@mudlet/mudlet-web 0.3.0 → 0.3.1

package/dist-lib/ui/CharLoginModal.d.ts

@@ -19,6 +19,10 @@ interface CharLoginModalProps {
     /** Decline GMCP login — sends the empty reply so the server falls back to
      *  its text login prompt. */
     onCancel: () => void;
+    /** Where focus goes once the popup closes. The server raised this dialog,
+     *  not a click, so there is no meaningful opener to return to — the caller
+     *  points this at the command line so the player can type straight away. */
+    restoreFocusTo?: () => HTMLElement | null | undefined;
 }
 /**
  * Credentials popup for GMCP `Char.Login` authentication. Rendered as a real
@@ -28,5 +32,5 @@ interface CharLoginModalProps {
  * the inline warning); the password is otherwise handed straight to `onSubmit`
  * and relayed to the server, never stored. Cancelling falls back to text login.
  */
-export declare function CharLoginModal({ connectionName, error, initialAccount, initialPassword, initialRemember, allowRemember, onSubmit, onCancel, }: CharLoginModalProps): import("react/jsx-runtime").JSX.Element;
+export declare function CharLoginModal({ connectionName, error, initialAccount, initialPassword, initialRemember, allowRemember, onSubmit, onCancel, restoreFocusTo, }: CharLoginModalProps): import("react/jsx-runtime").JSX.Element;
 export {};

package/dist-lib/ui/FileBrowserModal.d.ts

@@ -1,4 +1,5 @@
 import type { ProfileVFS } from '../scripting/vfs/ProfileVFS';
+export declare function collectZipEntries(vfs: ProfileVFS, dirPath: string, prefix: string, out: Record<string, Uint8Array>, depth?: number): void;
 export interface VFSNode {
     name: string;
     path: string;

package/dist-lib/ui/SettingsModal.d.ts

@@ -1,9 +1,13 @@
 import type { ProfileVFS } from '../scripting/vfs/ProfileVFS';
+import type { TlsStatus } from '../mud/events';
 interface SettingsModalProps {
     onClose: () => void;
     /** Active profile id; null on the connection screen (only theme is editable). */
     connectionId: string | null;
     vfs?: ProfileVFS | null;
+    /** TLS state of the live session, when there is one. Drives the certificate
+     *  box below the secure-connection reminder. */
+    tlsStatus?: TlsStatus | null;
 }
-export declare function SettingsModal({ onClose, connectionId, vfs }: SettingsModalProps): import("react/jsx-runtime").JSX.Element;
+export declare function SettingsModal({ onClose, connectionId, vfs, tlsStatus }: SettingsModalProps): import("react/jsx-runtime").JSX.Element;
 export {};

package/dist-lib/ui/TlsAlertBanner.d.ts

@@ -0,0 +1,18 @@
+import type { TlsStatus } from '../mud/events';
+interface Props {
+    status: TlsStatus;
+    /** The plaintext port to fall back to, when one was remembered. */
+    revertPort?: number;
+    onRevert: () => void;
+    onDismiss: () => void;
+}
+/**
+ * Explains a TLS connection that didn't work, and offers the way back.
+ *
+ * Mudlet reacts to a certificate failure by opening Preferences on the
+ * connection tab with the offending checkbox highlighted; the browser
+ * equivalent is to say which setting would allow it and let the user undo the
+ * port change in one click.
+ */
+export declare function TlsAlertBanner({ status, revertPort, onRevert, onDismiss }: Props): import("react/jsx-runtime").JSX.Element | null;
+export {};

package/dist-lib/ui/TlsCertificateBox.d.ts

@@ -0,0 +1,20 @@
+import type { TlsCertInfo } from '../mud/events';
+interface Props {
+    cert: TlsCertInfo | null;
+    /** False when the proxy runtime cannot read peer certificates at all. */
+    certInspection: boolean;
+    protocol?: string;
+    cipher?: string;
+    /** Faults the profile's ignore-flags waved through, if any. */
+    acceptedDespite?: string[];
+}
+/**
+ * The certificate of the current secure connection.
+ *
+ * Shows the same four fields Mudlet surfaces in Preferences → Connection
+ * (issuer, issued-to, expiry, serial), plus the negotiated protocol. When the
+ * proxy can't inspect certificates it says so rather than rendering an empty
+ * box — "unknown" and "none" would look identical otherwise.
+ */
+export declare function TlsCertificateBox({ cert, certInspection, protocol, cipher, acceptedDespite }: Props): import("react/jsx-runtime").JSX.Element | null;
+export {};

