@malloydata/malloyyo 0.2.39 → 0.2.41

package/dist/frame-inpage-entry.tsx

@@ -35,10 +35,16 @@ const givensToUrl = (dashboard, givens) => {
 
 mountInPage({
   root: document.getElementById("root"),
-  // Governed query — the shell's trusted /api/run (the same endpoint the iframe
+  // Governed query — the shell's trusted api/run (the same endpoint the iframe
   // broker forwards to). Returns the raw result the runtime normalizes.
+  //
+  // RELATIVE. A leading slash resolves against the ORIGIN, so behind anything
+  // serving this page under a prefix — code-server's `/proxy/<port>/`, a
+  // Codespaces forwarded port — the POST went to the proxy's own root and came
+  // back `405 Method Not Allowed` from the proxy rather than reaching the dev
+  // server at all. Resolved against the document, it is correct at any depth.
   run: (req, givens) =>
-    fetch("/api/run", {
+    fetch("api/run", {
       method: "POST",
       headers: { "content-type": "application/json" },
       body: JSON.stringify({ d: name, query: req.query, malloy: req.malloy, givens }),

package/dist/index.js

@@ -2881,7 +2881,7 @@ function clearCreds(url6) {
 }
 
 // package.json
-var version = "0.2.39";
+var version = "0.2.41";
 
 // src/http.ts
 var USER_AGENT = `malloyyo/${version}`;
@@ -2928,15 +2928,34 @@ async function registerClient(registrationEndpoint, redirectUri) {
   if (!res.ok) throw new Error(`client registration failed: ${res.status} ${await res.text()}`);
   return (await res.json()).client_id;
 }
+function browserless(platform = process.platform, env = process.env) {
+  if (platform === "darwin" || platform === "win32") return false;
+  return !env.DISPLAY && !env.WAYLAND_DISPLAY;
+}
 function openBrowser(url6) {
   const [cmd, args] = process.platform === "darwin" ? ["open", [url6]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url6]] : ["xdg-open", [url6]];
   try {
-    spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
   } catch {
   }
 }
+function listenTarget(env = process.env) {
+  const raw = env.MALLOYYO_OAUTH_PORT;
+  let port = 0;
+  if (raw !== void 0 && raw !== "") {
+    port = Number(raw);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+      throw new Error(`MALLOYYO_OAUTH_PORT must be a port number between 1 and 65535, got "${raw}"`);
+    }
+  }
+  return { host: env.MALLOYYO_OAUTH_HOST || "127.0.0.1", port };
+}
 function awaitRedirect(state) {
-  return new Promise((resolveServer) => {
+  return new Promise((resolveServer, rejectServer) => {
+    const { host, port: wanted } = listenTarget();
     let resolveCode;
     let rejectCode;
     const code = new Promise((res, rej) => {
@@ -2961,13 +2980,33 @@ function awaitRedirect(state) {
       if (ok) resolveCode(got);
       else rejectCode(new Error(err ?? "state mismatch or missing code"));
     });
-    server.listen(0, "127.0.0.1", () => {
+    let listening = false;
+    server.on("error", (err) => {
+      clearTimeout(timer);
+      const detail = err.code === "EADDRINUSE" ? `${host}:${wanted} is already in use \u2014 set MALLOYYO_OAUTH_PORT to a free port` : err.message;
+      const failure = new Error(`could not start the sign-in listener: ${detail}`);
+      rejectCode(failure);
+      if (!listening) {
+        void code.catch(() => {
+        });
+        rejectServer(failure);
+      }
+    });
+    server.listen(wanted, host, () => {
+      listening = true;
       const port = server.address().port;
-      resolveServer({ port, code, close: () => server.close() });
+      resolveServer({
+        port,
+        code,
+        close: () => {
+          clearTimeout(timer);
+          server.close();
+        }
