@dooc-dev/dooc 0.0.0-stage → 0.0.1

package/dist/viewer/nav-focus.js

@@ -0,0 +1,64 @@
+/** In narrow trees, show the current level beneath its compact ancestor chain. */
+export const focusNavTree = (root) => {
+    if (!root)
+        return;
+    const current = root.querySelector(".nav-row > a.cur")?.closest("[data-doc-id]");
+    const path = [];
+    for (let item = current; item; item = item.parentElement?.closest("[data-doc-id]")) {
+        path.unshift(item);
+    }
+    const width = root.clientWidth;
+    if (!width)
+        return;
+    const indent = 48 + Math.max(0, path.length - 2) * 29;
+    const ancestors = new Set(path.length > 2 && width < indent + 150 ? path.slice(0, -1) : []);
+    const items = [...root.querySelectorAll(".nav-item[data-doc-id]")];
+    const changed = items.some((item) => item.classList.contains("nav-ancestor") !== ancestors.has(item));
+    const collapsed = ".nav-list:has(> .nav-ancestor) > .nav-item:not(.nav-ancestor)";
+    const animate = changed &&
+        root.dataset.focusedDoc !== undefined &&
+        !matchMedia("(prefers-reduced-motion: reduce)").matches;
+    const siblings = [...root.querySelectorAll(".nav-list > .nav-item")];
+    const before = animate
+        ? siblings.map((item) => ({
+            item,
+            hidden: item.matches(collapsed),
+            height: item.getBoundingClientRect().height,
+            opacity: getComputedStyle(item).opacity,
+        }))
+        : [];
+    for (const item of items) {
+        item.classList.toggle("nav-ancestor", ancestors.has(item));
+        const list = item.querySelector(":scope > .nav-list");
+        if (!list)
+            continue;
+        const level = Number(item.parentElement?.style.getPropertyValue("--nav-depth") || 1);
+        list.style.setProperty("--nav-depth", String(ancestors.has(item) ? 2 : level + 1));
+    }
+    for (const item of siblings)
+        item.inert = item.matches(collapsed);
+    // Animate measured heights so siblings and Resources move together, including on reversal.
+    for (const previous of before) {
+        const { item } = previous;
+        const hidden = item.matches(collapsed);
+        if (hidden === previous.hidden)
+            continue;
+        for (const animation of item.getAnimations()) {
+            if (animation.id === "nav-collapse")
+                animation.cancel();
+        }
+        item.animate({
+            height: [`${previous.height}px`, `${item.getBoundingClientRect().height}px`],
+            opacity: [previous.opacity, hidden ? "0" : "1"],
+            visibility: "visible",
+            overflow: "hidden",
+        }, { id: "nav-collapse", duration: 260, easing: "cubic-bezier(.2, .8, .2, 1)" });
+    }
+    const id = current?.dataset.docId ?? "";
+    if (root.dataset.focusedDoc !== id) {
+        root.dataset.focusedDoc = id;
+        for (const item of ancestors)
+            item.classList.add("open");
+        current?.querySelector(":scope > .nav-row")?.scrollIntoView({ block: "nearest" });
+    }
+};

package/dist/viewer/plugin-blocks.d.ts

@@ -0,0 +1,3 @@
+import { type PluginBlock } from "../plugins/blocks.js";
+export declare const pluginMarkdown: (text: string) => string;
+export declare const pluginBlocksHtml: (blocks: PluginBlock[]) => string;

