist/server/plugins/mcp-auth.d.ts

@@ -0,0 +1,12 @@
+export interface McpAuthOptions {
+    /** The public URL of your MCP endpoint, e.g. "https://app.example.com/api/mcp". */
+    resource: string;
+    /** Your OAuth authorization server(s), e.g. ["https://auth.example.com"]. */
+    authorizationServers: string[];
+    scopes?: string[];
+}
+/** Sign-in for /mcp, so Claude, ChatGPT, and other MCP clients act as the real person. It
+ *  publishes OAuth protected-resource metadata and answers 401 with where to sign in;
+ *  your `host.actor` reads the bearer token, exactly as it reads your session cookie. */
+export declare const mcpAuth: ({ resource, authorizationServers, scopes }: McpAuthOptions) => import("../kit/plugin.js").ArtifactPlugin;
+//# sourceMappingURL=mcp-auth.d.ts.map

package/dist/server/plugins/mcp-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-auth.d.ts","sourceRoot":"","sources":["../../../src/server/plugins/mcp-auth.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,cAAc;IAC7B,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAA;IAChB,6EAA6E;IAC7E,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAC9B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAID;;yFAEyF;AACzF,eAAO,MAAM,OAAO,+CAAgD,cAAc,8CAqB9E,CAAA"}

package/dist/server/plugins/mcp-auth.js

@@ -0,0 +1,27 @@
+import { Hono } from "hono";
+import { definePlugin } from "../kit/plugin.js";
+const METADATA_PATH = "/.well-known/oauth-protected-resource";
+/** Sign-in for /mcp, so Claude, ChatGPT, and other MCP clients act as the real person. It
+ *  publishes OAuth protected-resource metadata and answers 401 with where to sign in;
+ *  your `host.actor` reads the bearer token, exactly as it reads your session cookie. */
+export const mcpAuth = ({ resource, authorizationServers, scopes }) => definePlugin({
+    id: "mcp-auth",
+    setup: ({ host, gates }) => {
+        const metadataUrl = `${resource.replace(/\/$/, "")}${METADATA_PATH}`;
+        const app = new Hono();
+        app.get(`/mcp${METADATA_PATH}`, gates.anyone(), (c) => c.json({
+            resource,
+            authorization_servers: authorizationServers,
+            bearer_methods_supported: ["header"],
+            ...(scopes ? { scopes_supported: scopes } : {}),
+        }));
+        app.use("/mcp", async (c, next) => {
+            if (await host.actor(c))
+                return next();
+            c.header("WWW-Authenticate", `Bearer resource_metadata="${metadataUrl}"`);
+            return c.json({ error: "Sign in to use this server." }, 401);
+        });
+        return { routes: app };
+    },
+});
+//# sourceMappingURL=mcp-auth.js.map

package/dist/server/plugins/mcp-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-auth.js","sourceRoot":"","sources":["../../../src/server/plugins/mcp-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAU/C,MAAM,aAAa,GAAG,uCAAuC,CAAA;AAE7D;;yFAEyF;AACzF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,EAAkB,EAAE,EAAE,CACpF,YAAY,CAAC;IACX,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QACzB,MAAM,WAAW,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,aAAa,EAAE,CAAA;QACpE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAO,CAAA;QAC3B,GAAG,CAAC,GAAG,CAAC,OAAO,aAAa,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CACpD,CAAC,CAAC,IAAI,CAAC;YACL,QAAQ;YACR,qBAAqB,EAAE,oBAAoB;YAC3C,wBAAwB,EAAE,CAAC,QAAQ,CAAC;YACpC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC,CACH,CAAA;QACD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAChC,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAA;YACtC,CAAC,CAAC,MAAM,CAAC,kBAAkB,EAAE,6BAA6B,WAAW,GAAG,CAAC,CAAA;YACzE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAA;QAC9D,CAAC,CAAC,CAAA;QACF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;IACxB,CAAC;CACF,CAAC,CAAA"}

