@pwfabric/cli 0.0.0-stage → 1.0.0-rc.1

package/dist/dev/diagnostics.js

@@ -0,0 +1,22 @@
+/**
+ * What an assembly says about the folder it read: one shape for compiler
+ * output, validation findings and the assembler's own checks, so the terminal
+ * and the overlay page print the same list.
+ */
+/** `error  app/surfaces/home.receipt.json:3:7  UNKNOWN_BLOCK_TYPE  …` */
+export function formatDiagnostic(d) {
+    const where = d.path ? `${d.path}${d.line !== undefined ? `:${d.line}${d.column !== undefined ? `:${d.column}` : ''}` : ''}  ` : '';
+    return `${d.severity.padEnd(7)} ${where}${d.code}  ${d.message}`;
+}
+export function hasErrors(diagnostics) {
+    return diagnostics.some((d) => d.severity === 'error');
+}
+/** Errors first, then warnings, then info; stable within a severity. */
+export function sortDiagnostics(diagnostics) {
+    const rank = { error: 0, warning: 1, info: 2 };
+    return diagnostics
+        .map((d, i) => [d, i])
+        .sort((a, b) => rank[a[0].severity] - rank[b[0].severity] || a[1] - b[1])
+        .map(([d]) => d);
+}
+//# sourceMappingURL=diagnostics.js.map

package/dist/dev/diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../../src/dev/diagnostics.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,CAAqB;IACpD,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IACnI,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAA;AAClE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,WAA0C;IAClE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAA;AACxD,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,WAA0C;IACxE,MAAM,IAAI,GAAqC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;IAChF,OAAO,WAAW;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAU,CAAC;SAC9B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;SACxE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;AACpB,CAAC","sourcesContent":["/**\n * What an assembly says about the folder it read: one shape for compiler\n * output, validation findings and the assembler's own checks, so the terminal\n * and the overlay page print the same list.\n */\n\nexport type AssembleSeverity = 'error' | 'warning' | 'info'\n\nexport interface AssembleDiagnostic {\n  readonly severity: AssembleSeverity\n  /** Machine-readable reason, e.g. `PACK_NOT_CACHED` or a compiler code. */\n  readonly code: string\n  readonly message: string\n  /** The file the finding is about, relative to the app folder when it can be. */\n  readonly path?: string\n  readonly line?: number\n  readonly column?: number\n}\n\n/** `error  app/surfaces/home.receipt.json:3:7  UNKNOWN_BLOCK_TYPE  …` */\nexport function formatDiagnostic(d: AssembleDiagnostic): string {\n  const where = d.path ? `${d.path}${d.line !== undefined ? `:${d.line}${d.column !== undefined ? `:${d.column}` : ''}` : ''}  ` : ''\n  return `${d.severity.padEnd(7)} ${where}${d.code}  ${d.message}`\n}\n\nexport function hasErrors(diagnostics: readonly AssembleDiagnostic[]): boolean {\n  return diagnostics.some((d) => d.severity === 'error')\n}\n\n/** Errors first, then warnings, then info; stable within a severity. */\nexport function sortDiagnostics(diagnostics: readonly AssembleDiagnostic[]): AssembleDiagnostic[] {\n  const rank: Record<AssembleSeverity, number> = { error: 0, warning: 1, info: 2 }\n  return diagnostics\n    .map((d, i) => [d, i] as const)\n    .sort((a, b) => rank[a[0].severity] - rank[b[0].severity] || a[1] - b[1])\n    .map(([d]) => d)\n}\n"]}

package/dist/dev/envelope.d.ts

@@ -0,0 +1,92 @@
+/**
+ * The envelope documents a runner reads (`pwpack/project.json`,
+ * `navigation.json`, `connections.json`, the two module manifests), built
+ * from the app folder's declaration.
+ */
+import type { AssembleDiagnostic } from './diagnostics.js';
+/** One page of the app: its key, its receipt and what the receipt says. */
+export interface Page {
+    readonly key: string;
+    /** Path of the receipt in the app folder. */
+    readonly path: string;
+    readonly bytes: Uint8Array;
+    readonly receipt: Record<string, unknown>;
+}
+/** The block types a receipt places, walking `blocks` and every `children`. */
+export declare function blockTypesOf(receipt: unknown): string[];
+/** The page's display name: the receipt's title, else the key. */
+export declare function pageLabel(page: Page): string;
+/** Navigation derived from the route table when the app declares none. */
+export declare function deriveNavigation(pages: readonly Page[], entry: string): {
+    navbar: {
+        links: {
+            label: string;
+            href: string;
+        }[];
+    };
+};
+/** What the app declares about who may enter (`app/definitions/auth.json`), as `project.json` carries it. */
+export declare function identityOf(auth: unknown): {
+    required: boolean;
+    topology: 'app' | 'external';
+    methods?: string[];
+} | undefined;
+export interface ProjectJsonInput {
+    readonly id: string;
+    readonly title: string;
+    readonly entry: string;
+    readonly pages: readonly Page[];
+    readonly auth?: unknown;
+}
+/** `pwpack/project.json`. */
+export declare function buildProjectJson(input: ProjectJsonInput): Record<string, unknown>;
+/** Config keys that smell of a credential. Such a key never reaches a published app. */
+export declare const CREDENTIAL_KEY_RE: RegExp;
+/**
+ * `pwpack/connections.json`: the declaration with every credential-like
+ * config key removed (each removal is reported). A bare string entry is read
+ * as `{ name }`.
+ */
+export declare function buildConnections(doc: unknown, diagnostics: AssembleDiagnostic[], path?: string): {
+    connections: Record<string, unknown>[];
+} | undefined;
+/** One entry of `blocks/manifest.json`. */
+export interface BlockManifestEntry {
+    readonly blockType: string;
+    readonly moduleUrl: string;
+    readonly integrity: string;
+    readonly publisher: string;
+    readonly publisherVerified: boolean;
+    readonly definition: {
+        readonly name: string;
+    };
+}
+/** One entry of `engines/manifest.json`. */
+export interface EngineManifestEntry {
+    readonly connection: string;
+    readonly atomId: string;
+    readonly kind: 'connector' | 'provider';
+    readonly moduleUrl?: string;
+    readonly integrity?: string;
+    readonly engine?: unknown;
+}
+/** A file name for a module: `<name>.<first 8 hex of its hash>.mjs`, with anything unsafe replaced. */
+export declare function moduleFileName(name: string, hexHash: string): string;
+/** The publisher an atom is attributed to: the pack id's publisher segment, or the id itself. */
+export declare function publisherOf(packId: string): string;
+/**
+ * Whether a local host may write `name` into the envelope: a relative path of
+ * `/`-separated segments ending in `.json` (`auth.json`,
+ * `surfaces/home.receipt.json`), each segment starting with a letter, digit,
+ * `_` or `-` — so no `.`/`..` segment, no hidden file, no absolute path.
+ */
+export declare function isEnvelopeFileName(name: string): boolean;
+/**
+ * Merges what a local host adds to the envelope. Each key is a file name
+ * relative to `pwpack/` (`auth.json`, `surfaces/<key>.receipt.json`) and each
+ * value the document; a value for `project.json` is merged into it member by
+ * member. Called after the static envelope is laid out, so what the host
+ * offers WINS: its receipts (entity sources rewritten to its record
+ * endpoints) replace the folder's copies.
+ */
+export declare function mergeEnvelopeEntries(files: Map<string, Uint8Array>, entries: Readonly<Record<string, unknown>> | undefined, diagnostics: AssembleDiagnostic[]): void;

