@hansenexus/hud 0.1.1 → 0.2.0

package/panels/tokens-panel.js

@@ -1,9 +0,0 @@
-import {
-  TokensPanel
-} from "../chunk-nm82wr8r.js";
-import"../chunk-kyeb6qeq.js";
-import"../chunk-xztw0xyt.js";
-import"../chunk-5gtx3pza.js";
-export {
-  TokensPanel
-};

package/panels/unlock-panel.d.mts

@@ -1,33 +0,0 @@
-import * as react from 'react';
-import { HudAccess } from '../core/access.mjs';
-import { HudEnv } from '../core/types.mjs';
-import 'lucide-react';
-
-type HudUnlockState = "checking" | "locked" | "unlocked" | "unconfigured";
-/**
- * Unlock state for a deployed hud.
- *
- * The browser never sees the password or the token: the cookie is httpOnly
- * and only the server can judge it, so this hook asks `${apiBase}/unlock`
- * rather than reading anything locally. On a tier that needs no unlock it
- * settles on `unlocked` without a request.
- */
-declare function useHudUnlock(apiBase: string, access: HudAccess): {
-    state: HudUnlockState;
-    error: string | null;
-    unlock: (password: string) => Promise<boolean>;
-};
-interface HudUnlockPanelProps {
-    env: HudEnv;
-    state: HudUnlockState;
-    error: string | null;
-    onUnlock: (password: string) => Promise<boolean>;
-}
-/**
- * The only panel a locked deployed hud shows. Everything else, including
- * the read-only production panels, stays behind it, because the panels
- * themselves fetch from `/api/hud/*` routes that would refuse anyway.
- */
-declare function HudUnlockPanel({ env, state, error, onUnlock }: HudUnlockPanelProps): react.JSX.Element;
-
-export { HudUnlockPanel, type HudUnlockPanelProps, type HudUnlockState, useHudUnlock };

package/panels/unlock-panel.js

@@ -1,14 +0,0 @@
-import {
-  HudUnlockPanel,
-  useHudUnlock
-} from "../chunk-kvxve0hx.js";
-import"../chunk-6cdpasm9.js";
-import"../chunk-kyeb6qeq.js";
-import"../chunk-xztw0xyt.js";
-import"../chunk-vjh0d29g.js";
-import"../chunk-v086j53b.js";
-import"../chunk-5gtx3pza.js";
-export {
-  useHudUnlock,
-  HudUnlockPanel
-};

package/panels/variants-panel.d.mts

@@ -1,51 +0,0 @@
-import * as react from 'react';
-
-interface HudVariantCategory {
-    id: string;
-    name: string;
-    /** Registry status — "active" renders as votable, "decided" as settled. */
-    status: string;
-    alternativeCount: number;
-    /** Domain bucket (marketing / admin / shared, …) for grouping. */
-    domain?: string;
-}
-interface HudGenerateRequest {
-    /** Repo-relative component path (apps/… or packages/…). */
-    path: string;
-    brief: string;
-    count: number;
-}
-interface HudGenerateResult {
-    ok: boolean;
-    /** Repo-relative queue marker path on success. */
-    markerPath?: string;
-    error?: string;
-}
-interface HudVariantsAdapter {
-    categories: HudVariantCategory[];
-    /** Deep link to the full review dashboard (e.g. /dev/review/console). */
-    reviewHref: string;
-    /** Deep link for one category's drill-in page. */
-    categoryHref?: (categoryId: string) => string;
-    /**
-     * Open the in-page preview drawer, when the app has a PreviewProvider
-     * mounted on the current route. Omit to fall back to deep links.
-     */
-    openPreview?: (categoryId: string) => void;
-    /**
-     * Queue a variant-generation brief (console: /api/dev/generate-variants →
-     * .claude/queue marker — human stays in the loop, no autonomous dispatch).
-     */
-    generate?: (request: HudGenerateRequest) => Promise<HudGenerateResult>;
-}
-/**
- * Variant-voting overview over an app-provided adapter: registered preview
- * categories with status, drill-in links (or the in-page drawer when
- * mounted), and the generate-brief queue. Voting itself stays on the review
- * dashboard — it needs the showcase to judge alternatives.
- */
-declare function VariantsPanel({ adapter }: {
-    adapter: HudVariantsAdapter;
-}): react.JSX.Element;
-
-export { type HudGenerateRequest, type HudGenerateResult, type HudVariantCategory, type HudVariantsAdapter, VariantsPanel };