package/dist/server/plugins/mentions.d.ts

@@ -0,0 +1,10 @@
+import { type Actor } from "../../protocol/index.js";
+import type { ArtifactRow } from "../ports.js";
+export interface MentionsOptions {
+    /** People matching `query` whom `viewer` may mention on `artifact`: your directory. */
+    search(query: string, viewer: Actor, artifact: ArtifactRow): Promise<Actor[]>;
+}
+/** @mentions in comments. Bodies carry `@[Name](id)`; the rail renders them and offers
+ *  people as you type; `notifications()` tells the people mentioned. */
+export declare const mentions: (options: MentionsOptions) => import("../kit/plugin.js").ArtifactPlugin;
+//# sourceMappingURL=mentions.d.ts.map

package/dist/server/plugins/mentions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mentions.d.ts","sourceRoot":"","sources":["../../../src/server/plugins/mentions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,KAAK,EAAc,MAAM,yBAAyB,CAAA;AAGhE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAI9C,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;CAC9E;AAED;wEACwE;AACxE,eAAO,MAAM,QAAQ,YAAa,eAAe,8CAqB7C,CAAA"}

package/dist/server/plugins/mentions.js

@@ -0,0 +1,28 @@
+import * as z from "zod/mini";
+import { peopleTool } from "../../protocol/index.js";
+import { definePlugin } from "../kit/plugin.js";
+import { defineTool } from "../kit/tool.js";
+const LIMIT = 8;
+/** @mentions in comments. Bodies carry `@[Name](id)`; the rail renders them and offers
+ *  people as you type; `notifications()` tells the people mentioned. */
+export const mentions = (options) => definePlugin({
+    id: "mentions",
+    features: ["mentions"],
+    instructions: "To mention someone in a comment, find them with artifact_people and write @[Name](id).",
+    setup: () => ({
+        tools: [
+            defineTool({
+                name: peopleTool.name,
+                description: "Find people to mention in a comment.",
+                visibility: ["model"],
+                access: "comment",
+                readOnly: true,
+                input: z.object({ query: peopleTool.input.shape.query }),
+                run: async (a, { actor, artifact }) => ({
+                    people: (await options.search(a.query.trim(), actor, artifact)).slice(0, LIMIT),
+                }),
+            }),
+        ],
+    }),
+});
+//# sourceMappingURL=mentions.js.map

package/dist/server/plugins/mentions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mentions.js","sourceRoot":"","sources":["../../../src/server/plugins/mentions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAC7B,OAAO,EAAc,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAG3C,MAAM,KAAK,GAAG,CAAC,CAAA;AAOf;wEACwE;AACxE,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,OAAwB,EAAE,EAAE,CACnD,YAAY,CAAC;IACX,EAAE,EAAE,UAAU;IACd,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,YAAY,EACV,wFAAwF;IAC1F,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACZ,KAAK,EAAE;YACL,UAAU,CAAC;gBACT,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,WAAW,EAAE,sCAAsC;gBACnD,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACxD,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;oBACtC,MAAM,EAAE,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;iBAChF,CAAC;aACH,CAAC;SACH;KACF,CAAC;CACH,CAAC,CAAA"}

package/dist/server/plugins/moderation.d.ts

@@ -0,0 +1,17 @@
+import type { Actor } from "../../protocol/index.js";
+import type { ArtifactRow } from "../ports.js";
+export interface ModerationInput {
+    kind: "comment" | "page";
+    /** The comment body, or the page's HTML. */
+    text: string;
+    actor: Actor;
+    /** Null for a page being created. */
+    artifact: ArtifactRow | null;
+}
+export interface ModerationOptions {
+    /** Return a reason to refuse, shown to the person; return nothing to allow. */
+    check(input: ModerationInput): Promise<string | undefined> | string | undefined;
+}
+/** Check comments and pages before they are saved, with your own classifier. */
+export declare const moderation: ({ check }: ModerationOptions) => import("../kit/plugin.js").ArtifactPlugin;
+//# sourceMappingURL=moderation.d.ts.map

