@energy8platform/golem 0.6.0 → 0.7.0

package/dist/lib/editor-entry.js

@@ -1,8 +1,8 @@
 // src/editor/server.ts
 import { createServer } from "node:http";
-import { readFile as readFile10, stat as stat3, readdir as readdir5, mkdir as mkdir7, open } from "node:fs/promises";
+import { readFile as readFile10, stat as stat4, readdir as readdir5, mkdir as mkdir7, open } from "node:fs/promises";
 import { watch as fsWatch } from "node:fs";
-import { resolve as resolve2, dirname as dirname9, basename as basename5, extname as extname2, sep, join as join10, relative as relative3 } from "node:path";
+import { resolve as resolve2, dirname as dirname9, basename as basename5, extname as extname2, sep as sep2, join as join10, relative as relative4 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/rig-format.ts
@@ -568,7 +568,7 @@ function parse(input) {
 // src/rig-api.ts
 import { z as z3 } from "zod";
 import { readFile as readFile9, writeFile as writeFile7, stat as stat2, mkdir as mkdir6, readdir as readdir4 } from "node:fs/promises";
-import { dirname as dirname8, join as join9, relative as relative2, isAbsolute } from "node:path";
+import { dirname as dirname8, join as join9, relative as relative3, isAbsolute as isAbsolute2 } from "node:path";
 
 // src/rig-io.ts
 import { mkdir, rename, rm, writeFile } from "node:fs/promises";
@@ -591,8 +591,10 @@ var saveJson = (path, value) => saveBytes(path, JSON.stringify(value, null, 2));
 // src/rig-queue.ts
 import { AsyncLocalStorage } from "node:async_hooks";
 import { resolve } from "node:path";
-var pending = /* @__PURE__ */ new Map();
-var active = new AsyncLocalStorage();
+var { pending, active } = globalThis[Symbol.for("golem.rigQueue")] ??= {
+  pending: /* @__PURE__ */ new Map(),
+  active: new AsyncLocalStorage()
+};
 async function withRigQueue(path, op) {
   const key = resolve(path);
   const held = active.getStore();
@@ -2008,8 +2010,9 @@ function createDoc(name, width, height, notes) {
 function createSymbol(name, asset, margin = 0.15, notes) {
   const mx = Math.ceil(asset.width * margin), my = Math.ceil(asset.height * margin);
   const width = asset.width + 2 * mx, height = asset.height + 2 * my;
-  const fromFile = asset.src.replace(/^.*\//, "").replace(/\.[^.]+$/, "").toLowerCase().replace(/[^a-z0-9_]/g, "_").replace(/^[^a-z]+/, "");
-  const id = asset.id ?? (fromFile || name);
+  const stem = asset.src.replace(/^.*\//, "").replace(/\.[^.]+$/, "").toLowerCase().replace(/[^a-z0-9_]/g, "_");
+  const fromFile = stem.replace(/^[^a-z]+/, "") || (stem ? `symbol_${stem}` : "");
+  const id = asset.id ?? (ID_RE.test(fromFile) ? fromFile : ID_RE.test(name) ? name : "symbol");
   let doc = createDoc(name, width, height, notes);
   doc = { ...doc, bones: [{ ...doc.bones[0], transform: { ...doc.bones[0].transform, x: width / 2, y: height - my } }] };
   doc = { ...doc, assets: [RigSchema.shape.assets.element.parse({ id, src: asset.src, width: asset.width, height: asset.height })] };
@@ -2765,7 +2768,7 @@ function setGoal(doc, bone, x, y, opts) {
 
 // src/rig-import-layers.ts
 import { readdir, readFile } from "node:fs/promises";
-import { join as join2, basename as basename2 } from "node:path";
+import { join as join2, basename as basename2, isAbsolute, relative, sep } from "node:path";
 var DEFAULT_PARENT = {
   head: "neck",
   neck: "torso",
@@ -2791,6 +2794,10 @@ function pngSize(buf) {
   if (buf.readUInt32BE(12) !== 1229472850) throw new Error("not a PNG (IHDR missing)");
   return [buf.readUInt32BE(16), buf.readUInt32BE(20)];
 }
+function outsideDir(dir, file) {