package/panels/variants-panel.js

@@ -1,12 +0,0 @@
-import {
-  VariantsPanel
-} from "../chunk-emfnvz4p.js";
-import"../chunk-9hw5r9y1.js";
-import"../chunk-kyeb6qeq.js";
-import"../chunk-xztw0xyt.js";
-import"../chunk-vjh0d29g.js";
-import"../chunk-v086j53b.js";
-import"../chunk-5gtx3pza.js";
-export {
-  VariantsPanel
-};

package/panels/vitals-panel.d.mts

@@ -1,11 +0,0 @@
-import * as react from 'react';
-
-/** Current values as a plain record — consumed by the dispatch payload. */
-declare function getVitalsSnapshot(): Record<string, number>;
-/**
- * Live Core Web Vitals of the current page (web-vitals, in-memory) plus the
- * app's server-side SigNoz snapshot via the hud hub.
- */
-declare function VitalsPanel(): react.JSX.Element;
-
-export { VitalsPanel, getVitalsSnapshot };

package/panels/vitals-panel.js

@@ -1,15 +0,0 @@
-import {
-  VitalsPanel,
-  getVitalsSnapshot
-} from "../chunk-yn1d38pb.js";
-import"../chunk-xezxydm3.js";
-import"../chunk-9hw5r9y1.js";
-import"../chunk-kyeb6qeq.js";
-import"../chunk-xztw0xyt.js";
-import"../chunk-vjh0d29g.js";
-import"../chunk-v086j53b.js";
-import"../chunk-5gtx3pza.js";
-export {
-  getVitalsSnapshot,
-  VitalsPanel
-};

package/server/guard.d.mts

@@ -1,42 +0,0 @@
-import { HudEnv, HudCapability } from '../core/types.mjs';
-import 'lucide-react';
-import 'react';
-
-/**
- * Server-side hud gate: layer two of the three the hud architecture calls
- * for (client render gate · per-app route gate · hub token).
- *
- * Client capability filtering is convenience: the panels a browser cannot see
- * are still reachable by typing the URL. Every `/api/hud/*` route therefore
- * re-derives the env itself and refuses anything the tier's matrix denies,
- * which is what makes production genuinely read-only rather than
- * read-only-by-UI. Deliberately framework-free (it takes anything with
- * `headers.get`) so the route decides how to render the failure.
- */
-
-interface HudGuardRequest {
-    headers: {
-        get(name: string): string | null;
-    };
-}
-type HudGuardResult = {
-    ok: true;
-    env: HudEnv;
-} | {
-    ok: false;
-    status: 401 | 403 | 404;
-    error: string;
-};
-/**
- * Whether this request may exercise `capability` right now.
- *
- * Order matters: a hud that is not enabled at all answers 404 (nothing here),
- * a denied capability answers 403 before any password is considered (the
- * password must never be a way to widen the matrix), and only a permitted
- * capability gets as far as the unlock check.
- */
-declare function checkHudRequest(request: HudGuardRequest, capability: HudCapability): Promise<HudGuardResult>;
-/** Whether the current request already carries a valid unlock (status route). */
-declare function isHudRequestUnlocked(request: HudGuardRequest): Promise<boolean>;
-
-export { type HudGuardRequest, type HudGuardResult, checkHudRequest, isHudRequestUnlocked };

package/server/guard.js

@@ -1,12 +0,0 @@
-import {
-  checkHudRequest,
-  isHudRequestUnlocked
-} from "../chunk-q15xwpy8.js";
-import"../chunk-6cdpasm9.js";
-import"../chunk-vjh0d29g.js";
-import"../chunk-v086j53b.js";
-import"../chunk-5gtx3pza.js";
-export {
-  isHudRequestUnlocked,
-  checkHudRequest
-};

