npm - @evomap/evolver-webui - Versions diffs - 2.0.0-beta.0 - Mend

@evomap/evolver-webui 2.0.0-beta.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7) hide show

package/dist/console.d.ts ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ /** 3 栏主控台 HTML(自包含, 无构建步; 轮询 /api/* 渲染). 军杰 §9.5: Triggers｜Timeline｜Inspector. */
2	+ export declare const CONSOLE_HTML = "<!doctype html><html lang=\"zh\"><head><meta charset=\"utf-8\"><title>Evolver \u63A7\u53F0</title>\n<style>\n*{box-sizing:border-box}body{margin:0;font:13px/1.5 ui-monospace,Menlo,monospace;background:#0d1117;color:#c9d1d9}\nheader{padding:8px 12px;background:#161b22;border-bottom:1px solid #30363d;display:flex;gap:16px;align-items:center}\nheader b{color:#58a6ff}.muted{color:#8b949e}\n.cols{display:grid;grid-template-columns:1fr 1fr 1.2fr;height:calc(100vh - 42px)}\n.col{overflow:auto;border-right:1px solid #30363d;padding:8px}\nh2{font-size:12px;text-transform:uppercase;color:#8b949e;margin:4px 0 8px;letter-spacing:.05em}\n.row{padding:6px 8px;border:1px solid #30363d;border-radius:6px;margin-bottom:6px;cursor:pointer}\n.row:hover{border-color:#58a6ff}.tag{display:inline-block;padding:0 6px;border-radius:10px;font-size:11px}\n.ok{background:#1a3d1a;color:#6fdd6f}.fail{background:#3d1a1a;color:#ff7b72}.warn{background:#3d3a1a;color:#e3b341}\n.act{display:flex;gap:6px;margin-top:8px}button{background:#21262d;color:#c9d1d9;border:1px solid #30363d;border-radius:6px;padding:4px 8px;cursor:pointer}\nbutton:hover{border-color:#58a6ff}pre{white-space:pre-wrap;word-break:break-all;background:#161b22;padding:8px;border-radius:6px}\n.valuecard{padding:10px 14px;background:#11161d;border-bottom:1px solid #30363d;display:flex;gap:24px;align-items:center;flex-wrap:wrap}\n.valuecard .big{font-size:18px;color:#6fdd6f;font-weight:600}.valuecard .est{color:#e3b341}.valuecard .lbl{color:#8b949e;font-size:11px;text-transform:uppercase;letter-spacing:.05em}\n</style></head><body>\n<header><b>EVOLVER</b> <span id=\"stat\" class=\"muted\">\u2026</span><span id=\"daily\" class=\"muted\"></span></header>\n<div class=\"valuecard\" id=\"valuecard\"><span class=\"muted\">\u4EF7\u503C / value \u2026</span></div>\n<div class=\"valuecard\" id=\"reviewqueue\"><span class=\"muted\">review queue \u2026</span></div>\n<div class=\"cols\">\n <div class=\"col\"><h2>Triggers</h2><div id=\"triggers\"></div></div>\n <div class=\"col\"><h2>Now & Timeline</h2><div id=\"cycles\"></div></div>\n <div class=\"col\"><h2>Inspector</h2><div id=\"inspector\" class=\"muted\">\u9009\u4E00\u4E2A cycle \u6216\u4E8B\u4EF6</div>\n <div class=\"act\"><button onclick=\"act('observe')\">Observe</button><button onclick=\"act('nudge')\">Nudge</button><button onclick=\"act('intervene')\">Intervene</button><button onclick=\"act('teach')\">Teach</button></div>\n </div>\n</div>\n<script>\nlet sel=null;\nconst TOK=new URLSearchParams(location.search).get('token')\|\|'';\nasync function j(u,o){o=o\|\|{};o.headers=Object.assign({},o.headers\|\|{},{authorization:'Bearer '+TOK});const r=await fetch(u,o);return r.json()}\n// XSS guards (#200): server data (gene summaries / event titles / payloads) is built from untrusted material \u2014\n// never put it into innerHTML raw. esc() = HTML-text escape (numeric entities) for text positions; q() strips a\n// value to the content-addressed id charset for inline-handler string args so a malicious id cannot break the\n// attribute/JS string. Every dynamic value below goes through one of these before reaching innerHTML.