@pwfabric/cli 0.0.0-stage → 1.0.0-rc.1

package/dist/dev/compile.js

@@ -0,0 +1,215 @@
+/**
+ * Compiling the atoms an app runs on — its own and those of every pinned
+ * pack — with the engine's compiler, and remembering the output by content
+ * hash so a rebuild only compiles what changed.
+ *
+ * The cache key of an atom is everything its output depends on: the compiler
+ * and esbuild versions, the atom's kind and entry, and the bytes of the files
+ * the compile can reach (the entry plus the shared companions it imports).
+ * Change one block and only that block — or the blocks sharing the changed
+ * companion — compile again.
+ */
+import { createHash } from 'node:crypto';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { join, posix } from 'node:path';
+import { COMPILER_VERSION, ESBUILD_VERSION, collectCompanions, compileAtom, } from '@pwfabric/compiler';
+import { atomKindMeta, resolveSiblingEntry } from '@pwfabric/contracts';
+import { isRecord, jsonOf } from './sources.js';
+/** Kinds that carry a compiled module. */
+export const COMPILED_KINDS = new Set(['block', 'capability', 'connector', 'provider']);
+/**
+ * A cache in `dir` (one JSON file per key) with an in-memory layer in front.
+ * Disk failures are not build failures: a cache that cannot be read or
+ * written just compiles again.
+ */
+export function createCompileCache(dir) {
+    const memory = new Map();
+    return {
+        async get(key) {
+            const hit = memory.get(key);
+            if (hit)
+                return hit;
+            if (!dir)
+                return undefined;
+            try {
+                const value = JSON.parse(await readFile(join(dir, `${key}.json`), 'utf8'));
+                if (typeof value?.code !== 'string' || typeof value.ok !== 'boolean' || !Array.isArray(value.diagnostics))
+                    return undefined;
+                memory.set(key, value);
+                return value;
+            }
+            catch {
+                return undefined;
+            }
+        },
+        async set(key, value) {
+            memory.set(key, value);
+            if (!dir)
+                return;
+            try {
+                await mkdir(dir, { recursive: true });
+                await writeFile(join(dir, `${key}.json`), JSON.stringify(value));
+            }
+            catch {
+                // A read-only or full disk only costs the next build a recompile.
+            }
+        },
+    };
+}
+export function sha256(bytes) {
+    return createHash('sha256').update(bytes).digest('hex');
+}
+/** The root under which a source keeps its atoms: `atoms/` in the canonical layout, `` in the rootless one. */
+export function atomRootOf(source) {
+    return [...source.folder.files.keys()].some((p) => p.startsWith('atoms/')) ? 'atoms/' : '';
+}
+/** The compiler's view of a source: atom files keyed by their path below the atom root. */
+export function compileTreeOf(source) {
+    const root = atomRootOf(source);
+    const tree = {};
+    for (const [path, bytes] of source.folder.files) {
+        if (root) {
+            if (path.startsWith(root))
+                tree[path.slice(root.length)] = bytes;
+        }
+        else if (path !== 'pwpack.json' && !path.startsWith('app/')) {
+            tree[path] = bytes;
+        }
+    }
+    return tree;
+}
+function manifestOf(source, ref) {
+    const own = ref.relPath.endsWith('.json') ? ref.relPath : posix.join(posix.dirname(ref.relPath), 'manifest.json');
+    const value = jsonOf(source.folder, own);
+    return isRecord(value) ? value : undefined;
+}
+function keyOf(parts) {
+    return sha256(JSON.stringify(parts));
+}
+function fileHashes(tree, paths) {
+    return [...new Set(paths)].sort().map((p) => [p, tree[p] ? sha256(tree[p]) : '-']);
+}
+/** Runs `fn` over `items` with at most `limit` in flight, keeping order. */
+export async function mapLimit(items, limit, fn) {
+    const out = new Array(items.length);
+    let next = 0;
+    const worker = async () => {
+        while (next < items.length) {
+            const i = next++;
+            out[i] = await fn(items[i]);
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(Math.max(1, limit), items.length) }, worker));
+    return out;
+}
+async function compileOne(job, cache) {
+    const { source, ref, tree, root } = job;
+    const bytes = source.folder.files.get(ref.relPath);
+    const manifest = manifestOf(source, ref);
+    const base = {
+        source,
+        kind: ref.kind,
+        id: ref.id,
+        relPath: ref.relPath,
+        sourceHash: `sha256:${ref.contentHash || sha256(bytes)}`,
+        ...(manifest ? { manifest } : {}),
+    };
+    const at = (virtual) => {
+        if (virtual === undefined)
+            return undefined;
+        const p = `${root}${virtual}`;
+        return source.label ? `${source.label}/${p}` : p;
+    };
+    const virtual = ref.relPath.slice(root.length);
+    const label = at(virtual);
+    const diagnostics = [];
+    const meta = atomKindMeta(ref.kind);
+    // A pack may ship an already-compiled block (`bundle.mjs`).
+    if (meta.precompiledFallback && ref.relPath.endsWith('.mjs')) {
+        return {
+            ...base,
+            status: 'precompiled',
+            code: new TextDecoder().decode(bytes),
+            hash: `sha256:${sha256(bytes)}`,
+            diagnostics,
+            fromCache: false,
+        };
+    }
+    let entry;
+    let engineName;
+    let reach;
+    let companions;
+    if (meta.entry === 'identity') {
+        entry = virtual;
+        const scan = collectCompanions(tree, entry);
+        for (const v of scan.violations) {
+            diagnostics.push({ severity: 'warning', code: 'SCREEN', message: v, path: label });
+        }
+        companions = [...scan.companions];
+        reach = [entry, ...companions];
+    }
+    else {
+        const sibling = resolveSiblingEntry(ref.kind, virtual);
+        if (!sibling || !tree[sibling.enginePath]) {
+            // No engine source beside the knowledge file: the engine is data (a
+            // declaration) or the atom is knowledge only. Nothing to compile.
+            return { ...base, status: 'declared', diagnostics, fromCache: false };
+        }
+        entry = sibling.wrapperPath;
+        engineName = posix.basename(sibling.enginePath, '.ts');
+        // An engine may import neighbours that are not companions; key on the whole tree.