package/server/unlock.d.mts

@@ -1,28 +0,0 @@
-/**
- * The `/api/hud/unlock` handler, shared by every app that mounts the hud.
- *
- * Framework-free on purpose (it takes anything with `headers.get` and a
- * `json()`), so each app's route file is four lines of Next glue and the
- * policy lives in one place. Verification is HMAC over the token's own issue
- * time (see core/access.ts), so nothing server-side needs to be stored.
- */
-interface HudUnlockRequest {
-    headers: {
-        get(name: string): string | null;
-    };
-    json(): Promise<unknown>;
-}
-interface HudUnlockResult {
-    status: number;
-    body: Record<string, unknown>;
-    /** `Set-Cookie` value, when the attempt changed the unlock state. */
-    setCookie?: string;
-}
-/** GET: what the client needs to decide between the panels and the lock. */
-declare function handleHudUnlockStatus(request: HudUnlockRequest): Promise<HudUnlockResult>;
-/** POST: exchange the password for a signed, expiring unlock cookie. */
-declare function handleHudUnlockAttempt(request: HudUnlockRequest): Promise<HudUnlockResult>;
-/** Test seam: the attempt budget is process state, not request state. */
-declare function resetHudUnlockAttempts(): void;
-
-export { type HudUnlockRequest, type HudUnlockResult, handleHudUnlockAttempt, handleHudUnlockStatus, resetHudUnlockAttempts };

package/server/unlock.js

@@ -1,108 +0,0 @@
-import {
-  isHudRequestUnlocked
-} from "../chunk-q15xwpy8.js";
-import {
-  hudRequiresUnlock,
-  hudUnlockCookieString,
-  hudUnlockTtlMs,
-  resolveHudAccess,
-  signHudUnlockToken,
-  timingSafeEqual
-} from "../chunk-6cdpasm9.js";
-import {
-  isHudVisible,
-  resolveHudEnv
-} from "../chunk-vjh0d29g.js";
-import"../chunk-v086j53b.js";
-import"../chunk-5gtx3pza.js";
-
-// server/unlock.ts
-var ATTEMPT_WINDOW_MS = 10 * 60 * 1000;
-var MAX_FAILED_ATTEMPTS = 10;
-var failures = new Map;
-function clientKey(request) {
-  const forwarded = request.headers.get("x-forwarded-for");
-  return forwarded?.split(",")[0]?.trim() || request.headers.get("x-real-ip") || "unknown";
-}
-function isThrottled(key, now) {
-  const entry = failures.get(key);
-  if (!entry)
-    return false;
-  if (now - entry.firstAt > ATTEMPT_WINDOW_MS) {
-    failures.delete(key);
-    return false;
-  }
-  return entry.count >= MAX_FAILED_ATTEMPTS;
-}
-function recordFailure(key, now) {
-  const entry = failures.get(key);
-  if (!entry || now - entry.firstAt > ATTEMPT_WINDOW_MS) {
-    failures.set(key, { count: 1, firstAt: now });
-    return;
-  }
-  entry.count += 1;
-}
-async function handleHudUnlockStatus(request) {
-  const env = resolveHudEnv();
-  if (!isHudVisible(env)) {
-    return { status: 404, body: { error: "not found" } };
-  }
-  const access = resolveHudAccess(env);
-  return {
-    status: 200,
-    body: {
-      env,
-      access,
-      required: hudRequiresUnlock(access),
-      configured: !hudRequiresUnlock(access) || Boolean(process.env.HUD_ACCESS_PASSWORD),
-      unlocked: await isHudRequestUnlocked(request)
-    }
-  };
-}
-async function handleHudUnlockAttempt(request) {
-  const env = resolveHudEnv();
-  if (!isHudVisible(env)) {
-    return { status: 404, body: { error: "not found" } };
-  }
-  const access = resolveHudAccess(env);
-  if (!hudRequiresUnlock(access)) {
-    return { status: 200, body: { unlocked: true, required: false } };
-  }
-  const expected = process.env.HUD_ACCESS_PASSWORD;
-  if (!expected) {
-    return {
-      status: 503,
-      body: { unlocked: false, configured: false, error: "hud unlock is not configured" }
-    };
-  }
-  const now = Date.now();
-  const key = clientKey(request);
-  if (isThrottled(key, now)) {
-    return { status: 429, body: { unlocked: false, error: "too many attempts, try again later" } };
-  }
-  let submitted = "";
-  try {
-    const payload = await request.json();
-    if (typeof payload?.password === "string")
-      submitted = payload.password;
-  } catch {}
-  if (!submitted || !timingSafeEqual(submitted, expected)) {
-    recordFailure(key, now);
-    return { status: 401, body: { unlocked: false, error: "wrong password" } };
-  }
-  failures.delete(key);
-  const ttlMs = hudUnlockTtlMs(access);
-  return {
-    status: 200,
-    body: { unlocked: true, env, access, expiresInMs: ttlMs },
-    setCookie: hudUnlockCookieString(await signHudUnlockToken(expected, now), ttlMs)
-  };
-}
-function resetHudUnlockAttempts() {
-  failures.clear();
-}
-export {
-  resetHudUnlockAttempts,
-  handleHudUnlockStatus,
-  handleHudUnlockAttempt
-};