package/dist/server/plugins/moderation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"moderation.d.ts","sourceRoot":"","sources":["../../../src/server/plugins/moderation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAA;AAGpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAE9C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,SAAS,GAAG,MAAM,CAAA;IACxB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,KAAK,CAAA;IACZ,qCAAqC;IACrC,QAAQ,EAAE,WAAW,GAAG,IAAI,CAAA;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,+EAA+E;IAC/E,KAAK,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,CAAA;CAChF;AAMD,gFAAgF;AAChF,eAAO,MAAM,UAAU,cAAe,iBAAiB,8CAWnD,CAAA"}

package/dist/server/plugins/moderation.js

@@ -0,0 +1,17 @@
+import { refused } from "../core/errors.js";
+import { definePlugin } from "../kit/plugin.js";
+const refuse = (reason) => {
+    if (reason)
+        throw refused(reason);
+};
+/** Check comments and pages before they are saved, with your own classifier. */
+export const moderation = ({ check }) => definePlugin({
+    id: "moderation",
+    setup: () => ({
+        before: {
+            "comment.create": async ({ body, actor, artifact }) => refuse(await check({ kind: "comment", text: body, actor, artifact })),
+            "version.publish": async ({ html, actor, artifact }) => refuse(await check({ kind: "page", text: html, actor, artifact })),
+        },
+    }),
+});
+//# sourceMappingURL=moderation.js.map

package/dist/server/plugins/moderation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"moderation.js","sourceRoot":"","sources":["../../../src/server/plugins/moderation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAiB/C,MAAM,MAAM,GAAG,CAAC,MAA0B,EAAE,EAAE;IAC5C,IAAI,MAAM;QAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;AACnC,CAAC,CAAA;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,EAAE,KAAK,EAAqB,EAAE,EAAE,CACzD,YAAY,CAAC;IACX,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACZ,MAAM,EAAE;YACN,gBAAgB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CACpD,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YACvE,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CACrD,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;SACrE;KACF,CAAC;CACH,CAAC,CAAA"}

package/dist/server/plugins/notifications.d.ts

@@ -0,0 +1,22 @@
+import { type Actor, type Comment, type Thread } from "../../protocol/index.js";
+import type { ArtifactRow } from "../ports.js";
+type Person = Pick<Actor, "id" | "name">;
+export interface Notice {
+    /** mentioned: named in a comment. commented: a new comment where they took part, or on
+     *  their artifact. resolved: a thread they took part in was resolved. */
+    kind: "mentioned" | "commented" | "resolved";
+    to: Person[];
+    by: Actor;
+    artifact: ArtifactRow;
+    thread: Thread;
+    comment?: Comment;
+}
+export interface NotificationsOptions {
+    /** Send it however your app does: email, Slack, an inbox. Recipients can already view the
+     *  artifact; the person who acted is never among them. */
+    deliver(notice: Notice): Promise<void> | void;
+}
+/** Tell people about comments, mentions, and resolutions, through your app's channels. */
+export declare const notifications: ({ deliver }: NotificationsOptions) => import("../kit/plugin.js").ArtifactPlugin;
+export {};
+//# sourceMappingURL=notifications.d.ts.map

package/dist/server/plugins/notifications.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notifications.d.ts","sourceRoot":"","sources":["../../../src/server/plugins/notifications.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,KAAK,EACV,KAAK,OAAO,EAGZ,KAAK,MAAM,EACZ,MAAM,yBAAyB,CAAA;AAGhC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAE9C,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,MAAM,CAAC,CAAA;AAExC,MAAM,WAAW,MAAM;IACrB;6EACyE;IACzE,IAAI,EAAE,WAAW,GAAG,WAAW,GAAG,UAAU,CAAA;IAC5C,EAAE,EAAE,MAAM,EAAE,CAAA;IACZ,EAAE,EAAE,KAAK,CAAA;IACT,QAAQ,EAAE,WAAW,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC;8DAC0D;IAC1D,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;CAC9C;AAQD,0FAA0F;AAC1F,eAAO,MAAM,aAAa,gBAAiB,oBAAoB,8CAyC3D,CAAA"}