+      });
     });
   });
 }
-async function login(baseUrl) {
+async function login(baseUrl, opts = {}) {
   const ep = await discover(baseUrl);
   const { verifier, challenge } = pkce();
   const state = crypto.randomBytes(16).toString("base64url");
@@ -2985,11 +3024,24 @@ async function login(baseUrl) {
       scope: "mcp",
       state
     }).toString();
-    console.log("Opening your browser to sign in\u2026");
-    console.log(`If it doesn't open, visit:
+    if (opts.noBrowser || browserless()) {
+      console.log(`Visit this URL to sign in:
+
   ${authUrl.toString()}
 `);
-    openBrowser(authUrl.toString());
+      if (!process.env.MALLOYYO_OAUTH_PORT) {
+        console.log(
+          "Note: sign-in redirects back to this machine on a random port.\n  In a container, set MALLOYYO_OAUTH_PORT and MALLOYYO_OAUTH_HOST=0.0.0.0,\n  and publish that port, so the browser can reach the redirect.\n"
+        );
+      }
+      console.log("Waiting for sign-in to complete\u2026");
+    } else {
+      console.log("Opening your browser to sign in\u2026");
+      console.log(`If it doesn't open, visit:
+  ${authUrl.toString()}
+`);
+      openBrowser(authUrl.toString());
+    }
     const authCode = await code;
     const res = await apiFetch(ep.token_endpoint, {
       method: "POST",
@@ -3330,6 +3382,7 @@ function siblingList(current, all, href) {
 // src/dashboard.ts
 var resolveFrameEntry = () => path6.join(resolveRuntimeDir(), "..", "frame-entry.tsx");
 var resolveInPageEntry = () => path6.join(resolveRuntimeDir(), "..", "frame-inpage-entry.tsx");
+var inlineScript = (js) => js.replace(/<\/(script)/gi, String.raw`<\/$1`);
 var esc2 = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 function makeBundler() {
   const cache = /* @__PURE__ */ new Map();
@@ -3405,9 +3458,26 @@ function makeInPageBundler() {
   };
 }
 var html = (body, title) => `<!doctype html><html><head><meta charset="utf-8"><title>${esc2(title)}</title><meta name="viewport" content="width=device-width,initial-scale=1"><style>${NAV_CSS}</style></head><body style="margin:0">${body}</body></html>`;
-var devSiblings = (dash, all) => siblingList(dash.name, all, (n) => `/?d=${encodeURIComponent(n)}`);
+var dashLink = (n) => `?d=${encodeURIComponent(n)}`;
+var DEV_PATHS = {
+  /** Sibling dashboard, for the switcher in the nav bar. */
+  dashboard: dashLink,
+  /** In-page (tag-only) bundle. */
+  inPage: (n) => `inpage.js?d=${encodeURIComponent(n)}`,
+  /** Artifact bundle, for a dashboard with a Dashboard.tsx. */
+  bundle: (n) => `bundle.js?d=${encodeURIComponent(n)}`,
+  /** The sandboxed artifact document. Same origin as the shell, relative like
+      everything else — the iframe is isolated by its OPAQUE origin (the
+      `allow-scripts`-only sandbox), not by living on a second port. */
+  frame: (n) => `frame?d=${encodeURIComponent(n)}`,
+  /** Live-reload stream. */
+  events: "events",
+  /** The privileged query broker the parent shell brokers postMessage into. */
+  run: "api/run"
+};
+var devSiblings = (dash, all) => siblingList(dash.name, all, dashLink);
 function navHtml2(dash, all) {
-  return navHtml(dash.name, all, (n) => `/?d=${encodeURIComponent(n)}`);
+  return navHtml(dash.name, all, dashLink);
 }
 function inPageShell(dash, all, givenSpecs, initialGivens, initialUrlState, tileSpecs) {
   const info = {
@@ -3422,21 +3492,20 @@ function inPageShell(dash, all, givenSpecs, initialGivens, initialUrlState, tile
     autorun: dash.autorun
   };
   return html(
