@dustfeather/deckrun 2.0.0

package/dist/index.js

@@ -0,0 +1,1020 @@
+#!/usr/bin/env node
+import { readFileSync, writeFileSync, watch } from "fs";
+import { readFile } from "fs/promises";
+import { createServer } from "http";
+import { createRequire } from "module";
+import { randomBytes, timingSafeEqual } from "crypto";
+import { resolve, dirname, basename, extname, join, isAbsolute, relative } from "path";
+import { Command } from "commander";
+import open from "open";
+import { parseSlides } from "./parser.js";
+import { deckTitle, docTitle } from "./titles.js";
+import { generateHtml, generateDocHtml, renderSlide } from "./generate.js";
+import { DEFAULT_THEME, findFont, findTheme, fontListing, resolveThemeName, themeListing, } from "./themes.js";
+import { generateEditorHtml } from "./editor.js";
+import { generatePreviewHtml } from "./preview.js";
+import { findBrowser, renderPdfSerial, PdfError } from "./pdf.js";
+import { DEFAULT_TEMPLATE, DEFAULT_TRANSITION, findTemplate, findTransition, resolveTemplateName, resolveTransitionName, templateListing, transitionListing, } from "./presentation-options.js";
+import { lintMarkdown, sanitizeForTerminal } from "./lint.js";
+import { safeFetch, BlockedAddressError } from "./safe-fetch.js";
+const moduleRequire = createRequire(import.meta.url);
+const c = {
+    reset: "\x1b[0m",
+    bold: "\x1b[1m",
+    dim: "\x1b[2m",
+    cyan: "\x1b[36m",
+    green: "\x1b[32m",
+    yellow: "\x1b[33m",
+    magenta: "\x1b[35m",
+};
+function packageVersion() {
+    try {
+        return moduleRequire("../package.json").version;
+    }
+    catch {
+        return "0.0.0";
+    }
+}
+const MIME = {
+    ".html": "text/html; charset=utf-8",
+    ".htm": "text/html; charset=utf-8",
+    ".css": "text/css",
+    ".js": "application/javascript",
+    ".mjs": "application/javascript",
+    ".json": "application/json",
+    ".md": "text/markdown; charset=utf-8",
+    ".txt": "text/plain; charset=utf-8",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".svg": "image/svg+xml",
+    ".webp": "image/webp",
+    ".ico": "image/x-icon",
+    ".avif": "image/avif",
+    ".mp4": "video/mp4",
+    ".webm": "video/webm",
+    ".woff": "font/woff",
+    ".woff2": "font/woff2",
+    ".ttf": "font/ttf",
+};
+function getMime(filepath) {
+    return MIME[extname(filepath).toLowerCase()] ?? "application/octet-stream";
+}
+/**
+ * Whether a path under the launch directory may be served.
+ *
+ * The static route exists so that `![](diagram.png)` in a deck resolves, and
+ * a deck references assets. It used to serve anything at or below baseDir —
+ * traversal *above* it was blocked, but everything inside was not restricted
+ * at all, and `deckrun` with no file argument uses the current directory. A
+ * user opening a blank editor from their home directory published
+ * `.aws/credentials`, `.ssh/id_rsa`, `.env` and `.npmrc` on a known port to
+ * every other process, sandboxed app and browser extension on the machine.
+ *
+ * Only the asset types already enumerated in the MIME table are servable, and
+ * no path segment may be a dotfile.
+ */
+function servableAsset(relativePath) {
+    const segments = relativePath.split(/[\\/]/).filter(Boolean);
+    if (segments.length === 0)
+        return false;
+    if (segments.some((segment) => segment.startsWith(".")))
+        return false;
+    return Object.hasOwn(MIME, extname(segments[segments.length - 1]).toLowerCase());
+}
+async function findFreePort(preferred) {
+    return new Promise((resolvePort) => {
+        const server = createServer();
+        server.listen(preferred, () => {
+            const addr = server.address();
+            server.close(() => resolvePort(addr.port));
+        });
+        server.on("error", () => {
+            // Preferred port is taken, take whatever the OS offers.
+            const fallback = createServer();
+            fallback.listen(0, () => {
+                const addr = fallback.address();
+                fallback.close(() => resolvePort(addr.port));
+            });
+        });
+    });
+}
+/** A deck name reduced to something safe for a Content-Disposition header. */
+function safeFilename(name) {
+    const slug = name
+        .trim()
+        .toLowerCase()
+        .replace(/\.(md|markdown)$/, "")
+        .replace(/[^a-z0-9._-]+/g, "-")
+        .replace(/^-|-$/g, "");
+    return slug || "deck";
+}
+/**
+ * A secret minted per server run and handed only to the editor page.
+ *
+ * Every `/__` route used to answer any caller. A POST with
+ * `Content-Type: text/plain` is a CORS *simple* request, so the browser sends
+ * it with no preflight and the response being opaque does not matter — the
+ * write, the stash, or the fetch has already happened. Any site the user
+ * visits while deckrun is running could overwrite the open file, or stash
+ * attacker HTML and have it served back from deckrun's own origin.