+        reach = Object.keys(tree);
+    }
+    const key = keyOf([
+        COMPILER_VERSION,
+        ESBUILD_VERSION,
+        ref.kind,
+        entry,
+        engineName ?? null,
+        companions ?? null,
+        fileHashes(tree, reach),
+    ]);
+    let result = await cache.get(key);
+    const fromCache = result !== undefined;
+    if (!result) {
+        const compiled = await compileAtom({
+            files: tree,
+            entry,
+            kind: ref.kind,
+            ...(engineName !== undefined ? { engineName } : {}),
+            ...(companions !== undefined ? { companions } : {}),
+        });
+        result = { ok: compiled.ok, code: compiled.code, hash: compiled.hash, diagnostics: compiled.diagnostics };
+        await cache.set(key, result);
+    }
+    for (const d of result.diagnostics) {
+        diagnostics.push({
+            severity: d.severity,
+            code: d.code,
+            message: d.message,
+            path: at(d.file) ?? label,
+            ...(d.line !== undefined ? { line: d.line } : {}),
+            ...(d.column !== undefined ? { column: d.column } : {}),
+        });
+    }
+    if (!result.ok)
+        return { ...base, status: 'failed', diagnostics, fromCache };
+    return { ...base, status: 'compiled', code: result.code, hash: result.hash, diagnostics, fromCache };
+}
+/** Compiles every compiled-kind atom of every source. */
+export async function compileSources(sources, cache, concurrency = 8) {
+    const jobs = [];
+    for (const source of sources) {
+        const tree = compileTreeOf(source);
+        const root = atomRootOf(source);
+        for (const ref of source.validation.atoms) {
+            if (!COMPILED_KINDS.has(ref.kind))
+                continue;
+            if (!ref.relPath.startsWith(root))
+                continue;
+            jobs.push({ source, ref, tree, root });
+        }
+    }
+    return mapLimit(jobs, concurrency, (job) => compileOne(job, cache));
+}
+//# sourceMappingURL=compile.js.map

package/dist/dev/compile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compile.js","sourceRoot":"","sources":["../../src/dev/compile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,WAAW,GAEZ,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAA+B,MAAM,qBAAqB,CAAA;AAEpG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAmB,MAAM,cAAc,CAAA;AAEhE,0CAA0C;AAC1C,MAAM,CAAC,MAAM,cAAc,GAA0B,IAAI,GAAG,CAAW,CAAC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAA;AAsCxH;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAkB;IACnD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAA;IAC/C,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC3B,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAA;YACnB,IAAI,CAAC,GAAG;gBAAE,OAAO,SAAS,CAAA;YAC1B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,EAAE,MAAM,CAAC,CAAkB,CAAA;gBAC3F,IAAI,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;oBAAE,OAAO,SAAS,CAAA;gBAC3H,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBACtB,OAAO,KAAK,CAAA;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAA;YAClB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK;YAClB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACtB,IAAI,CAAC,GAAG;gBAAE,OAAM;YAChB,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;gBACrC,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;YAClE,CAAC;YAAC,MAAM,CAAC;gBACP,kEAAkE;YACpE,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAA0B;IAC/C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACzD,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,UAAU,CAAC,MAAkB;IAC3C,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAA;AAC5F,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,aAAa,CAAC,MAAkB;IAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;IAC/B,MAAM,IAAI,GAA+B,EAAE,CAAA;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAChD,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAA;QAClE,CAAC;aAAM,IAAI,IAAI,KAAK,aAAa,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,UAAU,CAAC,MAAkB,EAAE,GAAY;IAClD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC,CAAA;IACjH,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACxC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5C,CAAC;AAED,SAAS,KAAK,CAAC,KAAc;IAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;AACtC,CAAC;AAED,SAAS,UAAU,CAAC,IAA0C,EAAE,KAAwB;IACtF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;AAClG,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAO,KAAmB,EAAE,KAAa,EAAE,EAA2B;IAClG,MAAM,GAAG,GAAQ,IAAI,KAAK,CAAI,KAAK,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,MAAM,MAAM,GAAG,KAAK,IAAmB,EAAE;QACvC,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,IAAI,EAAE,CAAA;YAChB,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAM,CAAC,CAAA;QAClC,CAAC;IACH,CAAC,CAAA;IACD,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAA;IAC7F,OAAO,GAAG,CAAA;AACZ,CAAC;AASD,KAAK,UAAU,UAAU,CAAC,GAAY,EAAE,KAAmB;IACzD,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,GAAG,CAAA;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAe,CAAA;IAChE,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACxC,MAAM,IAAI,GAAG;QACX,MAAM;QACN,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,UAAU,EAAE,UAAU,GAAG,CAAC,WAAW,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE;QACxD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAA;IACD,MAAM,EAAE,GAAG,CAAC,OAA2B,EAAsB,EAAE;QAC7D,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAC3C,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,OAAO,EAAE,CAAA;QAC7B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAClD,CAAC,CAAA;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC9C,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAW,CAAA;IACnC,MAAM,WAAW,GAAyB,EAAE,CAAA;IAC5C,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAEnC,4DAA4D;IAC5D,IAAI,IAAI,CAAC,mBAAmB,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;YACrC,IAAI,EAAE,UAAU,MAAM,CAAC,KAAK,CAAC,EAAE;YAC/B,WAAW;YACX,SAAS,EAAE,KAAK;SACjB,CAAA;IACH,CAAC;IAED,IAAI,KAAa,CAAA;IACjB,IAAI,UAA8B,CAAA;IAClC,IAAI,KAAe,CAAA;IACnB,IAAI,UAAgC,CAAA;IACpC,IAAI,IAAI,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QAC9B,KAAK,GAAG,OAAO,CAAA;QACf,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC3C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAChC,WAAW,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACpF,CAAC;QACD,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAA;QACjC,KAAK,GAAG,CAAC,KAAK,EAAE,GAAG,UAAU,CAAC,CAAA;IAChC,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACtD,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,oEAAoE;YACpE,kEAAkE;YAClE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QACvE,CAAC;QACD,KAAK,GAAG,OAAO,CAAC,WAAW,CAAA;QAC3B,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QACtD,kFAAkF;QAClF,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC;QAChB,gBAAgB;QAChB,eAAe;QACf,GAAG,CAAC,IAAI;QACR,KAAK;QACL,UAAU,IAAI,IAAI;QAClB,UAAU,IAAI,IAAI;QAClB,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC;KACxB,CAAC,CAAA;IACF,IAAI,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACjC,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,CAAA;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC;YACjC,KAAK,EAAE,IAAI;YACX,KAAK;YACL,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,CAAC,CAAA;QACF,MAAM,GAAG,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAA;QACzG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC9B,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACnC,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK;YACzB,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,CAAA;IAC5E,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAA;AACtG,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAA8B,EAC9B,KAAmB,EACnB,WAAW,GAAG,CAAC;IAEf,MAAM,IAAI,GAAc,EAAE,CAAA;IAC1B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;QAClC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;QAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAC1C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAC3C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAC3C,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;AACrE,CAAC","sourcesContent":["/**\n * Compiling the atoms an app runs on — its own and those of every pinned\n * pack — with the engine's compiler, and remembering the output by content\n * hash so a rebuild only compiles what changed.