npm - @malloydata/malloyyo - Versions diffs - 0.2.40 → 0.2.41 - Mend

@malloydata/malloyyo 0.2.40 → 0.2.41

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/dist/frame-inpage-entry.tsx +8 -2
package/dist/index.js +64 -39
package/package.json +1 -1

package/dist/frame-inpage-entry.tsx CHANGED Viewed

@@ -35,10 +35,16 @@ const givensToUrl = (dashboard, givens) => {
 mountInPage({
   root: document.getElementById("root"),
-  // Governed query — the shell's trusted /api/run (the same endpoint the iframe
+  // Governed query — the shell's trusted api/run (the same endpoint the iframe
   // broker forwards to). Returns the raw result the runtime normalizes.
+  //
+  // RELATIVE. A leading slash resolves against the ORIGIN, so behind anything
+  // serving this page under a prefix — code-server's `/proxy/<port>/`, a
+  // Codespaces forwarded port — the POST went to the proxy's own root and came
+  // back `405 Method Not Allowed` from the proxy rather than reaching the dev
+  // server at all. Resolved against the document, it is correct at any depth.
   run: (req, givens) =>
-    fetch("/api/run", {
+    fetch("api/run", {
       method: "POST",
       headers: { "content-type": "application/json" },
       body: JSON.stringify({ d: name, query: req.query, malloy: req.malloy, givens }),