+  const r = relative(dir, join2(dir, file));
+  return isAbsolute(file) || r === ".." || r.startsWith(".." + sep);
+}
 async function importLayers(doc, dir, relPrefix = "layers") {
   let specs;
   try {
@@ -2803,6 +2810,7 @@ async function importLayers(doc, dir, relPrefix = "layers") {
   let next = doc;
   const parsed = [];
   for (const s of specs) {
+    if (outsideDir(dir, s.file)) throw new Error(`layers.json file "${s.file}" is outside the layers folder (${dir})`);
     const buf = await readFile(join2(dir, s.file));
     const [w, h] = pngSize(buf);
     const m = basename2(s.file, ".png").match(/^(?:(\d+)_)?(.+)$/);
@@ -4052,7 +4060,7 @@ async function buildAtlas(doc, assetsDir, outDir, opts = {}) {
 
 // src/spine-import.ts
 import { readFile as readFile7, stat, writeFile as writeFile5 } from "node:fs/promises";
-import { basename as basename4, dirname as dirname6, extname, join as join8, relative } from "node:path";
+import { basename as basename4, dirname as dirname6, extname, join as join8, relative as relative2 } from "node:path";
 
 // src/ktx2.ts
 import { readFile as readFile6 } from "node:fs/promises";
@@ -4201,13 +4209,13 @@ var Ids = class {
 var spineToDoc = (x, y, originX, originY) => [x + originX, originY - y];
 var r4 = (v) => Math.round(v * 1e6) / 1e6 + 0;
 var hex8 = (c) => `#${(c ?? "ffffffff").toLowerCase().padEnd(8, "f").slice(0, 8)}`;
-function importSpine(json, atlasText, opts = {}) {
+function importSpine(json2, atlasText, opts = {}) {
   const warnings = [];
   const atlas = parseAtlas(atlasText);
-  const version = String(json.skeleton?.spine ?? "4.0");
-  if (json.physics?.length) warnings.push(`${json.physics.length} Spine physics constraints are not imported; bake their motion before delivery`);
+  const version = String(json2.skeleton?.spine ?? "4.0");
+  if (json2.physics?.length) warnings.push(`${json2.physics.length} Spine physics constraints are not imported; bake their motion before delivery`);
   const major = parseFloat(version);
-  const bounds = { x: json.skeleton?.x ?? 0, y: json.skeleton?.y ?? 0, w: json.skeleton?.width ?? 0, h: json.skeleton?.height ?? 0 };
+  const bounds = { x: json2.skeleton?.x ?? 0, y: json2.skeleton?.y ?? 0, w: json2.skeleton?.width ?? 0, h: json2.skeleton?.height ?? 0 };
   const margin = opts.margin ?? 0;
   let originX = -bounds.x + margin, originY = bounds.y + bounds.h + margin;
   const toDoc = (x, y) => spineToDoc(x, y, originX, originY);
@@ -4224,7 +4232,7 @@ function importSpine(json, atlasText, opts = {}) {
     }
     return id;
   };
-  const spineBones = json.bones ?? [];
+  const spineBones = json2.bones ?? [];
   const boneIndexByName = new Map(spineBones.map((b, i) => [b.name, i]));
   const bones = [{ id: ROOT, transform: { x: r4(originX), y: r4(originY) }, role: "root" }];
   for (const b of spineBones) {
@@ -4237,7 +4245,7 @@ function importSpine(json, atlasText, opts = {}) {
       ...b.color ? { color: b.color } : {}
     });
   }
-  const skins = Array.isArray(json.skins) ? json.skins : Object.entries(json.skins ?? {}).map(([name, attachments2]) => ({ name, attachments: attachments2 }));
+  const skins = Array.isArray(json2.skins) ? json2.skins : Object.entries(json2.skins ?? {}).map(([name, attachments2]) => ({ name, attachments: attachments2 }));
   const selectedSkin = opts.skin ? skins.find((s) => s.name === opts.skin) : skins.find((s) => s.name === "default") ?? skins[0];
   if (opts.skin && !selectedSkin) throw new Error(`Spine skin "${opts.skin}" not found; available: ${skins.map((s) => s.name).join(", ")}`);