package/dist/server/plugins/notifications.js

@@ -0,0 +1,43 @@
+import { mentionsIn, signedIn, } from "../../protocol/index.js";
+import { definePlugin } from "../kit/plugin.js";
+const unique = (people) => [...new Map(people.map((p) => [p.id, p])).values()];
+/** Who took part: everyone who commented in the thread, and the artifact's creator. */
+const participants = (artifact, thread) => unique([artifact.createdBy, ...thread.comments.map((comment) => comment.author)]);
+/** Tell people about comments, mentions, and resolutions, through your app's channels. */
+export const notifications = ({ deliver }) => definePlugin({
+    id: "notifications",
+    setup: ({ access }) => {
+        /** Only people who may view the artifact, never the one who acted. */
+        const audience = async (people, by, artifact) => {
+            const others = unique(people).filter((person) => person.id !== by.id);
+            const allowed = await Promise.all(others.map(async (person) => access.can(signedIn(person), "view", artifact)));
+            return others.filter((_, index) => allowed[index]);
+        };
+        const send = async (kind, people, notice) => {
+            const to = await audience(people, notice.by, notice.artifact);
+            if (to.length > 0)
+                await deliver({ kind, to, ...notice });
+        };
+        return {
+            after: {
+                "comment.created": async ({ artifact, thread, comment, actor }) => {
+                    const named = mentionsIn(comment.body);
+                    const notice = { by: actor, artifact, thread, comment };
+                    await send("mentioned", named, notice);
+                    const ids = new Set(named.map((person) => person.id));
+                    const rest = participants(artifact, thread).filter((person) => !ids.has(person.id));
+                    await send("commented", rest, notice);
+                },
+                "thread.updated": async ({ artifact, thread, actor }) => {
+                    if (thread.state === "resolved")
+                        await send("resolved", participants(artifact, thread), {
+                            by: actor,
+                            artifact,
+                            thread,
+                        });
+                },
+            },
+        };
+    },
+});
+//# sourceMappingURL=notifications.js.map

package/dist/server/plugins/notifications.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../../../src/server/plugins/notifications.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,UAAU,EACV,QAAQ,GAET,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAsB/C,MAAM,MAAM,GAAG,CAAC,MAAgB,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAExF,uFAAuF;AACvF,MAAM,YAAY,GAAG,CAAC,QAAqB,EAAE,MAAc,EAAY,EAAE,CACvE,MAAM,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AAEnF,0FAA0F;AAC1F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAAE,OAAO,EAAwB,EAAE,EAAE,CACjE,YAAY,CAAC;IACX,EAAE,EAAE,eAAe;IACnB,KAAK,EAAE,CAAC,EAAE,MAAM,EAAQ,EAAE,EAAE;QAC1B,sEAAsE;QACtE,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAgB,EAAE,EAAS,EAAE,QAAqB,EAAE,EAAE;YAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;YACrE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAC7E,CAAA;YACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;QACpD,CAAC,CAAA;QACD,MAAM,IAAI,GAAG,KAAK,EAChB,IAAoB,EACpB,MAAgB,EAChB,MAAmC,EACnC,EAAE;YACF,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC7D,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAA;QAC3D,CAAC,CAAA;QACD,OAAO;YACL,KAAK,EAAE;gBACL,iBAAiB,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;oBAChE,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;oBACtC,MAAM,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;oBACvD,MAAM,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;oBACtC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;oBACrD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;oBACnF,MAAM,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;gBACvC,CAAC;gBACD,gBAAgB,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE;oBACtD,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU;wBAC7B,MAAM,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;4BACrD,EAAE,EAAE,KAAK;4BACT,QAAQ;4BACR,MAAM;yBACP,CAAC,CAAA;gBACN,CAAC;aACF;SACF,CAAA;IACH,CAAC;CACF,CAAC,CAAA"}