\nconst esc=s=>String(s==null?'':s).replace(/[&<>\"']/g,c=>'&#'+c.charCodeAt(0)+';');\nconst q=s=>String(s==null?'':s).replace(/[^a-zA-Z0-9:_.-]/g,'');\nasync function refresh(){\n const s=await j('/api/status');document.getElementById('stat').textContent='events='+s.totalEvents+' cycles='+s.cycles;\n const d=await j('/api/daily-summary');document.getElementById('daily').textContent='\u4ECA\u65E5 '+d.solidified+'\u2713/'+d.failed+'\u2717 \u89E6\u53D1'+d.triggered;\n const v=await j('/api/value?window=7d');const nf=n=>Math.round(n\|\|0).toLocaleString('en-US');\n const top=(v.topGenes\|\|[]).slice(0,3).map(g=>esc(g.assetId)+' \u00D7'+esc(g.reuses)).join(' \u00B7 ')\|\|'\u2014';\n document.getElementById('valuecard').innerHTML=\n '<div><div class=\"lbl\">measured saved (7d)</div><span class=\"big\">'+nf(v.totalTokensSaved)+' tokens</span> <span class=\"muted\">$'+(v.totalCostUsd\|\|0).toFixed(4)+'</span></div>'\n +'<div><div class=\"lbl\">estimated</div><span class=\"est\">'+nf(v.estimated&&v.estimated.totalTokensSaved)+' tokens</span> <span class=\"muted\">(tracked separately)</span></div>'\n +'<div><div class=\"lbl\">top reused</div><span class=\"muted\">'+top+'</span></div>';\n const rv=await j('/api/review');const stag=s=>s==='quarantined'?'warn':s==='approved'?'ok':s==='rejected'?'fail':'muted';\n const pend=rv.filter(g=>g.state==='quarantined').length;\n const btns=g=>g.state==='quarantined'?' <button onclick=\"reviewAct(\\''+q(g.assetId)+'\\',\\'approve\\')\">Approve</button><button onclick=\"reviewAct(\\''+q(g.assetId)+'\\',\\'reject\\')\">Reject</button>':'';\n document.getElementById('reviewqueue').innerHTML='<div><div class=\"lbl\">review queue</div><span class=\"big\">'+pend+'</span> <span class=\"muted\">\u5F85\u5BA1 pending</span></div>'\n +rv.slice(0,8).map(g=>'<div><span class=\"tag '+stag(g.state)+'\">'+esc(g.state)+'</span> '+esc(g.geneId)+(g.autoDrafted?' <span class=\"muted\">auto</span>':'')+btns(g)+'</div>').join('');\n const tr=await j('/api/triggers');document.getElementById('triggers').innerHTML=tr.map(t=>'<div class=\"row\"><span class=\"tag '+(t.triggered?'ok':'warn')+'\">'+(t.triggered?'\u89E6\u53D1':'\u6291\u5236')+'</span> '+esc(t.patternId)+' <span class=\"muted\">v='+((t.value\|\|0).toFixed?t.value.toFixed(2):esc(t.value))+'</span></div>').join('')\|\|'<div class=\"muted\">\u65E0</div>';\n const cs=await j('/api/cycles');document.getElementById('cycles').innerHTML=cs.slice(-30).reverse().map(c=>'<div class=\"row\" onclick=\"showCycle(\\''+q(c.cycleId)+'\\')\"><span class=\"tag '+(c.finalStage==='solidified'?'ok':c.finalStage==='failed'?'fail':'warn')+'\">'+esc(c.finalStage)+'</span> '+esc(c.cycleId)+' <span class=\"muted\">('+esc(c.events)+')</span></div>').join('')\|\|'<div class=\"muted\">\u65E0 cycle</div>';\n}\nasync function showCycle(id){sel=id;const t=await j('/api/cycle?id='+encodeURIComponent(id));\n document.getElementById('inspector').innerHTML='<b>'+esc(id)+'</b>'+t.timeline.map(e=>'<div class=\"row\">#'+esc(e.seq)+' <b>'+esc(e.type)+'</b><br>'+esc(e.title)+(e.why?'<br><span class=\"muted\">why: '+esc(e.why)+'</span>':'')+(e.payload?'<pre>'+esc(JSON.stringify(e.payload,null,1))+'</pre>':'')+'</div>').join('');\n}\nasync function reviewAct(gene,action){const reason=prompt(action+' \u7406\u7531 reason:');if(reason===null)return;\n try{const r=await j('/api/review',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({gene,action,reason})});\n if(!r\|\|r.ok!==true){alert('review \u5931\u8D25 failed: '+((r&&r.error)\|\|'unknown'));return;}}\n catch(e){alert('review \u5931\u8D25 failed: '+e);return;}\n refresh();}\nasync function act(kind){const note=prompt(kind+' \u5907\u6CE8:');if(note===null)return;\n await j('/api/action',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({action:kind,title:kind+(sel?(' @'+sel):''),note,cycleId:sel})});refresh();}\nrefresh();setInterval(refresh,4000);\n</script></body></html>";