package/dist/dev/envelope.js

@@ -0,0 +1,154 @@
+import { isRecord } from './sources.js';
+/** The block types a receipt places, walking `blocks` and every `children`. */
+export function blockTypesOf(receipt) {
+    const types = new Set();
+    const walk = (node) => {
+        if (Array.isArray(node)) {
+            node.forEach(walk);
+            return;
+        }
+        if (!isRecord(node))
+            return;
+        if (typeof node['type'] === 'string' && node['type'])
+            types.add(node['type']);
+        if (Array.isArray(node['children']))
+            node['children'].forEach(walk);
+    };
+    if (isRecord(receipt))
+        walk(receipt['blocks']);
+    return [...types];
+}
+/** The page's display name: the receipt's title, else the key. */
+export function pageLabel(page) {
+    const title = page.receipt['title'];
+    return typeof title === 'string' && title.trim() ? title.trim() : page.key;
+}
+/** Navigation derived from the route table when the app declares none. */
+export function deriveNavigation(pages, entry) {
+    return {
+        navbar: { links: pages.map((p) => ({ label: pageLabel(p), href: p.key === entry ? '/' : `/${p.key}` })) },
+    };
+}
+/** What the app declares about who may enter (`app/definitions/auth.json`), as `project.json` carries it. */
+export function identityOf(auth) {
+    if (!isRecord(auth))
+        return undefined;
+    const topology = auth['topology'] === 'external' ? 'external' : 'app';
+    const methods = Array.isArray(auth['methods']) ? auth['methods'].filter((m) => typeof m === 'string') : [];
+    return {
+        required: auth['required'] === true,
+        topology,
+        ...(topology === 'app' ? { methods } : {}),
+    };
+}
+/** `pwpack/project.json`. */
+export function buildProjectJson(input) {
+    const surfaceReceiptFiles = {};
+    for (const p of input.pages)
+        surfaceReceiptFiles[p.key] = `surfaces/${p.key}.receipt.json`;
+    const identity = identityOf(input.auth);
+    return {
+        schemaVersion: '1.0.0',
+        id: input.id,
+        title: input.title,
+        entrySurfaceId: input.entry,
+        surfaceOrder: input.pages.map((p) => p.key),
+        surfaceReceiptFiles,
+        ...(identity ? { identity } : {}),
+    };
+}
+/** Config keys that smell of a credential. Such a key never reaches a published app. */
+export const CREDENTIAL_KEY_RE = /(auth|header|credential|secret|token|password|passwd|apikey|api_key|clientsecret|client_secret|bearer|cookie|signature)/i;
+function stripCredentials(value, path, dropped) {
+    if (Array.isArray(value))
+        return value.map((v, i) => stripCredentials(v, `${path}[${i}]`, dropped));
+    if (!isRecord(value))
+        return value;
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+        if (CREDENTIAL_KEY_RE.test(k)) {
+            dropped.push(`${path}.${k}`);
+            continue;
+        }
+        out[k] = stripCredentials(v, `${path}.${k}`, dropped);
+    }
+    return out;
+}
+/**
+ * `pwpack/connections.json`: the declaration with every credential-like
+ * config key removed (each removal is reported). A bare string entry is read
+ * as `{ name }`.
+ */
+export function buildConnections(doc, diagnostics, path = 'app/definitions/connections.json') {
+    if (!isRecord(doc))
+        return undefined;
+    const list = Array.isArray(doc['connections']) ? doc['connections'] : [];
+    const connections = [];
+    for (const raw of list) {
+        const entry = typeof raw === 'string' ? { name: raw } : isRecord(raw) ? raw : null;
+        if (!entry || typeof entry['name'] !== 'string') {
+            diagnostics.push({ severity: 'warning', code: 'CONNECTION_INVALID', message: 'a connection without a name is skipped', path });
+            continue;
+        }
+        const dropped = [];
+        const out = { ...entry };
+        if (entry['config'] !== undefined)
+            out['config'] = stripCredentials(entry['config'], 'config', dropped);
+        for (const d of dropped) {
+            diagnostics.push({
+                severity: 'warning',
+                code: 'CREDENTIAL_DROPPED',
+                message: `connection "${entry['name']}": ${d} looks like a credential and is not published`,
+                path,
+            });
+        }
+        connections.push(out);
+    }
+    return { connections };
+}
+/** A file name for a module: `<name>.<first 8 hex of its hash>.mjs`, with anything unsafe replaced. */
+export function moduleFileName(name, hexHash) {
+    const safe = name.replace(/[^A-Za-z0-9._-]+/g, '_').replace(/^\.+/, '_') || 'module';
+    return `${safe}.${hexHash.slice(0, 8)}.mjs`;
+}
+/** The publisher an atom is attributed to: the pack id's publisher segment, or the id itself. */
+export function publisherOf(packId) {
+    const m = /^@pwpack\/([^/]+)\//.exec(packId);
+    return m?.[1] ?? packId;
+}
+/**
+ * Whether a local host may write `name` into the envelope: a relative path of
+ * `/`-separated segments ending in `.json` (`auth.json`,
+ * `surfaces/home.receipt.json`), each segment starting with a letter, digit,
+ * `_` or `-` — so no `.`/`..` segment, no hidden file, no absolute path.
+ */
+export function isEnvelopeFileName(name) {
+    return /^(?:[A-Za-z0-9_-][A-Za-z0-9_.-]*\/)*[A-Za-z0-9_-][A-Za-z0-9_.-]*\.json$/.test(name);
+}
+/**
+ * Merges what a local host adds to the envelope. Each key is a file name
+ * relative to `pwpack/` (`auth.json`, `surfaces/<key>.receipt.json`) and each
+ * value the document; a value for `project.json` is merged into it member by
+ * member. Called after the static envelope is laid out, so what the host
+ * offers WINS: its receipts (entity sources rewritten to its record
+ * endpoints) replace the folder's copies.
+ */
+export function mergeEnvelopeEntries(files, entries, diagnostics) {
+    if (!entries)
+        return;
+    const enc = new TextEncoder();
+    for (const [name, value] of Object.entries(entries)) {
+        if (!isEnvelopeFileName(name)) {
+            diagnostics.push({ severity: 'warning', code: 'HOST_ENTRY_IGNORED', message: `the local host offered "${name}", which is not an envelope file name` });
+            continue;
+        }
+        const path = `pwpack/${name}`;
+        if (name === 'project.json' && isRecord(value)) {
+            const current = JSON.parse(new TextDecoder().decode(files.get(path)));
+            files.set(path, enc.encode(JSON.stringify({ ...current, ...value })));
+            continue;
+        }
+        files.set(path, enc.encode(JSON.stringify(value)));
+    }
+}
+//# sourceMappingURL=envelope.js.map