package/dist/server/plugins/presence.d.ts

@@ -0,0 +1,3 @@
+/** Live cursors and who's here. Ephemeral: fanned out over the bus, never stored. */
+export declare const presence: () => import("../kit/plugin.js").ArtifactPlugin;
+//# sourceMappingURL=presence.d.ts.map

package/dist/server/plugins/presence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presence.d.ts","sourceRoot":"","sources":["../../../src/server/plugins/presence.ts"],"names":[],"mappings":"AASA,qFAAqF;AACrF,eAAO,MAAM,QAAQ,iDAcjB,CAAA"}

package/dist/server/plugins/presence.js

@@ -0,0 +1,23 @@
+import { Hono } from "hono";
+import * as z from "zod/mini";
+import { pointSchema } from "../../protocol/index.js";
+import { readJson } from "../http/body.js";
+import { actorOf } from "../http/gates.js";
+import { definePlugin } from "../kit/plugin.js";
+const cursorSchema = z.object({ cursor: z.nullable(pointSchema) });
+/** Live cursors and who's here. Ephemeral: fanned out over the bus, never stored. */
+export const presence = () => definePlugin({
+    id: "presence",
+    features: ["presence"],
+    setup: ({ gates, backend }) => {
+        const app = new Hono();
+        app.post("/artifacts/:id/presence", gates.guard("view"), async (c) => {
+            const { cursor } = await readJson(c, cursorSchema);
+            const artifactId = c.get("artifact").id;
+            await backend.bus.publish({ type: "presence", artifactId, actor: actorOf(c), cursor });
+            return c.body(null, 204);
+        });
+        return { routes: app };
+    },
+});
+//# sourceMappingURL=presence.js.map

package/dist/server/plugins/presence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presence.js","sourceRoot":"","sources":["../../../src/server/plugins/presence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAY,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAE/C,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;AAElE,qFAAqF;AACrF,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAG,EAAE,CAC3B,YAAY,CAAC;IACX,EAAE,EAAE,UAAU;IACd,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAO,CAAA;QAC3B,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACnE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAA;YAClD,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAA;YACvC,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;YACtF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAC1B,CAAC,CAAC,CAAA;QACF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;IACxB,CAAC;CACF,CAAC,CAAA"}

package/dist/server/plugins/rate-limit.d.ts

@@ -0,0 +1,18 @@
+import type { Actor } from "../../protocol/index.js";
+/** What a person did, for counting: publishing pages, commenting, or changing shared state. */
+export type LimitedAction = "publish" | "comment" | "state";
+export interface RateLimitOptions {
+    /** Most actions per person per minute. Defaults: 20 publishes, 30 comments, 240 state
+     *  changes (a busy board, but not a script). */
+    perMinute?: Partial<Record<LimitedAction, number>>;
+    /** Take one from a shared budget, returning false when it is spent: your Redis or edge
+     *  limiter, so limits hold across instances. Defaults to a per-instance window. */
+    take?(key: {
+        actor: Actor;
+        action: LimitedAction;
+    }, perMinute: number): Promise<boolean> | boolean;
+}
+/** Per-person limits on every write, so one script or runaway agent cannot flood an
+ *  artifact. Reads are never limited. */
+export declare const rateLimit: (options?: RateLimitOptions) => import("../kit/plugin.js").ArtifactPlugin;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/server/plugins/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/server/plugins/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAA;AAIpD,+FAA+F;AAC/F,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAA;AAE3D,MAAM,WAAW,gBAAgB;IAC/B;oDACgD;IAChD,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD;uFACmF;IACnF,IAAI,CAAC,CAAC,GAAG,EAAE;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,aAAa,CAAA;KAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;CACnG;AAwBD;yCACyC;AACzC,eAAO,MAAM,SAAS,aAAa,gBAAgB,8CAgBlD,CAAA"}