package/dist/console.js ADDED Viewed

@@ -0,0 +1,66 @@
+/** 3 栏主控台 HTML(自包含, 无构建步; 轮询 /api/* 渲染). 军杰 §9.5: Triggers｜Timeline｜Inspector. */
+export const CONSOLE_HTML = `<!doctype html><html lang="zh"><head><meta charset="utf-8"><title>Evolver 控台</title>
+<style>
+*{box-sizing:border-box}body{margin:0;font:13px/1.5 ui-monospace,Menlo,monospace;background:#0d1117;color:#c9d1d9}
+header{padding:8px 12px;background:#161b22;border-bottom:1px solid #30363d;display:flex;gap:16px;align-items:center}
+header b{color:#58a6ff}.muted{color:#8b949e}
+.cols{display:grid;grid-template-columns:1fr 1fr 1.2fr;height:calc(100vh - 42px)}
+.col{overflow:auto;border-right:1px solid #30363d;padding:8px}
+h2{font-size:12px;text-transform:uppercase;color:#8b949e;margin:4px 0 8px;letter-spacing:.05em}
+.row{padding:6px 8px;border:1px solid #30363d;border-radius:6px;margin-bottom:6px;cursor:pointer}
+.row:hover{border-color:#58a6ff}.tag{display:inline-block;padding:0 6px;border-radius:10px;font-size:11px}
+.ok{background:#1a3d1a;color:#6fdd6f}.fail{background:#3d1a1a;color:#ff7b72}.warn{background:#3d3a1a;color:#e3b341}
+.act{display:flex;gap:6px;margin-top:8px}button{background:#21262d;color:#c9d1d9;border:1px solid #30363d;border-radius:6px;padding:4px 8px;cursor:pointer}
+button:hover{border-color:#58a6ff}pre{white-space:pre-wrap;word-break:break-all;background:#161b22;padding:8px;border-radius:6px}
+.valuecard{padding:10px 14px;background:#11161d;border-bottom:1px solid #30363d;display:flex;gap:24px;align-items:center;flex-wrap:wrap}
+.valuecard .big{font-size:18px;color:#6fdd6f;font-weight:600}.valuecard .est{color:#e3b341}.valuecard .lbl{color:#8b949e;font-size:11px;text-transform:uppercase;letter-spacing:.05em}
+</style></head><body>
+<header><b>EVOLVER</b> <span id="stat" class="muted">…</span><span id="daily" class="muted"></span></header>
+<div class="valuecard" id="valuecard"><span class="muted">价值 / value …</span></div>
+<div class="valuecard" id="reviewqueue"><span class="muted">review queue …</span></div>
+<div class="cols">
+ <div class="col"><h2>Triggers</h2><div id="triggers"></div></div>
+ <div class="col"><h2>Now &amp; Timeline</h2><div id="cycles"></div></div>
+ <div class="col"><h2>Inspector</h2><div id="inspector" class="muted">选一个 cycle 或事件</div>
+   <div class="act"><button onclick="act('observe')">Observe</button><button onclick="act('nudge')">Nudge</button><button onclick="act('intervene')">Intervene</button><button onclick="act('teach')">Teach</button></div>
+ </div>
+</div>
+<script>
+let sel=null;
+const TOK=new URLSearchParams(location.search).get('token')||'';
+async function j(u,o){o=o||{};o.headers=Object.assign({},o.headers||{},{authorization:'Bearer '+TOK});const r=await fetch(u,o);return r.json()}
+// XSS guards (#200): server data (gene summaries / event titles / payloads) is built from untrusted material —
+// never put it into innerHTML raw. esc() = HTML-text escape (numeric entities) for text positions; q() strips a
+// value to the content-addressed id charset for inline-handler string args so a malicious id cannot break the
+// attribute/JS string. Every dynamic value below goes through one of these before reaching innerHTML.