package/dist/dev/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../src/dev/envelope.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAWvC,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,OAAgB;IAC3C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,MAAM,IAAI,GAAG,CAAC,IAAa,EAAQ,EAAE;QACnC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAClB,OAAM;QACR,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAM;QAC3B,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;QAC7E,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACrE,CAAC,CAAA;IACD,IAAI,QAAQ,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC9C,OAAO,CAAC,GAAG,KAAK,CAAC,CAAA;AACnB,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,SAAS,CAAC,IAAU;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA;AAC5E,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,KAAsB,EAAE,KAAa;IACpE,OAAO;QACL,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE;KAC1G,CAAA;AACH,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,UAAU,CAAC,IAAa;IACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAA;IACrE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACvH,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI;QACnC,QAAQ;QACR,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAA;AACH,CAAC;AAUD,6BAA6B;AAC7B,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IACtD,MAAM,mBAAmB,GAA2B,EAAE,CAAA;IACtD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK;QAAE,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,GAAG,eAAe,CAAA;IAC1F,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACvC,OAAO;QACL,aAAa,EAAE,OAAO;QACtB,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,cAAc,EAAE,KAAK,CAAC,KAAK;QAC3B,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3C,mBAAmB;QACnB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAA;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,MAAM,iBAAiB,GAC5B,0HAA0H,CAAA;AAE5H,SAAS,gBAAgB,CAAC,KAAc,EAAE,IAAY,EAAE,OAAiB;IACvE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAA;IACnG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAClC,MAAM,GAAG,GAA4B,EAAE,CAAA;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAA;YAC5B,SAAQ;QACV,CAAC;QACD,GAAG,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAY,EACZ,WAAiC,EACjC,IAAI,GAAG,kCAAkC;IAEzC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACxE,MAAM,WAAW,GAA8B,EAAE,CAAA;IACjD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;QAClF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;YAChD,WAAW,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,wCAAwC,EAAE,IAAI,EAAE,CAAC,CAAA;YAC9H,SAAQ;QACV,CAAC;QACD,MAAM,OAAO,GAAa,EAAE,CAAA;QAC5B,MAAM,GAAG,GAA4B,EAAE,GAAG,KAAK,EAAE,CAAA;QACjD,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;QACvG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,WAAW,CAAC,IAAI,CAAC;gBACf,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,eAAe,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,+CAA+C;gBAC3F,IAAI;aACL,CAAC,CAAA;QACJ,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,CAAA;AACxB,CAAC;AAsBD,uGAAuG;AACvG,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,OAAe;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,QAAQ,CAAA;IACpF,OAAO,GAAG,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAA;AAC7C,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC5C,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAA;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,yEAAyE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC7F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAA8B,EAC9B,OAAsD,EACtD,WAAiC;IAEjC,IAAI,CAAC,OAAO;QAAE,OAAM;IACpB,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAA;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,WAAW,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,2BAA2B,IAAI,uCAAuC,EAAE,CAAC,CAAA;YACtJ,SAAQ;QACV,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,IAAI,EAAE,CAAA;QAC7B,IAAI,IAAI,KAAK,cAAc,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAe,CAAC,CAA4B,CAAA;YAC9G,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;YACrE,SAAQ;QACV,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACpD,CAAC;AACH,CAAC","sourcesContent":["/**\n * The envelope documents a runner reads (`pwpack/project.json`,\n * `navigation.json`, `connections.json`, the two module manifests), built\n * from the app folder's declaration.\n */\nimport type { AssembleDiagnostic } from './diagnostics.js'\nimport { isRecord } from './sources.js'\n\n/** One page of the app: its key, its receipt and what the receipt says. */\nexport interface Page {\n  readonly key: string\n  /** Path of the receipt in the app folder. */\n  readonly path: string\n  readonly bytes: Uint8Array\n  readonly receipt: Record<string, unknown>\n}\n\n/** The block types a receipt places, walking `blocks` and every `children`. */\nexport function blockTypesOf(receipt: unknown): string[] {\n  const types = new Set<string>()\n  const walk = (node: unknown): void => {\n    if (Array.isArray(node)) {\n      node.forEach(walk)\n      return\n    }\n    if (!isRecord(node)) return\n    if (typeof node['type'] === 'string' && node['type']) types.add(node['type'])\n    if (Array.isArray(node['children'])) node['children'].forEach(walk)\n  }\n  if (isRecord(receipt)) walk(receipt['blocks'])\n  return [...types]\n}\n\n/** The page's display name: the receipt's title, else the key. */\nexport function pageLabel(page: Page): string {\n  const title = page.receipt['title']\n  return typeof title === 'string' && title.trim() ? title.trim() : page.key\n}\n\n/** Navigation derived from the route table when the app declares none. */\nexport function deriveNavigation(pages: readonly Page[], entry: string): { navbar: { links: { label: string; href: string }[] } } {\n  return {\n    navbar: { links: pages.map((p) => ({ label: pageLabel(p), href: p.key === entry ? '/' : `/${p.key}` })) },\n  }\n}\n\n/** What the app declares about who may enter (`app/definitions/auth.json`), as `project.json` carries it. */\nexport function identityOf(auth: unknown): { required: boolean; topology: 'app' | 'external'; methods?: string[] } | undefined {\n  if (!isRecord(auth)) return undefined\n  const topology = auth['topology'] === 'external' ? 'external' : 'app'\n  const methods = Array.isArray(auth['methods']) ? auth['methods'].filter((m): m is string => typeof m === 'string') : []\n  return {\n    required: auth['required'] === true,\n    topology,\n    ...(topology === 'app' ? { methods } : {}),\n  }\n}\n\nexport interface ProjectJsonInput {\n  readonly id: string\n  readonly title: string\n  readonly entry: string\n  readonly pages: readonly Page[]\n  readonly auth?: unknown\n}\n\n/** `pwpack/project.json`. */\nexport function buildProjectJson(input: ProjectJsonInput): Record<string, unknown> {\n  const surfaceReceiptFiles: Record<string, string> = {}\n  for (const p of input.pages) surfaceReceiptFiles[p.key] = `surfaces/${p.key}.receipt.json`\n  const identity = identityOf(input.auth)\n  return {\n    schemaVersion: '1.0.0',\n    id: input.id,\n    title: input.title,\n    entrySurfaceId: input.entry,\n    surfaceOrder: input.pages.map((p) => p.key),\n    surfaceReceiptFiles,\n    ...(identity ? { identity } : {}),\n  }\n}\n\n/** Config keys that smell of a credential. Such a key never reaches a published app. */\nexport const CREDENTIAL_KEY_RE =\n  /(auth|header|credential|secret|token|password|passwd|apikey|api_key|clientsecret|client_secret|bearer|cookie|signature)/i\n\nfunction stripCredentials(value: unknown, path: string, dropped: string[]): unknown {\n  if (Array.isArray(value)) return value.map((v, i) => stripCredentials(v, `${path}[${i}]`, dropped))\n  if (!isRecord(value)) return value\n  const out: Record<string, unknown> = {}\n  for (const [k, v] of Object.entries(value)) {\n    if (CREDENTIAL_KEY_RE.test(k)) {\n      dropped.push(`${path}.${k}`)\n      continue\n    }\n    out[k] = stripCredentials(v, `${path}.${k}`, dropped)\n  }\n  return out\n}\n\n/**\n * `pwpack/connections.json`: the declaration with every credential-like\n * config key removed (each removal is reported). A bare string entry is read\n * as `{ name }`.\n */\nexport function buildConnections(\n  doc: unknown,\n  diagnostics: AssembleDiagnostic[],\n  path = 'app/definitions/connections.json'\n): { connections: Record<string, unknown>[] } | undefined {\n  if (!isRecord(doc)) return undefined\n  const list = Array.isArray(doc['connections']) ? doc['connections'] : []\n  const connections: Record<string, unknown>[] = []\n  for (const raw of list) {\n    const entry = typeof raw === 'string' ? { name: raw } : isRecord(raw) ? raw : null\n    if (!entry || typeof entry['name'] !== 'string') {\n      diagnostics.push({ severity: 'warning', code: 'CONNECTION_INVALID', message: 'a connection without a name is skipped', path })\n      continue\n    }\n    const dropped: string[] = []\n    const out: Record<string, unknown> = { ...entry }\n    if (entry['config'] !== undefined) out['config'] = stripCredentials(entry['config'], 'config', dropped)\n    for (const d of dropped) {\n      diagnostics.push({\n        severity: 'warning',\n        code: 'CREDENTIAL_DROPPED',\n        message: `connection \"${entry['name']}\": ${d} looks like a credential and is not published`,\n        path,\n      })\n    }\n    connections.push(out)\n  }\n  return { connections }\n}\n\n/** One entry of `blocks/manifest.json`. */\nexport interface BlockManifestEntry {\n  readonly blockType: string\n  readonly moduleUrl: string\n  readonly integrity: string\n  readonly publisher: string\n  readonly publisherVerified: boolean\n  readonly definition: { readonly name: string }\n}\n\n/** One entry of `engines/manifest.json`. */\nexport interface EngineManifestEntry {\n  readonly connection: string\n  readonly atomId: string\n  readonly kind: 'connector' | 'provider'\n  readonly moduleUrl?: string\n  readonly integrity?: string\n  readonly engine?: unknown\n}\n\n/** A file name for a module: `<name>.<first 8 hex of its hash>.mjs`, with anything unsafe replaced. */\nexport function moduleFileName(name: string, hexHash: string): string {\n  const safe = name.replace(/[^A-Za-z0-9._-]+/g, '_').replace(/^\\.+/, '_') || 'module'\n  return `${safe}.${hexHash.slice(0, 8)}.mjs`\n}\n\n/** The publisher an atom is attributed to: the pack id's publisher segment, or the id itself. */\nexport function publisherOf(packId: string): string {\n  const m = /^@pwpack\\/([^/]+)\\//.exec(packId)\n  return m?.[1] ?? packId\n}\n\n/**\n * Whether a local host may write `name` into the envelope: a relative path of\n * `/`-separated segments ending in `.json` (`auth.json`,\n * `surfaces/home.receipt.json`), each segment starting with a letter, digit,\n * `_` or `-` — so no `.`/`..` segment, no hidden file, no absolute path.\n */\nexport function isEnvelopeFileName(name: string): boolean {\n  return /^(?:[A-Za-z0-9_-][A-Za-z0-9_.-]*\\/)*[A-Za-z0-9_-][A-Za-z0-9_.-]*\\.json$/.test(name)\n}\n\n/**\n * Merges what a local host adds to the envelope. Each key is a file name\n * relative to `pwpack/` (`auth.json`, `surfaces/<key>.receipt.json`) and each\n * value the document; a value for `project.json` is merged into it member by\n * member. Called after the static envelope is laid out, so what the host\n * offers WINS: its receipts (entity sources rewritten to its record\n * endpoints) replace the folder's copies.\n */\nexport function mergeEnvelopeEntries(\n  files: Map<string, Uint8Array>,\n  entries: Readonly<Record<string, unknown>> | undefined,\n  diagnostics: AssembleDiagnostic[]\n): void {\n  if (!entries) return\n  const enc = new TextEncoder()\n  for (const [name, value] of Object.entries(entries)) {\n    if (!isEnvelopeFileName(name)) {\n      diagnostics.push({ severity: 'warning', code: 'HOST_ENTRY_IGNORED', message: `the local host offered \"${name}\", which is not an envelope file name` })\n      continue\n    }\n    const path = `pwpack/${name}`\n    if (name === 'project.json' && isRecord(value)) {\n      const current = JSON.parse(new TextDecoder().decode(files.get(path) as Uint8Array)) as Record<string, unknown>\n      files.set(path, enc.encode(JSON.stringify({ ...current, ...value })))\n      continue\n    }\n    files.set(path, enc.encode(JSON.stringify(value)))\n  }\n}\n"]}