   const lookupSkins = [selectedSkin, skins.find((s) => s.name === "default")].filter((s, i, list) => s && list.indexOf(s) === i);
@@ -4261,7 +4269,7 @@ function importSpine(json, atlasText, opts = {}) {
     const resolved = skinnedName.get(`${slot} ${name}`);
     return resolved === void 0 ? null : attachmentId(slot, resolved);
   };
-  const spineSlots = json.slots ?? [];
+  const spineSlots = json2.slots ?? [];
   const slotIndexByName = new Map(spineSlots.map((s, i) => [s.name, i]));
   const blendOf = (b) => b === "additive" ? "add" : b === "multiply" ? "multiply" : b === "screen" ? "screen" : "normal";
   const slots = spineSlots.map((s, i) => ({
@@ -4427,7 +4435,7 @@ function importSpine(json, atlasText, opts = {}) {
     }
   }
   const activeConstraint = (kind, c) => !c.skin || lookupSkins.some((s) => s[kind]?.includes(c.name));
-  const ik = (json.ik ?? []).filter((c) => activeConstraint("ik", c)).map((c) => ({
+  const ik = (json2.ik ?? []).filter((c) => activeConstraint("ik", c)).map((c) => ({
     id: ikIds.get(c.name),
     order: c.order ?? 0,
     bones: c.bones.map((b) => boneIds.get(b)),
@@ -4440,7 +4448,7 @@ function importSpine(json, atlasText, opts = {}) {
     stretch: !!c.stretch,
     uniform: !!c.uniform
   }));
-  const transform = (json.transform ?? []).filter((c) => activeConstraint("transform", c)).map((c) => ({
+  const transform = (json2.transform ?? []).filter((c) => activeConstraint("transform", c)).map((c) => ({
     id: tcIds.get(c.name),
     order: c.order ?? 0,
     bones: c.bones.map((b) => boneIds.get(b)),
@@ -4460,7 +4468,7 @@ function importSpine(json, atlasText, opts = {}) {
     mixScaleY: c.mixScaleY ?? c.mixScaleX ?? c.scaleMix ?? 1,
     mixShearY: c.mixShearY ?? c.shearMix ?? 1
   }));
-  const path = (json.path ?? []).filter((c) => activeConstraint("path", c)).map((c) => ({
+  const path = (json2.path ?? []).filter((c) => activeConstraint("path", c)).map((c) => ({
     id: pcIds.get(c.name),
     order: c.order ?? 0,
     bones: c.bones.map((b) => boneIds.get(b)),
@@ -4514,7 +4522,7 @@ function importSpine(json, atlasText, opts = {}) {
     return keys;
   };
   const animations = [];
-  for (const [animName, a] of Object.entries(json.animations ?? {})) {
+  for (const [animName, a] of Object.entries(json2.animations ?? {})) {
     const tracks = [], events = [];
     let duration = 0;
     const seen = (frames) => {
@@ -4795,7 +4803,7 @@ function importSpine(json, atlasText, opts = {}) {
   const build = () => ({
     format: "energy8.rig",
     version: 2,
-    meta: { name: opts.name ?? json.skeleton?.hash ?? "spine", width, height, notes: opts.notes ?? `imported from Spine ${version}` },
+    meta: { name: opts.name ?? json2.skeleton?.hash ?? "spine", width, height, notes: opts.notes ?? `imported from Spine ${version}` },
     assets: [...assets.values()],
     bones,
     slots,
@@ -4848,7 +4856,7 @@ async function firstExisting(candidates, what) {
   throw new Error(`${what} not found, tried: ${candidates.join(", ")}`);
 }
 async function importSpineProject(opts) {
-  const json = JSON.parse(await readFile7(opts.json, "utf8"));
+  const json2 = JSON.parse(await readFile7(opts.json, "utf8"));
   const stem = opts.json.replace(/\.json$/i, "");
   const atlasPath = opts.atlas ?? await firstExisting([stem + ".atlas", stem + ".atlas.txt"], "atlas");
   const atlasText = await readFile7(atlasPath, "utf8");
@@ -4858,6 +4866,7 @@ async function importSpineProject(opts) {
   const rigDir = dirname6(opts.rigPath);
   const pagePaths = /* @__PURE__ */ new Map();
   for (const page2 of pages) {