+const esc=s=>String(s==null?'':s).replace(/[&<>"']/g,c=>'&#'+c.charCodeAt(0)+';');
+const q=s=>String(s==null?'':s).replace(/[^a-zA-Z0-9:_.-]/g,'');
+async function refresh(){
+ const s=await j('/api/status');document.getElementById('stat').textContent='events='+s.totalEvents+' cycles='+s.cycles;
+ const d=await j('/api/daily-summary');document.getElementById('daily').textContent='今日 '+d.solidified+'✓/'+d.failed+'✗ 触发'+d.triggered;
+ const v=await j('/api/value?window=7d');const nf=n=>Math.round(n||0).toLocaleString('en-US');
+ const top=(v.topGenes||[]).slice(0,3).map(g=>esc(g.assetId)+' ×'+esc(g.reuses)).join(' · ')||'—';
+ document.getElementById('valuecard').innerHTML=
+   '<div><div class="lbl">measured saved (7d)</div><span class="big">'+nf(v.totalTokensSaved)+' tokens</span> <span class="muted">$'+(v.totalCostUsd||0).toFixed(4)+'</span></div>'
+   +'<div><div class="lbl">estimated</div><span class="est">'+nf(v.estimated&&v.estimated.totalTokensSaved)+' tokens</span> <span class="muted">(tracked separately)</span></div>'
+   +'<div><div class="lbl">top reused</div><span class="muted">'+top+'</span></div>';
+ const rv=await j('/api/review');const stag=s=>s==='quarantined'?'warn':s==='approved'?'ok':s==='rejected'?'fail':'muted';
+ const pend=rv.filter(g=>g.state==='quarantined').length;
+ const btns=g=>g.state==='quarantined'?' <button onclick="reviewAct(\\''+q(g.assetId)+'\\',\\'approve\\')">Approve</button><button onclick="reviewAct(\\''+q(g.assetId)+'\\',\\'reject\\')">Reject</button>':'';
+ document.getElementById('reviewqueue').innerHTML='<div><div class="lbl">review queue</div><span class="big">'+pend+'</span> <span class="muted">待审 pending</span></div>'
+   +rv.slice(0,8).map(g=>'<div><span class="tag '+stag(g.state)+'">'+esc(g.state)+'</span> '+esc(g.geneId)+(g.autoDrafted?' <span class="muted">auto</span>':'')+btns(g)+'</div>').join('');
+ const tr=await j('/api/triggers');document.getElementById('triggers').innerHTML=tr.map(t=>'<div class="row"><span class="tag '+(t.triggered?'ok':'warn')+'">'+(t.triggered?'触发':'抑制')+'</span> '+esc(t.patternId)+' <span class="muted">v='+((t.value||0).toFixed?t.value.toFixed(2):esc(t.value))+'</span></div>').join('')||'<div class="muted">无</div>';
+ const cs=await j('/api/cycles');document.getElementById('cycles').innerHTML=cs.slice(-30).reverse().map(c=>'<div class="row" onclick="showCycle(\\''+q(c.cycleId)+'\\')"><span class="tag '+(c.finalStage==='solidified'?'ok':c.finalStage==='failed'?'fail':'warn')+'">'+esc(c.finalStage)+'</span> '+esc(c.cycleId)+' <span class="muted">('+esc(c.events)+')</span></div>').join('')||'<div class="muted">无 cycle</div>';
+}
+async function showCycle(id){sel=id;const t=await j('/api/cycle?id='+encodeURIComponent(id));