package/dist-lib/ui/TlsUpgradeModal.d.ts

@@ -0,0 +1,16 @@
+interface Props {
+    /** The secure port the server advertised via MSSP. */
+    port: number;
+    onAccept: () => void;
+    onDecline: () => void;
+}
+/**
+ * Offers the MSSP-advertised secure port. Wording follows Mudlet's prompt
+ * (cTelnet::promptTlsConnectionAvailable) so the choice reads the same to
+ * anyone arriving from the desktop client.
+ *
+ * Declining is permanent for the profile, so it is stated on the button's
+ * description rather than hidden behind a "don't ask again" checkbox.
+ */
+export declare function TlsUpgradeModal({ port, onAccept, onDecline }: Props): import("react/jsx-runtime").JSX.Element;
+export {};

package/dist-lib/ui/components/useModalFocus.d.ts

@@ -14,5 +14,11 @@ export interface ModalFocusOptions {
     /** Close on Escape via `onClose`. Default true. Set false when the modal has
      *  its own Escape handling (then `onClose` may be omitted). */
     closeOnEscape?: boolean;
+    /** Where focus should land on close, instead of the opener. Use when the
+     *  dialog was raised by the game rather than by a click, so "the opener" is
+     *  either nothing or a control that has since gone away — the GMCP login
+     *  popup hands focus to the command line this way. Falls back to the opener
+     *  when it returns null. */
+    restoreFocusTo?: () => HTMLElement | null | undefined;
 }
 export declare function useModalFocus<T extends HTMLElement = HTMLDivElement>(onClose?: () => void, opts?: ModalFocusOptions): React.RefObject<T | null>;

package/dist-lib/ui/labels/LabelManager.d.ts

@@ -70,6 +70,13 @@ export interface LabelState {
         visitedColor?: string;
         underline: boolean;
     };
+    /** Hrefs clicked in this label, tracked so `linkStyle.visitedColor` can be
+     *  applied explicitly — CSS `:visited` only ever matches real browser
+     *  history, so it never fires for the `send:`/`prompt:` pseudo-schemes label
+     *  links use. Mirrors Mudlet's `TLabel::mVisitedLinks`, which exists for the
+     *  same reason (Qt won't style them either). Only populated while a visited
+     *  color is set, as Mudlet does. */
+    visitedLinks?: Set<string>;
     /** Click handler installed by setLabelClickCallback. The event table mirrors
      *  Mudlet's `mudlet.mouse_button` shape: `{button, x, y, alt, ctrl, shift, meta}`. */
     onClick?: (event: LabelMouseEvent) => void;
@@ -117,11 +124,16 @@ export interface LabelWheelEvent extends LabelMouseEvent {
     };
 }
 type Listener = (labels: LabelState[]) => void;
+/** Runs the action behind an `<a href>` clicked inside a label — installed by
+ *  ScriptingAPI, which owns the send/prompt/openUrl/Lua machinery the schemes
+ *  map onto (see {@link LabelManager.setLinkActivator}). */
+type LinkActivator = (href: string) => void;
 export declare class LabelManager {
     readonly overlayZ: OverlayLayerOrder;
     private readonly labels;
     private readonly byParent;
     private readonly listeners;
+    private linkActivator;
     private indexAdd;
     private indexRemove;
     constructor(overlayZ?: OverlayLayerOrder);
@@ -175,6 +187,19 @@ export declare class LabelManager {
     setStyleSheet(name: string, css: string): boolean;
     /** Mudlet `setLinkStyle(labelName, linkColor, linkVisitedColor, underline)`. */
     setLinkStyle(name: string, color: string, visitedColor: string, underline: boolean): boolean;
+    /**
+     * Install the handler that runs a clicked label link (`<a href="send:…">`).
+     * The manager itself has no scripting access, so LabelOverlay routes clicks
+     * here and ScriptingAPI supplies the behaviour.
+     */
+    setLinkActivator(fn: LinkActivator | null): void;
+    /**
+     * A link inside `name`'s rich text was clicked. Records it as visited (when
+     * a visited color is configured) and runs the activator — Mudlet's
+     * `TLabel::slot_linkActivated`, which does the same two things in the same
+     * order.
+     */
+    activateLink(name: string, href: string): void;
     /** Mudlet `resetLinkStyle(labelName)` — drop any setLinkStyle override. */
     resetLinkStyle(name: string): boolean;
     /** Mudlet `getLabelStyleSheet(name)` — the Qt-style CSS last set via