\n *\n * The cache key of an atom is everything its output depends on: the compiler\n * and esbuild versions, the atom's kind and entry, and the bytes of the files\n * the compile can reach (the entry plus the shared companions it imports).\n * Change one block and only that block — or the blocks sharing the changed\n * companion — compile again.\n */\nimport { createHash } from 'node:crypto'\nimport { mkdir, readFile, writeFile } from 'node:fs/promises'\nimport { join, posix } from 'node:path'\nimport {\n  COMPILER_VERSION,\n  ESBUILD_VERSION,\n  collectCompanions,\n  compileAtom,\n  type CompileResult,\n} from '@pwfabric/compiler'\nimport { atomKindMeta, resolveSiblingEntry, type AtomKind, type AtomRef } from '@pwfabric/contracts'\nimport type { AssembleDiagnostic } from './diagnostics.js'\nimport { isRecord, jsonOf, type SourcePack } from './sources.js'\n\n/** Kinds that carry a compiled module. */\nexport const COMPILED_KINDS: ReadonlySet<AtomKind> = new Set<AtomKind>(['block', 'capability', 'connector', 'provider'])\n\n/** One atom after the compile step. */\nexport interface CompiledAtom {\n  readonly source: SourcePack\n  readonly kind: AtomKind\n  readonly id: string\n  /** Path of the atom's file inside its source folder. */\n  readonly relPath: string\n  /** `sha256:<hex>` of that file. */\n  readonly sourceHash: string\n  /**\n   * `compiled` — a module was produced; `precompiled` — the pack shipped one;\n   * `declared` — an engine that is data, nothing to compile; `failed`.\n   */\n  readonly status: 'compiled' | 'precompiled' | 'declared' | 'failed'\n  readonly code?: string\n  /** `sha256:<hex>` of `code`. */\n  readonly hash?: string\n  readonly diagnostics: readonly AssembleDiagnostic[]\n  readonly fromCache: boolean\n  /** The atom's manifest (`manifest.json` next to it, or the knowledge file itself). */\n  readonly manifest?: Record<string, unknown>\n}\n\n/** What the cache stores per key. */\nexport interface CachedCompile {\n  readonly ok: boolean\n  readonly code: string\n  readonly hash: string\n  readonly diagnostics: CompileResult['diagnostics']\n}\n\nexport interface CompileCache {\n  get(key: string): Promise<CachedCompile | undefined>\n  set(key: string, value: CachedCompile): Promise<void>\n}\n\n/**\n * A cache in `dir` (one JSON file per key) with an in-memory layer in front.\n * Disk failures are not build failures: a cache that cannot be read or\n * written just compiles again.\n */\nexport function createCompileCache(dir: string | null): CompileCache {\n  const memory = new Map<string, CachedCompile>()\n  return {\n    async get(key) {\n      const hit = memory.get(key)\n      if (hit) return hit\n      if (!dir) return undefined\n      try {\n        const value = JSON.parse(await readFile(join(dir, `${key}.json`), 'utf8')) as CachedCompile\n        if (typeof value?.code !== 'string' || typeof value.ok !== 'boolean' || !Array.isArray(value.diagnostics)) return undefined\n        memory.set(key, value)\n        return value\n      } catch {\n        return undefined\n      }\n    },\n    async set(key, value) {\n      memory.set(key, value)\n      if (!dir) return\n      try {\n        await mkdir(dir, { recursive: true })\n        await writeFile(join(dir, `${key}.json`), JSON.stringify(value))\n      } catch {\n        // A read-only or full disk only costs the next build a recompile.\n      }\n    },\n  }\n}\n\nexport function sha256(bytes: Uint8Array | string): string {\n  return createHash('sha256').update(bytes).digest('hex')\n}\n\n/** The root under which a source keeps its atoms: `atoms/` in the canonical layout, `` in the rootless one. */\nexport function atomRootOf(source: SourcePack): string {\n  return [...source.folder.files.keys()].some((p) => p.startsWith('atoms/')) ? 'atoms/' : ''\n}\n\n/** The compiler's view of a source: atom files keyed by their path below the atom root. */\nexport function compileTreeOf(source: SourcePack): Record<string, Uint8Array> {\n  const root = atomRootOf(source)\n  const tree: Record<string, Uint8Array> = {}\n  for (const [path, bytes] of source.folder.files) {\n    if (root) {\n      if (path.startsWith(root)) tree[path.slice(root.length)] = bytes\n    } else if (path !== 'pwpack.json' && !path.startsWith('app/')) {\n      tree[path] = bytes\n    }\n  }\n  return tree\n}\n\nfunction manifestOf(source: SourcePack, ref: AtomRef): Record<string, unknown> | undefined {\n  const own = ref.relPath.endsWith('.json') ? ref.relPath : posix.join(posix.dirname(ref.relPath), 'manifest.json')\n  const value = jsonOf(source.folder, own)\n  return isRecord(value) ? value : undefined\n}\n\nfunction keyOf(parts: unknown): string {\n  return sha256(JSON.stringify(parts))\n}\n\nfunction fileHashes(tree: Readonly<Record<string, Uint8Array>>, paths: readonly string[]): [string, string][] {\n  return [...new Set(paths)].sort().map((p) => [p, tree[p] ? sha256(tree[p] as Uint8Array) : '-'])\n}\n\n/** Runs `fn` over `items` with at most `limit` in flight, keeping order. */\nexport async function mapLimit<T, R>(items: readonly T[], limit: number, fn: (item: T) => Promise<R>): Promise<R[]> {\n  const out: R[] = new Array<R>(items.length)\n  let next = 0\n  const worker = async (): Promise<void> => {\n    while (next < items.length) {\n      const i = next++\n      out[i] = await fn(items[i] as T)\n    }\n  }\n  await Promise.all(Array.from({ length: Math.min(Math.max(1, limit), items.length) }, worker))\n  return out\n}\n\ninterface AtomJob {\n  readonly source: SourcePack\n  readonly ref: AtomRef\n  readonly tree: Readonly<Record<string, Uint8Array>>\n  readonly root: string\n}\n\nasync function compileOne(job: AtomJob, cache: CompileCache): Promise<CompiledAtom> {\n  const { source, ref, tree, root } = job\n  const bytes = source.folder.files.get(ref.relPath) as Uint8Array\n  const manifest = manifestOf(source, ref)\n  const base = {\n    source,\n    kind: ref.kind,\n    id: ref.id,\n    relPath: ref.relPath,\n    sourceHash: `sha256:${ref.contentHash || sha256(bytes)}`,\n    ...(manifest ? { manifest } : {}),\n  }\n  const at = (virtual: string | undefined): string | undefined => {\n    if (virtual === undefined) return undefined\n    const p = `${root}${virtual}`\n    return source.label ? `${source.label}/${p}` : p\n  }\n  const virtual = ref.relPath.slice(root.length)\n  const label = at(virtual) as string\n  const diagnostics: AssembleDiagnostic[] = []\n  const meta = atomKindMeta(ref.kind)\n\n  // A pack may ship an already-compiled block (`bundle.mjs`).\n  if (meta.precompiledFallback && ref.relPath.endsWith('.mjs')) {\n    return {\n      ...base,\n      status: 'precompiled',\n      code: new TextDecoder().decode(bytes),\n      hash: `sha256:${sha256(bytes)}`,\n      diagnostics,\n      fromCache: false,\n    }\n  }\n\n  let entry: string\n  let engineName: string | undefined\n  let reach: string[]\n  let companions: string[] | undefined\n  if (meta.entry === 'identity') {\n    entry = virtual\n    const scan = collectCompanions(tree, entry)\n    for (const v of scan.violations) {\n      diagnostics.push({ severity: 'warning', code: 'SCREEN', message: v, path: label })\n    }\n    companions = [...scan.companions]\n    reach = [entry, ...companions]\n  } else {\n    const sibling = resolveSiblingEntry(ref.kind, virtual)\n    if (!sibling || !tree[sibling.enginePath]) {\n      // No engine source beside the knowledge file: the engine is data (a\n      // declaration) or the atom is knowledge only. Nothing to compile.