package/dist/viewer/plugin-blocks.js

@@ -0,0 +1,115 @@
+import { escapeHtml } from "../core/html.js";
+import { parseMdast } from "../core/markdown.js";
+import { pluginLink, } from "../plugins/blocks.js";
+const link = (url, html) => pluginLink(url)
+    ? `<a href="${escapeHtml(url)}" target="_blank" rel="noopener noreferrer">${html}</a>`
+    : html;
+const markdownNode = (node) => {
+    const children = "children" in node
+        ? node.children.map((child) => markdownNode(child)).join("")
+        : "";
+    switch (node.type) {
+        case "root":
+            return children;
+        case "text":
+        case "html":
+            return escapeHtml(node.value);
+        case "paragraph":
+            return `<p>${children}</p>`;
+        case "heading":
+            return `<strong class="plugin-markdown-heading">${children}</strong>`;
+        case "strong":
+            return `<strong>${children}</strong>`;
+        case "emphasis":
+            return `<em>${children}</em>`;
+        case "delete":
+            return `<del>${children}</del>`;
+        case "inlineCode":
+            return `<code>${escapeHtml(node.value)}</code>`;
+        case "code":
+            return `<pre><code>${escapeHtml(node.value)}</code></pre>`;
+        case "link":
+            return link(node.url, children);
+        case "image":
+            return escapeHtml(node.alt ?? "");
+        case "list":
+            return node.ordered ? `<ol>${children}</ol>` : `<ul>${children}</ul>`;
+        case "listItem": {
+            const body = node.children
+                .map((child) => child.type === "paragraph"
+                ? child.children.map(markdownNode).join("")
+                : markdownNode(child))
+                .join("");
+            return node.checked === null || node.checked === undefined
+                ? `<li>${body}</li>`
+                : `<li class="plugin-task"><span aria-label="${node.checked ? "Completed" : "Incomplete"}">${node.checked ? "☑" : "☐"}</span><div>${body}</div></li>`;
+        }
+        case "blockquote":
+            return `<blockquote>${children}</blockquote>`;
+        case "break":
+            return "<br>";
+        case "thematicBreak":
+            return "<hr>";
+        default:
+            return children;
+    }
+};
+export const pluginMarkdown = (text) => markdownNode(parseMdast(text));
+const binding = (edit) => edit ? ` data-block-edit="${escapeHtml(JSON.stringify(edit))}"` : "";
+const inline = (value) => {
+    if (typeof value === "string")
+        return `<span>${escapeHtml(value)}</span>`;
+    let html = escapeHtml(value.text);
+    if (value.code)
+        html = `<code>${html}</code>`;
+    if (value.strong)
+        html = `<strong>${html}</strong>`;
+    if (value.url)
+        html = link(value.url, html);
+    if (value.tone)
+        html = `<span class="plugin-badge" data-tone="${value.tone}">${html}</span>`;
+    if (value.copy !== undefined)
+        html = `<span class="plugin-copy-value">${html}<button type="button" class="plugin-copy" data-block-copy="${escapeHtml(value.copy)}" aria-label="Copy" title="Copy" data-i18n-aria-label="Copy" data-i18n-title="Copy"><svg viewBox="0 0 20 20" fill="none" stroke="currentColor" stroke-width="1.5" aria-hidden="true"><rect x="7" y="7" width="10" height="10" rx="2"/><path d="M13 4V3H3v10h1"/></svg></button></span>`;
+    return html;
+};
+const inlines = (items) => items.map(inline).join(" ");
+const actions = (ids, composer = false) => ids
+    .map((id) => `<span data-block-action="${escapeHtml(id)}"${composer ? ' data-block-composer=""' : ""}></span>`)
+    .join("");
+export const pluginBlocksHtml = (blocks) => blocks
+    .map((block) => {
+    switch (block.type) {
+        case "heading":
+            return `<h3 class="plugin-block-heading"${binding(block.edit)}>${escapeHtml(block.text)}</h3>`;
+        case "text":
+            return `<div class="plugin-block-text"${binding(block.edit)}>${block.markdown ? pluginMarkdown(block.text) : escapeHtml(block.text) || "—"}</div>`;
+        case "context":
+            return `<div class="plugin-block-context">${inlines(block.items)}</div>`;
+        case "fields":
+            return `<dl class="plugin-block-fields">${block.items.map((item) => `<div><dt>${escapeHtml(item.label)}</dt><dd${binding(item.edit)}>${inlines(item.items) || "—"}</dd></div>`).join("")}</dl>`;
+        case "columns":
+            return `<div class="plugin-block-columns"><div>${pluginBlocksHtml(block.main)}</div><aside>${pluginBlocksHtml(block.aside)}</aside></div>`;
+        case "section":
+            return `<details class="plugin-block-section"${block.collapsed ? "" : " open"}><summary>${escapeHtml(block.title)}</summary>${block.note ? `<p class="plugin-block-note">${escapeHtml(block.note)}</p>` : ""}${pluginBlocksHtml(block.blocks)}</details>`;
+        case "table":
+            return `<div class="plugin-block-table" tabindex="0" role="region" aria-label="Table" data-i18n-aria-label="Table"><table><thead><tr>${block.headers.map((h) => `<th scope="col">${escapeHtml(h)}</th>`).join("")}${block.rows.some((r) => r.actions?.length) ? '<th scope="col" aria-label="Actions" data-i18n-aria-label="Actions"></th>' : ""}</tr></thead><tbody>${block.rows.map((row) => `<tr>${row.cells.map((c) => `<td${binding(c.edit)}>${inlines(c.items) || "—"}</td>`).join("")}${block.rows.some((r) => r.actions?.length) ? `<td>${actions(row.actions ?? [])}</td>` : ""}</tr>`).join("")}</tbody></table></div>`;
+        case "code":
+            return `<div${binding(block.edit)}><pre class="plugin-block-code${block.diff ? " plugin-block-diff" : ""}"><code>${block.diff
+                ? block.text
+                    .split("\n")
+                    .map((line) => `<span data-tone="${line.startsWith("+") ? "success" : line.startsWith("-") ? "danger" : "neutral"}">${escapeHtml(line)}</span>`)
+                    .join("\n")
+                : escapeHtml(block.text)}</code></pre></div>`;
+        case "message":
+            return `<div class="plugin-block-message"><div class="plugin-message-byline"><span class="plugin-avatar" aria-hidden="true">${escapeHtml(block.author.slice(0, 2).toUpperCase())}</span><strong>${escapeHtml(block.author)}</strong>${block.time ? `<span>${escapeHtml(block.time)}</span>` : ""}<span class="plugin-message-actions">${actions(block.actions ?? [])}</span></div><div class="plugin-message-body"${binding(block.edit)}>${pluginMarkdown(block.text) || "—"}</div>${block.reactions?.length ? `<div class="plugin-reactions">${block.reactions.map((r) => (r.action ? `<button type="button" data-block-action="${escapeHtml(r.action)}" data-block-values="${escapeHtml(JSON.stringify(r.values ?? {}))}" aria-pressed="${!!r.active}" title="${escapeHtml(r.label)}">${escapeHtml(r.label)} ${r.count}</button>` : `<span>${escapeHtml(r.label)} ${r.count}</span>`)).join("")}</div>` : ""}</div>`;
+        case "actions":
+            return `<div class="plugin-block-actions">${actions(block.ids, block.composer)}</div>`;
+        case "progress":
+            return `<div class="plugin-block-progress"><progress max="100" value="${block.value}" aria-label="${escapeHtml(block.label)}"></progress><span>${escapeHtml(block.label)} ${block.value}%</span></div>`;
+        case "divider":
+            return "<hr>";
+        default:
+            throw new Error("Invalid plugin block");
+    }
+})
+    .join("");