+    if (!opts.image && outsideDir(dirname6(atlasPath), page2.name)) throw new Error(`atlas page "${page2.name}" is outside the atlas folder (${dirname6(atlasPath)})`);
     const pageStem = join8(dirname6(atlasPath), page2.name.replace(/\.[a-z0-9]+$/i, ""));
     const imagePath = opts.image ?? await firstExisting([join8(dirname6(atlasPath), page2.name), pageStem + ".png", pageStem + ".ktx2", ...pages.length === 1 ? [stem + ".png", stem + ".ktx2"] : []], `atlas page image ${page2.name}`);
     let pngPath = imagePath;
@@ -4870,10 +4879,10 @@ async function importSpineProject(opts) {
     }
     pagePaths.set(page2.name, pngPath);
   }
-  const pageImage = (page2) => relative(rigDir, pagePaths.get(page2)).split("\\").join("/");
+  const pageImage = (page2) => relative2(rigDir, pagePaths.get(page2)).split("\\").join("/");
   const name = opts.name ?? basename4(stem);
   const imagePaths = [...pagePaths.values()];
-  return { ...importSpine(json, atlasText, { name, skin: opts.skin, pageImage, margin: opts.margin, notes: opts.notes }), imagePath: imagePaths[0], imagePaths };
+  return { ...importSpine(json2, atlasText, { name, skin: opts.skin, pageImage, margin: opts.margin, notes: opts.notes }), imagePath: imagePaths[0], imagePaths };
 }
 
 // src/rig-templates.ts
@@ -5562,8 +5571,8 @@ async function load(path) {
 }
 var save = (path, doc) => saveJson(path, doc);
 var exists2 = (p) => stat2(p).then(() => true, () => false);
-var resolveFrom = (rigPath, p) => isAbsolute(p) ? p : join9(dirname8(rigPath), p);
-var srcFor = (rigPath, file) => relative2(dirname8(rigPath), file).split("\\").join("/");
+var resolveFrom = (rigPath, p) => isAbsolute2(p) ? p : join9(dirname8(rigPath), p);
+var srcFor = (rigPath, file) => relative3(dirname8(rigPath), file).split("\\").join("/");
 var libraryFor = (rigPath, lib) => lib ? resolveFrom(rigPath, lib) : join9(dirname8(rigPath), "presets.json");
 async function pngInfo(rigPath, file) {
   const abs = resolveFrom(rigPath, file);
@@ -5814,9 +5823,9 @@ tool(
     margin: z3.number().optional().describe("canvas margin around the skeleton bounds, px"),
     notes: z3.string().optional()
   },
-  async ({ path, json, atlas, image, name, skin: skin2, margin, notes }) => {
+  async ({ path, json: json2, atlas, image, name, skin: skin2, margin, notes }) => {
     try {
-      const r = await importSpineProject({ json: resolveFrom(path, json), atlas: atlas && resolveFrom(path, atlas), image: image && resolveFrom(path, image), rigPath: path, name, skin: skin2, margin, notes });
+      const r = await importSpineProject({ json: resolveFrom(path, json2), atlas: atlas && resolveFrom(path, atlas), image: image && resolveFrom(path, image), rigPath: path, name, skin: skin2, margin, notes });
       const res = await create(path, parse(r.doc));
       if (r.warnings.length) res.text += `
 warnings:
@@ -6588,40 +6597,41 @@ tool(
   }
 );
 
+// src/rig-version.ts
+import { stat as stat3 } from "node:fs/promises";
+async function rigVersion(abs) {
+  try {
+    const s = await stat3(abs);
+    return `${s.mtimeMs}:${s.size}`;
+  } catch {
+    return "missing";
+  }
+}
+
 // src/editor/server.ts
 var TYPES = { ".html": "text/html; charset=utf-8", ".js": "text/javascript", ".css": "text/css", ".map": "application/json", ".json": "application/json", ".png": "image/png", ".jpg": "image/jpeg", ".webp": "image/webp" };
-async function startEditorServer(opts) {
+var json = (res, status, body) => {
+  res.writeHead(status, { "content-type": "application/json" });
+  res.end(JSON.stringify(body));