\n      return { ...base, status: 'declared', diagnostics, fromCache: false }\n    }\n    entry = sibling.wrapperPath\n    engineName = posix.basename(sibling.enginePath, '.ts')\n    // An engine may import neighbours that are not companions; key on the whole tree.\n    reach = Object.keys(tree)\n  }\n\n  const key = keyOf([\n    COMPILER_VERSION,\n    ESBUILD_VERSION,\n    ref.kind,\n    entry,\n    engineName ?? null,\n    companions ?? null,\n    fileHashes(tree, reach),\n  ])\n  let result = await cache.get(key)\n  const fromCache = result !== undefined\n  if (!result) {\n    const compiled = await compileAtom({\n      files: tree,\n      entry,\n      kind: ref.kind,\n      ...(engineName !== undefined ? { engineName } : {}),\n      ...(companions !== undefined ? { companions } : {}),\n    })\n    result = { ok: compiled.ok, code: compiled.code, hash: compiled.hash, diagnostics: compiled.diagnostics }\n    await cache.set(key, result)\n  }\n  for (const d of result.diagnostics) {\n    diagnostics.push({\n      severity: d.severity,\n      code: d.code,\n      message: d.message,\n      path: at(d.file) ?? label,\n      ...(d.line !== undefined ? { line: d.line } : {}),\n      ...(d.column !== undefined ? { column: d.column } : {}),\n    })\n  }\n  if (!result.ok) return { ...base, status: 'failed', diagnostics, fromCache }\n  return { ...base, status: 'compiled', code: result.code, hash: result.hash, diagnostics, fromCache }\n}\n\n/** Compiles every compiled-kind atom of every source. */\nexport async function compileSources(\n  sources: readonly SourcePack[],\n  cache: CompileCache,\n  concurrency = 8\n): Promise<CompiledAtom[]> {\n  const jobs: AtomJob[] = []\n  for (const source of sources) {\n    const tree = compileTreeOf(source)\n    const root = atomRootOf(source)\n    for (const ref of source.validation.atoms) {\n      if (!COMPILED_KINDS.has(ref.kind)) continue\n      if (!ref.relPath.startsWith(root)) continue\n      jobs.push({ source, ref, tree, root })\n    }\n  }\n  return mapLimit(jobs, concurrency, (job) => compileOne(job, cache))\n}\n"]}

package/dist/dev/csp.d.ts

@@ -0,0 +1,67 @@
+/** Directive name → its sources, in the order they are written. */
+export type CspDirectives = Record<string, string[]>;
+/** Something the policy could not resolve at build time. */
+export interface CspUnresolved {
+    /** What declared it: `connection:<name>`, `engine:<atomId>`, `page:<key>`, `auth`. */
+    readonly source: string;
+    /** The template or address as written. */
+    readonly value: string;
+    readonly reason: string;
+}
+export interface AppCsp {
+    readonly directives: CspDirectives;
+    /** The policy as a header value (every directive). */
+    readonly header: string;
+    /** The policy for a `<meta http-equiv>` (without the directives a meta cannot carry). */
+    readonly meta: string;
+    readonly unresolved: readonly CspUnresolved[];
+}
+export interface CspInputs {
+    /** The exact text of the shell's inline import map. */
+    readonly importMapText: string;
+    /** Served receipts by page key (after media slots are filled). */
+    readonly receipts: ReadonlyMap<string, unknown>;
+    /** `pwpack/connections.json`. */
+    readonly connections?: {
+        readonly connections: readonly Record<string, unknown>[];
+    } | undefined;
+    /** `engines/manifest.json` entries. */
+    readonly engines: readonly {
+        readonly connection: string;
+        readonly atomId: string;
+        readonly moduleUrl?: string;
+        readonly engine?: unknown;
+    }[];
+    /** The envelope `auth.json`, when the build has one. */
+    readonly envelopeAuth?: unknown;
+    /** `app/definitions/auth.json` (the declaration). */
+    readonly authDefinition?: unknown;
+    /** `publish.json` `media[]`. */
+    readonly media: readonly {
+        readonly url: string;
+    }[];
+    /** The webfont stylesheet the shell links, when any. */
+    readonly webfontHref?: string | null;
+}
+/** The CSP source for an inline script: `'sha256-<base64>'` of its exact text. */
+export declare function scriptHash(text: string): string;
+/**
+ * The origin of an absolute http(s) URL, or null. Expressions (`{{…}}`) or
+ * templates (`{…}`) in the scheme or host make it unresolvable (`undefined`).
+ */
+export declare function originOf(value: string): string | null | undefined;
+/**
+ * The origin a declared engine's `host` reaches (connector-manifest §3.1):
+ * `{name}` filled from the connection's string config, the scheme dropped and
+ * `https://` prepended, except an explicit `http://` on a loopback host.
+ * `undefined` when a placeholder stays unfilled.
+ */
+export declare function engineHostOrigin(host: string, config: Record<string, unknown> | undefined): string | undefined;
+/** Writes the directives as a policy string. */
+export declare function serializeCsp(directives: CspDirectives, options?: {
+    meta?: boolean;
+}): string;
+/** Derives the app's policy from what it declares. */
+export declare function deriveCsp(input: CspInputs): AppCsp;
+/** The static-host `_headers` file (`/*` and the policy). */
+export declare function headersFile(policy: string): string;

package/dist/dev/csp.js

@@ -0,0 +1,260 @@
+/**
+ * The app's Content Security Policy, derived from what the app declares.
+ *
+ * A pwapp is static files; what it may load and reach is known at build time
+ * from its own declarations, so `pwf build` writes a policy that allows that
+ * and nothing else (pwapp-format §2.1):
+ *
+ *   default-src  'none'
+ *   script-src   'self' blob: 'sha256-<import map>'
+ *                Blocks and compiled engines are verified and then imported
+ *                from `blob:` URLs. The import map is the shell's only inline
+ *                script (an import map cannot be an external file), so its
+ *                hash is listed; the renderer seeding and the boot call are
+ *                files (`assets/seed.js`, `assets/boot.js`).
+ *   style-src    'self' 'unsafe-inline' [+ the webfont stylesheet origin]
+ *                The renderer draws `<style>` elements at run time (the
+ *                surface base, visibility, state, responsive and dark-theme
+ *                rules, computed per page), and blocks set `style`
+ *                attributes. Neither can be hashed ahead of time.
+ *   img-src      'self' data: blob: [+ media origins]
+ *   media-src    'self' data: blob: [+ media origins]
+ *   frame-src    [media origins] — only when there are any
+ *   font-src     'self' [+ the webfont file origin]
+ *   connect-src  'self' [+ every origin the app's data and sign-in reach]
+ *   base-uri     'self'  — a host that serves the app under a sub-path
+ *                injects `<base href>` (pwapp-format §2); 'none' would make
+ *                the browser ignore it and break path routing.
+ *   object-src   'none'
+ *   frame-ancestors 'none'  — header only: browsers ignore it in a `<meta>`.
+ *
+ * Origins come from: absolute `rest` endpoints in the receipts; declared
+ * engines' `host` templates filled from `connections.json` config;
+ * the envelope `auth.json` addresses and an external issuer; `publish.json`
+ * media and absolute media URLs in receipt props. A template that cannot be
+ * resolved at build time, and a compiled engine (whose code may reach any
+ * origin), is listed in `unresolved` instead of being guessed.