package/dist/dev/media.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Media: the app's declared images and files, copied into the pwapp.
+ *
+ * pwpack-format §1.3: `app/media/<key>.json` declares one image or file
+ * (`{ purpose, kind, origin, slots, status, url?, decorative?, file? }`) and
+ * carries no bytes; the bytes are `media/<file>`, each recorded in
+ * `media/provenance.json`. The pack library's `mediaDeclarations` reads
+ * that layout (its findings reach the diagnostics through `validatePack`).
+ * pwapp-format §1 puts the bytes the app serves at `pwpack/media/<file>`,
+ * and §4 records each declaration's resolved address in `publish.json`
+ * `media[]`.
+ *
+ * For each declaration the bytes are looked up, in order:
+ *
+ *   1. the declaration's `file` (a pack path, `media/<name>`);
+ *   2. `media/<path>` — a `url` that is itself a `media/…` path;
+ *   3. `media/<key>.<ext>` — the one media file named after the key.
+ *
+ * Found bytes are served at `pwpack/media/…` and the declaration resolves to
+ * that address. A declaration without bytes but with an absolute `url` keeps
+ * the url. Every other one is reported (info) and left alone.
+ *
+ * Slots: a declared slot (`{ surfaceKey, blockId, prop }`) whose prop is
+ * empty in the served receipt gets the resolved address. A value already in
+ * the prop is never replaced (plan.md §2 rule 1). The app's own files are
+ * never rewritten; only the served copy of the receipt is.
+ */
+import { type PackFolder } from '@pwfabric/pack';
+import type { AssembleDiagnostic } from './diagnostics.js';
+/** One slot a resolved address is written into. */
+export interface MediaSlot {
+    readonly blockId: string;
+    readonly prop: string;
+    readonly url: string;
+}
+export interface CollectedMedia {
+    /** Files to serve, relative to `pwpack/` (`media/hero.webp`). */
+    readonly files: Map<string, Uint8Array>;
+    /** `publish.json` `media[]`, in key order. */
+    readonly records: {
+        key: string;
+        url: string;
+    }[];
+    /** Slots to fill, by page key. */
+    readonly slots: Map<string, MediaSlot[]>;
+}
+/** Reads the app's media declarations and bytes. */
+export declare function collectMedia(folder: PackFolder, diagnostics: AssembleDiagnostic[]): CollectedMedia;
+/**
+ * The served receipt with its empty media slots filled, or `undefined` when
+ * nothing changed (the bytes are then served exactly as written).
+ */
+export declare function fillMediaSlots(receiptBytes: Uint8Array, slots: readonly MediaSlot[] | undefined): Uint8Array | undefined;