package/dist/viewer/plugin-config.d.ts

@@ -0,0 +1,35 @@
+import { type WorkspaceSource } from "../core/workspace.js";
+import type { DataPlugin } from "../plugins/types.js";
+import type { GitOrigin } from "./git-types.js";
+export interface PluginMock {
+    origin: string;
+    /** Complete local mock authorization automatically when displaying a preview. */
+    autoConnect?: boolean;
+    handle: (request: Request) => Response | Promise<Response>;
+}
+export interface ViewerPlugins {
+    workspace?: WorkspaceSource;
+    gitOrigin?: GitOrigin;
+    allowedDomains?: string[];
+    setup?: (viewer: ViewerRuntime) => void | Promise<void>;
+    plugins: readonly DataPlugin[];
+    mocks: Readonly<Record<string, PluginMock>>;
+}
+export interface ViewerPluginRegistry {
+    /** Replacing an ID clears that plugin's connections and pending authorization attempts. */
+    register(plugin: DataPlugin, options?: {
+        mock?: PluginMock;
+    }): void;
+    unregister(id: string): void;
+}
+export interface ViewerRuntime extends ViewerPluginRegistry {
+    /** Replaces the host-owned workspace location; undefined restores local discovery. */
+    setWorkspace(workspace: WorkspaceSource | undefined): void;
+    /** The host owns origin operations and authentication; undefined disconnects it. */
+    setGitOrigin(origin: GitOrigin | undefined): void;
+    /** Replaces the network policy and refreshes open viewers; an empty list revokes all hosts. */
+    setAllowedDomains(domains: readonly string[]): void;
+}
+/** Viewer modules are explicitly injected; document roots never select executable plugins. */
+export declare const loadViewerPlugins: (specifier?: string) => Promise<ViewerPlugins>;
+export declare const validateViewerPlugins: (input: unknown) => ViewerPlugins;