+ */
+const SESSION_TOKEN = randomBytes(24).toString("base64url");
+/** Constant-time comparison, so a wrong token leaks nothing by timing. */
+function tokenMatches(given) {
+    if (!given)
+        return false;
+    const a = Buffer.from(given);
+    const b = Buffer.from(SESSION_TOKEN);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+/**
+ * Whether a request carries the session token, in the header the editor's
+ * fetch() calls set or — for an EventSource and the preview frame, neither of
+ * which can set headers — in the query string.
+ */
+function authorized(req, query) {
+    const header = req.headers["x-deckrun-token"];
+    const given = Array.isArray(header) ? header[0] : header;
+    return tokenMatches(given) || tokenMatches(query.get("token") ?? undefined);
+}
+/**
+ * Rejects a state-changing request whose Origin is another site.
+ *
+ * The token is what actually closes CSRF; this is the second layer, and it
+ * also refuses the `text/plain` content type that made these requests
+ * preflight-free in the first place.
+ */
+function sameOriginPost(req, port) {
+    const origin = req.headers.origin;
+    if (typeof origin === "string" && origin !== "null") {
+        if (origin !== `http://127.0.0.1:${port}` &&
+            origin !== `http://localhost:${port}` &&
+            origin !== `http://[::1]:${port}`) {
+            return false;
+        }
+    }
+    const site = req.headers["sec-fetch-site"];
+    if (typeof site === "string" && site !== "same-origin" && site !== "none")
+        return false;
+    return true;
+}
+const MAX_BODY = 32 * 1024 * 1024;
+/** Ceiling on a file `deckrun lint` will read, so CI cannot be parked on one. */
+const MAX_LINT_INPUT = 8 * 1024 * 1024;
+function readBody(req) {
+    return new Promise((resolveBody, rejectBody) => {
+        const chunks = [];
+        let size = 0;
+        let overflowed = false;
+        req.on("data", (chunk) => {
+            if (overflowed)
+                return;
+            size += chunk.length;
+            if (size > MAX_BODY) {
+                // Reject now but keep the socket open long enough to answer with 413.
+                overflowed = true;
+                chunks.length = 0;
+                rejectBody(new Error("request body too large"));
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on("end", () => {
+            if (!overflowed)
+                resolveBody(Buffer.concat(chunks).toString("utf-8"));
+        });
+        req.on("error", rejectBody);
+    });
+}
+function sendHtml(res, html) {
+    res.writeHead(200, {
+        "Content-Type": "text/html; charset=utf-8",
+        "Cache-Control": "no-store",
+        // Nothing prevented a cross-origin page from framing the editor or the
+        // preview and posting into it. It cannot read the frame, but it can post
+        // to it, and the handlers wrote what arrived to innerHTML. Both headers
+        // are sent because the older one still governs some contexts.
+        "X-Frame-Options": "SAMEORIGIN",
+        "Content-Security-Policy": "frame-ancestors 'self'",
+    });
+    res.end(html);
+}
+function sendJson(res, payload) {
+    res.writeHead(200, {
+        "Content-Type": "application/json; charset=utf-8",
+        "Cache-Control": "no-store",
+    });
+    res.end(JSON.stringify(payload));
+}
+/** Resolve bundled math/diagram assets installed with the npm package. */
+function vendorAsset(pathname) {
+    const name = pathname.replace(/^\/__vendor\/?/, "");
+    if (name === "katex.min.css" || name === "katex.min.js" || name.startsWith("fonts/")) {
+        const katexDist = dirname(moduleRequire.resolve("katex"));
+        const target = resolve(katexDist, name);
+        const fromRoot = relative(katexDist, target);
+        return !isAbsolute(fromRoot) && !fromRoot.startsWith("..") ? target : null;
+    }
+    if (name === "mermaid.min.js") {
+        const mermaidDist = dirname(moduleRequire.resolve("mermaid"));
+        return join(mermaidDist, "mermaid.min.js");
+    }
+    return null;
+}
+/** Editor tabs holding an open /__events stream, waiting on a reload ping. */
+const liveClients = new Set();
+function notifyLiveClients() {
+    for (const client of liveClients) {
+        try {
+            client.write("data: reload\n\n");
+        }
+        catch {
+            liveClients.delete(client);
+        }
+    }
+}
+/**
+ * The content most recently written to the file by the editor itself, so
+ * the watcher can tell the editor's own save landing on disk apart from an
+ * external edit and not bounce it back as a reload.
+ */
+let lastEditorWrite = null;
+/**
+ * Watches the opened file and pings the editor when it changes on disk.
+ *
+ * The parent directory is watched rather than the file itself so editors
+ * that save by atomic rename (vim, VS Code, …) do not silently detach the
+ * watcher. Events are debounced because a single save fires several.