package/dist/dev/media.js

@@ -0,0 +1,128 @@
+/**
+ * Media: the app's declared images and files, copied into the pwapp.
+ *
+ * pwpack-format §1.3: `app/media/<key>.json` declares one image or file
+ * (`{ purpose, kind, origin, slots, status, url?, decorative?, file? }`) and
+ * carries no bytes; the bytes are `media/<file>`, each recorded in
+ * `media/provenance.json`. The pack library's `mediaDeclarations` reads
+ * that layout (its findings reach the diagnostics through `validatePack`).
+ * pwapp-format §1 puts the bytes the app serves at `pwpack/media/<file>`,
+ * and §4 records each declaration's resolved address in `publish.json`
+ * `media[]`.
+ *
+ * For each declaration the bytes are looked up, in order:
+ *
+ *   1. the declaration's `file` (a pack path, `media/<name>`);
+ *   2. `media/<path>` — a `url` that is itself a `media/…` path;
+ *   3. `media/<key>.<ext>` — the one media file named after the key.
+ *
+ * Found bytes are served at `pwpack/media/…` and the declaration resolves to
+ * that address. A declaration without bytes but with an absolute `url` keeps
+ * the url. Every other one is reported (info) and left alone.
+ *
+ * Slots: a declared slot (`{ surfaceKey, blockId, prop }`) whose prop is
+ * empty in the served receipt gets the resolved address. A value already in
+ * the prop is never replaced (plan.md §2 rule 1). The app's own files are
+ * never rewritten; only the served copy of the receipt is.
+ */
+import { MEDIA_DIR, MEDIA_PROVENANCE_FILE, mediaDeclarations } from '@pwfabric/pack';
+import { isRecord } from './sources.js';
+const ABSOLUTE_URL = /^(?:https?:|data:)/i;
+/** A single path segment that is safe to serve: no separators, no dot names. */
+function isSafeName(name) {
+    return name.length > 0 && !/[\\/\0]/.test(name) && name !== '.' && name !== '..';
+}
+/** A relative `media/…` path with no `.`/`..` segment. */
+function isSafeMediaPath(path) {
+    return path.startsWith(MEDIA_DIR) && path.slice(MEDIA_DIR.length).split('/').every(isSafeName);
+}
+/** The media file named after a key (`media/<key>.<ext>`), when exactly one exists. */
+function byKey(mediaPaths, key) {
+    const hits = mediaPaths.filter((p) => {
+        const name = p.slice(MEDIA_DIR.length);
+        return !name.includes('/') && name.slice(0, name.lastIndexOf('.') > 0 ? name.lastIndexOf('.') : undefined) === key;
+    });
+    return hits.length === 1 ? hits[0] : undefined;
+}
+/** Reads the app's media declarations and bytes. */
+export function collectMedia(folder, diagnostics) {
+    const files = new Map();
+    const records = [];
+    const slots = new Map();
+    const mediaPaths = [...folder.files.keys()].filter((p) => p !== MEDIA_PROVENANCE_FILE && isSafeMediaPath(p)).sort();
+    for (const path of mediaPaths)
+        files.set(path, folder.files.get(path));
+    for (const { key, path, declaration, filePath } of mediaDeclarations(folder).declarations) {
+        const declaredUrl = declaration.url?.trim() ?? '';
+        const urlPath = declaredUrl.replace(/^\.\//, '');
+        let url;
+        const inMedia = (filePath !== undefined && files.has(filePath) ? filePath : undefined) ??
+            (isSafeMediaPath(urlPath) && files.has(urlPath) ? urlPath : undefined) ??
+            byKey(mediaPaths, key);
+        if (inMedia) {
+            url = `pwpack/${inMedia}`;
+        }
+        else if (ABSOLUTE_URL.test(declaredUrl)) {
+            url = declaredUrl;
+        }
+        if (url === undefined) {
+            diagnostics.push({
+                severity: 'info',
+                code: 'MEDIA_UNRESOLVED',
+                message: `media "${key}" has no bytes in media/ and no absolute url; its slots keep what the receipts say`,
+                path,
+            });
+            continue;
+        }
+        records.push({ key, url });
+        const served = ABSOLUTE_URL.test(url) ? url : `./${url}`;
+        for (const { surfaceKey, blockId, prop } of declaration.slots ?? []) {
+            const list = slots.get(surfaceKey) ?? [];
+            list.push({ blockId, prop, url: served });
+            slots.set(surfaceKey, list);
+        }
+    }
+    return { files, records, slots };
+}
+const isEmpty = (v) => v === undefined || v === null || (typeof v === 'string' && v.trim() === '');
+/**
+ * The served receipt with its empty media slots filled, or `undefined` when
+ * nothing changed (the bytes are then served exactly as written).
+ */
+export function fillMediaSlots(receiptBytes, slots) {
+    if (!slots || slots.length === 0)
+        return undefined;
+    let receipt;
+    try {
+        receipt = JSON.parse(new TextDecoder().decode(receiptBytes));
+    }
+    catch {
+        return undefined;
+    }
+    if (!isRecord(receipt))
+        return undefined;
+    const copy = structuredClone(receipt);
+    let changed = false;
+    const walk = (node) => {
+        if (Array.isArray(node)) {
+            node.forEach(walk);
+            return;
+        }
+        if (!isRecord(node))
+            return;
+        for (const slot of slots) {
+            if (node['id'] !== slot.blockId)
+                continue;
+            const props = isRecord(node['props']) ? node['props'] : {};
+            if (!isEmpty(props[slot.prop]))
+                continue;
+            node['props'] = { ...props, [slot.prop]: slot.url };
+            changed = true;
+        }
+        if (Array.isArray(node['children']))
+            node['children'].forEach(walk);
+    };
+    walk(copy['blocks']);
+    return changed ? new TextEncoder().encode(JSON.stringify(copy)) : undefined;
+}
+//# sourceMappingURL=media.js.map