package/dist-lib/ui/labels/labelLinks.d.ts

@@ -0,0 +1,52 @@
+/**
+ * `<a href>` links inside a label's rich text — Mudlet's `TLabel::slot_linkActivated`
+ * (src/TLabel.cpp).
+ *
+ * Geyser packages build clickable UI by echoing anchors into a label:
+ *
+ *   myLabel:echo([[<a href="send:help topics">Help</a>]])
+ *
+ * and the href's scheme decides what a click does. The rules deliberately differ
+ * from the OSC 8 links the main window renders (`classifyHyperlinkUri`):
+ *
+ * - a scheme-less href is **Lua source** to run, not a dropped link;
+ * - only `send:`, `prompt:`, `http:` and `https:` are recognised (no `ftp:`);
+ * - the payload is **not** percent-decoded — Qt hands `linkActivated` the href
+ *   verbatim, so `send:cast fireball` reaches the MUD with its literal space.
+ *
+ * Any other scheme is ignored rather than falling through to the Lua branch,
+ * which is what stops a `javascript:`/`file:`/`data:` href from executing.
+ */
+export type LabelLinkAction = {
+    kind: 'send';
+    command: string;
+} | {
+    kind: 'prompt';
+    command: string;
+} | {
+    kind: 'url';
+    url: string;
+}
+/** No scheme at all — the whole href is a Lua chunk. */
+ | {
+    kind: 'lua';
+    code: string;
+};
+/**
+ * Classify a label link href. Returns null when the link does nothing (empty,
+ * or an unrecognised scheme).
+ *
+ * Like Mudlet, the split is on the first `:` rather than an RFC 3986 scheme
+ * match — so a scheme-less chunk that happens to contain a colon
+ * (`myTable:method()`) is treated as an unknown scheme and ignored.
+ */
+export declare function classifyLabelLink(href: string): LabelLinkAction | null;
+/**
+ * The href of the anchor an event target sits inside, or null when the click
+ * didn't land on a link.
+ *
+ * Read through `getAttribute` on purpose: the `.href` *property* resolves the
+ * value against the page URL and percent-encodes it, which would turn
+ * `send:help topics` into `send:help%20topics` and mangle the command.
+ */
+export declare function labelLinkHref(target: EventTarget | null): string | null;

package/dist-lib/ui/output/linkNavigation.d.ts

@@ -11,7 +11,29 @@
  * the send/prompt/url action, reveals a spoiler, toggles selection, arms
  * visibility); the Menu key or Shift+F10 opens its context menu. Mirrors
  * Mudlet's TTextEdit key handling.
+ *
+ * Being focusable has a mouse-side cost, which `restoreFocusAfterLinkClick`
+ * pays back: a tabIndex of -1 keeps a span out of the Tab order but still lets
+ * a click focus it, and Mudlet's TTextEdit never takes focus off the command
+ * line that way.
+ */
+/**
+ * Give focus back to the command line after a link is clicked with the mouse,
+ * so the player can keep typing — Mudlet's behaviour, where the output never
+ * takes focus at all.
+ *
+ * Call from a *capture*-phase click listener on the output container: a link's
+ * own handler stops propagation, so a bubble-phase listener never sees it. The
+ * hand-back is deferred to a microtask (i.e. after the click has been fully
+ * dispatched) and happens only if a link is still holding focus — a link that
+ * opened a dialog or moved focus deliberately keeps its say. Keyboard
+ * activation (`link.click()` from Enter/Space, which reports `detail === 0`)
+ * leaves focus on the link so Ctrl+]/Ctrl+[ can carry on from there.
  */
+export declare function restoreFocusAfterLinkClick(e: {
+    detail: number;
+    target: EventTarget | null;
+}, commandInput: () => HTMLElement | null | undefined): void;
 /**
  * One representative element per logical link under `root`, in document order.
  * A multicolour link is rendered as several spans (one per colour run) sharing