+};
+function createEditorHandler(opts) {
   const root2 = resolve2(opts.root);
   const assets = resolve2(opts.assets ?? fileURLToPath3(new URL("../..", import.meta.url)));
   const inside = (rel) => {
     const abs = resolve2(root2, rel);
-    return abs === root2 || abs.startsWith(root2 + sep) ? abs : void 0;
-  };
-  const version = async (abs) => {
-    try {
-      const s = await stat3(abs);
-      return `${s.mtimeMs}:${s.size}`;
-    } catch {
-      return "missing";
-    }
+    return abs === root2 || abs.startsWith(root2 + sep2) ? abs : void 0;
   };
   const readDoc = async (abs) => RigDocument.parse(JSON.parse(await readFile10(abs, "utf8")));
   const readDocAt = async (abs) => {
-    let v = await version(abs);
+    let v = await rigVersion(abs);
     for (let i = 0; i < 3; i++) {
       const doc = await readDoc(abs);
-      const after = await version(abs);
+      const after = await rigVersion(abs);
       if (after === v) return { doc, version: v };
       v = after;
     }
     return { doc: await readDoc(abs), version: v };
   };
-  const json = (res, status, body2) => {
-    res.writeHead(status, { "content-type": "application/json" });
-    res.end(JSON.stringify(body2));
-  };
-  let allowedHosts = /* @__PURE__ */ new Set();
-  const hostOk = (req) => allowedHosts.has(String(req.headers.host ?? "").toLowerCase());
   const clients = /* @__PURE__ */ new Map();
   const watchers = /* @__PURE__ */ new Map();
   function ensureWatch(abs) {
@@ -6633,7 +6643,7 @@ async function startEditorServer(opts) {
     const schedule = () => {
       clearTimeout(entry.timer);
       entry.timer = setTimeout(async () => {
-        const v = await version(abs);
+        const v = await rigVersion(abs);
         if (v === entry.last) return;
         entry.last = v;
         for (const res of clients.get(abs) ?? []) res.write(`event: changed
@@ -6642,7 +6652,7 @@ data: ${JSON.stringify({ version: v })}
 `);
       }, 50);
     };
-    version(abs).then((v) => {
+    rigVersion(abs).then((v) => {
       entry.last = v;
     });
     watchers.set(abs, entry);
@@ -6668,7 +6678,7 @@ data: ${JSON.stringify({ version: v })}
           name = String(JSON.parse(await readFile10(abs, "utf8")).meta?.name ?? "?");
         } catch {
         }
-        out.push({ rig: relative3(root2, abs).split(sep).join("/"), name, mtimeMs: (await stat3(abs)).mtimeMs });
+        out.push({ rig: relative4(root2, abs).split(sep2).join("/"), name, mtimeMs: (await stat4(abs)).mtimeMs });
       }
     };
     await walk(root2);
@@ -6702,20 +6712,22 @@ data: ${JSON.stringify({ version: v })}
     }
     return Buffer.concat(chunks);
   }
-  const server = createServer(async (req, res) => {
+  async function handle(req, res, rawUrl = req.url ?? "/") {
     try {
-      if (!hostOk(req)) return json(res, 403, { isError: true, text: `ERROR: forbidden Host "${req.headers.host ?? ""}" \u2014 this server answers only on 127.0.0.1 / localhost` });
-      const url = new URL(req.url ?? "/", "http://x");
+      const url = new URL(rawUrl, "http://x");
       if (url.pathname === "/") {
-        res.writeHead(302, { location: "/editor.html" + url.search });
-        return res.end();
+        res.writeHead(302, { location: "editor.html" + url.search });
+        return void res.end();
+      }
+      if (url.pathname.startsWith("/api/")) {
+        await api(url, req, res);
+        return;
       }
-      if (url.pathname.startsWith("/api/")) return await api(url, req, res);
       const STATIC = /* @__PURE__ */ new Set(["/editor.html", "/dist/editor.js", "/dist/editor.js.map", "/dist/editor.css", "/dist/editor.css.map"]);