+ */
+function watchSourceFile(absPath) {
+    const name = basename(absPath);
+    let timer;
+    try {
+        watch(dirname(absPath), (_event, filename) => {
+            if (filename && filename !== name)
+                return;
+            clearTimeout(timer);
+            timer = setTimeout(() => {
+                let content;
+                try {
+                    content = readFileSync(absPath, "utf-8");
+                }
+                catch {
+                    return; // mid-save window of an atomic rename; the next event retries
+                }
+                if (content === lastEditorWrite)
+                    return; // our own save landing
+                notifyLiveClients();
+            }, 150);
+        });
+    }
+    catch {
+        console.error(`${c.dim}deckrun: cannot watch '${name}' for changes; live reload is off.${c.reset}`);
+    }
+}
+/** Decks built from editor content, addressable so a new tab can load them. */
+const decks = new Map();
+/**
+ * Stores a built deck and returns the path that serves it.
+ *
+ * The path stays at the root on purpose: a deck served from a subpath would
+ * resolve `![](diagram.png)` against that subpath instead of the directory
+ * being served, and every local image would 404.
+ */
+function stashDeck(html) {
+    // Unguessable, because the stash is served back as text/html from this
+    // origin. A monotonic counter meant an attacker who had stashed a payload
+    // could simply frame `?deck=1` through `?deck=8` to run it.
+    const id = randomBytes(16).toString("hex");
+    decks.set(id, html);
+    // Keep only the handful of most recent builds.
+    for (const key of decks.keys()) {
+        if (decks.size <= 8)
+            break;
+        decks.delete(key);
+    }
+    return `/?deck=${id}`;
+}
+/** A built deck, addressed by `?deck=<id>` so its base URL stays the root. */
+function serveStashedDeck(id, res) {
+    const html = decks.get(id);
+    if (!html) {
+        res.writeHead(410, { "Content-Type": "text/plain; charset=utf-8" });
+        res.end("This build has expired. Press present again in the editor.");
+        return;
+    }
+    sendHtml(res, html);
+}
+async function handleEditorRoute(mode, pathname, req, res, query, port) {
+    // Every /__ route is part of the editor session, so all of them are gated
+    // on the token rather than only the ones that write.
+    if (!authorized(req, query)) {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "forbidden", detail: "missing or invalid session token" }));
+        return true;
+    }
+    if (req.method === "POST" && !sameOriginPost(req, port)) {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "forbidden", detail: "cross-origin request" }));
+        return true;
+    }
+    if (pathname === "/__preview" && req.method === "GET") {
+        sendHtml(res, generatePreviewHtml(mode.theme, mode.fonts, mode.template, mode.transition));
+        return true;
+    }
+    if (pathname === "/__file" && req.method === "GET" && mode.file) {
+        let content;
+        if (mode.file.path) {
+            try {
+                content = readFileSync(mode.file.path, "utf-8");
+            }
+            catch {
+                res.writeHead(500, { "Content-Type": "text/plain; charset=utf-8" });
+                res.end("Cannot read the file.");
+                return true;
+            }
+        }
+        else {
+            content = mode.file.content ?? "";
+        }
+        res.writeHead(200, {
+            "Content-Type": "text/plain; charset=utf-8",
+            "Cache-Control": "no-store",
+        });
+        res.end(content);
+        return true;
+    }
+    if (pathname === "/__file" && req.method === "POST" && mode.file) {
+        if (!mode.file.path) {
+            res.writeHead(405, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "read-only", detail: "This document came from a URL; download it to keep changes." }));
+            return true;
+        }
+        const content = await readBody(req);
+        // Remember the write before it lands so the watcher can ignore its echo.
+        lastEditorWrite = content;
+        try {
+            writeFileSync(mode.file.path, content, "utf-8");
+        }
+        catch {
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "write failed" }));
+            return true;
+        }
+        sendJson(res, { ok: true });
+        return true;
+    }
+    if (pathname === "/__events" && req.method === "GET" && mode.file?.watched) {
+        res.writeHead(200, {
+            "Content-Type": "text/event-stream",
+            "Cache-Control": "no-store",
+            Connection: "keep-alive",
+        });
+        res.write(": connected\n\n");
+        liveClients.add(res);
+        req.on("close", () => liveClients.delete(res));
+        return true;
+    }
+    if (pathname === "/__parse" && req.method === "POST") {
+        const markdown = await readBody(req);
+        const slides = parseSlides(markdown);
+        sendJson(res, {
+            slides: slides.map((slide, i) => renderSlide(slide, i)),
+            notes: slides.map((slide) => slide.notes ?? ""),
+            title: deckTitle(slides, ""),
+        });
+        return true;
+    }
+    if (pathname === "/__present" && req.method === "POST") {
+        const body = JSON.parse(await readBody(req));
+        const slides = parseSlides(body.markdown ?? "");
+        if (slides.length === 0) {
+            res.writeHead(422, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "no slides" }));
+            return true;
+        }
+        const theme = resolveThemeName(body.theme);
+        const template = resolveTemplateName(body.template);
+        const transition = resolveTransitionName(body.transition);
+        const title = deckTitle(slides, body.title?.trim() || "deckrun");
+        // A deck built for printing must not open behind a fullscreen prompt.