package/dist-lib/ui/windows/WindowManager.d.ts

@@ -146,6 +146,9 @@ export declare class WindowManager {
     /** Bridge to ScriptingEngine.downloadMap — the map UI's "download map from
      *  game" action (Mudlet dlgMapper's Download button). */
     onDownloadMap?: () => void;
+    /** Bridge to the Lua speedwalk entry point (Mudlet Host::startSpeedWalk),
+     *  wired by ScriptingEngine. Driven by {@link startSpeedWalk}. */
+    onStartSpeedWalk?: (from: number, to: number) => void;
     /** The MMP map URL from GMCP `Client.Map`, or '' when none announced. */
     get mmpMapLocation(): string;
     /** Record the game-announced map URL (Mudlet TMap::setMmpMapLocation). */
@@ -327,6 +330,20 @@ export declare class WindowManager {
     registerMapCallback(id: string, cb: (roomId: number) => void): void;
     unregisterMapCallback(id: string): void;
     centerView(roomId: number): boolean;
+    /**
+     * Mudlet `T2DMap::initiateSpeedWalk` — start a speedwalk from the player's
+     * current room to `targetRoomId`, the room the user double-clicked on the
+     * map (or the far side of a double-clicked out-of-area exit).
+     *
+     * Like Mudlet, an unknown target room is ignored outright, while an unknown
+     * *player* room is not: it pathfinds from -1 (Mudlet uses the missing
+     * profile entry, 0), finds nothing, and the Lua side reports the mapper's
+     * "cannot find a path" message rather than failing silently.
+     *
+     * Returns false when the gesture didn't start a walk — no such room, or no
+     * scripting runtime attached to walk it.
+     */
+    startSpeedWalk(targetRoomId: number): boolean;
     registerMapControl(id: string, ctrl: MapControl): void;
     unregisterMapControl(id: string): void;
     /** Live zoom of the displayed 2D map, or null when no map panel is mounted.