+ *
+ * @module @pwfabric/cli/dev/csp
+ */
+import { createHash } from 'node:crypto';
+import { isRecord } from './sources.js';
+/** Directives a `<meta http-equiv="Content-Security-Policy">` cannot carry (CSP3 §3.3). */
+const HEADER_ONLY = new Set(['frame-ancestors', 'report-uri', 'report-to', 'sandbox']);
+/** The CSP source for an inline script: `'sha256-<base64>'` of its exact text. */
+export function scriptHash(text) {
+    return `'sha256-${createHash('sha256').update(text, 'utf8').digest('base64')}'`;
+}
+const LOOPBACK = /^(?:localhost|127\.0\.0\.1|\[::1\]|[^/:]+\.localhost)(?::\d+)?$/i;
+/**
+ * The origin of an absolute http(s) URL, or null. Expressions (`{{…}}`) or
+ * templates (`{…}`) in the scheme or host make it unresolvable (`undefined`).
+ */
+export function originOf(value) {
+    const m = /^(https?):\/\/([^/?#]*)/i.exec(value.trim());
+    if (!m)
+        return null;
+    const host = m[2];
+    if (!host || /[{}]/.test(host))
+        return undefined;
+    try {
+        return new URL(`${m[1].toLowerCase()}://${host}`).origin;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The origin a declared engine's `host` reaches (connector-manifest §3.1):
+ * `{name}` filled from the connection's string config, the scheme dropped and
+ * `https://` prepended, except an explicit `http://` on a loopback host.
+ * `undefined` when a placeholder stays unfilled.
+ */
+export function engineHostOrigin(host, config) {
+    const filled = host.replace(/\{([A-Za-z0-9_.-]+)\}/g, (whole, name) => {
+        const v = config?.[name];
+        return typeof v === 'string' ? v : whole;
+    });
+    if (/[{}]/.test(filled))
+        return undefined;
+    const explicitHttp = /^http:\/\//i.test(filled.trim());
+    const bare = filled.trim().replace(/^[a-z][a-z0-9+.-]*:\/\//i, '');
+    const hostPart = bare.split(/[/?#]/)[0] ?? '';
+    if (!hostPart)
+        return undefined;
+    const scheme = explicitHttp && LOOPBACK.test(hostPart) ? 'http' : 'https';
+    try {
+        return new URL(`${scheme}://${hostPart}`).origin;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** A prop that names where a link goes (navigation is not governed by CSP). */
+const LINK_PROP = /^(?:href|to|link|url|.*Href|.*Link)$/;
+/** Every absolute URL a receipt's block props carry, except links. */
+function mediaUrlsOf(blocks, out) {
+    if (!Array.isArray(blocks))
+        return;
+    for (const block of blocks) {
+        if (!isRecord(block))
+            continue;
+        const props = block['props'];
+        if (isRecord(props))
+            collectUrls(props, out);
+        mediaUrlsOf(block['children'], out);
+    }
+}
+function collectUrls(value, out) {
+    const entries = Array.isArray(value) ? value.map((v, i) => [String(i), v]) : Object.entries(value);
+    for (const [key, v] of entries) {
+        if (typeof v === 'string') {
+            if (!LINK_PROP.test(key) && /^https?:\/\//i.test(v.trim()))
+                out.push(v.trim());
+        }
+        else if (Array.isArray(v) || isRecord(v)) {
+            collectUrls(v, out);
+        }
+    }
+}
+/** `rest` data sources of a receipt's persistence capability. */
+function restEndpointsOf(receipt) {
+    if (!isRecord(receipt) || !Array.isArray(receipt['capabilities']))
+        return [];
+    const out = [];
+    for (const cap of receipt['capabilities']) {
+        if (!isRecord(cap) || !isRecord(cap['config']))
+            continue;
+        const sources = cap['config']['dataSources'];
+        if (!Array.isArray(sources))
+            continue;
+        for (const s of sources) {
+            if (isRecord(s) && s['kind'] === 'rest' && typeof s['endpoint'] === 'string')
+                out.push(s['endpoint']);
+        }
+    }
+    return out;
+}
+const AUTH_ADDRESS_KEYS = ['loginUrl', 'registerUrl', 'logoutUrl', 'sessionUrl', 'tokenUrl', 'issuer', 'startUrl', 'gatewaySessionUrl', 'gatewayLogoutUrl'];
+/** Writes the directives as a policy string. */
+export function serializeCsp(directives, options = {}) {
+    return Object.entries(directives)
+        .filter(([name, values]) => values.length > 0 && !(options.meta && HEADER_ONLY.has(name)))
+        .map(([name, values]) => `${name} ${values.join(' ')}`)
+        .join('; ');
+}
+/** Derives the app's policy from what it declares. */
+export function deriveCsp(input) {
+    const unresolved = [];
+    const connect = new Set();
+    const media = new Set();
+    const style = new Set();
+    const font = new Set();
+    const addConnect = (value, source) => {
+        const o = originOf(value);
+        if (o === undefined)
+            unresolved.push({ source, value, reason: 'the address is a template or expression; its origin is known only at run time' });
+        else if (o)
+            connect.add(o);
+    };
+    // Data: absolute `rest` endpoints in the receipts. Relative ones are 'self'.
+    for (const [key, receipt] of input.receipts) {
+        for (const endpoint of restEndpointsOf(receipt))
+            addConnect(endpoint, `page:${key}`);
+        const urls = [];
+        if (isRecord(receipt))
+            mediaUrlsOf(receipt['blocks'], urls);
+        for (const url of urls) {
+            const o = originOf(url);
+            if (o)
+                media.add(o);
+            else if (o === undefined)
+                unresolved.push({ source: `page:${key}`, value: url, reason: 'a media address with an expression in its origin' });
+        }
+    }
+    // Connections: declared engines resolve their host; compiled ones cannot be read.
+    const configOf = new Map();
+    for (const c of input.connections?.connections ?? []) {
+        if (typeof c['name'] === 'string')
+            configOf.set(c['name'], isRecord(c['config']) ? c['config'] : {});
+    }
+    for (const e of input.engines) {
+        const host = isRecord(e.engine) && typeof e.engine['host'] === 'string' ? e.engine['host'] : undefined;
+        if (host !== undefined) {
+            const o = engineHostOrigin(host, configOf.get(e.connection));
+            if (o)
+                connect.add(o);
+            else
+                unresolved.push({ source: `connection:${e.connection}`, value: host, reason: 'the engine host names config the connection does not provide' });
+        }
+        else if (e.moduleUrl) {
+            unresolved.push({
+                source: `engine:${e.atomId}`,
+                value: e.moduleUrl,
+                reason: `compiled engine for connection "${e.connection}"; the origins its code reaches are not declared`,
+            });
+        }
+    }
+    // Sign-in: the envelope's addresses, and an external issuer's.