+ document.getElementById('inspector').innerHTML='<b>'+esc(id)+'</b>'+t.timeline.map(e=>'<div class="row">#'+esc(e.seq)+' <b>'+esc(e.type)+'</b><br>'+esc(e.title)+(e.why?'<br><span class="muted">why: '+esc(e.why)+'</span>':'')+(e.payload?'<pre>'+esc(JSON.stringify(e.payload,null,1))+'</pre>':'')+'</div>').join('');
+}
+async function reviewAct(gene,action){const reason=prompt(action+' 理由 reason:');if(reason===null)return;
+ try{const r=await j('/api/review',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({gene,action,reason})});
+  if(!r||r.ok!==true){alert('review 失败 failed: '+((r&&r.error)||'unknown'));return;}}
+ catch(e){alert('review 失败 failed: '+e);return;}
+ refresh();}
+async function act(kind){const note=prompt(kind+' 备注:');if(note===null)return;
+ await j('/api/action',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({action:kind,title:kind+(sel?(' @'+sel):''),note,cycleId:sel})});refresh();}
+refresh();setInterval(refresh,4000);
+</script></body></html>`;

package/dist/index.d.ts ADDED Viewed

@@ -0,0 +1,3 @@
+export declare const PACKAGE = "@evomap/evolver-webui";
+export * from './server.js';
+export { CONSOLE_HTML } from './console.js';

package/dist/index.js ADDED Viewed

@@ -0,0 +1,3 @@
+export const PACKAGE = '@evomap/evolver-webui';
+export * from './server.js';
+export { CONSOLE_HTML } from './console.js';

package/dist/server.d.ts ADDED Viewed

@@ -0,0 +1,43 @@
+import { events as ev, assetstore, mailbox as mb, ops } from '@evomap/evolver-core';
+export interface WebUIServerDeps {
+    eventsPath: string;
+    ingestor?: ev.Ingestor;
+    store?: assetstore.AssetStoreProvider;
+    /** 人审队列用的 review ledger(#117 人审门）。缺省由 LocalJsonlProvider store 的 baseDir 推导。 */
+    review?: assetstore.ReviewLedger;
+    mailbox?: mb.MailboxStore;
+    now?: () => number;
+    host?: string;
+    /** 人工操作记的 actor id. */
+    actorId?: string;
+    /** Bearer token required for all /api/* routes; auto-generated if absent. Loopback alone is not an
+     *  auth boundary on shared hosts. The launcher prints it; the console gets it via the ?token= URL param. */
+    token?: string;
+    /** Value-card data provider (#113). Injected by the composition layer wired to ops.loadValueSummary over the
+     *  proxy traces + root_events + the adapter's price table — the WebUI stays a THIN shell (it never prices or
+     *  re-derives savings; M7 克制). Absent → /api/value reports an empty summary instead of failing. */
+    valueSummary?: (window: ops.SummaryWindow) => ops.ValueSummary;
+}
+/**
+ * WebUI 控台(M7): 可观测 + 保活. node:http + 自包含 HTML, 仅绑 loopback.
+ * 复用 core events/reports 报表 + assetstore + mailbox; 人工操作 Observe/Nudge/Intervene/Teach 走 ingest(actor.kind=human).