package/dist/server/plugins/rate-limit.js

@@ -0,0 +1,43 @@
+import { fail } from "../core/errors.js";
+import { definePlugin } from "../kit/plugin.js";
+const DEFAULTS = { publish: 20, comment: 30, state: 240 };
+const MINUTE = 60_000;
+/** A sliding one-minute window per person and action, on this instance only. */
+const localWindow = () => {
+    const seen = new Map();
+    return ({ actor, action }, perMinute) => {
+        const key = `${action}:${actor.id}`;
+        const now = Date.now();
+        const recent = (seen.get(key) ?? []).filter((at) => now - at < MINUTE);
+        if (recent.length >= perMinute)
+            return false;
+        seen.set(key, [...recent, now]);
+        return true;
+    };
+};
+const MESSAGES = {
+    publish: "Too many versions in a minute. Wait a moment and publish again.",
+    comment: "Too many comments in a minute. Wait a moment and try again.",
+    state: "Too many changes in a minute. Wait a moment and try again.",
+};
+/** Per-person limits on every write, so one script or runaway agent cannot flood an
+ *  artifact. Reads are never limited. */
+export const rateLimit = (options = {}) => {
+    const take = options.take ?? localWindow();
+    const check = async (actor, action) => {
+        const perMinute = options.perMinute?.[action] ?? DEFAULTS[action];
+        if (!(await take({ actor, action }, perMinute)))
+            throw fail("RATE_LIMITED", MESSAGES[action]);
+    };
+    return definePlugin({
+        id: "rate-limit",
+        setup: () => ({
+            before: {
+                "version.publish": ({ actor }) => check(actor, "publish"),
+                "comment.create": ({ actor }) => check(actor, "comment"),
+                "state.mutate": ({ actor }) => check(actor, "state"),
+            },
+        }),
+    });
+};
+//# sourceMappingURL=rate-limit.js.map

package/dist/server/plugins/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../../src/server/plugins/rate-limit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAc/C,MAAM,QAAQ,GAAkC,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;AACxF,MAAM,MAAM,GAAG,MAAM,CAAA;AAErB,gFAAgF;AAChF,MAAM,WAAW,GAAG,GAAG,EAAE;IACvB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAA;IACxC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAA2C,EAAE,SAAiB,EAAE,EAAE;QACvF,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,KAAK,CAAC,EAAE,EAAE,CAAA;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,CAAA;QACtE,IAAI,MAAM,CAAC,MAAM,IAAI,SAAS;YAAE,OAAO,KAAK,CAAA;QAC5C,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,CAAA;QAC/B,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;AACH,CAAC,CAAA;AAED,MAAM,QAAQ,GAAkC;IAC9C,OAAO,EAAE,iEAAiE;IAC1E,OAAO,EAAE,6DAA6D;IACtE,KAAK,EAAE,4DAA4D;CACpE,CAAA;AAED;yCACyC;AACzC,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAAO,GAAqB,EAAE,EAAE,EAAE;IAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAA;IAC1C,MAAM,KAAK,GAAG,KAAK,EAAE,KAAY,EAAE,MAAqB,EAAE,EAAE;QAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAA;QACjE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC;YAAE,MAAM,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAC/F,CAAC,CAAA;IACD,OAAO,YAAY,CAAC;QAClB,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACZ,MAAM,EAAE;gBACN,iBAAiB,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC;gBACzD,gBAAgB,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC;gBACxD,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC;aACrD;SACF,CAAC;KACH,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/server/plugins/state/index.d.ts

@@ -0,0 +1,10 @@
+import type { CollectionDialect } from "../../../protocol/collection.js";
+import { type ArtifactPlugin } from "../../kit/plugin.js";
+export interface SharedStateOptions {
+    /** Preserve the host's stored ownership fields and mutation markers. */
+    dialect?: Readonly<CollectionDialect>;
+}
+/** Shared state: votes, checklists, polls, small boards. The artifact reads and writes it
+ *  through app-only tools, so it persists in any MCP Apps host; agents can read it. */
+export declare const sharedState: (options?: SharedStateOptions) => ArtifactPlugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/server/plugins/state/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/server/plugins/state/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AAGxE,OAAO,EAAE,KAAK,cAAc,EAAgB,MAAM,qBAAqB,CAAA;AAIvE,MAAM,WAAW,kBAAkB;IACjC,wEAAwE;IACxE,OAAO,CAAC,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAA;CACtC;AAED;uFACuF;AACvF,eAAO,MAAM,WAAW,aAAa,kBAAkB,KAAQ,cA8D3D,CAAA"}

