@kky42/pievo-server 1.0.0

package/.output/server/_ssr/artifactView-DS4O22wl.mjs

@@ -0,0 +1,304 @@
+import { o as __toESM } from "../_runtime.mjs";
+import { C as require_jsx_runtime, S as require_react } from "../_libs/@base-ui/react+[...].mjs";
+import { s as getArtifact } from "./loopApi-Cxe8WyOB.mjs";
+import { t as artifactKind } from "./artifactKind-BW0isV8L.mjs";
+import { t as purify } from "../_libs/dompurify.mjs";
+import { t as g } from "../_libs/marked.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/artifactView-DS4O22wl.js
+var import_react = /* @__PURE__ */ __toESM(require_react());
+var import_jsx_runtime = require_jsx_runtime();
+/** Download URL for one artifact - the path is segment-encoded so a nested path
+*  (`data/raw.json`) round-trips and can't be mistaken for extra route segments. */
+function downloadHref(loopId, path) {
+	const enc = path.split("/").map(encodeURIComponent).join("/");
+	return `/api/artifact/${encodeURIComponent(loopId)}/${enc}`;
+}
+/** Inline render URL for an image artifact - the same bytes as `downloadHref`
+*  but served with the real image content-type + `inline` disposition (see the
+*  route). Used as an <img> src; never for a document the browser navigates to. */
+function inlineHref(loopId, path) {
+	return `${downloadHref(loopId, path)}?view=inline`;
+}
+/**
+* Shared markdown → sanitized HTML pipeline: marked (GFM) → DOMPurify (an
+* allowlisted prose subset, NO script/handlers). ONE sanitizer config for every
+* markdown surface (including the Files viewer's `TaskFileView`) so the allowlist
+* can't drift between them. Render the output under
+* the `.taskmd` styles.
+*/
+var MD_SANITIZE = {
+	ALLOWED_TAGS: [
+		"h1",
+		"h2",
+		"h3",
+		"h4",
+		"h5",
+		"h6",
+		"p",
+		"br",
+		"hr",
+		"strong",
+		"b",
+		"em",
+		"i",
+		"del",
+		"s",
+		"code",
+		"pre",
+		"blockquote",
+		"ul",
+		"ol",
+		"li",
+		"a",
+		"span",
+		"table",
+		"thead",
+		"tbody",
+		"tr",
+		"th",
+		"td",
+		"img"
+	],
+	ALLOWED_ATTR: [
+		"href",
+		"title",
+		"target",
+		"rel",
+		"src",
+		"alt"
+	]
+};
+/** Markdown string → sanitized HTML string (safe for dangerouslySetInnerHTML). */
+function renderMarkdown(content) {
+	return purify.sanitize(g.parse(content, {
+		async: false,
+		gfm: true
+	}), MD_SANITIZE);
+}
+/**
+* Renders markdown (a loop's task file, or any `.md` artifact) as a calm,
+* formatted document instead of a raw mono dump. Pipeline: the shared
+* `renderMarkdown` (marked GFM → DOMPurify allowlist) → `.taskmd` styles.
+* Bare prose only — the host (the unified Files viewer) owns the surface,
+* padding cadence, and scroll.
+*/
+function TaskFileView({ content }) {
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
+		className: "taskmd px-5 py-4",
+		dangerouslySetInnerHTML: { __html: (0, import_react.useMemo)(() => renderMarkdown(content), [content]) }
+	});
+}
+/**
+* Shared pieces of the artifact content viewer - one source for the Files
+* panel's detail pane AND the dashboard artifact primitives (`<loop-embed>`,
+* `<loop-calendar>`'s and `<loop-kanban>`'s detail), so the caption strip, the
+* binary/oversize copy, and the type-appropriate render can't drift between
+* surfaces.
+*
+* Display types (see `lib/artifactKind`):
+*  - HTML   → a STRICT sandboxed iframe (`sandbox="allow-scripts"`, deliberately
+*             NO `allow-same-origin`): user-machine-synced markup renders richly
+*             but in an opaque origin, so its scripts can't read the app's
+*             cookies/session or reach `parent` - stored-XSS is contained by
+*             design. A Preview/Source toggle exposes the raw markup too.