+ */
+export declare class WebUIServer {
+    private readonly deps;
+    private readonly server;
+    private readonly ingestor;
+    private readonly host;
+    private readonly now;
+    private readonly actorId;
+    /** Review ledger backing the human-review queue. Undefined when no LocalJsonlProvider store is available. */
+    private readonly review;
+    /** Token guarding /api/*; printed by the launcher, supplied by the browser via ?token= or Bearer. */
+    readonly token: string;
+    constructor(deps: WebUIServerDeps);
+    listen(port?: number): Promise<number>;
+    close(): Promise<void>;
+    private handle;
+    private readJson;
+    private json;
+    private send;
+}

package/dist/server.js ADDED Viewed

@@ -0,0 +1,204 @@
+import { createServer } from 'node:http';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { events as ev, assetstore, mailbox as mb, ops } from '@evomap/evolver-core';
+import { CONSOLE_HTML } from './console.js';
+const LOOPBACK = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1']);
+/** The empty value summary (zero entries) — the shape /api/value returns when no provider is wired, so the card
+ *  always gets a valid ValueSummary to render. Derived from core's aggregator to stay shape-identical. */
+const EMPTY_VALUE_SUMMARY = ops.valueSummary([]);
+/** Constant-time token compare (avoids leaking the token via timing). */
+function tokenEq(a, b) {
+    const ba = Buffer.from(a), bb = Buffer.from(b);
+    return ba.length === bb.length && timingSafeEqual(ba, bb);
+}
+function positiveIntParam(value) {
+    if (value === null || value.trim() === '')
+        return undefined;
+    const n = Number(value);
+    return Number.isFinite(n) && n > 0 ? Math.floor(n) : undefined;
+}
+const HUMAN_ACTIONS = {
+    observe: 'actor.human.observe', nudge: 'actor.human.nudge', intervene: 'actor.human.intervene', teach: 'actor.human.teach',
+};
+/**
+ * WebUI 控台(M7): 可观测 + 保活. node:http + 自包含 HTML, 仅绑 loopback.
+ * 复用 core events/reports 报表 + assetstore + mailbox; 人工操作 Observe/Nudge/Intervene/Teach 走 ingest(actor.kind=human).
+ */
+export class WebUIServer {
+    deps;
+    server;
+    ingestor;
+    host;
+    now;
+    actorId;
+    /** Review ledger backing the human-review queue. Undefined when no LocalJsonlProvider store is available. */
+    review;
+    /** Token guarding /api/*; printed by the launcher, supplied by the browser via ?token= or Bearer. */
+    token;
+    constructor(deps) {
+        this.deps = deps;
+        this.host = deps.host ?? '127.0.0.1';
+        this.now = deps.now ?? (() => Date.now());
+        this.actorId = deps.actorId ?? 'console';
+        this.token = deps.token ?? randomBytes(16).toString('hex');
+        this.ingestor = deps.ingestor ?? new ev.Ingestor({ path: deps.eventsPath });
+        // Co-locate the review ledger with the store so the queue reads the same review.jsonl the CLI writes.
+        this.review = deps.review ?? (deps.store instanceof assetstore.LocalJsonlProvider ? new assetstore.ReviewLedger(deps.store.baseDir) : undefined);
+        this.server = createServer((req, res) => { void this.handle(req, res); });
+    }
+    listen(port = 0) {
+        return new Promise((resolve) => this.server.listen(port, this.host, () => {
+            const a = this.server.address();
+            resolve(a && typeof a === 'object' ? a.port : port);
+        }));
+    }
+    close() { return new Promise((res, rej) => this.server.close((e) => (e ? rej(e) : res()))); }
+    async handle(req, res) {
+        try {
+            if (!LOOPBACK.has(req.socket.remoteAddress ?? ''))
+                return this.send(res, 403, 'text/plain', 'non-loopback');
+            const url = new URL(req.url ?? '/', 'http://localhost');
+            const p = url.pathname;
+            // Root HTML is a static shell (no data) → served freely; it reads ?token= and authenticates the /api calls.
+            if (p === '/' || p === '/index.html')
+                return this.send(res, 200, 'text/html; charset=utf-8', CONSOLE_HTML);
+            // Everything else (all /api/*) requires the token — accepted via Bearer header or ?token= (browser convenience).
+            const auth = req.headers['authorization'] ?? '';
+            const supplied = auth.startsWith('Bearer ') ? auth.slice(7) : (url.searchParams.get('token') ?? '');
+            if (!tokenEq(supplied, this.token))
+                return this.send(res, 401, 'application/json', JSON.stringify({ error: 'unauthorized' }));
+            if (p === '/api/status')
+                return this.json(res, ev.statusReport(ev.readEvents(this.deps.eventsPath)));
+            if (p === '/api/cycles')
+                return this.json(res, ev.listCycles(ev.readEvents(this.deps.eventsPath)));
+            if (p === '/api/cycle')
+                return this.json(res, ev.showCycle(ev.readEvents(this.deps.eventsPath), url.searchParams.get('id') ?? ''));
+            if (p === '/api/narrative') {
+                return this.json(res, ev.buildNarrativeSnapshot(ev.readEvents(this.deps.eventsPath), { limit: positiveIntParam(url.searchParams.get('limit')) }));
+            }
+            if (p === '/api/triggers')
+                return this.json(res, ev.listTriggers(ev.readEvents(this.deps.eventsPath)));
+            if (p === '/api/daily-summary') {
+                const day = url.searchParams.get('day') ?? new Date(this.now()).toISOString().slice(0, 10);
+                return this.json(res, ev.dailySummary(ev.readEvents(this.deps.eventsPath), day));
+            }
+            if (p === '/api/value') {
+                // Thin pass-through: the provider (composition layer) owns prices + traces; the server only scopes the
+                // window and serializes. No provider wired → an empty summary so the card renders "no savings yet".