-    navHtml2(dash, all) + `<div id="root"></div><script>window.__DASHBOARD__=${safeJson(info)};window.__DASHBOARDS__=${safeJson(devSiblings(dash, all))};window.__GIVENS__=${safeJson(givenSpecs)};window.__INITIAL_GIVENS__=${safeJson(initialGivens)};window.__INITIAL_URLSTATE__=${safeJson(initialUrlState)}</script><script>try{new EventSource('/events').onmessage=()=>location.reload();}catch(e){}</script><script src="/inpage.js?d=${encodeURIComponent(dash.name)}"></script>`,
+    navHtml2(dash, all) + `<div id="root"></div><script>window.__DASHBOARD__=${safeJson(info)};window.__DASHBOARDS__=${safeJson(devSiblings(dash, all))};window.__GIVENS__=${safeJson(givenSpecs)};window.__INITIAL_GIVENS__=${safeJson(initialGivens)};window.__INITIAL_URLSTATE__=${safeJson(initialUrlState)}</script><script>try{new EventSource('${DEV_PATHS.events}').onmessage=()=>location.reload();}catch(e){}</script><script src="${DEV_PATHS.inPage(dash.name)}"></script>`,
     dash.title
   );
 }
-function parentShell(dash, frameBase, all, initialGivens, initialUrlState) {
+function parentShell(dash, all, initialGivens, initialUrlState) {
   const givensQs = Object.entries({ ...initialGivens, ...initialUrlState }).map(([k, v]) => `&${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("");
   const d = safeJson(dash.name);
-  const fb = safeJson(frameBase);
   const nav = navHtml2(dash, all);
   return html(
     `<div style="display:flex;flex-direction:column;height:100vh">` + nav + // allow-popups(+escape-sandbox): let a # link mark open its target in a
     // normal new tab on click instead of being blocked by the sandbox.
-    `<iframe id="f" sandbox="allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox" src="${frameBase}/frame?d=${encodeURIComponent(dash.name)}${givensQs}" style="border:0;flex:1;width:100%"></iframe></div><script>
+    `<iframe id="f" sandbox="allow-scripts allow-popups allow-popups-to-escape-sandbox" src="${DEV_PATHS.frame(dash.name)}${givensQs}" style="border:0;flex:1;width:100%"></iframe></div><script>
 const f=document.getElementById('f');
-try{new EventSource('/events').onmessage=()=>location.reload();}catch(e){}
+try{new EventSource('${DEV_PATHS.events}').onmessage=()=>location.reload();}catch(e){}
 // The shareable URL has TWO namespaces the frame syncs independently:
 // '$NAME' = a given (the governed query contract), '~key' = a custom
 // component's useUrlState view-state. Each write must re-emit the other's
@@ -3451,7 +3520,7 @@ function shareUrl(dashboard){
   return u.pathname+u.search;
 }
 window.addEventListener('message',async(e)=>{
-  if(e.source!==f.contentWindow||e.origin!==${fb})return;
+  if(e.source!==f.contentWindow)return;
   const m=e.data;
   if(m&&m.type==='givens'){
     G=m.givens||{};
@@ -3473,11 +3542,11 @@ window.addEventListener('message',async(e)=>{
   if(!m||m.type!=='run')return;
   let out;
   try{
-    const res=await fetch('/api/run',{method:'POST',headers:{'content-type':'application/json'},
+    const res=await fetch('${DEV_PATHS.run}',{method:'POST',headers:{'content-type':'application/json'},
       body:JSON.stringify({d:${d},query:m.query,malloy:m.malloy,givens:m.givens,dashboard:m.dashboard})});
     out=await res.json();
   }catch(err){ out={ok:false,problems:[{message:String(err)}]}; }
-  f.contentWindow.postMessage({type:'result',id:m.id,...out},${fb});
+  f.contentWindow.postMessage({type:'result',id:m.id,...out},'*');
 });
 </script>`,
     dash.title
@@ -3489,7 +3558,7 @@ function givensFromUrl(url6) {
 function urlStateFromUrl(url6) {
   return urlStateFromSearch(url6.search);
 }
-function frameDoc(dash, all, givenSpecs, initialGivens, initialUrlState, tileSpecs) {
+function frameDoc(dash, all, givenSpecs, initialGivens, initialUrlState, bundleJs, tileSpecs) {
   const info = {
     name: dash.name,
     query: dash.query,