package/dist/viewer/plugin-config.js

@@ -0,0 +1,57 @@
+import { createRequire } from "node:module";
+import { isAbsolute, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { parsePreviewSettings } from "../core/previewers.js";
+import { parseWorkspaceSource } from "../core/workspace.js";
+import { httpsUrl, validatePlugins } from "../plugins/oauth.js";
+import { validateGitOrigin } from "./git.js";
+/** Viewer modules are explicitly injected; document roots never select executable plugins. */
+export const loadViewerPlugins = async (specifier) => {
+    if (!specifier)
+        return { plugins: [], mocks: {} };
+    const path = isAbsolute(specifier) || specifier.startsWith(".")
+        ? resolve(specifier)
+        : createRequire(resolve("dooc-viewer.cjs")).resolve(specifier);
+    const { default: config } = await import(pathToFileURL(path).href);
+    return validateViewerPlugins(config);
+};
+export const validateViewerPlugins = (input) => {
+    const config = input;
+    if (!config || typeof config !== "object" || Array.isArray(config))
+        throw new Error("Viewer plugin module must export a configuration object");
+    if (config.setup !== undefined && typeof config.setup !== "function")
+        throw new Error("Viewer setup must be a function");
+    const plugins = validatePlugins(config.plugins);
+    if ("mounts" in config)
+        throw new Error("Use ![](service-url) instead of viewer mounts");
+    const mocks = config.mocks ?? {};
+    if (typeof mocks !== "object" || Array.isArray(mocks))
+        throw new Error("Viewer mocks must be an object");
+    const origins = new Set();
+    for (const [id, mock] of Object.entries(mocks)) {
+        if (!/^[a-z][a-z0-9-]{0,63}$/.test(id) ||
+            !mock ||
+            typeof mock.handle !== "function" ||
+            (mock.autoConnect !== undefined && typeof mock.autoConnect !== "boolean") ||
+            typeof mock.origin !== "string" ||
+            httpsUrl(mock.origin).origin !== mock.origin ||
+            !new URL(mock.origin).hostname.endsWith(".invalid") ||
+            origins.has(mock.origin))
+            throw new Error("Viewer mocks require distinct HTTPS .invalid origins and handlers");
+        origins.add(mock.origin);
+    }
+    return {
+        plugins,
+        mocks,
+        ...(config.gitOrigin === undefined
+            ? {}
+            : { gitOrigin: validateGitOrigin(config.gitOrigin) }),
+        ...(config.allowedDomains === undefined
+            ? {}
+            : { allowedDomains: parsePreviewSettings({ domains: config.allowedDomains }).domains }),
+        ...(config.setup === undefined ? {} : { setup: config.setup }),
+        ...(config.workspace === undefined
+            ? {}
+            : { workspace: parseWorkspaceSource(config.workspace) }),
+    };
+};

package/dist/viewer/plugin-view.d.ts

@@ -0,0 +1,3 @@
+import { type PluginView } from "../plugins/view.js";
+/** Authored HTML cannot run scripts; auto height permits only a nonce-protected reporter. */
+export declare const pluginViewHtml: (input: PluginView) => string;