package/dist/dev/media.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media.js","sourceRoot":"","sources":["../../src/dev/media.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,iBAAiB,EAAmB,MAAM,gBAAgB,CAAA;AAErG,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAkBvC,MAAM,YAAY,GAAG,qBAAqB,CAAA;AAE1C,gFAAgF;AAChF,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAA;AAClF,CAAC;AAED,0DAA0D;AAC1D,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;AAChG,CAAC;AAED,uFAAuF;AACvF,SAAS,KAAK,CAAC,UAA6B,EAAE,GAAW;IACvD,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QACtC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,GAAG,CAAA;IACpH,CAAC,CAAC,CAAA;IACF,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAChD,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,YAAY,CAAC,MAAkB,EAAE,WAAiC;IAChF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAA;IAC3C,MAAM,OAAO,GAAmC,EAAE,CAAA;IAClD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAA;IAE5C,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,qBAAqB,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACnH,KAAK,MAAM,IAAI,IAAI,UAAU;QAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAe,CAAC,CAAA;IAEpF,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,CAAC;QAC1F,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QACjD,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QAEhD,IAAI,GAAuB,CAAA;QAC3B,MAAM,OAAO,GACX,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YACtE,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YACtE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QACxB,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG,GAAG,UAAU,OAAO,EAAE,CAAA;QAC3B,CAAC;aAAM,IAAI,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1C,GAAG,GAAG,WAAW,CAAA;QACnB,CAAC;QACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,WAAW,CAAC,IAAI,CAAC;gBACf,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,UAAU,GAAG,oFAAoF;gBAC1G,IAAI;aACL,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;QAC1B,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAA;QACxD,KAAK,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,WAAW,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACpE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAA;YACxC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;YACzC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;AAClC,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;AAEpH;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,YAAwB,EAAE,KAAuC;IAC9F,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAClD,IAAI,OAAgB,CAAA;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAA;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAA;IACxC,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IACrC,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,MAAM,IAAI,GAAG,CAAC,IAAa,EAAQ,EAAE;QACnC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAClB,OAAM;QACR,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAM;QAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;gBAAE,SAAQ;YACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAC1D,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAE,SAAQ;YACxC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAA;YACnD,OAAO,GAAG,IAAI,CAAA;QAChB,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACrE,CAAC,CAAA;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;IACpB,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7E,CAAC","sourcesContent":["/**\n * Media: the app's declared images and files, copied into the pwapp.\n *\n * pwpack-format §1.3: `app/media/<key>.json` declares one image or file\n * (`{ purpose, kind, origin, slots, status, url?, decorative?, file? }`) and\n * carries no bytes; the bytes are `media/<file>`, each recorded in\n * `media/provenance.json`. The pack library's `mediaDeclarations` reads\n * that layout (its findings reach the diagnostics through `validatePack`).\n * pwapp-format §1 puts the bytes the app serves at `pwpack/media/<file>`,\n * and §4 records each declaration's resolved address in `publish.json`\n * `media[]`.\n *\n * For each declaration the bytes are looked up, in order:\n *\n *   1. the declaration's `file` (a pack path, `media/<name>`);\n *   2. `media/<path>` — a `url` that is itself a `media/…` path;\n *   3. `media/<key>.<ext>` — the one media file named after the key.\n *\n * Found bytes are served at `pwpack/media/…` and the declaration resolves to\n * that address. A declaration without bytes but with an absolute `url` keeps\n * the url. Every other one is reported (info) and left alone.\n *\n * Slots: a declared slot (`{ surfaceKey, blockId, prop }`) whose prop is\n * empty in the served receipt gets the resolved address. A value already in\n * the prop is never replaced (plan.md §2 rule 1). The app's own files are\n * never rewritten; only the served copy of the receipt is.\n */\nimport { MEDIA_DIR, MEDIA_PROVENANCE_FILE, mediaDeclarations, type PackFolder } from '@pwfabric/pack'\nimport type { AssembleDiagnostic } from './diagnostics.js'\nimport { isRecord } from './sources.js'\n\n/** One slot a resolved address is written into. */\nexport interface MediaSlot {\n  readonly blockId: string\n  readonly prop: string\n  readonly url: string\n}\n\nexport interface CollectedMedia {\n  /** Files to serve, relative to `pwpack/` (`media/hero.webp`). */\n  readonly files: Map<string, Uint8Array>\n  /** `publish.json` `media[]`, in key order. */\n  readonly records: { key: string; url: string }[]\n  /** Slots to fill, by page key. */\n  readonly slots: Map<string, MediaSlot[]>\n}\n\nconst ABSOLUTE_URL = /^(?:https?:|data:)/i\n\n/** A single path segment that is safe to serve: no separators, no dot names. */\nfunction isSafeName(name: string): boolean {\n  return name.length > 0 && !/[\\\\/\\0]/.test(name) && name !== '.' && name !== '..'\n}\n\n/** A relative `media/…` path with no `.`/`..` segment. */\nfunction isSafeMediaPath(path: string): boolean {\n  return path.startsWith(MEDIA_DIR) && path.slice(MEDIA_DIR.length).split('/').every(isSafeName)\n}\n\n/** The media file named after a key (`media/<key>.<ext>`), when exactly one exists. */\nfunction byKey(mediaPaths: readonly string[], key: string): string | undefined {\n  const hits = mediaPaths.filter((p) => {\n    const name = p.slice(MEDIA_DIR.length)\n    return !name.includes('/') && name.slice(0, name.lastIndexOf('.') > 0 ? name.lastIndexOf('.') : undefined) === key\n  })\n  return hits.length === 1 ? hits[0] : undefined\n}\n\n/** Reads the app's media declarations and bytes. */\nexport function collectMedia(folder: PackFolder, diagnostics: AssembleDiagnostic[]): CollectedMedia {\n  const files = new Map<string, Uint8Array>()\n  const records: { key: string; url: string }[] = []\n  const slots = new Map<string, MediaSlot[]>()\n\n  const mediaPaths = [...folder.files.keys()].filter((p) => p !== MEDIA_PROVENANCE_FILE && isSafeMediaPath(p)).sort()\n  for (const path of mediaPaths) files.set(path, folder.files.get(path) as Uint8Array)\n\n  for (const { key, path, declaration, filePath } of mediaDeclarations(folder).declarations) {\n    const declaredUrl = declaration.url?.trim() ?? ''\n    const urlPath = declaredUrl.replace(/^\\.\\//, '')\n\n    let url: string | undefined\n    const inMedia =\n      (filePath !== undefined && files.has(filePath) ? filePath : undefined) ??\n      (isSafeMediaPath(urlPath) && files.has(urlPath) ? urlPath : undefined) ??\n      byKey(mediaPaths, key)\n    if (inMedia) {\n      url = `pwpack/${inMedia}`\n    } else if (ABSOLUTE_URL.test(declaredUrl)) {\n      url = declaredUrl\n    }\n    if (url === undefined) {\n      diagnostics.push({\n        severity: 'info',\n        code: 'MEDIA_UNRESOLVED',\n        message: `media \"${key}\" has no bytes in media/ and no absolute url; its slots keep what the receipts say`,\n        path,\n      })\n      continue\n    }\n    records.push({ key, url })\n    const served = ABSOLUTE_URL.test(url) ? url : `./${url}`\n    for (const { surfaceKey, blockId, prop } of declaration.slots ?? []) {\n      const list = slots.get(surfaceKey) ?? []\n      list.push({ blockId, prop, url: served })\n      slots.set(surfaceKey, list)\n    }\n  }\n  return { files, records, slots }\n}\n\nconst isEmpty = (v: unknown): boolean => v === undefined || v === null || (typeof v === 'string' && v.trim() === '')\n\n/**\n * The served receipt with its empty media slots filled, or `undefined` when\n * nothing changed (the bytes are then served exactly as written).\n */\nexport function fillMediaSlots(receiptBytes: Uint8Array, slots: readonly MediaSlot[] | undefined): Uint8Array | undefined {\n  if (!slots || slots.length === 0) return undefined\n  let receipt: unknown\n  try {\n    receipt = JSON.parse(new TextDecoder().decode(receiptBytes))\n  } catch {\n    return undefined\n  }\n  if (!isRecord(receipt)) return undefined\n  const copy = structuredClone(receipt)\n  let changed = false\n  const walk = (node: unknown): void => {\n    if (Array.isArray(node)) {\n      node.forEach(walk)\n      return\n    }\n    if (!isRecord(node)) return\n    for (const slot of slots) {\n      if (node['id'] !== slot.blockId) continue\n      const props = isRecord(node['props']) ? node['props'] : {}\n      if (!isEmpty(props[slot.prop])) continue\n      node['props'] = { ...props, [slot.prop]: slot.url }\n      changed = true\n    }\n    if (Array.isArray(node['children'])) node['children'].forEach(walk)\n  }\n  walk(copy['blocks'])\n  return changed ? new TextEncoder().encode(JSON.stringify(copy)) : undefined\n}\n"]}