package/state-boundary.d.mts

@@ -1,25 +0,0 @@
-import * as react from 'react';
-import { ReactNode } from 'react';
-import { ForcedState } from './core/force-state.mjs';
-
-interface StateBoundaryProps {
-    /** Stable, page-unique id; the HUD force-state panel lists boundaries by it. */
-    id: string;
-    /** Renders the boundary; `forced` is the state to show instead of the real one, or null. */
-    children: (forced: ForcedState | null) => ReactNode;
-}
-/**
- * Registers a loading/empty/error boundary with the HUD force-state panel and
- * `?__state=`. Wrap the part of a page that branches on a query result:
- *
- * ```tsx
- * <StateBoundary id="blog-post">
- *   {(forced) => forced === "loading" || post === undefined ? <Skeleton /> : …}
- * </StateBoundary>
- * ```
- *
- * In production it renders `children(null)` and nothing else.
- */
-declare function StateBoundary({ id, children }: StateBoundaryProps): string | number | bigint | boolean | Iterable<ReactNode> | Promise<string | number | bigint | boolean | react.ReactPortal | react.ReactElement<unknown, string | react.JSXElementConstructor<any>> | Iterable<ReactNode> | null | undefined> | react.JSX.Element | null | undefined;
-
-export { StateBoundary, type StateBoundaryProps };

package/state-boundary.js

@@ -1,54 +0,0 @@
-import {
-  getForceStateStore,
-  resolveForcedState
-} from "./chunk-c5y856ad.js";
-import"./chunk-5gtx3pza.js";
-
-// state-boundary.tsx
-import { createContext, useContext, useEffect, useSyncExternalStore } from "react";
-import { jsx } from "react/jsx-runtime";
-"use client";
-var FORCE_STATE_ENABLED = process.env.NODE_ENV === "development";
-function StateBoundary({ id, children }) {
-  if (!FORCE_STATE_ENABLED)
-    return children(null);
-  return /* @__PURE__ */ jsx(DevStateBoundary, {
-    id,
-    children
-  });
-}
-var ParentBoundary = /* @__PURE__ */ createContext(null);
-var SERVER_SNAPSHOT = { boundaries: [], overrides: {}, param: null };
-function subscribe(listener) {
-  const store = getForceStateStore();
-  const onPopState = () => store.syncSearch(window.location.search);
-  window.addEventListener("popstate", onPopState);
-  const unsubscribe = store.subscribe(listener);
-  return () => {
-    window.removeEventListener("popstate", onPopState);
-    unsubscribe();
-  };
-}
-function getSnapshot() {
-  return getForceStateStore().getSnapshot();
-}
-function getServerSnapshot() {
-  return SERVER_SNAPSHOT;
-}
-function DevStateBoundary({ id, children }) {
-  const parentId = useContext(ParentBoundary);
-  const snapshot = useSyncExternalStore(subscribe, getSnapshot, getServerSnapshot);
-  useEffect(() => {
-    const store = getForceStateStore();
-    store.syncSearch(window.location.search);
-    return store.register(id, parentId);
-  }, [id, parentId]);
-  const forced = resolveForcedState(snapshot, { id, parentId });
-  return /* @__PURE__ */ jsx(ParentBoundary.Provider, {
-    value: id,
-    children: children(forced)
-  });
-}
-export {
-  StateBoundary
-};