@@ -3504,7 +3573,7 @@ function frameDoc(dash, all, givenSpecs, initialGivens, initialUrlState, tileSpe
     autorun: dash.autorun
   };
   return html(
-    `<div id="root"></div><script>window.__DASHBOARD__=${safeJson(info)};window.__DASHBOARDS__=${safeJson(devSiblings(dash, all))};window.__GIVENS__=${safeJson(givenSpecs)};window.__INITIAL_GIVENS__=${safeJson(initialGivens)};window.__INITIAL_URLSTATE__=${safeJson(initialUrlState)}</script><script src="/bundle.js?d=${encodeURIComponent(dash.name)}"></script>`,
+    `<div id="root"></div><script>window.__DASHBOARD__=${safeJson(info)};window.__DASHBOARDS__=${safeJson(devSiblings(dash, all))};window.__GIVENS__=${safeJson(givenSpecs)};window.__INITIAL_GIVENS__=${safeJson(initialGivens)};window.__INITIAL_URLSTATE__=${safeJson(initialUrlState)}</script><script>${inlineScript(bundleJs)}</script>`,
     dash.title
   );
 }
@@ -3517,8 +3586,6 @@ async function serveDashboard(opts) {
   await initConnections();
   const root = path6.resolve(opts.root ?? process.cwd());
   const port = opts.port ?? 4173;
-  const framePort = port + 1;
-  const frameBase = `http://localhost:${framePort}`;
   const runner = await makeRunner(root);
   if (!runner.entryExists()) {
     throw new Error(`No index.malloy at ${root} \u2014 run this from a Malloy model repo.`);
@@ -3566,34 +3633,39 @@ async function serveDashboard(opts) {
     console.error(`  (file watch unavailable: ${e.message} \u2014 edits won't auto-reload)`);
   }
   const handler = async (req, res) => {
-    const onFramePort = (req.socket.localPort ?? port) === framePort;
-    const url6 = new URL(req.url ?? "/", `http://localhost:${onFramePort ? framePort : port}`);
+    const url6 = new URL(req.url ?? "/", `http://localhost:${port}`);
     const send = (code, type, body, extra = {}) => {
       res.writeHead(code, { "content-type": type, ...extra });
       res.end(body);
     };
     try {
-      if (onFramePort) {
-        if (url6.pathname === "/frame") {
-          const dash = pick(url6);
-          const g = await resolveGivens(dash);
-          if (!g.ok) {
-            return send(
-              200,
-              "text/html; charset=utf-8",
-              html(`<pre style="color:crimson;padding:16px">model error: ${esc2(g.error)}</pre>`, dash.title)
-            );
-          }
+      if (url6.pathname === "/frame") {
+        const dash = pick(url6);
+        const g = await resolveGivens(dash);
+        if (!g.ok) {
           return send(
             200,
             "text/html; charset=utf-8",
-            frameDoc(dash, dashboards, g.union, givensFromUrl(url6), urlStateFromUrl(url6), g.tiles)
+            html(`<pre style="color:crimson;padding:16px">model error: ${esc2(g.error)}</pre>`, dash.title)
           );
         }
-        if (url6.pathname === "/bundle.js") {
-          return send(200, "application/javascript; charset=utf-8", await bundle(pick(url6)));
-        }
-        return send(404, "text/plain", "not found");
+        return send(
+          200,
+          "text/html; charset=utf-8",
+          frameDoc(
+            dash,
+            dashboards,
+            g.union,
+            givensFromUrl(url6),
+            urlStateFromUrl(url6),
+            await bundle(dash),
+            g.tiles
+          ),
+          { "cache-control": "no-store" }
+        );
+      }
+      if (url6.pathname === "/bundle.js") {
+        return send(200, "application/javascript; charset=utf-8", await bundle(pick(url6)));
       }
       if (url6.pathname === "/events") {
         res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-cache", connection: "keep-alive" });
