@ggui-ai/dev-stack 0.1.0-rc.1

package/dist/dev-server/hub.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Local dev hub — the HTML surface served from the same
+ * dev-stack HTTP host as the registry / runtime endpoints.
+ *
+ * Charter — what this surface is and is not:
+ *
+ *   IS:     runtime status, registry state, discovered UIs,
+ *           compile/runtime errors, recent runtime events/logs,
+ *           code-first local observability
+ *
+ *   IS NOT: Studio-lite, starter gallery, no-code authoring,
+ *           billing/workspace UI, NL playground, deploy flow,
+ *           tunnel flow
+ *
+ * Delivery choices:
+ *
+ *   - Single self-contained HTML document — no bundler, no
+ *     framework, no build step. Matches the "code-first dev tool"
+ *     charter and keeps `@ggui-ai/dev-stack`'s dep weight at zero
+ *     for this feature.
+ *   - `/hub` is **public** (bearer-exempt) so a browser that opens
+ *     the page gets the shell without a pre-flight token dance. The
+ *     existing origin allowlist in `auth.ts` still prevents
+ *     cross-origin reads; the server injects the bearer token
+ *     directly into the HTML so the hub's same-origin XHRs carry
+ *     it automatically.
+ *   - No parallel backend shape — every panel queries the existing
+ *     `/health`, `/uis`, `/runtime/status`, `/runtime/events`
+ *     endpoints. Live SSE wiring lands in a follow-up commit.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { GguiJsonV1 } from '@ggui-ai/project-config';
+/**
+ * Context the hub shell needs to render. The `token` is the bearer
+ * the hub's own JS should send on XHRs; `null` when the server was
+ * started without a security policy (tests).
+ */
+export interface HubShellContext {
+    /** Bearer token the hub JS uses for XHRs. `null` = server open. */
+    readonly token: string | null;
+    /** Loaded `ggui.json` — hub shows `app.name` / `app.slug`. */
+    readonly manifest: GguiJsonV1;
+}
+/**
+ * Build the self-contained HTML document for the hub. Pure function
+ * so tests can exercise the rendered shape without binding a port.
+ *
+ * HTML escaping is applied to every string that bubbles up from
+ * user-controlled data (manifest fields, token). The token itself
+ * is hex in practice, but the escape is defensive — a future
+ * pairing-protocol token might be arbitrary.
+ */
+export declare function renderHubHtml(ctx: HubShellContext): string;
+/**
+ * Write the hub shell to `res` with no-cache headers. Response is
+ * always 200 — there's no per-request failure mode for the shell.
+ */
+export declare function serveHubShell(_req: IncomingMessage, res: ServerResponse, ctx: HubShellContext): void;
+//# sourceMappingURL=hub.d.ts.map

package/dist/dev-server/hub.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub.d.ts","sourceRoot":"","sources":["../../src/dev-server/hub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CA+D1D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,eAAe,EACrB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,eAAe,GACnB,IAAI,CAcN"}