+    if (isRecord(input.envelopeAuth)) {
+        for (const k of AUTH_ADDRESS_KEYS) {
+            const v = input.envelopeAuth[k];
+            if (typeof v === 'string')
+                addConnect(v, 'auth');
+        }
+    }
+    const issuer = isRecord(input.authDefinition) && isRecord(input.authDefinition['issuer']) ? input.authDefinition['issuer'] : undefined;
+    if (issuer) {
+        for (const k of ['issuer', 'tokenUrl']) {
+            const v = issuer[k];
+            if (typeof v === 'string')
+                addConnect(v, 'auth');
+        }
+        if (typeof issuer['tokenUrl'] !== 'string' && typeof issuer['issuer'] === 'string') {
+            unresolved.push({
+                source: 'auth',
+                value: issuer['issuer'],
+                reason: "the token endpoint is discovered at run time; the policy allows the issuer's own origin only",
+            });
+        }
+    }
+    // Media the app declares.
+    for (const m of input.media) {
+        const o = originOf(m.url);
+        if (o)
+            media.add(o);
+    }
+    // Webfonts: the stylesheet and the files it points at.
+    if (input.webfontHref) {
+        const o = originOf(input.webfontHref);
+        if (o)
+            style.add(o);
+        if (o === 'https://fonts.googleapis.com')
+            font.add('https://fonts.gstatic.com');
+    }
+    const sorted = (s) => [...s].sort();
+    const directives = {
+        'default-src': ["'none'"],
+        'script-src': ["'self'", 'blob:', scriptHash(input.importMapText)],
+        'style-src': ["'self'", "'unsafe-inline'", ...sorted(style)],
+        'img-src': ["'self'", 'data:', 'blob:', ...sorted(media)],
+        'media-src': ["'self'", 'data:', 'blob:', ...sorted(media)],
+        ...(media.size > 0 ? { 'frame-src': sorted(media) } : {}),
+        'font-src': ["'self'", ...sorted(font)],
+        'connect-src': ["'self'", ...sorted(connect)],
+        'base-uri': ["'self'"],
+        'object-src': ["'none'"],
+        'frame-ancestors': ["'none'"],
+    };
+    return {
+        directives,
+        header: serializeCsp(directives),
+        meta: serializeCsp(directives, { meta: true }),
+        unresolved,
+    };
+}
+/** The static-host `_headers` file (`/*` and the policy). */
+export function headersFile(policy) {
+    return `/*\n  Content-Security-Policy: ${policy}\n`;
+}
+//# sourceMappingURL=csp.js.map

package/dist/dev/csp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp.js","sourceRoot":"","sources":["../../src/dev/csp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AA0CvC,2FAA2F;AAC3F,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAA;AAEtF,kFAAkF;AAClF,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,WAAW,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAA;AACjF,CAAC;AAED,MAAM,QAAQ,GAAG,kEAAkE,CAAA;AAEnF;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,MAAM,CAAC,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IACvD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAW,CAAA;IAC3B,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IAChD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAI,CAAC,CAAC,CAAC,CAAY,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAA;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,MAA2C;IACxF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QAC5E,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAA;QACxB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC1C,CAAC,CAAC,CAAA;IACF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAA;IACzC,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IACtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAA;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC7C,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC/B,MAAM,MAAM,GAAG,YAAY,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;IACzE,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,MAAM,MAAM,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,SAAS,GAAG,sCAAsC,CAAA;AAExD,sEAAsE;AACtE,SAAS,WAAW,CAAC,MAAe,EAAE,GAAa;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAM;IAClC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAQ;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAA;QAC5B,IAAI,QAAQ,CAAC,KAAK,CAAC;YAAE,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QAC5C,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAA;IACrC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAA0C,EAAE,GAAa;IAC5E,MAAM,OAAO,GAAwB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IACvH,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QAChF,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,SAAS,eAAe,CAAC,OAAgB;IACvC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IAC5E,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAAE,SAAQ;QACxD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,CAAA;QAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,SAAQ;QACrC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAA;QACvG,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,CAAA;AAE3J,gDAAgD;AAChD,MAAM,UAAU,YAAY,CAAC,UAAyB,EAAE,UAA8B,EAAE;IACtF,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;SAC9B,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;SACzF,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;SACtD,IAAI,CAAC,IAAI,CAAC,CAAA;AACf,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,SAAS,CAAC,KAAgB;IACxC,MAAM,UAAU,GAAoB,EAAE,CAAA;IACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAE9B,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,MAAc,EAAQ,EAAE;QACzD,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QACzB,IAAI,CAAC,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,+EAA+E,EAAE,CAAC,CAAA;aAC3I,IAAI,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC5B,CAAC,CAAA;IAED,6EAA6E;IAC7E,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5C,KAAK,MAAM,QAAQ,IAAI,eAAe,CAAC,OAAO,CAAC;YAAE,UAAU,CAAC,QAAQ,EAAE,QAAQ,GAAG,EAAE,CAAC,CAAA;QACpF,MAAM,IAAI,GAAa,EAAE,CAAA;QACzB,IAAI,QAAQ,CAAC,OAAO,CAAC;YAAE,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAA;QAC3D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;YACvB,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;iBACd,IAAI,CAAC,KAAK,SAAS;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC,CAAA;QAC9I,CAAC;IACH,CAAC;IAED,kFAAkF;IAClF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmC,CAAA;IAC3D,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,WAAW,IAAI,EAAE,EAAE,CAAC;QACrD,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACtG,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACtG,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAA;YAC5D,IAAI,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;;gBAChB,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,8DAA8D,EAAE,CAAC,CAAA;QACrJ,CAAC;aAAM,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;YACvB,UAAU,CAAC,IAAI,CAAC;gBACd,MAAM,EAAE,UAAU,CAAC,CAAC,MAAM,EAAE;gBAC5B,KAAK,EAAE,CAAC,CAAC,SAAS;gBAClB,MAAM,EAAE,mCAAmC,CAAC,CAAC,UAAU,kDAAkD;aAC1G,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,IAAI,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,iBAAiB,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;YAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QAClD,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACtI,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;YACnB,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QAClD,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;YACnF,UAAU,CAAC,IAAI,CAAC;gBACd,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC;gBACvB,MAAM,EAAE,8FAA8F;aACvG,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACzB,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IACrB,CAAC;IAED,uDAAuD;IACvD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QACrC,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,CAAC,KAAK,8BAA8B;YAAE,IAAI,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAA;IACjF,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,CAAc,EAAY,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC1D,MAAM,UAAU,GAAkB;QAChC,aAAa,EAAE,CAAC,QAAQ,CAAC;QACzB,YAAY,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAClE,WAAW,EAAE,CAAC,QAAQ,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5D,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACzD,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3D,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,UAAU,EAAE,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,aAAa,EAAE,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7C,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,YAAY,EAAE,CAAC,QAAQ,CAAC;QACxB,iBAAiB,EAAE,CAAC,QAAQ,CAAC;KAC9B,CAAA;IACD,OAAO;QACL,UAAU;QACV,MAAM,EAAE,YAAY,CAAC,UAAU,CAAC;QAChC,IAAI,EAAE,YAAY,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC9C,UAAU;KACX,CAAA;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,OAAO,kCAAkC,MAAM,IAAI,CAAA;AACrD,CAAC","sourcesContent":["/**\n * The app's Content Security Policy, derived from what the app declares.\n *\n * A pwapp is static files; what it may load and reach is known at build time\n * from its own declarations, so `pwf build` writes a policy that allows that\n * and nothing else (pwapp-format §2.1):\n *\n *   default-src  'none'\n *   script-src   'self' blob: 'sha256-<import map>'\n *                Blocks and compiled engines are verified and then imported\n *                from `blob:` URLs. The import map is the shell's only inline\n *                script (an import map cannot be an external file), so its\n *                hash is listed; the renderer seeding and the boot call are\n *                files (`assets/seed.js`, `assets/boot.js`).\n *   style-src    'self' 'unsafe-inline' [+ the webfont stylesheet origin]\n *                The renderer draws `<style>` elements at run time (the\n *                surface base, visibility, state, responsive and dark-theme\n *                rules, computed per page), and blocks set `style`\n *                attributes. Neither can be hashed ahead of time.\n *   img-src      'self' data: blob: [+ media origins]\n *   media-src    'self' data: blob: [+ media origins]\n *   frame-src    [media origins] — only when there are any\n *   font-src     'self' [+ the webfont file origin]\n *   connect-src  'self' [+ every origin the app's data and sign-in reach]\n *   base-uri     'self'  — a host that serves the app under a sub-path\n *                injects `<base href>` (pwapp-format §2); 'none' would make\n *                the browser ignore it and break path routing.\n *   object-src   'none'\n *   frame-ancestors 'none'  — header only: browsers ignore it in a `<meta>`.\n *\n * Origins come from: absolute `rest` endpoints in the receipts; declared\n * engines' `host` templates filled from `connections.json` config;\n * the envelope `auth.json` addresses and an external issuer; `publish.json`\n * media and absolute media URLs in receipt props. A template that cannot be\n * resolved at build time, and a compiled engine (whose code may reach any\n * origin), is listed in `unresolved` instead of being guessed.\n *\n * @module @pwfabric/cli/dev/csp\n */\nimport { createHash } from 'node:crypto'\nimport { isRecord } from './sources.js'\n\n/** Directive name → its sources, in the order they are written. */\nexport type CspDirectives = Record<string, string[]>\n\n/** Something the policy could not resolve at build time. */\nexport interface CspUnresolved {\n  /** What declared it: `connection:<name>`, `engine:<atomId>`, `page:<key>`, `auth`. */\n  readonly source: string\n  /** The template or address as written. */\n  readonly value: string\n  readonly reason: string\n}\n\nexport interface AppCsp {\n  readonly directives: CspDirectives\n  /** The policy as a header value (every directive). */\n  readonly header: string\n  /** The policy for a `<meta http-equiv>` (without the directives a meta cannot carry). */\n  readonly meta: string\n  readonly unresolved: readonly CspUnresolved[]\n}\n\nexport interface CspInputs {\n  /** The exact text of the shell's inline import map. */\n  readonly importMapText: string\n  /** Served receipts by page key (after media slots are filled). */\n  readonly receipts: ReadonlyMap<string, unknown>\n  /** `pwpack/connections.json`. */\n  readonly connections?: { readonly connections: readonly Record<string, unknown>[] } | undefined\n  /** `engines/manifest.json` entries. */\n  readonly engines: readonly { readonly connection: string; readonly atomId: string; readonly moduleUrl?: string; readonly engine?: unknown }[]\n  /** The envelope `auth.json`, when the build has one. */\n  readonly envelopeAuth?: unknown\n  /** `app/definitions/auth.json` (the declaration). */\n  readonly authDefinition?: unknown\n  /** `publish.json` `media[]`. */\n  readonly media: readonly { readonly url: string }[]\n  /** The webfont stylesheet the shell links, when any. */\n  readonly webfontHref?: string | null\n}\n\n/** Directives a `<meta http-equiv=\"Content-Security-Policy\">` cannot carry (CSP3 §3.3). */\nconst HEADER_ONLY = new Set(['frame-ancestors', 'report-uri', 'report-to', 'sandbox'])\n\n/** The CSP source for an inline script: `'sha256-<base64>'` of its exact text. */\nexport function scriptHash(text: string): string {\n  return `'sha256-${createHash('sha256').update(text, 'utf8').digest('base64')}'`\n}\n\nconst LOOPBACK = /^(?:localhost|127\\.0\\.0\\.1|\\[::1\\]|[^/:]+\\.localhost)(?::\\d+)?$/i\n\n/**\n * The origin of an absolute http(s) URL, or null. Expressions (`{{…}}`) or\n * templates (`{…}`) in the scheme or host make it unresolvable (`undefined`).\n */\nexport function originOf(value: string): string | null | undefined {\n  const m = /^(https?):\\/\\/([^/?#]*)/i.exec(value.trim())\n  if (!m) return null\n  const host = m[2] as string\n  if (!host || /[{}]/.test(host)) return undefined\n  try {\n    return new URL(`${(m[1] as string).toLowerCase()}://${host}`).origin\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * The origin a declared engine's `host` reaches (connector-manifest §3.1):\n * `{name}` filled from the connection's string config, the scheme dropped and\n * `https://` prepended, except an explicit `http://` on a loopback host.\n * `undefined` when a placeholder stays unfilled.\n */\nexport function engineHostOrigin(host: string, config: Record<string, unknown> | undefined): string | undefined {\n  const filled = host.replace(/\\{([A-Za-z0-9_.-]+)\\}/g, (whole, name: string) => {\n    const v = config?.[name]\n    return typeof v === 'string' ? v : whole\n  })\n  if (/[{}]/.test(filled)) return undefined\n  const explicitHttp = /^http:\\/\\//i.test(filled.trim())\n  const bare = filled.trim().replace(/^[a-z][a-z0-9+.-]*:\\/\\//i, '')\n  const hostPart = bare.split(/[/?#]/)[0] ?? ''\n  if (!hostPart) return undefined\n  const scheme = explicitHttp && LOOPBACK.test(hostPart) ? 'http' : 'https'\n  try {\n    return new URL(`${scheme}://${hostPart}`).origin\n  } catch {\n    return undefined\n  }\n}\n\n/** A prop that names where a link goes (navigation is not governed by CSP). */\nconst LINK_PROP = /^(?:href|to|link|url|.