package/dist/viewer/plugin-view.js

@@ -0,0 +1,28 @@
+import { escapeHtml } from "../core/html.js";
+import { validatePluginView } from "../plugins/view.js";
+import { pluginBlocksHtml } from "./plugin-blocks.js";
+/** Authored HTML cannot run scripts; auto height permits only a nonce-protected reporter. */
+export const pluginViewHtml = (input) => {
+    const view = validatePluginView(input);
+    if (view.format === "blocks")
+        return `<div class="plugin-blocks">${pluginBlocksHtml(view.blocks)}</div>`;
+    if (view.format === "html") {
+        const auto = view.height === "auto";
+        const nonce = auto ? crypto.randomUUID() : "";
+        const script = auto
+            ? `<script nonce="${nonce}">(()=>{const report=()=>parent.postMessage({doocPluginHeight:Math.ceil(document.body.getBoundingClientRect().height)},"*");new ResizeObserver(report).observe(document.body);report();})()</script>`
+            : "";
+        const source = `<!doctype html><html><head><meta charset="utf-8"><meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline';${auto ? ` script-src 'nonce-${nonce}';` : ""} base-uri 'none'; form-action 'none'"><meta name="referrer" content="no-referrer"><style>html,body{margin:0}body{display:flow-root}</style></head><body>${view.html}${script}</body></html>`;
+        return `<iframe title="Plugin content" sandbox="${auto ? "allow-scripts" : ""}"${auto ? ' data-plugin-auto-height=""' : ""} referrerpolicy="no-referrer" srcdoc="${escapeHtml(source)}" style="width:100%;height:${auto ? 120 : (view.height ?? 240)}px;border:0"></iframe>`;
+    }
+    switch (view.preset) {
+        case "card":
+            return `<article class="plugin-card"><strong>${escapeHtml(view.title)}</strong><p>${escapeHtml(view.text)}</p></article>`;
+        case "list":
+            return `<ul>${view.items.map((item) => `<li>${escapeHtml(item)}</li>`).join("")}</ul>`;
+        case "table":
+            return `<table><thead><tr>${view.headers.map((header) => `<th scope="col">${escapeHtml(header)}</th>`).join("")}</tr></thead><tbody>${view.rows.map((row) => `<tr>${row.map((cell) => `<td>${escapeHtml(cell === null ? "" : String(cell))}</td>`).join("")}</tr>`).join("")}</tbody></table>`;
+        case "code":
+            return `<pre><code>${escapeHtml(JSON.stringify(view.value, null, 2))}</code></pre>`;
+    }
+};

package/dist/viewer/plugins.d.ts

@@ -0,0 +1,8 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { DataPlugin } from "../plugins/types.js";
+export type { GitWorkspace, StorageWorkspace, WorkspaceSource } from "../core/workspace.js";
+import { type ViewerPluginRegistry, type ViewerPlugins } from "./plugin-config.js";
+export type { GitContext, GitOrigin, GitOriginAction, GitOriginState, GitPullRequest, } from "./git-types.js";
+export type { PluginMock, ViewerPluginRegistry, ViewerPlugins, ViewerRuntime, } from "./plugin-config.js";
+/** Local viewer only: the cookie identifies a browser session, never a document-supplied user. */
+export declare const createPluginHandler: (plugins: readonly DataPlugin[], presentation?: Pick<ViewerPlugins, "mocks">) => ((req: IncomingMessage, res: ServerResponse) => Promise<boolean>) & ViewerPluginRegistry;