+        const forPrint = body.print === true;
+        const path = stashDeck(generateHtml(slides, title, forPrint ? false : mode.fullscreen, theme, {
+            head: body.head,
+            body: body.body,
+        }, { template, transition, standalone: body.standalone === true }));
+        sendJson(res, { path: forPrint ? `${path}&print=1` : path });
+        return true;
+    }
+    if (pathname === "/__pdf" && req.method === "POST") {
+        const body = JSON.parse(await readBody(req));
+        const slides = parseSlides(body.markdown ?? "");
+        if (slides.length === 0) {
+            res.writeHead(422, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "no slides" }));
+            return true;
+        }
+        const browser = await findBrowser();
+        if (!browser) {
+            // The caller falls back to the print dialog, which prints correctly too.
+            res.writeHead(501, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({
+                error: "no browser",
+                detail: "No Chrome, Chromium, Edge, or Brave found. Set DECKRUN_BROWSER to one to export PDFs directly.",
+            }));
+            return true;
+        }
+        const theme = resolveThemeName(body.theme);
+        const template = resolveTemplateName(body.template);
+        const transition = resolveTransitionName(body.transition);
+        const title = deckTitle(slides, body.title?.trim() || "deckrun");
+        const path = stashDeck(generateHtml(slides, title, false, theme, { head: body.head, body: body.body }, 
+        // A PDF is handed to the audience: no speaker notes travel with it.
+        { template, transition, notes: false }));
+        try {
+            const pdf = await renderPdfSerial(`${mode.origin}${path}`, browser);
+            const filename = safeFilename(body.title?.trim() || title) + ".pdf";
+            res.writeHead(200, {
+                "Content-Type": "application/pdf",
+                "Content-Length": pdf.length,
+                "Content-Disposition": `attachment; filename="${filename}"`,
+                "Cache-Control": "no-store",
+            });
+            res.end(pdf);
+        }
+        catch (err) {
+            const detail = err instanceof PdfError ? err.message : "rendering failed";
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "render failed", detail }));
+        }
+        return true;
+    }
+    if (pathname === "/__fetch-doc" && req.method === "POST") {
+        const body = JSON.parse(await readBody(req));
+        const raw = (body.url ?? "").trim();
+        let target;
+        try {
+            target = new URL(raw);
+        }
+        catch {
+            res.writeHead(422, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "invalid url" }));
+            return true;
+        }
+        if (target.protocol !== "http:" && target.protocol !== "https:") {
+            res.writeHead(422, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "url must be http or https" }));
+            return true;
+        }
+        let upstream;
+        try {
+            // Fetched server-side, not from the browser, so a page with no
+            // Access-Control-Allow-Origin still loads fine. safeFetch refuses to
+            // connect to a private address and re-checks every redirect hop, so
+            // this route cannot be used to reach loopback services, the instance
+            // metadata endpoint, or anything else on the local network.
+            upstream = await safeFetch(target.href, {
+                maxBytes: MAX_BODY,
+                timeoutMs: 15_000,
+            });
+        }
+        catch (err) {
+            const blocked = err instanceof BlockedAddressError;
+            res.writeHead(blocked ? 403 : 502, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({
+                error: blocked ? "address not allowed" : "fetch failed",
+                detail: err instanceof Error ? err.message : "network error",
+            }));
+            return true;
+        }
+        if (upstream.status < 200 || upstream.status >= 300) {
+            res.writeHead(502, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "fetch failed", detail: `upstream responded ${upstream.status}` }));
+            return true;
+        }
+        if (upstream.truncated) {
+            res.writeHead(413, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({
+                error: "too large",
+                detail: `page is larger than ${Math.round(MAX_BODY / 1024 / 1024)} MB`,
+            }));
+            return true;
+        }
+        const rawContent = upstream.body;
+        if (!rawContent.trim()) {
+            res.writeHead(422, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "empty document" }));
+            return true;
+        }
+        const contentType = String(upstream.headers["content-type"] ?? "").toLowerCase();
+        // The redirect chain may have moved us; name the document by where it
+        // actually came from.