+                const window = ops.windowFromSpec(url.searchParams.get('window') ?? undefined, this.now());
+                const summary = this.deps.valueSummary ? this.deps.valueSummary(window) : EMPTY_VALUE_SUMMARY;
+                return this.json(res, summary);
+            }
+            if (p === '/api/mailbox') {
+                if (!this.deps.mailbox)
+                    return this.json(res, { pending: 0, dlq: 0, messages: [] });
+                return this.json(res, {
+                    pending: this.deps.mailbox.countByStatus('pending'),
+                    dlq: this.deps.mailbox.dlq().length,
+                    messages: this.deps.mailbox.list({ limit: 50 }).map((m) => ({ id: m.id, type: m.type, status: m.status, handler: m.handler })),
+                });
+            }
+            if (p === '/api/assets') {
+                if (!this.deps.store)
+                    return this.json(res, []);
+                const kind = url.searchParams.get('kind');
+                return this.json(res, (await this.deps.store.list(kind ?? undefined, 100)).map((a) => ({ asset_id: a.asset_id, type: a.type, summary: a.summary })));
+            }
+            if (p === '/api/review' && req.method === 'POST') {
+                // Approve/reject a quarantined draft from the console: the SAME gate the CLI uses — flip the ReviewLedger
+                // state + record an audited actor.human.review.* event. Loopback + bearer already guard the route; actor is
+                // the console operator. Resolve the target by asset_id directly (no list, never truncated), or by logical id.
+                if (!this.deps.store || !this.review)
+                    return this.send(res, 400, 'application/json', JSON.stringify({ error: 'no review store wired' }));
+                const b = (await this.readJson(req));
+                if (b.action !== 'approve' && b.action !== 'reject')
+                    return this.send(res, 400, 'application/json', JSON.stringify({ error: 'action must be approve or reject' }));
+                const target = String(b.gene ?? '');
+                const g = (await this.deps.store.get(target)) ?? (await this.deps.store.list('Gene', 1000)).find((x) => String(x['id']) === target) ?? null;
+                // Only a Gene is reviewable: store.get resolves ANY asset by id, so guard the kind (a Capsule's asset_id
+                // must not be approvable, which would emit a review event with a misleading geneId — matches CLI runReview).
+                if (!g || g.type !== 'Gene')
+                    return this.send(res, 404, 'application/json', JSON.stringify({ error: 'gene not found' }));
+                const assetId = String(g.asset_id);
+                const geneId = typeof g['id'] === 'string' ? String(g['id']) : assetId;
+                const reason = (b.reason ?? '').trim() || `${b.action === 'approve' ? 'approved' : 'rejected'} via console`;
+                if (b.action === 'approve')
+                    this.review.approve(assetId, this.actorId, reason);
+                else
+                    this.review.reject(assetId, this.actorId, reason);
+                const root = await this.ingestor.ingest({
+                    type: b.action === 'approve' ? 'actor.human.review.approve' : 'actor.human.review.reject',
+                    actor: { kind: 'human', id: this.actorId },
+                    human: { title: `${b.action} gene ${geneId}`, severity: 'info' },
+                    payload: { geneId, assetId, reason },
+                });
+                return this.json(res, { ok: true, geneId, assetId, state: b.action === 'approve' ? 'approved' : 'rejected', seq: root.seq });
+            }
+            if (p === '/api/review') {
+                if (!this.deps.store)
+                    return this.json(res, []);
+                // The human-review queue. The set of REVIEWED (quarantined/approved/rejected) assets comes from the review
+                // LEDGER — the authoritative, complete source — so a pending draft is never dropped behind a store.list
+                // cutoff (Bugbot). Gene metadata is resolved per asset_id from the store. Default-eligible genes (no ledger
+                // record) are appended as context from a bounded list. Pending (quarantined) sorts first. Read-only here.