package/dist/server/plugins/state/index.js

@@ -0,0 +1,66 @@
+import * as z from "zod/mini";
+import { appTools, STATE_LIMITS, stateKeySchema } from "../../../protocol/index.js";
+import { nowIso } from "../../core/ids.js";
+import { definePlugin } from "../../kit/plugin.js";
+import { defineTool } from "../../kit/tool.js";
+import { stateService } from "./service.js";
+/** Shared state: votes, checklists, polls, small boards. The artifact reads and writes it
+ *  through app-only tools, so it persists in any MCP Apps host; agents can read it. */
+export const sharedState = (options = {}) => definePlugin({
+    id: "state",
+    features: ["state"],
+    setup: (kit) => {
+        const state = stateService(kit.backend, kit.access, kit.events, options.dialect);
+        const { stateRead, stateMutate, stateActivity } = appTools;
+        const forApp = ["app"];
+        return {
+            after: {
+                "state.changed": ({ artifact, key, mutation, actor, stateVersion, itemId }) => kit.backend.store.appendActivity({
+                    artifactId: artifact.id,
+                    key,
+                    action: mutation.op,
+                    itemId,
+                    version: stateVersion,
+                    actor,
+                    at: nowIso(),
+                }, STATE_LIMITS.activity),
+            },
+            tools: [
+                defineTool({
+                    name: "artifact_read_state",
+                    description: "Read a shared-state key, such as votes or a checklist.",
+                    visibility: ["model"],
+                    access: "view",
+                    input: z.object({ key: stateKeySchema }),
+                    run: async (a, { actor, artifact }) => state.read(actor, artifact, a.key),
+                }),
+                defineTool({
+                    name: stateRead.name,
+                    visibility: forApp,
+                    access: "view",
+                    input: stateRead.input,
+                    run: async (a, { actor, artifact }) => state.read(actor, artifact, a.key),
+                }),
+                defineTool({
+                    name: stateMutate.name,
+                    visibility: forApp,
+                    access: "interact",
+                    input: stateMutate.input,
+                    run: async (a, { actor, who, artifact }) => state.mutate({ actor, link: who.link }, artifact, {
+                        key: a.key,
+                        mutation: a.mutation,
+                        initial: a.initial,
+                    }),
+                }),
+                defineTool({
+                    name: stateActivity.name,
+                    visibility: forApp,
+                    access: "view",
+                    input: stateActivity.input,
+                    run: async (a, { artifact }) => ({ activity: await state.activity(artifact, a.key) }),
+                }),
+            ],
+        };
+    },
+});
+//# sourceMappingURL=index.js.map