+        const finalUrl = upstream.url;
+        const pathname = finalUrl.pathname.toLowerCase();
+        let isHtml = false;
+        if (pathname.endsWith(".html") || pathname.endsWith(".htm")) {
+            isHtml = true;
+        }
+        else if (pathname.endsWith(".md") || pathname.endsWith(".markdown")) {
+            isHtml = false;
+        }
+        else if (contentType.includes("text/html") ||
+            contentType.includes("application/xhtml+xml")) {
+            isHtml = true;
+        }
+        else if (contentType.includes("text/markdown") ||
+            contentType.includes("text/x-markdown") ||
+            contentType.includes("text/plain")) {
+            isHtml = false;
+        }
+        else if (/<!doctype\s+html/i.test(rawContent) || /<html[\s>]/i.test(rawContent)) {
+            isHtml = true;
+        }
+        const defaultName = finalUrl.pathname.split("/").filter(Boolean).pop() || finalUrl.hostname;
+        let title;
+        if (isHtml) {
+            title = docTitle(rawContent, defaultName);
+        }
+        else {
+            const slides = parseSlides(rawContent);
+            title = deckTitle(slides, defaultName);
+        }
+        sendJson(res, {
+            kind: isHtml ? "html" : "markdown",
+            content: rawContent,
+            html: isHtml ? rawContent : undefined,
+            markdown: !isHtml ? rawContent : undefined,
+            title,
+        });
+        return true;
+    }
+    if (pathname === "/__present-doc" && req.method === "POST") {
+        const body = JSON.parse(await readBody(req));
+        const raw = body.html ?? "";
+        if (!raw.trim()) {
+            res.writeHead(422, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "empty document" }));
+            return true;
+        }
+        const theme = resolveThemeName(body.theme);
+        const title = docTitle(raw, body.title?.trim() || "deckrun");
+        const forPrint = body.print === true;
+        const docPath = stashDeck(raw);
+        const wrapperPath = stashDeck(generateDocHtml(docPath, title, forPrint ? false : mode.fullscreen, theme));
+        sendJson(res, { path: forPrint ? `${wrapperPath}&print=1` : wrapperPath, docPath });
+        return true;
+    }
+    if (pathname === "/__pdf-doc" && req.method === "POST") {
+        const body = JSON.parse(await readBody(req));
+        const raw = body.html ?? "";
+        if (!raw.trim()) {
+            res.writeHead(422, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "empty document" }));
+            return true;
+        }
+        const browser = await findBrowser();
+        if (!browser) {
+            res.writeHead(501, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({
+                error: "no browser",
+                detail: "No Chrome, Chromium, Edge, or Brave found. Set DECKRUN_BROWSER to one to export PDFs directly.",
+            }));
+            return true;
+        }
+        const title = docTitle(raw, body.title?.trim() || "deckrun");
+        // Print the raw doc directly, with no chrome wrapper: its own @page /
+        // print CSS (or Chrome's defaults) governs pagination, and there is no
+        // presenter chrome to strip since there is none in the printed page.
+        const docPath = stashDeck(raw);
+        try {
+            const pdf = await renderPdfSerial(`${mode.origin}${docPath}`, browser);
+            const filename = safeFilename(body.title?.trim() || title) + ".pdf";
+            res.writeHead(200, {
+                "Content-Type": "application/pdf",
+                "Content-Length": pdf.length,
+                "Content-Disposition": `attachment; filename="${filename}"`,
+                "Cache-Control": "no-store",
+            });
+            res.end(pdf);
+        }
+        catch (err) {
+            const detail = err instanceof PdfError ? err.message : "rendering failed";
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "render failed", detail }));
+        }
+        return true;
+    }
+    return false;
+}
+/**
+ * Whether a request's Host header names this server.
+ *
+ * Binding to 127.0.0.1 keeps other machines from *routing* to the server; it
+ * does not keep a remote page from *reaching* it. An attacker domain whose A
+ * record flips to 127.0.0.1 after the page loads becomes same-origin with
+ * deckrun, so every response the same-origin policy would otherwise hide
+ * becomes readable — and a same-origin GET carries no Origin header, so
+ * nothing else here would fire. Pinning Host to the names the server is
+ * actually reachable under is what closes DNS rebinding.
+ */
+function hostIsLocal(host, port) {
+    if (!host)
+        return false;
+    // A bracketed IPv6 literal, or host:port; the port is optional for :80.
+    const match = /^(\[[0-9a-f:.]+\]|[^:]+)(?::(\d+))?$/i.exec(host.trim());
+    if (!match)
+        return false;
+    const name = match[1].toLowerCase();
+    const given = match[2] ? parseInt(match[2], 10) : 80;
+    if (given !== port)
+        return false;
+    return name === "127.0.0.1" || name === "localhost" || name === "[::1]";
+}
+async function serve(mode, baseDir, port) {
+    const server = createServer(async (req, res) => {
+        try {
+            if (!hostIsLocal(req.headers.host, port)) {
+                res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
+                res.end("Forbidden: deckrun only answers requests addressed to localhost.");
+                return;
+            }
+            const rawUrl = req.url ?? "/";
+            const [rawPath, rawQuery = ""] = rawUrl.split("?");
+            const pathname = decodeURIComponent(rawPath);
+            const query = new URLSearchParams(rawQuery);
+            if (pathname === "/" || pathname === "/index.html") {
+                const wantsDeck = query.get("deck");
+                if (wantsDeck)
+                    serveStashedDeck(wantsDeck, res);
+                else
+                    sendHtml(res, generateEditorHtml(mode.theme, mode.fonts, mode.template, mode.transition, mode.file
+                        ? {
+                            name: mode.file.name,
+                            kind: mode.file.kind,
+                            writable: !!mode.file.path,
+                            watched: mode.file.watched,
+                        }
+                        : null, SESSION_TOKEN));
+                return;
+            }
+            if (pathname.startsWith("/__vendor/")) {
+                const asset = vendorAsset(pathname);
+                if (!asset) {
+                    res.writeHead(404, { "Content-Type": "text/plain" });
+                    res.end("Not found");
+                    return;
+                }
+                const data = await readFile(asset);
+                res.writeHead(200, {
+                    "Content-Type": getMime(asset),
+                    "Cache-Control": "public, max-age=31536000, immutable",
+                });
+                res.end(data);
+                return;
+            }
+            if (pathname.startsWith("/__") && await handleEditorRoute(mode, pathname, req, res, query, port)) {
+                return;
+            }
+            // Everything else comes off disk, relative to the working directory.