package/dist/viewer/plugins.js

@@ -0,0 +1,214 @@
+import { randomBytes } from "node:crypto";
+import { isPluginError, PluginError } from "../plugins/oauth.js";
+import { createPluginRuntime } from "../plugins/runtime.js";
+import { isLocalToolRequest } from "./editor-tools.js";
+import { validateViewerPlugins, } from "./plugin-config.js";
+const readBody = (req) => new Promise((resolve, reject) => {
+    let body = "";
+    let size = 0;
+    req.setEncoding("utf8");
+    req.on("data", (chunk) => {
+        size += Buffer.byteLength(chunk);
+        if (size > 65_536) {
+            body = "";
+            reject(new PluginError(413, "Plugin request is too large"));
+        }
+        else
+            body += chunk;
+    });
+    req.on("error", reject);
+    req.on("end", () => resolve(body));
+});
+const readInput = async (req) => {
+    const body = await readBody(req);
+    try {
+        const input = JSON.parse(body);
+        if (!input || typeof input !== "object" || Array.isArray(input))
+            throw new Error();
+        return input;
+    }
+    catch {
+        throw new PluginError(400, "Invalid plugin request");
+    }
+};
+/** Local viewer only: the cookie identifies a browser session, never a document-supplied user. */
+export const createPluginHandler = (plugins, presentation = { mocks: {} }) => {
+    let config = validateViewerPlugins({ plugins, ...presentation });
+    let mocks = new Map(Object.entries(config.mocks));
+    let origins = new Map([...mocks].map(([id, mock]) => [mock.origin, { id, ...mock }]));
+    const transport = async (input, init) => {
+        if (!origins.size)
+            return fetch(input, init);
+        const request = new Request(input, init);
+        const mock = origins.get(new URL(request.url).origin);
+        return mock ? mock.handle(request) : fetch(input, init);
+    };
+    const runtime = createPluginRuntime(config.plugins, transport);
+    const cookie = `dooc-plugins-${randomBytes(8).toString("hex")}`;
+    let revision = 0;
+    const streams = new Set();
+    const notify = (res) => {
+        res.write(`data: ${cookie}:${revision}\n\n`);
+    };
+    const update = (next) => {
+        config = next;
+        mocks = new Map(Object.entries(config.mocks));
+        origins = new Map([...mocks].map(([id, mock]) => [mock.origin, { id, ...mock }]));
+        revision++;
+        for (const stream of streams)
+            notify(stream);
+    };
+    const registry = {
+        register(plugin, options = {}) {
+            const addition = validateViewerPlugins({
+                plugins: [plugin],
+                mocks: options.mock ? { [plugin.id]: options.mock } : {},
+            });
+            const next = validateViewerPlugins({
+                plugins: [...config.plugins.filter((item) => item.id !== plugin.id), plugin],
+                mocks: {
+                    ...Object.fromEntries(Object.entries(config.mocks).filter(([id]) => id !== plugin.id)),
+                    ...addition.mocks,
+                },
+            });
+            runtime.register(plugin);
+            update(next);
+        },
+        unregister(id) {
+            if (!config.plugins.some((plugin) => plugin.id === id))
+                return;
+            runtime.unregister(id);
+            update({
+                plugins: config.plugins.filter((plugin) => plugin.id !== id),
+                mocks: Object.fromEntries(Object.entries(config.mocks).filter(([key]) => key !== id)),
+            });
+        },
+    };
+    const handle = async (req, res) => {
+        const url = new URL(req.url ?? "/", "http://localhost");
+        if (url.pathname !== "/api/plugins" && !url.pathname.startsWith("/api/plugins/"))
+            return false;
+        res.setHeader("cache-control", "no-store");
+        res.setHeader("referrer-policy", "no-referrer");
+        res.setHeader("x-content-type-options", "nosniff");
+        res.setHeader("content-security-policy", "default-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'");
+        const send = (status, body) => {
+            res.writeHead(status, { "content-type": "application/json; charset=utf-8" });
+            res.end(JSON.stringify(body));
+        };
+        try {
+            const host = req.headers.host ?? "";
+            if (!["localhost", "127.0.0.1", "[::1]"].some((name) => host === `${name}:${req.socket.localPort}`))
+                throw new PluginError(403, "Plugins require the local viewer");
+            if (req.method === "GET" && url.pathname === "/api/plugins/events") {
+                res.writeHead(200, {
+                    "content-type": "text/event-stream",
+                    connection: "keep-alive",
+                });
+                streams.add(res);
+                res.on("close", () => streams.delete(res));
+                notify(res);
+                return true;
+            }
+            const mockRoute = /^\/api\/plugins\/mock\/([a-z][a-z0-9-]{0,63})(\/.*)$/.exec(url.pathname);
+            if (mockRoute) {
+                const mock = mocks.get(mockRoute[1] ?? "");
+                const target = mock && `${mock.origin}${mockRoute[2]}`;
+                if (!mock ||
+                    !config.plugins.some((plugin) => plugin.oauth.authorizationUrl === target))
+                    throw new PluginError(404, "Mock authorization is not configured");
+                if (req.method !== "GET" &&
+                    (req.method !== "POST" ||