package/dist/index.js CHANGED Viewed

@@ -2881,7 +2881,7 @@ function clearCreds(url6) {
 }
 // package.json
-var version = "0.2.40";
+var version = "0.2.41";
 // src/http.ts
 var USER_AGENT = `malloyyo/${version}`;
@@ -3382,6 +3382,7 @@ function siblingList(current, all, href) {
 // src/dashboard.ts
 var resolveFrameEntry = () => path6.join(resolveRuntimeDir(), "..", "frame-entry.tsx");
 var resolveInPageEntry = () => path6.join(resolveRuntimeDir(), "..", "frame-inpage-entry.tsx");
+var inlineScript = (js) => js.replace(/<\/(script)/gi, String.raw`<\/$1`);
 var esc2 = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 function makeBundler() {
   const cache = /* @__PURE__ */ new Map();
@@ -3457,9 +3458,26 @@ function makeInPageBundler() {
   };
 }
 var html = (body, title) => `<!doctype html><html><head><meta charset="utf-8"><title>${esc2(title)}</title><meta name="viewport" content="width=device-width,initial-scale=1"><style>${NAV_CSS}</style></head><body style="margin:0">${body}</body></html>`;
-var devSiblings = (dash, all) => siblingList(dash.name, all, (n) => `/?d=${encodeURIComponent(n)}`);
+var dashLink = (n) => `?d=${encodeURIComponent(n)}`;
+var DEV_PATHS = {
+  /** Sibling dashboard, for the switcher in the nav bar. */
+  dashboard: dashLink,
+  /** In-page (tag-only) bundle. */
+  inPage: (n) => `inpage.js?d=${encodeURIComponent(n)}`,
+  /** Artifact bundle, for a dashboard with a Dashboard.tsx. */
+  bundle: (n) => `bundle.js?d=${encodeURIComponent(n)}`,
+  /** The sandboxed artifact document. Same origin as the shell, relative like
+      everything else — the iframe is isolated by its OPAQUE origin (the
+      `allow-scripts`-only sandbox), not by living on a second port. */
+  frame: (n) => `frame?d=${encodeURIComponent(n)}`,
+  /** Live-reload stream. */
+  events: "events",
+  /** The privileged query broker the parent shell brokers postMessage into. */
+  run: "api/run"
+};
+var devSiblings = (dash, all) => siblingList(dash.name, all, dashLink);
 function navHtml2(dash, all) {
-  return navHtml(dash.name, all, (n) => `/?d=${encodeURIComponent(n)}`);
+  return navHtml(dash.name, all, dashLink);
 }
 function inPageShell(dash, all, givenSpecs, initialGivens, initialUrlState, tileSpecs) {
   const info = {
@@ -3474,21 +3492,20 @@ function inPageShell(dash, all, givenSpecs, initialGivens, initialUrlState, tile
     autorun: dash.autorun
   };
   return html(
-    navHtml2(dash, all) + `<div id="root"></div><script>window.__DASHBOARD__=${safeJson(info)};window.__DASHBOARDS__=${safeJson(devSiblings(dash, all))};window.__GIVENS__=${safeJson(givenSpecs)};window.__INITIAL_GIVENS__=${safeJson(initialGivens)};window.__INITIAL_URLSTATE__=${safeJson(initialUrlState)}</script><script>try{new EventSource('/events').onmessage=()=>location.reload();}catch(e){}</script><script src="/inpage.js?d=${encodeURIComponent(dash.name)}"></script>`,
+    navHtml2(dash, all) + `<div id="root"></div><script>window.__DASHBOARD__=${safeJson(info)};window.__DASHBOARDS__=${safeJson(devSiblings(dash, all))};window.__GIVENS__=${safeJson(givenSpecs)};window.__INITIAL_GIVENS__=${safeJson(initialGivens)};window.__INITIAL_URLSTATE__=${safeJson(initialUrlState)}</script><script>try{new EventSource('${DEV_PATHS.events}').onmessage=()=>location.reload();}catch(e){}</script><script src="${DEV_PATHS.inPage(dash.name)}"></script>`,
     dash.title
   );
 }
-function parentShell(dash, frameBase, all, initialGivens, initialUrlState) {
+function parentShell(dash, all, initialGivens, initialUrlState) {
   const givensQs = Object.entries({ ...initialGivens, ...initialUrlState }).map(([k, v]) => `&${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("");
   const d = safeJson(dash.name);
-  const fb = safeJson(frameBase);
   const nav = navHtml2(dash, all);
   return html(
     `<div style="display:flex;flex-direction:column;height:100vh">` + nav + // allow-popups(+escape-sandbox): let a # link mark open its target in a
     // normal new tab on click instead of being blocked by the sandbox.
-    `<iframe id="f" sandbox="allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox" src="${frameBase}/frame?d=${encodeURIComponent(dash.name)}${givensQs}" style="border:0;flex:1;width:100%"></iframe></div><script>
+    `<iframe id="f" sandbox="allow-scripts allow-popups allow-popups-to-escape-sandbox" src="${DEV_PATHS.frame(dash.name)}${givensQs}" style="border:0;flex:1;width:100%"></iframe></div><script>
 const f=document.getElementById('f');
-try{new EventSource('/events').onmessage=()=>location.reload();}catch(e){}
+try{new EventSource('${DEV_PATHS.events}').onmessage=()=>location.reload();}catch(e){}
 // The shareable URL has TWO namespaces the frame syncs independently:
 // '$NAME' = a given (the governed query contract), '~key' = a custom
 // component's useUrlState view-state. Each write must re-emit the other's
@@ -3503,7 +3520,7 @@ function shareUrl(dashboard){
   return u.pathname+u.search;
 }
 window.addEventListener('message',async(e)=>{
-  if(e.source!==f.contentWindow||e.origin!==${fb})return;
+  if(e.source!==f.contentWindow)return;
   const m=e.data;
   if(m&&m.type==='givens'){
     G=m.givens||{};
@@ -3525,11 +3542,11 @@ window.addEventListener('message',async(e)=>{
   if(!m||m.type!=='run')return;
   let out;
   try{
-    const res=await fetch('/api/run',{method:'POST',headers:{'content-type':'application/json'},
+    const res=await fetch('${DEV_PATHS.run}',{method:'POST',headers:{'content-type':'application/json'},
       body:JSON.stringify({d:${d},query:m.query,malloy:m.malloy,givens:m.givens,dashboard:m.dashboard})});
     out=await res.json();
   }catch(err){ out={ok:false,problems:[{message:String(err)}]}; }
-  f.contentWindow.postMessage({type:'result',id:m.id,...out},${fb});
+  f.contentWindow.postMessage({type:'result',id:m.id,...out},'*');
 });
 </script>`,
     dash.title
@@ -3541,7 +3558,7 @@ function givensFromUrl(url6) {
 function urlStateFromUrl(url6) {
   return urlStateFromSearch(url6.search);
 }