package/dist-lib/vfs-sw.js

@@ -1,131 +1,131 @@
-// Service worker that serves ProfileVFS-backed assets at /__vfs/<connectionId>/<path>.
-// The page is the source of truth for VFS contents (the SW can't share folder
-// handles or always-open the same IDB store), so each request round-trips to
-// the client via MessageChannel.
-
-const CACHE_NAME = 'mudix-vfs-v1';
-// Scope path always ends with '/'. On a root-served deploy this is '/'; on
-// GitHub Pages or any subpath deploy it's '/<repo>/'. The intercept prefix is
-// '<scope>__vfs/' so SW-controlled URLs stay inside scope.
-const SCOPE_PATH = new URL(self.registration.scope).pathname;
-const PREFIX = `${SCOPE_PATH}__vfs/`;
-const READ_TIMEOUT_MS = 5000;
-
-self.addEventListener('install', () => self.skipWaiting());
-self.addEventListener('activate', (e) => e.waitUntil(self.clients.claim()));
-
-self.addEventListener('fetch', (event) => {
-    const url = new URL(event.request.url);
-    if (url.origin !== self.location.origin) return;
-    if (!url.pathname.startsWith(PREFIX)) return;
-    event.respondWith(handle(event, url));
-});
-
-async function handle(event, url) {
-    const rest = url.pathname.slice(PREFIX.length).split('/').filter(Boolean);
-    if (rest.length < 2) return new Response('Bad request', { status: 400 });
-    const connectionId = decodeURIComponent(rest[0]);
-    const filePath = '/' + rest.slice(1).map(decodeURIComponent).join('/');
-
-    const cache = await caches.open(CACHE_NAME);
-    const cached = await cache.match(event.request);
-    if (cached) return cached;
-
-    const client = await pickClient(event);
-    if (!client) {
-        // Either there's no app tab loaded (direct URL hit in fresh tab) or
-        // the only candidate is the tab currently navigating to this URL.
-        return new Response('No app tab loaded; open mudix first', { status: 503 });
-    }
-
-    const reply = await ask(client, { type: 'vfs:read', connectionId, path: filePath });
-    if (!reply || !reply.ok) {
-        return new Response(reply?.error ?? 'Not found', { status: 404 });
-    }
-
-    const headers = new Headers();
-    headers.set('Content-Type', reply.contentType || 'application/octet-stream');
-    // no-store keeps this response out of the browser's own HTTP cache, which
-    // has no validator to revalidate against (we set none) and would otherwise
-    // race our explicit Cache Storage entry above — that race is what produced
-    // stale 304-with-no-body responses for cached images. The Cache Storage
-    // entry (invalidated on writes via postMessage) is the only cache that
-    // should own this decision.
-    headers.set('Cache-Control', 'no-store');
-    const response = new Response(reply.bytes, { headers });
-    cache.put(event.request, response.clone()).catch(() => {});
-    return response;
-}
-
-async function pickClient(event) {
-    // Prefer the client that issued this request — for sub-resource fetches
-    // that's the loaded app page, which can reply immediately.
-    const requestingId = event.clientId || event.resultingClientId || '';
-    if (requestingId) {
-        const c = await self.clients.get(requestingId);
-        if (c && isUsable(c)) return c;
-    }
-    const all = await self.clients.matchAll({ type: 'window', includeUncontrolled: true });
-    const usable = all.filter(isUsable);
-    return usable.find((c) => c.focused) ?? usable[0] ?? null;
-}
-
-// Skip clients that are themselves navigating to a /__vfs/ URL — those are
-// fresh tabs in the middle of loading the SW response; they have no JS running
-// and can't reply, so picking one guarantees a timeout.
-function isUsable(client) {
-    try {
-        return !new URL(client.url).pathname.startsWith(PREFIX);
-    } catch {
-        return false;
-    }
-}
-
-function ask(client, message) {
-    return new Promise((resolve) => {
-        const channel = new MessageChannel();
-        const timer = setTimeout(() => {
-            channel.port1.close();
-            resolve({ ok: false, error: 'timeout' });
-        }, READ_TIMEOUT_MS);
-        channel.port1.onmessage = (e) => {
-            clearTimeout(timer);
-            channel.port1.close();
-            resolve(e.data);
-        };
-        client.postMessage(message, [channel.port2]);
-    });
-}
-
-self.addEventListener('message', (event) => {
-    const data = event.data;
-    if (!data) return;
-    if (data.type === 'vfs:invalidate') {
-        event.waitUntil(invalidate(data));
-    }
-});
-
-async function invalidate({ connectionId, path }) {
-    if (!connectionId) {
-        await caches.delete(CACHE_NAME);
-        return;
-    }
-    const cache = await caches.open(CACHE_NAME);
-    const connPrefix = `${PREFIX}${encodeURIComponent(connectionId)}/`;
-    const keys = await cache.keys();
-    if (path) {
-        const segs = path.split('/').filter(Boolean).map(encodeURIComponent).join('/');
-        const target = `${connPrefix}${segs}`;
-        await Promise.all(
-            keys
-                .filter((req) => new URL(req.url).pathname === target)
-                .map((req) => cache.delete(req)),
-        );
-        return;
-    }
-    await Promise.all(
-        keys
-            .filter((req) => new URL(req.url).pathname.startsWith(connPrefix))
-            .map((req) => cache.delete(req)),