package/dist/dev/needs-host.d.ts

@@ -0,0 +1,2 @@
+/** What the app declares that only a host can serve. Empty when it needs none. */
+export declare function hostNeeds(root: string): Promise<string[]>;

package/dist/dev/needs-host.js

@@ -0,0 +1,32 @@
+/**
+ * Whether an app needs a local host: it declares sign-in
+ * (`app/definitions/auth.json`) or records (`app/definitions/entities.json`).
+ */
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { isRecord } from './sources.js';
+async function readJson(path) {
+    try {
+        return JSON.parse((await readFile(path, 'utf8')).replace(/^\uFEFF/, ''));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** What the app declares that only a host can serve. Empty when it needs none. */
+export async function hostNeeds(root) {
+    const needs = [];
+    const auth = await readJson(join(root, 'app', 'definitions', 'auth.json'));
+    if (isRecord(auth) &&
+        (auth['required'] === true ||
+            auth['topology'] === 'external' ||
+            (Array.isArray(auth['methods']) && auth['methods'].length > 0))) {
+        needs.push('sign-in');
+    }
+    const entities = await readJson(join(root, 'app', 'definitions', 'entities.json'));
+    if (isRecord(entities) && Array.isArray(entities['entities']) && entities['entities'].length > 0) {
+        needs.push('records');
+    }
+    return needs;
+}
+//# sourceMappingURL=needs-host.js.map