+*  - image  → an <img> pointed at the hardened inline route (`inlineHref`); the
+*             bytes are NEVER inlined into the app DOM (SVG is scriptable, so it
+*             rides as an image, which does not execute embedded scripts).
+*  - markdown → the shared markdown pipeline (Preview) with a raw Source toggle.
+*  - text   → monospace source.
+* Everything keeps a Download fallback; an oversize (metadata-only) artifact has
+* no synced bytes to render, so it says so rather than showing an empty pane.
+*/
+var isMarkdown = (path) => artifactKind(path) === "markdown";
+/** A small monospace caption strip above a file's content (path · meta [· action]). */
+function ViewerHead({ path, meta, action }) {
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+		className: "sticky top-0 z-10 flex flex-wrap items-center gap-x-2 gap-y-1 border-b border-hairline bg-surface px-5 py-2.5",
+		children: [
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", {
+				className: "break-all font-mono text-label text-primary",
+				children: path
+			}),
+			meta && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", {
+				className: "font-mono text-caption text-disabled",
+				children: ["· ", meta]
+			}),
+			action && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", {
+				className: "ml-auto shrink-0",
+				children: action
+			})
+		]
+	});
+}
+/** The binary / oversize body - download affordance or the metadata-only note. */
+function BinaryNotice({ loopId, path, oversize }) {
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
+		className: "px-5 py-8 text-body text-secondary",
+		children: oversize ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", {
+			className: "text-disabled",
+			children: "Too large to preview - stored as metadata only (no synced bytes)."
+		}) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+			"Binary file - not previewable.",
+			" ",
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", {
+				href: downloadHref(loopId, path),
+				download: true,
+				className: "text-interactive underline underline-offset-2 transition-colors hover:text-display",
+				children: "Download"
+			})
+		] })
+	});
+}
+/** The viewer's action strip: a Preview/Source toggle (renderable types only)
+*  plus an always-present Download. Sits just under the content head. */
+function ViewerActions({ loopId, path, mode, onMode, showToggle }) {
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+		className: "flex items-center gap-2 border-b border-hairline bg-surface px-5 py-1.5",
+		children: [showToggle && mode && onMode && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
+			className: "inline-flex overflow-hidden rounded-control border border-hairline",
+			children: ["preview", "source"].map((m) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", {
+				type: "button",
+				onClick: () => onMode(m),
+				className: `cursor-pointer border-none px-2.5 py-0.5 text-caption font-medium transition-colors ${mode === m ? "bg-raised text-display" : "bg-transparent text-secondary hover:text-display"}`,
+				children: m === "preview" ? "Preview" : "Source"
+			}, m))
+		}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", {
+			href: downloadHref(loopId, path),
+			download: true,
+			className: "ml-auto shrink-0 text-caption font-medium text-interactive underline underline-offset-2 transition-colors hover:text-display",
+			children: "Download ↓"
+		})]
+	});
+}
+/**
+* Rendered HTML in a STRICT sandbox. `sandbox="allow-scripts"` WITHOUT
+* `allow-same-origin` is the load-bearing isolation: the frame gets an opaque
+* origin, so document.cookie is empty, storage is inaccessible, and `parent`
+* access throws a cross-origin SecurityError - synced markup can render (styles
+* + its own scripts run) yet can't touch the app's session or DOM. `srcDoc`
+* keeps the bytes off any navigable app-origin URL. Bounded height with internal
+* scroll; a white backdrop matches what report HTML expects regardless of theme.