package/dist/server/plugins/state/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/server/plugins/state/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAE7B,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AACnF,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAuB,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAO3C;uFACuF;AACvF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAO,GAAuB,EAAE,EAAkB,EAAE,CAC9E,YAAY,CAAC;IACX,EAAE,EAAE,OAAO;IACX,QAAQ,EAAE,CAAC,OAAO,CAAC;IACnB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;QAChF,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,QAAQ,CAAA;QAC1D,MAAM,MAAM,GAAG,CAAC,KAAK,CAAU,CAAA;QAC/B,OAAO;YACL,KAAK,EAAE;gBACL,eAAe,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAC5E,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAC9B;oBACE,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,GAAG;oBACH,MAAM,EAAE,QAAQ,CAAC,EAAE;oBACnB,MAAM;oBACN,OAAO,EAAE,YAAY;oBACrB,KAAK;oBACL,EAAE,EAAE,MAAM,EAAE;iBACb,EACD,YAAY,CAAC,QAAQ,CACtB;aACJ;YACD,KAAK,EAAE;gBACL,UAAU,CAAC;oBACT,IAAI,EAAE,qBAAqB;oBAC3B,WAAW,EAAE,wDAAwD;oBACrE,UAAU,EAAE,CAAC,OAAO,CAAC;oBACrB,MAAM,EAAE,MAAM;oBACd,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;oBACxC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC;iBAC1E,CAAC;gBACF,UAAU,CAAC;oBACT,IAAI,EAAE,SAAS,CAAC,IAAI;oBACpB,UAAU,EAAE,MAAM;oBAClB,MAAM,EAAE,MAAM;oBACd,KAAK,EAAE,SAAS,CAAC,KAAK;oBACtB,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC;iBAC1E,CAAC;gBACF,UAAU,CAAC;oBACT,IAAI,EAAE,WAAW,CAAC,IAAI;oBACtB,UAAU,EAAE,MAAM;oBAClB,MAAM,EAAE,UAAU;oBAClB,KAAK,EAAE,WAAW,CAAC,KAAK;oBACxB,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CACzC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE;wBAChD,GAAG,EAAE,CAAC,CAAC,GAAG;wBACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;wBACpB,OAAO,EAAE,CAAC,CAAC,OAAO;qBACnB,CAAC;iBACL,CAAC;gBACF,UAAU,CAAC;oBACT,IAAI,EAAE,aAAa,CAAC,IAAI;oBACxB,UAAU,EAAE,MAAM;oBAClB,MAAM,EAAE,MAAM;oBACd,KAAK,EAAE,aAAa,CAAC,KAAK;oBAC1B,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;iBACtF,CAAC;aACH;SACF,CAAA;IACH,CAAC;CACF,CAAC,CAAA"}

package/dist/server/plugins/state/service.d.ts

@@ -0,0 +1,21 @@
+import { type CollectionDialect } from "../../../protocol/collection.js";
+import { type Activity, type Actor, type Mutation, type Snapshot } from "../../../protocol/index.js";
+import type { Access } from "../../core/access.js";
+import type { Events } from "../../kit/events.js";
+import type { ArtifactRow, Backend } from "../../ports.js";
+/** Shared state for one artifact, as one viewer sees it. */
+export declare const stateService: ({ store }: Backend, access: Access, events: Events, dialect?: Readonly<CollectionDialect>) => {
+    read: (actor: Actor | null, artifact: ArtifactRow, key: string) => Promise<Snapshot>;
+    /** `interact` covers adding, your own values, and ±1 counters. Rewriting arbitrary fields
+     *  is authorship, so it needs `edit`: hiding a control in the HTML is not authorization. */
+    mutate: (who: {
+        actor: Actor;
+        link: string | null;
+    }, artifact: ArtifactRow, input: {
+        key: string;
+        mutation: Mutation;
+        initial?: Record<string, unknown>[] | undefined;
+    }) => Promise<Snapshot>;
+    activity: (artifact: ArtifactRow, key: string) => Promise<Activity[]>;
+};
+//# sourceMappingURL=service.d.ts.map

package/dist/server/plugins/state/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/server/plugins/state/service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,iBAAiB,EAIvB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,KAAK,EACV,KAAK,QAAQ,EACb,KAAK,QAAQ,EAEd,MAAM,4BAA4B,CAAA;AAEnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAGlD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,KAAK,EAAE,WAAW,EAAiB,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAkCzE,4DAA4D;AAC5D,eAAO,MAAM,YAAY,cACZ,OAAO,UACV,MAAM,UACN,MAAM,YACL,QAAQ,CAAC,iBAAiB,CAAC;IAIlC,IAAI,UAAgB,KAAK,GAAG,IAAI,YAAY,WAAW,OAAO,MAAM,KAAG,OAAO,CAAC,QAAQ,CAAC;IAIxF;gGAC4F;IAC5F,MAAM,QACC;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,YAChC,WAAW,SACd;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,SAAS,CAAA;KAAE,KAC1F,OAAO,CAAC,QAAQ,CAAC;IA6BpB,QAAQ,aAAmB,WAAW,OAAO,MAAM,KAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;CAK5E,CAAA"}