       const abs = url.pathname.startsWith("/rig/") ? inside(decodeURIComponent(url.pathname.slice(5))) : STATIC.has(url.pathname) ? join10(assets, url.pathname) : void 0;
       if (!abs) {
         res.writeHead(403);
-        return res.end("forbidden");
+        return void res.end("forbidden");
       }
       try {
         const data = await readFile10(abs);
@@ -6733,7 +6745,7 @@ data: ${JSON.stringify({ version: v })}
       }
       json(res, 500, { isError: true, text: `ERROR: ${e.message}` });
     }
-  });
+  }
   async function api(url, req, res) {
     const rigOf = (rel) => {
       if (!rel) return void 0;
@@ -6750,7 +6762,7 @@ data: ${JSON.stringify({ version: v })}
         res.writeHead(403);
         return res.end();
       }
-      if (!await stat3(abs).then(() => true, () => false)) return json(res, 404, { isError: true, text: `ERROR: ${url.searchParams.get("rig")} does not exist under ${root2}` });
+      if (!await stat4(abs).then(() => true, () => false)) return json(res, 404, { isError: true, text: `ERROR: ${url.searchParams.get("rig")} does not exist under ${root2}` });
       ensureWatch(abs);
       res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-cache", connection: "keep-alive" });
       res.write(`: connected
@@ -6772,7 +6784,7 @@ data: ${JSON.stringify({ version: v })}
       if (!abs) return json(res, 403, { isError: true, text: "rig outside root" });
       ensureWatch(abs);
       return await withRigQueue(abs, async () => {
-        if (baseVersion !== void 0 && await version(abs) !== baseVersion) {
+        if (baseVersion !== void 0 && await rigVersion(abs) !== baseVersion) {
           const at = await readDocAt(abs);
           return json(res, 409, {
             isError: true,
@@ -6781,8 +6793,15 @@ data: ${JSON.stringify({ version: v })}
             text: `ERROR: the rig changed on disk (expected ${baseVersion}, found ${at.version}); nothing was written`
           });
         }
-        const r = await callTool(url.pathname.slice(10), { ...args ?? {}, path: abs });
-        return json(res, 200, { text: r.text, doc: r.doc, image: r.image?.toString("base64"), isError: r.isError, version: await version(abs) });
+        const tool2 = url.pathname.slice(10);
+        let given = { ...args ?? {}, path: abs };
+        try {
+          if (opts.args) given = opts.args(tool2, given);
+        } catch (e) {
+          return json(res, 400, { isError: true, text: `ERROR: ${e instanceof Error ? e.message : String(e)}` });
+        }
+        const r = await callTool(tool2, given);
+        return json(res, 200, { text: r.text, doc: r.doc, image: r.image?.toString("base64"), isError: r.isError, version: await rigVersion(abs) });
       });
     }
     if (url.pathname === "/api/rigs" && req.method === "GET") return json(res, 200, await listRigs());
@@ -6793,11 +6812,11 @@ data: ${JSON.stringify({ version: v })}
       if (typeof rig !== "string" || !/(^|\/)rig\.json$/.test(rig)) return json(res, 400, { isError: true, text: "ERROR: a project is a directory with a rig.json \u2014 the path must end with /rig.json" });
       const abs = inside(rig);
       if (!abs) return json(res, 403, { isError: true, text: "rig outside root" });
-      if (await stat3(abs).then(() => true, () => false)) return json(res, 409, { isError: true, text: `ERROR: ${rig} already exists \u2014 open it, or pick another directory` });
+      if (await stat4(abs).then(() => true, () => false)) return json(res, 409, { isError: true, text: `ERROR: ${rig} already exists \u2014 open it, or pick another directory` });