+            const filePath = resolve(baseDir, pathname.replace(/^\/+/, ""));
+            const fromBase = relative(baseDir, filePath);
+            if (isAbsolute(fromBase) || fromBase.startsWith("..") || !servableAsset(fromBase)) {
+                res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
+                res.end("Forbidden");
+                return;
+            }
+            const data = await readFile(filePath);
+            res.writeHead(200, { "Content-Type": getMime(filePath) });
+            res.end(data);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "error";
+            if (message === "request body too large") {
+                res.writeHead(413, { "Content-Type": "text/plain", Connection: "close" });
+                res.end(`Deck is larger than ${Math.round(MAX_BODY / 1024 / 1024)} MB.`);
+                req.destroy();
+                return;
+            }
+            if (!res.headersSent)
+                res.writeHead(404, { "Content-Type": "text/plain" });
+            res.end("Not found");
+        }
+    });
+    await new Promise((ready) => server.listen(port, "127.0.0.1", ready));
+    return `http://127.0.0.1:${port}`;
+}
+// ── CLI ───────────────────────────────────────────────────────────────────
+const program = new Command();
+program
+    .name("deckrun")
+    .description("Open a Markdown file, HTML file, or public URL in the built-in editor, and present from there. Run without an argument for a blank editor.")
+    .version(packageVersion(), "-v, --version", "Print the version number")
+    .argument("[file]", "Markdown file, HTML file, or public URL to open in the editor. Omit it for a blank editor.")
+    .option("-p, --port <number>", "Port to serve on", "7890")
+    .option("--no-open", "Do not automatically open the browser")
+    .option("--no-watch", "Do not watch the opened file for changes on disk")
+    .option("--fullscreen", "Auto-enter fullscreen on first interaction")
+    .option("--theme <name>", "Color theme, by id (see --list-themes)", DEFAULT_THEME)
+    .option("--head-font <name>", "Override the theme's heading face (see --list-fonts)")
+    .option("--body-font <name>", "Override the theme's body face (see --list-fonts)")
+    .option("--template <name>", "Composition template (see --list-templates)", DEFAULT_TEMPLATE)
+    .option("--transition <name>", "Slide transition (see --list-transitions)", DEFAULT_TRANSITION)
+    .option("--list-themes", "Print every theme and exit")
+    .option("--list-fonts", "Print every font face and exit")
+    .option("--list-templates", "Print every composition template and exit")
+    .option("--list-transitions", "Print every slide transition and exit")
+    .action(async (file, opts) => {
+    if (opts.listThemes) {
+        for (const line of themeListing())
+            console.log(line);
+        process.exit(0);
+    }
+    if (opts.listFonts) {
+        for (const line of fontListing())
+            console.log(line);
+        process.exit(0);
+    }
+    if (opts.listTemplates) {
+        for (const line of templateListing())
+            console.log(line);
+        process.exit(0);
+    }
+    if (opts.listTransitions) {
+        for (const line of transitionListing())
+            console.log(line);
+        process.exit(0);
+    }
+    const named = findTheme(opts.theme);
+    if (!named) {
+        console.error(`deckrun: unknown theme '${opts.theme}'. Run --list-themes to see them all.`);
+        process.exit(1);
+    }
+    const templated = findTemplate(opts.template);
+    if (!templated) {
+        console.error(`deckrun: unknown template '${opts.template}'. Run --list-templates to see them all.`);
+        process.exit(1);
+    }
+    const transitioned = findTransition(opts.transition);
+    if (!transitioned) {
+        console.error(`deckrun: unknown transition '${opts.transition}'. Run --list-transitions to see them all.`);
+        process.exit(1);
+    }
+    // Both face flags are optional; unset means the theme keeps its own.