+*/
+function HtmlPreview({ html }) {
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("iframe", {
+		title: "Rendered HTML artifact (sandboxed)",
+		srcDoc: html,
+		sandbox: "allow-scripts",
+		referrerPolicy: "no-referrer",
+		className: "h-[min(70vh,620px)] w-full border-0 bg-white"
+	});
+}
+/** An image artifact, rendered from the hardened inline route (never inlined
+*  into the app DOM). Falls back to a download prompt if the bytes won't load. */
+function ImageView({ loopId, file }) {
+	const [failed, setFailed] = (0, import_react.useState)(false);
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+		className: "min-w-0",
+		children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(ViewerActions, {
+			loopId,
+			path: file.path,
+			showToggle: false
+		}), failed ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+			className: "px-5 py-8 text-body text-secondary",
+			children: [
+				"Couldn't load this image.",
+				" ",
+				/* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", {
+					href: downloadHref(loopId, file.path),
+					download: true,
+					className: "text-interactive underline underline-offset-2 transition-colors hover:text-display",
+					children: "Download"
+				}),
+				" ",
+				"instead."
+			]
+		}) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
+			className: "flex justify-center overflow-auto px-5 py-6",
+			children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("img", {
+				src: inlineHref(loopId, file.path),
+				alt: file.path,
+				onError: () => setFailed(true),
+				className: "max-w-full rounded-control border border-hairline bg-white object-contain"
+			})
+		})]
+	});
+}
+/** A text-bearing artifact (html / markdown / plain text): fetch the bytes, then
+*  render per its kind with a Preview/Source toggle (html + markdown) + download. */
+function TextArtifactView({ loopId, file, kind }) {
+	const [loaded, setLoaded] = (0, import_react.useState)({ loading: true });
+	const [mode, setMode] = (0, import_react.useState)("preview");
+	(0, import_react.useEffect)(() => {
+		let alive = true;
+		setLoaded({ loading: true });
+		getArtifact({ data: {
+			loopId,
+			path: file.path
+		} }).then((c) => alive && setLoaded(c)).catch((e) => alive && setLoaded({ error: String(e) }));
+		return () => {
+			alive = false;
+		};
+	}, [
+		loopId,
+		file.path,
+		file.updatedAt
+	]);
+	if ("loading" in loaded) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
+		className: "px-5 py-6 text-body text-disabled",
+		children: "Loading…"
+	});
+	if ("binary" in loaded) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(BinaryNotice, {
+		loopId,
+		path: file.path,
+		oversize: loaded.oversize
+	});
+	if ("error" in loaded) return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+		className: "px-5 py-6 text-body text-accent",
+		children: ["Couldn't load this file - ", loaded.error]
+	});
+	const text = loaded.text || "(empty file)";
+	const renderable = kind === "html" || kind === "markdown";
+	const showSource = !renderable || mode === "source";
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+		className: "min-w-0",
+		children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(ViewerActions, {
+			loopId,
+			path: file.path,
+			mode,
+			onMode: setMode,
+			showToggle: renderable
+		}), kind === "html" && !showSource ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(HtmlPreview, { html: loaded.text || "" }) : kind === "markdown" && !showSource ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(TaskFileView, { content: text }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("pre", {
+			className: "m-0 overflow-x-auto whitespace-pre-wrap px-5 py-4 font-mono text-label leading-relaxed text-secondary",
+			children: text
+		})]
+	});
+}
+/**
+* One artifact's content body, dispatched by display kind (see `artifactKind`).
+* Oversize → metadata-only note (no bytes); image → hardened <img>; other binary
+* → download; text-bearing → the fetch-and-render viewer.
+*/
+function ArtifactBody({ loopId, file }) {
+	const kind = artifactKind(file.path);
+	if (file.oversize) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(BinaryNotice, {
+		loopId,
+		path: file.path,
+		oversize: true
+	});
+	if (kind === "image") return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ImageView, {
+		loopId,
+		file
+	}, `${file.path}:${file.updatedAt ?? ""}`);
+	if (file.binary) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(BinaryNotice, {
+		loopId,
+		path: file.path,
+		oversize: false
+	});
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(TextArtifactView, {
+		loopId,
+		file,
+		kind
+	}, file.path);
+}
+//#endregion
+export { isMarkdown as i, TaskFileView as n, ViewerHead as r, ArtifactBody as t };

package/.output/server/_ssr/artifacts-DngKyW2u.mjs

@@ -0,0 +1,2 @@
+import { d as SYNC_BODY_CAP, i as BLOB_CAP } from "./boot-BbtG0ImW.mjs";
+export { BLOB_CAP, SYNC_BODY_CAP };