package/dist/dev/needs-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"needs-host.js","sourceRoot":"","sources":["../../src/dev/needs-host.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAEvC,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAY,CAAA;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;IAC1E,IACE,QAAQ,CAAC,IAAI,CAAC;QACd,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI;YACxB,IAAI,CAAC,UAAU,CAAC,KAAK,UAAU;YAC/B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EACjE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACvB,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,CAAA;IAClF,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACvB,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC","sourcesContent":["/**\n * Whether an app needs a local host: it declares sign-in\n * (`app/definitions/auth.json`) or records (`app/definitions/entities.json`).\n */\nimport { readFile } from 'node:fs/promises'\nimport { join } from 'node:path'\nimport { isRecord } from './sources.js'\n\nasync function readJson(path: string): Promise<unknown> {\n  try {\n    return JSON.parse((await readFile(path, 'utf8')).replace(/^\\uFEFF/, '')) as unknown\n  } catch {\n    return undefined\n  }\n}\n\n/** What the app declares that only a host can serve. Empty when it needs none. */\nexport async function hostNeeds(root: string): Promise<string[]> {\n  const needs: string[] = []\n  const auth = await readJson(join(root, 'app', 'definitions', 'auth.json'))\n  if (\n    isRecord(auth) &&\n    (auth['required'] === true ||\n      auth['topology'] === 'external' ||\n      (Array.isArray(auth['methods']) && auth['methods'].length > 0))\n  ) {\n    needs.push('sign-in')\n  }\n  const entities = await readJson(join(root, 'app', 'definitions', 'entities.json'))\n  if (isRecord(entities) && Array.isArray(entities['entities']) && entities['entities'].length > 0) {\n    needs.push('records')\n  }\n  return needs\n}\n"]}

package/dist/dev/output.d.ts

@@ -0,0 +1,9 @@
+/** Thrown when the output folder holds something that is not a previous build. */
+export declare class OutputFolderError extends Error {
+}
+/**
+ * Writes `files` into `outDir`, replacing a previous build there. A folder
+ * that exists, is not empty and holds no `publish.json` is not a build this
+ * command wrote, and is left alone.
+ */
+export declare function writePwapp(files: ReadonlyMap<string, Uint8Array>, outDir: string): Promise<void>;

package/dist/dev/output.js

@@ -0,0 +1,32 @@
+/**
+ * Writing an assembled pwapp to disk.
+ */
+import { mkdir, readdir, rm, stat, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+/** Thrown when the output folder holds something that is not a previous build. */
+export class OutputFolderError extends Error {
+}
+/**
+ * Writes `files` into `outDir`, replacing a previous build there. A folder
+ * that exists, is not empty and holds no `publish.json` is not a build this
+ * command wrote, and is left alone.
+ */
+export async function writePwapp(files, outDir) {
+    const st = await stat(outDir).catch(() => null);
+    if (st) {
+        if (!st.isDirectory())
+            throw new OutputFolderError(`${outDir} exists and is not a folder`);
+        const entries = await readdir(outDir);
+        if (entries.length > 0 && !entries.includes('publish.json')) {
+            throw new OutputFolderError(`${outDir} is not empty and holds no previous build (no publish.json); choose another --out`);
+        }
+        await rm(outDir, { recursive: true, force: true });
+    }
+    await mkdir(outDir, { recursive: true });
+    for (const [path, bytes] of files) {
+        const target = join(outDir, ...path.split('/'));
+        await mkdir(dirname(target), { recursive: true });
+        await writeFile(target, bytes);
+    }
+}
+//# sourceMappingURL=output.js.map

package/dist/dev/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../src/dev/output.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACtE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEzC,kFAAkF;AAClF,MAAM,OAAO,iBAAkB,SAAQ,KAAK;CAAG;AAE/C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAsC,EAAE,MAAc;IACrF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAC/C,IAAI,EAAE,EAAE,CAAC;QACP,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,MAAM,6BAA6B,CAAC,CAAA;QAC1F,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;QACrC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,iBAAiB,CAAC,GAAG,MAAM,mFAAmF,CAAC,CAAA;QAC3H,CAAC;QACD,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,CAAC;IACD,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACxC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;QAC/C,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACjD,MAAM,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAChC,CAAC;AACH,CAAC","sourcesContent":["/**\n * Writing an assembled pwapp to disk.\n */\nimport { mkdir, readdir, rm, stat, writeFile } from 'node:fs/promises'\nimport { dirname, join } from 'node:path'\n\n/** Thrown when the output folder holds something that is not a previous build. */\nexport class OutputFolderError extends Error {}\n\n/**\n * Writes `files` into `outDir`, replacing a previous build there. A folder\n * that exists, is not empty and holds no `publish.json` is not a build this\n * command wrote, and is left alone.\n */\nexport async function writePwapp(files: ReadonlyMap<string, Uint8Array>, outDir: string): Promise<void> {\n  const st = await stat(outDir).catch(() => null)\n  if (st) {\n    if (!st.isDirectory()) throw new OutputFolderError(`${outDir} exists and is not a folder`)\n    const entries = await readdir(outDir)\n    if (entries.length > 0 && !entries.includes('publish.json')) {\n      throw new OutputFolderError(`${outDir} is not empty and holds no previous build (no publish.json); choose another --out`)\n    }\n    await rm(outDir, { recursive: true, force: true })\n  }\n  await mkdir(outDir, { recursive: true })\n  for (const [path, bytes] of files) {\n    const target = join(outDir, ...path.split('/'))\n    await mkdir(dirname(target), { recursive: true })\n    await writeFile(target, bytes)\n  }\n}\n"]}

package/dist/dev/overlay.d.ts

@@ -0,0 +1,21 @@
+/**
+ * What `pwf dev` adds to a page: the reload client, and the overlay shown
+ * instead of the app when the last build failed.
+ */
+import type { AssembleDiagnostic } from './diagnostics.js';
+/** Server-Sent Events endpoint the page listens on. */
+export declare const EVENTS_PATH = "/_pwf/events";
+/** The current build's status as JSON. */
+export declare const STATUS_PATH = "/_pwf/status";
+/** Where the dev server serves the reload client's script. */
+export declare const RELOAD_PATH = "/_pwf/reload.js";
+/** The reload client's script: reloads the page when the server announces a new build. */
+export declare const RELOAD_JS = "(function () {\n  if (typeof EventSource === 'undefined') return\n  var es = new EventSource('/_pwf/events')\n  es.addEventListener('reload', function () { location.reload() })\n})()\n";
+/**
+ * The reload client, as markup for a page. A script file on the dev server's
+ * own origin, not an inline script, so the app's Content Security Policy
+ * covers it with 'self' (and its event stream with connect-src 'self').
+ */
+export declare const RELOAD_CLIENT = "\n    <script src=\"/_pwf/reload.js\"></script>";
+/** The page shown while the last build has errors. */
+export declare function overlayHtml(diagnostics: readonly AssembleDiagnostic[], title?: string): string;