+                        req.headers.origin !== `http://${host}` ||
+                        req.headers["content-type"]?.split(";")[0] !==
+                            "application/x-www-form-urlencoded"))
+                    throw new PluginError(403, "Mock consent requires a same-origin request");
+                const response = await mock.handle(new Request(`${target}${url.search}`, {
+                    method: req.method,
+                    ...(req.method === "POST"
+                        ? {
+                            body: await readBody(req),
+                            headers: { "content-type": "application/x-www-form-urlencoded" },
+                        }
+                        : {}),
+                }));
+                const location = response.headers.get("location");
+                if (location && !location.startsWith(`http://${host}/api/plugins/callback/`))
+                    throw new PluginError(400, "Invalid mock callback");
+                // Preserve the Origin header on local consent form submissions.
+                res.setHeader("referrer-policy", "same-origin");
+                res.setHeader("content-security-policy", "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'");
+                res.writeHead(response.status, {
+                    "content-type": response.headers.get("content-type") ?? "text/plain; charset=utf-8",
+                    ...(location ? { location } : {}),
+                });
+                res.end(await response.text());
+                return true;
+            }
+            let session = req.headers.cookie
+                ?.split(";")
+                .map((part) => part.trim())
+                .find((part) => part.startsWith(`${cookie}=`))
+                ?.slice(cookie.length + 1) ?? "";
+            const callback = /^\/api\/plugins\/callback\/([a-z][a-z0-9-]{0,63})$/.exec(url.pathname);
+            if (req.method === "GET" && callback?.[1]) {
+                await runtime.callback(session, callback[1], `http://${host}${url.pathname}`, url.searchParams);
+                res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+                res.end('<!doctype html><html lang="en"><meta charset="utf-8"><title>Plugin connected</title><p>Connected. Close this tab and choose Load data in dooc.</p></html>');
+                return true;
+            }
+            if (url.pathname !== "/api/plugins")
+                throw new PluginError(404, "Plugin route not found");
+            if (req.method !== "POST" ||
+                !isLocalToolRequest(host, req.headers.origin, req.headers["content-type"]))
+                throw new PluginError(403, "Plugins require a same-origin local request");
+            const input = await readInput(req);
+            if (input.action === "resolve") {
+                const plugin = runtime.resolve(input.url);
+                send(200, {
+                    plugin,
+                    ...(plugin && mocks.get(plugin)?.autoConnect ? { autoConnect: true } : {}),
+                });
+                return true;
+            }
+            if (typeof input.plugin !== "string" || !/^[a-z][a-z0-9-]{0,63}$/.test(input.plugin))
+                throw new PluginError(400, "Invalid plugin ID");
+            if (input.action === "connect") {
+                if (!runtime.hasSession(session)) {
+                    session = runtime.createSession();
+                    res.setHeader("set-cookie", `${cookie}=${session}; HttpOnly; SameSite=Lax; Path=/api/plugins; Max-Age=28800`);
+                }
+                const authorization = new URL(runtime.connect(session, input.plugin, `http://${host}/api/plugins/callback/${input.plugin}`));
+                const mock = origins.get(authorization.origin);
+                send(200, {
+                    url: mock
+                        ? `http://${host}/api/plugins/mock/${mock.id}${authorization.pathname}${authorization.search}`
+                        : authorization.href,
+                });
+            }
+            else if (input.action === "disconnect") {
+                if (runtime.hasSession(session))
+                    runtime.disconnect(session, input.plugin);
+                send(200, { disconnected: true });
+            }
+            else if (input.action === "read") {
+                send(200, await runtime.read(session, input.plugin, input.url));
+            }
+            else if (input.action === "actions") {
+                send(200, await runtime.actions(session, input.plugin, input.url));
+            }
+            else if (input.action === "act") {
+                send(200, await runtime.act(session, input.plugin, input.url, input.operation, input.requestId));
+            }
+            else
+                throw new PluginError(400, "Invalid plugin action");
+        }
+        catch (error) {
+            send(isPluginError(error) ? error.status : 502, {
+                error: isPluginError(error) ? error.message : "Plugin request failed",
+            });
+        }
+        return true;
+    };
+    return Object.assign(handle, registry);
+};

package/dist/viewer/resize.d.ts

@@ -0,0 +1,4 @@
+/** Shared by editor, preview, and published pages; keep this function self-contained. */
+export declare const mountPanelResize: () => void;
+/** The navigation is replaced on refresh; keep listeners and height on its stable sidebar. */
+export declare const mountToolsResize: () => (() => void);