-function frameDoc(dash, all, givenSpecs, initialGivens, initialUrlState, tileSpecs) {
+function frameDoc(dash, all, givenSpecs, initialGivens, initialUrlState, bundleJs, tileSpecs) {
   const info = {
     name: dash.name,
     query: dash.query,
@@ -3556,7 +3573,7 @@ function frameDoc(dash, all, givenSpecs, initialGivens, initialUrlState, tileSpe
     autorun: dash.autorun
   };
   return html(
-    `<div id="root"></div><script>window.__DASHBOARD__=${safeJson(info)};window.__DASHBOARDS__=${safeJson(devSiblings(dash, all))};window.__GIVENS__=${safeJson(givenSpecs)};window.__INITIAL_GIVENS__=${safeJson(initialGivens)};window.__INITIAL_URLSTATE__=${safeJson(initialUrlState)}</script><script src="/bundle.js?d=${encodeURIComponent(dash.name)}"></script>`,
+    `<div id="root"></div><script>window.__DASHBOARD__=${safeJson(info)};window.__DASHBOARDS__=${safeJson(devSiblings(dash, all))};window.__GIVENS__=${safeJson(givenSpecs)};window.__INITIAL_GIVENS__=${safeJson(initialGivens)};window.__INITIAL_URLSTATE__=${safeJson(initialUrlState)}</script><script>${inlineScript(bundleJs)}</script>`,
     dash.title
   );
 }
@@ -3569,8 +3586,6 @@ async function serveDashboard(opts) {
   await initConnections();
   const root = path6.resolve(opts.root ?? process.cwd());
   const port = opts.port ?? 4173;
-  const framePort = port + 1;
-  const frameBase = `http://localhost:${framePort}`;
   const runner = await makeRunner(root);
   if (!runner.entryExists()) {
     throw new Error(`No index.malloy at ${root} \u2014 run this from a Malloy model repo.`);
@@ -3618,34 +3633,39 @@ async function serveDashboard(opts) {
     console.error(`  (file watch unavailable: ${e.message} \u2014 edits won't auto-reload)`);
   }
   const handler = async (req, res) => {
-    const onFramePort = (req.socket.localPort ?? port) === framePort;
-    const url6 = new URL(req.url ?? "/", `http://localhost:${onFramePort ? framePort : port}`);
+    const url6 = new URL(req.url ?? "/", `http://localhost:${port}`);
     const send = (code, type, body, extra = {}) => {
       res.writeHead(code, { "content-type": type, ...extra });
       res.end(body);
     };
     try {
-      if (onFramePort) {
-        if (url6.pathname === "/frame") {
-          const dash = pick(url6);
-          const g = await resolveGivens(dash);
-          if (!g.ok) {
-            return send(
-              200,
-              "text/html; charset=utf-8",
-              html(`<pre style="color:crimson;padding:16px">model error: ${esc2(g.error)}</pre>`, dash.title)
-            );
-          }
+      if (url6.pathname === "/frame") {
+        const dash = pick(url6);
+        const g = await resolveGivens(dash);
+        if (!g.ok) {
           return send(
             200,
             "text/html; charset=utf-8",
-            frameDoc(dash, dashboards, g.union, givensFromUrl(url6), urlStateFromUrl(url6), g.tiles)
+            html(`<pre style="color:crimson;padding:16px">model error: ${esc2(g.error)}</pre>`, dash.title)
           );
         }
-        if (url6.pathname === "/bundle.js") {
-          return send(200, "application/javascript; charset=utf-8", await bundle(pick(url6)));
-        }
-        return send(404, "text/plain", "not found");
+        return send(
+          200,
+          "text/html; charset=utf-8",
+          frameDoc(
+            dash,
+            dashboards,
+            g.union,
+            givensFromUrl(url6),
+            urlStateFromUrl(url6),
+            await bundle(dash),
+            g.tiles
+          ),
+          { "cache-control": "no-store" }
+        );
+      }
+      if (url6.pathname === "/bundle.js") {
+        return send(200, "application/javascript; charset=utf-8", await bundle(pick(url6)));
       }
       if (url6.pathname === "/events") {
         res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-cache", connection: "keep-alive" });
@@ -3668,17 +3688,24 @@ async function serveDashboard(opts) {
           return send(
             200,
             "text/html; charset=utf-8",
-            inPageShell(dash, dashboards, g.union, givensFromUrl(url6), urlStateFromUrl(url6), g.tiles)
+            inPageShell(dash, dashboards, g.union, givensFromUrl(url6), urlStateFromUrl(url6), g.tiles),
+            { "cache-control": "no-store" }
           );
         }
         return send(
           200,
           "text/html; charset=utf-8",
-          parentShell(dash, frameBase, dashboards, givensFromUrl(url6), urlStateFromUrl(url6))
+          parentShell(dash, dashboards, givensFromUrl(url6), urlStateFromUrl(url6)),
+          { "cache-control": "no-store" }
         );
       }
       if (url6.pathname === "/inpage.js") {
-        return send(200, "application/javascript; charset=utf-8", await inPageBundle());
+        return send(
+          200,
+          "application/javascript; charset=utf-8",
+          await inPageBundle(),
+          { "cache-control": "no-store" }
+        );
       }
       if (url6.pathname === "/api/run" && req.method === "POST") {
         const { d, query, malloy, givens } = JSON.parse(await readBody(req));
@@ -3694,12 +3721,10 @@ async function serveDashboard(opts) {
     }
   };
   const shellServer = http2.createServer(handler);
-  const frameServer = http2.createServer(handler);
   await new Promise((r) => shellServer.listen(port, r));
-  await new Promise((r) => frameServer.listen(framePort, r));
   console.error(`
   malloyyo dashboard dev \u2014 model: ${root}`);
-  console.error(`  http://localhost:${port}/   (artifact origin: ${frameBase})`);
+  console.error(`  http://localhost:${port}/`);
   for (const d of dashboards) {
     const kind = d.tsxPath ? "custom (iframe)" : "tag-only (in-page)";
     console.error(`    \u2022 ${d.name} (${kind})  \u2192  http://localhost:${port}/?d=${d.name}`);

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@malloydata/malloyyo",
-  "version": "0.2.40",
+  "version": "0.2.41",
   "description": "Publish Malloy models to a Malloyyo instance",
   "license": "MIT",
   "repository": {