-    );
-}
+// Service worker that serves ProfileVFS-backed assets at /__vfs/<connectionId>/<path>.
+// The page is the source of truth for VFS contents (the SW can't share folder
+// handles or always-open the same IDB store), so each request round-trips to
+// the client via MessageChannel.
+
+const CACHE_NAME = 'mudix-vfs-v1';
+// Scope path always ends with '/'. On a root-served deploy this is '/'; on
+// GitHub Pages or any subpath deploy it's '/<repo>/'. The intercept prefix is
+// '<scope>__vfs/' so SW-controlled URLs stay inside scope.
+const SCOPE_PATH = new URL(self.registration.scope).pathname;
+const PREFIX = `${SCOPE_PATH}__vfs/`;
+const READ_TIMEOUT_MS = 5000;
+
+self.addEventListener('install', () => self.skipWaiting());
+self.addEventListener('activate', (e) => e.waitUntil(self.clients.claim()));
+
+self.addEventListener('fetch', (event) => {
+    const url = new URL(event.request.url);
+    if (url.origin !== self.location.origin) return;
+    if (!url.pathname.startsWith(PREFIX)) return;
+    event.respondWith(handle(event, url));
+});
+
+async function handle(event, url) {
+    const rest = url.pathname.slice(PREFIX.length).split('/').filter(Boolean);
+    if (rest.length < 2) return new Response('Bad request', { status: 400 });
+    const connectionId = decodeURIComponent(rest[0]);
+    const filePath = '/' + rest.slice(1).map(decodeURIComponent).join('/');
+
+    const cache = await caches.open(CACHE_NAME);
+    const cached = await cache.match(event.request);
+    if (cached) return cached;
+
+    const client = await pickClient(event);
+    if (!client) {
+        // Either there's no app tab loaded (direct URL hit in fresh tab) or
+        // the only candidate is the tab currently navigating to this URL.
+        return new Response('No app tab loaded; open mudix first', { status: 503 });
+    }
+
+    const reply = await ask(client, { type: 'vfs:read', connectionId, path: filePath });
+    if (!reply || !reply.ok) {
+        return new Response(reply?.error ?? 'Not found', { status: 404 });
+    }
+
+    const headers = new Headers();
+    headers.set('Content-Type', reply.contentType || 'application/octet-stream');
+    // no-store keeps this response out of the browser's own HTTP cache, which
+    // has no validator to revalidate against (we set none) and would otherwise
+    // race our explicit Cache Storage entry above — that race is what produced
+    // stale 304-with-no-body responses for cached images. The Cache Storage
+    // entry (invalidated on writes via postMessage) is the only cache that
+    // should own this decision.
+    headers.set('Cache-Control', 'no-store');
+    const response = new Response(reply.bytes, { headers });
+    cache.put(event.request, response.clone()).catch(() => {});
+    return response;
+}
+
+async function pickClient(event) {
+    // Prefer the client that issued this request — for sub-resource fetches
+    // that's the loaded app page, which can reply immediately.
+    const requestingId = event.clientId || event.resultingClientId || '';
+    if (requestingId) {
+        const c = await self.clients.get(requestingId);
+        if (c && isUsable(c)) return c;
+    }
+    const all = await self.clients.matchAll({ type: 'window', includeUncontrolled: true });
+    const usable = all.filter(isUsable);
+    return usable.find((c) => c.focused) ?? usable[0] ?? null;
+}
+
+// Skip clients that are themselves navigating to a /__vfs/ URL — those are
+// fresh tabs in the middle of loading the SW response; they have no JS running
+// and can't reply, so picking one guarantees a timeout.
+function isUsable(client) {
+    try {
+        return !new URL(client.url).pathname.startsWith(PREFIX);
+    } catch {
+        return false;
+    }
+}
+
+function ask(client, message) {
+    return new Promise((resolve) => {
+        const channel = new MessageChannel();
+        const timer = setTimeout(() => {
+            channel.port1.close();
+            resolve({ ok: false, error: 'timeout' });
+        }, READ_TIMEOUT_MS);
+        channel.port1.onmessage = (e) => {
+            clearTimeout(timer);
+            channel.port1.close();
+            resolve(e.data);
+        };
+        client.postMessage(message, [channel.port2]);
+    });
+}
+
+self.addEventListener('message', (event) => {
+    const data = event.data;
+    if (!data) return;
+    if (data.type === 'vfs:invalidate') {
+        event.waitUntil(invalidate(data));
+    }
+});
+
+async function invalidate({ connectionId, path }) {
+    if (!connectionId) {
+        await caches.delete(CACHE_NAME);
+        return;
+    }
+    const cache = await caches.open(CACHE_NAME);
+    const connPrefix = `${PREFIX}${encodeURIComponent(connectionId)}/`;
+    const keys = await cache.keys();
+    if (path) {
+        const segs = path.split('/').filter(Boolean).map(encodeURIComponent).join('/');
+        const target = `${connPrefix}${segs}`;
+        await Promise.all(
+            keys
+                .filter((req) => new URL(req.url).pathname === target)
+                .map((req) => cache.delete(req)),
+        );
+        return;
+    }
+    await Promise.all(
+        keys
+            .filter((req) => new URL(req.url).pathname.startsWith(connPrefix))
+            .map((req) => cache.delete(req)),
+    );
+}