*Href|.*Link)$/\n\n/** Every absolute URL a receipt's block props carry, except links. */\nfunction mediaUrlsOf(blocks: unknown, out: string[]): void {\n  if (!Array.isArray(blocks)) return\n  for (const block of blocks) {\n    if (!isRecord(block)) continue\n    const props = block['props']\n    if (isRecord(props)) collectUrls(props, out)\n    mediaUrlsOf(block['children'], out)\n  }\n}\n\nfunction collectUrls(value: Record<string, unknown> | unknown[], out: string[]): void {\n  const entries: [string, unknown][] = Array.isArray(value) ? value.map((v, i) => [String(i), v]) : Object.entries(value)\n  for (const [key, v] of entries) {\n    if (typeof v === 'string') {\n      if (!LINK_PROP.test(key) && /^https?:\\/\\//i.test(v.trim())) out.push(v.trim())\n    } else if (Array.isArray(v) || isRecord(v)) {\n      collectUrls(v, out)\n    }\n  }\n}\n\n/** `rest` data sources of a receipt's persistence capability. */\nfunction restEndpointsOf(receipt: unknown): string[] {\n  if (!isRecord(receipt) || !Array.isArray(receipt['capabilities'])) return []\n  const out: string[] = []\n  for (const cap of receipt['capabilities']) {\n    if (!isRecord(cap) || !isRecord(cap['config'])) continue\n    const sources = cap['config']['dataSources']\n    if (!Array.isArray(sources)) continue\n    for (const s of sources) {\n      if (isRecord(s) && s['kind'] === 'rest' && typeof s['endpoint'] === 'string') out.push(s['endpoint'])\n    }\n  }\n  return out\n}\n\nconst AUTH_ADDRESS_KEYS = ['loginUrl', 'registerUrl', 'logoutUrl', 'sessionUrl', 'tokenUrl', 'issuer', 'startUrl', 'gatewaySessionUrl', 'gatewayLogoutUrl']\n\n/** Writes the directives as a policy string. */\nexport function serializeCsp(directives: CspDirectives, options: { meta?: boolean } = {}): string {\n  return Object.entries(directives)\n    .filter(([name, values]) => values.length > 0 && !(options.meta && HEADER_ONLY.has(name)))\n    .map(([name, values]) => `${name} ${values.join(' ')}`)\n    .join('; ')\n}\n\n/** Derives the app's policy from what it declares. */\nexport function deriveCsp(input: CspInputs): AppCsp {\n  const unresolved: CspUnresolved[] = []\n  const connect = new Set<string>()\n  const media = new Set<string>()\n  const style = new Set<string>()\n  const font = new Set<string>()\n\n  const addConnect = (value: string, source: string): void => {\n    const o = originOf(value)\n    if (o === undefined) unresolved.push({ source, value, reason: 'the address is a template or expression; its origin is known only at run time' })\n    else if (o) connect.add(o)\n  }\n\n  // Data: absolute `rest` endpoints in the receipts. Relative ones are 'self'.\n  for (const [key, receipt] of input.receipts) {\n    for (const endpoint of restEndpointsOf(receipt)) addConnect(endpoint, `page:${key}`)\n    const urls: string[] = []\n    if (isRecord(receipt)) mediaUrlsOf(receipt['blocks'], urls)\n    for (const url of urls) {\n      const o = originOf(url)\n      if (o) media.add(o)\n      else if (o === undefined) unresolved.push({ source: `page:${key}`, value: url, reason: 'a media address with an expression in its origin' })\n    }\n  }\n\n  // Connections: declared engines resolve their host; compiled ones cannot be read.\n  const configOf = new Map<string, Record<string, unknown>>()\n  for (const c of input.connections?.connections ?? []) {\n    if (typeof c['name'] === 'string') configOf.set(c['name'], isRecord(c['config']) ? c['config'] : {})\n  }\n  for (const e of input.engines) {\n    const host = isRecord(e.engine) && typeof e.engine['host'] === 'string' ? e.engine['host'] : undefined\n    if (host !== undefined) {\n      const o = engineHostOrigin(host, configOf.get(e.connection))\n      if (o) connect.add(o)\n      else unresolved.push({ source: `connection:${e.connection}`, value: host, reason: 'the engine host names config the connection does not provide' })\n    } else if (e.moduleUrl) {\n      unresolved.push({\n        source: `engine:${e.atomId}`,\n        value: e.moduleUrl,\n        reason: `compiled engine for connection \"${e.connection}\"; the origins its code reaches are not declared`,\n      })\n    }\n  }\n\n  // Sign-in: the envelope's addresses, and an external issuer's.\n  if (isRecord(input.envelopeAuth)) {\n    for (const k of AUTH_ADDRESS_KEYS) {\n      const v = input.envelopeAuth[k]\n      if (typeof v === 'string') addConnect(v, 'auth')\n    }\n  }\n  const issuer = isRecord(input.authDefinition) && isRecord(input.authDefinition['issuer']) ? input.authDefinition['issuer'] : undefined\n  if (issuer) {\n    for (const k of ['issuer', 'tokenUrl']) {\n      const v = issuer[k]\n      if (typeof v === 'string') addConnect(v, 'auth')\n    }\n    if (typeof issuer['tokenUrl'] !== 'string' && typeof issuer['issuer'] === 'string') {\n      unresolved.push({\n        source: 'auth',\n        value: issuer['issuer'],\n        reason: \"the token endpoint is discovered at run time; the policy allows the issuer's own origin only\",\n      })\n    }\n  }\n\n  // Media the app declares.\n  for (const m of input.media) {\n    const o = originOf(m.url)\n    if (o) media.add(o)\n  }\n\n  // Webfonts: the stylesheet and the files it points at.\n  if (input.webfontHref) {\n    const o = originOf(input.webfontHref)\n    if (o) style.add(o)\n    if (o === 'https://fonts.googleapis.com') font.add('https://fonts.gstatic.com')\n  }\n\n  const sorted = (s: Set<string>): string[] => [...s].sort()\n  const directives: CspDirectives = {\n    'default-src': [\"'none'\"],\n    'script-src': [\"'self'\", 'blob:', scriptHash(input.importMapText)],\n    'style-src': [\"'self'\", \"'unsafe-inline'\", ...sorted(style)],\n    'img-src': [\"'self'\", 'data:', 'blob:', ...sorted(media)],\n    'media-src': [\"'self'\", 'data:', 'blob:', ...sorted(media)],\n    ...(media.size > 0 ? { 'frame-src': sorted(media) } : {}),\n    'font-src': [\"'self'\", ...sorted(font)],\n    'connect-src': [\"'self'\", ...sorted(connect)],\n    'base-uri': [\"'self'\"],\n    'object-src': [\"'none'\"],\n    'frame-ancestors': [\"'none'\"],\n  }\n  return {\n    directives,\n    header: serializeCsp(directives),\n    meta: serializeCsp(directives, { meta: true }),\n    unresolved,\n  }\n}\n\n/** The static-host `_headers` file (`/*` and the policy). */\nexport function headersFile(policy: string): string {\n  return `/*\\n  Content-Security-Policy: ${policy}\\n`\n}\n"]}

package/dist/dev/diagnostics.d.ts

@@ -0,0 +1,21 @@
+/**
+ * What an assembly says about the folder it read: one shape for compiler
+ * output, validation findings and the assembler's own checks, so the terminal
+ * and the overlay page print the same list.
+ */
+export type AssembleSeverity = 'error' | 'warning' | 'info';
+export interface AssembleDiagnostic {
+    readonly severity: AssembleSeverity;
+    /** Machine-readable reason, e.g. `PACK_NOT_CACHED` or a compiler code. */
+    readonly code: string;
+    readonly message: string;
+    /** The file the finding is about, relative to the app folder when it can be. */
+    readonly path?: string;
+    readonly line?: number;
+    readonly column?: number;
+}
+/** `error  app/surfaces/home.receipt.json:3:7  UNKNOWN_BLOCK_TYPE  …` */
+export declare function formatDiagnostic(d: AssembleDiagnostic): string;
+export declare function hasErrors(diagnostics: readonly AssembleDiagnostic[]): boolean;
+/** Errors first, then warnings, then info; stable within a severity. */
+export declare function sortDiagnostics(diagnostics: readonly AssembleDiagnostic[]): AssembleDiagnostic[];