@@ -3616,17 +3688,24 @@ async function serveDashboard(opts) {
           return send(
             200,
             "text/html; charset=utf-8",
-            inPageShell(dash, dashboards, g.union, givensFromUrl(url6), urlStateFromUrl(url6), g.tiles)
+            inPageShell(dash, dashboards, g.union, givensFromUrl(url6), urlStateFromUrl(url6), g.tiles),
+            { "cache-control": "no-store" }
           );
         }
         return send(
           200,
           "text/html; charset=utf-8",
-          parentShell(dash, frameBase, dashboards, givensFromUrl(url6), urlStateFromUrl(url6))
+          parentShell(dash, dashboards, givensFromUrl(url6), urlStateFromUrl(url6)),
+          { "cache-control": "no-store" }
         );
       }
       if (url6.pathname === "/inpage.js") {
-        return send(200, "application/javascript; charset=utf-8", await inPageBundle());
+        return send(
+          200,
+          "application/javascript; charset=utf-8",
+          await inPageBundle(),
+          { "cache-control": "no-store" }
+        );
       }
       if (url6.pathname === "/api/run" && req.method === "POST") {
         const { d, query, malloy, givens } = JSON.parse(await readBody(req));
@@ -3642,12 +3721,10 @@ async function serveDashboard(opts) {
     }
   };
   const shellServer = http2.createServer(handler);
-  const frameServer = http2.createServer(handler);
   await new Promise((r) => shellServer.listen(port, r));
-  await new Promise((r) => frameServer.listen(framePort, r));
   console.error(`
   malloyyo dashboard dev \u2014 model: ${root}`);
-  console.error(`  http://localhost:${port}/   (artifact origin: ${frameBase})`);
+  console.error(`  http://localhost:${port}/`);
   for (const d of dashboards) {
     const kind = d.tsxPath ? "custom (iframe)" : "tag-only (in-page)";
     console.error(`    \u2022 ${d.name} (${kind})  \u2192  http://localhost:${port}/?d=${d.name}`);
@@ -5389,9 +5466,9 @@ async function status(target, opts) {
   console.log(`  version ${s.version ?? "?"}` + (git?.sha ? `  ${git.branch}@${shortSha(git.sha)}` : ""));
   console.log(`  ${s.compileError ? `\u2717 ${s.compileError}` : `\u2713 compiled ${s.compiledAt ?? ""}`}`);
 }
-async function loginCmd(target) {
+async function loginCmd(target, opts) {
   const inst = resolveInstance(resolve3("."), target);
-  await login(inst.url);
+  await login(inst.url, { noBrowser: opts.browser === false });
   console.log(`\u2713 logged in to ${inst.name} (${inst.url})`);
 }
 async function logoutCmd(target) {
@@ -5400,7 +5477,7 @@ async function logoutCmd(target) {
 }
 var program = new Command();
 program.name("malloyyo").description("Publish Malloy models to a Malloyyo instance").version(version);
-program.command("login").argument("[target]", "target name or instance URL (optional if the config has one target)").description("sign in to an instance in your browser (stores a token)").action(loginCmd);
+program.command("login").argument("[target]", "target name or instance URL (optional if the config has one target)").option("--no-browser", "print the sign-in URL instead of launching a browser").description("sign in to an instance in your browser (stores a token)").action(loginCmd);
 program.command("logout").argument("[target]", "target name or instance URL (optional if the config has one target)").description("forget the stored token for an instance").action(logoutCmd);
 program.command("publish").argument(
   "[target]",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@malloydata/malloyyo",
-  "version": "0.2.39",
+  "version": "0.2.41",
   "description": "Publish Malloy models to a Malloyyo instance",
   "license": "MIT",
   "repository": {