+    const fonts = { head: null, body: null };
+    for (const [flag, slot] of [
+        ["--head-font", "head"],
+        ["--body-font", "body"],
+    ]) {
+        const raw = slot === "head" ? opts.headFont : opts.bodyFont;
+        if (raw === undefined)
+            continue;
+        const face = findFont(raw);
+        if (!face) {
+            console.error(`deckrun: unknown font '${raw}' for ${flag}. Run --list-fonts to see them all.`);
+            process.exit(1);
+        }
+        fonts[slot] = face;
+    }
+    const theme = named;
+    const template = templated;
+    const transition = transitioned;
+    const fullscreen = !!opts.fullscreen;
+    let mode;
+    let baseDir;
+    if (file) {
+        if (/^https?:\/\//i.test(file)) {
+            let target;
+            try {
+                target = new URL(file);
+            }
+            catch {
+                console.error(`deckrun: invalid URL '${file}'`);
+                process.exit(1);
+            }
+            let upstream;
+            try {
+                upstream = await fetch(target, {
+                    redirect: "follow",
+                    signal: AbortSignal.timeout(15_000),
+                    headers: { "User-Agent": "deckrun" },
+                });
+            }
+            catch (err) {
+                console.error(`deckrun: cannot fetch '${file}': ${err instanceof Error ? err.message : "network error"}`);
+                process.exit(1);
+            }
+            if (!upstream.ok) {
+                console.error(`deckrun: fetch failed for '${file}' (HTTP ${upstream.status})`);
+                process.exit(1);
+            }
+            const rawContent = await upstream.text();
+            if (!rawContent.trim()) {
+                console.error(`deckrun: empty document fetched from '${file}'`);
+                process.exit(1);
+            }
+            const contentType = (upstream.headers.get("content-type") ?? "").toLowerCase();
+            const pathname = target.pathname.toLowerCase();
+            let isHtml = false;
+            if (pathname.endsWith(".html") || pathname.endsWith(".htm")) {
+                isHtml = true;
+            }
+            else if (pathname.endsWith(".md") || pathname.endsWith(".markdown")) {
+                isHtml = false;
+            }
+            else if (contentType.includes("text/html") ||
+                contentType.includes("application/xhtml+xml")) {
+                isHtml = true;
+            }
+            else if (contentType.includes("text/markdown") ||
+                contentType.includes("text/x-markdown") ||
+                contentType.includes("text/plain")) {
+                isHtml = false;
+            }
+            else if (/<!doctype\s+html/i.test(rawContent) || /<html[\s>]/i.test(rawContent)) {
+                isHtml = true;
+            }
+            baseDir = process.cwd();
+            const defaultName = target.pathname.split("/").filter(Boolean).pop() || target.hostname;
+            // A fetched page is a one-shot import: it opens in the editor,
+            // held in memory, read-only toward its origin.
+            let editorFile;
+            if (isHtml) {
+                let docHtml = rawContent;
+                if (!/<base\s/i.test(docHtml)) {
+                    if (/<head[^>]*>/i.test(docHtml)) {
+                        docHtml = docHtml.replace(/<head[^>]*>/i, (m) => `${m}\n  <base href="${target.href}">`);
+                    }
+                    else {
+                        docHtml = `<base href="${target.href}">\n` + docHtml;
+                    }
+                }
+                editorFile = {
+                    name: docTitle(rawContent, defaultName),
+                    kind: "html",
+                    content: docHtml,
+                    watched: false,
+                };
+                console.log(`${c.dim}opening ${file} in the editor as an HTML doc${c.reset}`);
+            }
+            else {
+                const slides = parseSlides(rawContent);
+                editorFile = {
+                    name: defaultName,
+                    kind: "markdown",
+                    content: rawContent,
+                    watched: false,
+                };
+                console.log(`${c.dim}${slides.length} slide${slides.length !== 1 ? "s" : ""} from ${file} · opening in the editor${c.reset}`);
+            }
+            mode = { kind: "editor", theme, fonts, template, transition, fullscreen, file: editorFile };
+        }
+        else {
+            const absPath = resolve(process.cwd(), file);
+            baseDir = dirname(absPath);
+            const ext = extname(absPath).toLowerCase();
+            const kind = ext === ".html" || ext === ".htm" ? "html" : "markdown";
+            let raw;
+            try {
+                raw = readFileSync(absPath, "utf-8");
+            }
+            catch {
+                console.error(`deckrun: cannot read file '${file}'`);
+                process.exit(1);
+            }
+            mode = {
+                kind: "editor",
+                theme,
+                fonts,
+                template,
+                transition,
+                fullscreen,
+                file: { name: basename(absPath), kind, path: absPath, watched: opts.watch },
+            };
+            if (opts.watch)
+                watchSourceFile(absPath);
+            if (kind === "markdown") {
+                const slides = parseSlides(raw);
+                console.log(`${c.dim}${slides.length} slide${slides.length !== 1 ? "s" : ""} from ${basename(absPath)} · opening in the editor${c.reset}`);
+            }
+            else {
+                console.log(`${c.dim}opening ${basename(absPath)} in the editor as an HTML doc${c.reset}`);
+            }
+        }
+    }
+    else {
+        baseDir = process.cwd();
+        mode = { kind: "editor", theme, fonts, template, transition, fullscreen };
+    }
+    const port = await findFreePort(parseInt(opts.port, 10));
+    mode.origin = `http://127.0.0.1:${port}`;
+    const url = await serve(mode, baseDir, port);
+    console.log(`${c.bold}${c.magenta}editor${c.reset} ${c.dim}→${c.reset} ${c.cyan}${c.bold}${url}${c.reset}  ${c.dim}(Ctrl+C to stop)${c.reset}`);
+    if (mode.file?.path) {
+        console.log(`${c.dim}write on the left, live deck on the right. saves back to ${mode.file.name}.${c.reset}`);
+        if (mode.file.watched) {
+            console.log(`${c.dim}edits to ${mode.file.name} on disk reload the editor as well.${c.reset}`);
+        }
+    }
+    else {
+        console.log(`${c.dim}write on the left, live deck on the right. autosaves to your browser.${c.reset}`);
+    }
+    console.log(`${c.dim}Cmd/Ctrl+K inserts anything · template/theme controls recompose live · Cmd/Ctrl+Enter presents${c.reset}`);
+    if (opts.open !== false)
+        await open(url);
+    // Keep the process alive until interrupted.