       await mkdir7(dirname9(abs), { recursive: true });
       const r = await callTool("rig_create", { path: abs, name: name ?? basename5(dirname9(abs)), width: width ?? 640, height: height ?? 700 });
       ensureWatch(abs);
-      return json(res, r.isError ? 400 : 200, { text: r.text, doc: r.doc, isError: r.isError, version: await version(abs) });
+      return json(res, r.isError ? 400 : 200, { text: r.text, doc: r.doc, isError: r.isError, version: await rigVersion(abs) });
     }
     if (url.pathname === "/api/files" && req.method === "GET") {
       const abs = rigOf(url.searchParams.get("rig"));
@@ -6811,8 +6830,8 @@ data: ${JSON.stringify({ version: v })}
       if (!/^[A-Za-z0-9._-]+\.png$/i.test(name) || name.startsWith(".")) return json(res, 400, { isError: true, text: `ERROR: bad file name "${name}" \u2014 letters, digits, . _ - and a .png extension` });
       if (!String(req.headers["content-type"] ?? "").toLowerCase().startsWith("image/png")) return json(res, 415, { isError: true, text: "ERROR: upload needs content-type: image/png" });
       const target = join10(dirname9(abs), name);
-      if (!inside(relative3(root2, target))) return json(res, 403, { isError: true, text: "file outside root" });
-      if (await stat3(target).then(() => true, () => false)) return json(res, 409, { isError: true, text: `ERROR: ${name} already exists next to the rig \u2014 rename the file` });
+      if (!inside(relative4(root2, target))) return json(res, 403, { isError: true, text: "file outside root" });
+      if (await stat4(target).then(() => true, () => false)) return json(res, 409, { isError: true, text: `ERROR: ${name} already exists next to the rig \u2014 rename the file` });
       const data = await bytes(req, UPLOAD_MAX);
       if (!data) return json(res, 413, { isError: true, text: `ERROR: ${name} is larger than ${UPLOAD_MAX / 1048576} MB` });
       let size;
@@ -6826,6 +6845,22 @@ data: ${JSON.stringify({ version: v })}
     }
     json(res, 404, { isError: true, text: "unknown api route" });
   }
+  return { handle, close() {
+    for (const w of watchers.values()) {
+      clearTimeout(w.timer);
+      w.w.close();
+    }
+    for (const set of clients.values()) for (const c of set) c.end();
+  } };
+}
+async function startEditorServer(opts) {
+  const editor = createEditorHandler(opts);
+  let allowedHosts = /* @__PURE__ */ new Set();
+  const server = createServer((req, res) => {
+    if (!allowedHosts.has(String(req.headers.host ?? "").toLowerCase()))
+      return json(res, 403, { isError: true, text: `ERROR: forbidden Host "${req.headers.host ?? ""}" \u2014 this server answers only on 127.0.0.1 / localhost` });
+    void editor.handle(req, res);
+  });
   await new Promise((ok, fail2) => {
     server.once("error", fail2);
     server.listen(opts.port ?? 8765, "127.0.0.1", () => {
@@ -6836,15 +6871,12 @@ data: ${JSON.stringify({ version: v })}
   const port = server.address().port;
   allowedHosts = /* @__PURE__ */ new Set([`127.0.0.1:${port}`, `localhost:${port}`, `[::1]:${port}`]);
   return { port, url: `http://127.0.0.1:${port}`, close: async () => {
-    for (const w of watchers.values()) {
-      clearTimeout(w.timer);
-      w.w.close();
-    }
-    for (const set of clients.values()) for (const c of set) c.end();
+    editor.close();
     await new Promise((r) => server.close(() => r()));
   } };
 }
 export {
+  createEditorHandler,
   startEditorServer
 };
 //# sourceMappingURL=editor-entry.js.map