+                // Match the CLI's semantics exactly: only the unattended distill-observer counts as "auto-drafted"
+                // (manual `ingest --distill` / skill2gep emit gene.distilled with a different source and are NOT auto).
+                const autoDrafted = new Set(this.ingestor.readAll()
+                    .filter((e) => e.type === 'gene.distilled' && e.payload?.['source'] === 'distill-observer')
+                    .map((e) => String(e.payload?.['assetId'] ?? ''))
+                    .filter(Boolean));
+                const order = { quarantined: 0, rejected: 1, approved: 2, eligible: 3 };
+                const toRow = (assetId, state, g) => ({
+                    geneId: g && typeof g['id'] === 'string' ? String(g['id']) : assetId,
+                    assetId, state,
+                    category: g ? String(g['category'] ?? '') : '',
+                    summary: g ? String(g.summary ?? '') : '',
+                    autoDrafted: autoDrafted.has(assetId),
+                });
+                const records = this.review ? this.review.records() : [];
+                const decided = new Set(records.map((r) => r.assetId));
+                const reviewed = await Promise.all(records.map(async (r) => toRow(r.assetId, r.state, await this.deps.store.get(r.assetId))));
+                const eligible = (await this.deps.store.list('Gene', 1000))
+                    .filter((g) => !decided.has(String(g.asset_id)))
+                    .map((g) => toRow(String(g.asset_id), 'eligible', g));
+                const rows = [...reviewed, ...eligible].sort((a, b) => (order[a.state] ?? 9) - (order[b.state] ?? 9));
+                return this.json(res, rows);
+            }
+            if (p === '/api/action' && req.method === 'POST') {
+                const b = (await this.readJson(req));
+                const type = HUMAN_ACTIONS[b.action ?? ''];
+                if (!type)
+                    return this.send(res, 400, 'application/json', JSON.stringify({ error: 'unknown action' }));
+                const root = await this.ingestor.ingest({
+                    type, actor: { kind: 'human', id: this.actorId },
+                    human: { title: b.title ?? b.action ?? 'human action' },
+                    payload: { note: b.note ?? '', ...(b.cycleId ? { cycleId: b.cycleId } : {}) },
+                });
+                return this.json(res, { ok: true, seq: root.seq });
+            }
+            return this.send(res, 404, 'application/json', JSON.stringify({ error: 'not found' }));
+        }
+        catch (e) {
+            return this.send(res, 500, 'application/json', JSON.stringify({ error: e instanceof Error ? e.message : String(e) }));
+        }
+    }
+    readJson(req) {
+        return new Promise((resolve, reject) => {
+            const chunks = [];
+            let size = 0;
+            req.on('data', (c) => { size += c.length; if (size > 256 * 1024)
+                reject(new Error('body too large'));
+            else
+                chunks.push(c); });
+            req.on('end', () => { try {
+                resolve(chunks.length ? JSON.parse(Buffer.concat(chunks).toString('utf8')) : {});
+            }
+            catch {
+                reject(new Error('invalid json'));
+            } });
+            req.on('error', reject);
+        });
+    }
+    json(res, body) { this.send(res, 200, 'application/json', JSON.stringify(body)); }
+    send(res, code, ct, body) { res.writeHead(code, { 'content-type': ct }); res.end(body); }
+}

package/package.json ADDED Viewed

@@ -0,0 +1,27 @@
+{
+  "name": "@evomap/evolver-webui",
+  "version": "2.0.0-beta.0",
+  "private": false,
+  "type": "module",
+  "description": "保活/可视化 WebUI",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "@evomap/evolver-core": "2.0.0-beta.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "tag": "v2-beta"
+  },
+  "files": [
+    "dist/",
+    "README.md",
+    "package.json"
+  ]
+}