+    await new Promise(() => { });
+});
+program
+    .command("lint")
+    .description("Check Markdown decks for common authoring and rendering problems")
+    .argument("<files...>", "Markdown files to check; use - to read standard input")
+    .option("--format <format>", "Output format: stylish or json", "stylish")
+    .option("--max-warnings <number>", "Warnings allowed before the command fails", "0")
+    .action((files, opts) => {
+    if (opts.format !== "stylish" && opts.format !== "json") {
+        console.error("deckrun lint: --format must be 'stylish' or 'json'.");
+        process.exitCode = 2;
+        return;
+    }
+    const maxWarnings = Number.parseInt(opts.maxWarnings, 10);
+    if (!Number.isInteger(maxWarnings) || maxWarnings < -1) {
+        console.error("deckrun lint: --max-warnings must be -1 or a non-negative integer.");
+        process.exitCode = 2;
+        return;
+    }
+    const reports = [];
+    for (const file of files) {
+        let markdown;
+        try {
+            markdown = file === "-" ? readFileSync(0, "utf-8") : readFileSync(resolve(process.cwd(), file), "utf-8");
+            if (markdown.length > MAX_LINT_INPUT) {
+                reports.push({
+                    file,
+                    slides: 0,
+                    errors: 1,
+                    warnings: 0,
+                    issues: [{
+                            rule: "file-too-large",
+                            severity: "error",
+                            message: `The file is larger than ${Math.round(MAX_LINT_INPUT / 1024 / 1024)} MB and was not checked.`,
+                            line: 1,
+                            column: 1,
+                        }],
+                });
+                continue;
+            }
+        }
+        catch {
+            reports.push({
+                file,
+                slides: 0,
+                errors: 1,
+                warnings: 0,
+                issues: [{
+                        rule: "file-read",
+                        severity: "error",
+                        message: "The file could not be read.",
+                        line: 1,
+                        column: 1,
+                    }],
+            });
+            continue;
+        }
+        const result = lintMarkdown(markdown);
+        reports.push({ file, ...result });
+    }
+    const errors = reports.reduce((sum, report) => sum + report.errors, 0);
+    const warnings = reports.reduce((sum, report) => sum + report.warnings, 0);
+    const issueCount = errors + warnings;
+    if (opts.format === "json") {
+        console.log(JSON.stringify({ files: reports, errors, warnings }, null, 2));
+    }
+    else {
+        for (const report of reports) {
+            if (!report.issues.length)
+                continue;
+            // Both the path and the message can carry text lifted out of a deck
+            // that someone else wrote, and this output is read in a CI job log.
+            console.log(`\n${sanitizeForTerminal(report.file, 500)}`);
+            for (const item of report.issues) {
+                const position = `${item.line}:${item.column}`.padEnd(9);
+                const severity = item.severity.padEnd(7);
+                const slide = item.slide ? `slide ${item.slide} · ` : "";
+                console.log(`  ${position} ${severity} ${slide}${sanitizeForTerminal(item.message, 300)}  ${item.rule}`);
+            }
+        }
+        if (issueCount === 0) {
+            const slides = reports.reduce((sum, report) => sum + report.slides, 0);
+            console.log(`✓ ${files.length} file${files.length === 1 ? "" : "s"}, ${slides} slide${slides === 1 ? "" : "s"}, no problems`);
+        }
+        else {
+            console.log(`\n✖ ${issueCount} problem${issueCount === 1 ? "" : "s"} (${errors} error${errors === 1 ? "" : "s"}, ${warnings} warning${warnings === 1 ? "" : "s"})`);
+        }
+    }
+    if (errors > 0 || (maxWarnings !== -1 && warnings > maxWarnings)) {
+        process.exitCode = 1;
+    }
+});
+program.parse(process.argv);