@stringsync/splates 0.0.60 → 1.13.3

package/vendor/core/creds/index.js

@@ -0,0 +1,337 @@
+// creds/credential-proxy.ts
+import { timingSafeEqual } from "node:crypto";
+var HOP_BY_HOP = [
+  "connection",
+  "content-length",
+  "host",
+  "keep-alive",
+  "proxy-authorization",
+  "proxy-connection",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+];
+
+class CredentialProxy {
+  server;
+  url;
+  placeholder;
+  constructor(server, url, placeholder) {
+    this.server = server;
+    this.url = url;
+    this.placeholder = placeholder;
+  }
+  static listen(source, opts) {
+    const upstream = new URL(opts.upstream);
+    if (upstream.protocol !== "https:" && !isLoopback(upstream.hostname)) {
+      throw new Error(`the upstream ${upstream.origin} is not https: a key would cross the network in the clear`);
+    }
+    const prefix = upstream.pathname.replace(/\/+$/, "");
+    const header = opts.header.toLowerCase();
+    const placeholder = `wiz-proxy-${randomHex(32)}`;
+    const expected = Buffer.from(opts.scheme === undefined ? placeholder : `${opts.scheme} ${placeholder}`);
+    const server = Bun.serve({
+      hostname: "127.0.0.1",
+      port: 0,
+      idleTimeout: 0,
+      development: false,
+      fetch: async (request) => {
+        const presented = Buffer.from(request.headers.get(header) ?? "");
+        if (presented.length !== expected.length || !timingSafeEqual(presented, expected)) {
+          return refuse(401, "this proxy wants its placeholder key");
+        }
+        const key = await source.get(opts.credential).catch(() => {
+          return;
+        });
+        if (key === undefined || key === "") {
+          return refuse(503, `${opts.credential} is not available to this proxy`);
+        }
+        const headers = new Headers(request.headers);
+        for (const name of HOP_BY_HOP) {
+          headers.delete(name);
+        }
+        try {
+          headers.set(header, opts.scheme === undefined ? key : `${opts.scheme} ${key}`);
+        } catch {
+          return refuse(503, `${opts.credential} is not a valid header value`);
+        }
+        const { pathname, search } = new URL(request.url);
+        const target = new URL(`${upstream.origin}${prefix}${pathname}${search}`);
+        if (target.origin !== upstream.origin) {
+          return refuse(400, "that path leaves the upstream");
+        }
+        const body = request.method === "GET" || request.method === "HEAD" ? undefined : await request.arrayBuffer();
+        let response;
+        try {
+          response = await fetch(target, {
+            method: request.method,
+            headers,
+            body,
+            redirect: "manual",
+            signal: request.signal,
+            decompress: false
+          });
+        } catch {
+          return refuse(502, `could not reach ${upstream.origin}`);
+        }
+        const passed = new Headers(response.headers);
+        for (const name of ["connection", "keep-alive", "transfer-encoding"]) {
+          passed.delete(name);
+        }
+        return new Response(response.body, {
+          status: response.status,
+          statusText: response.statusText,
+          headers: passed
+        });
+      },
+      error: () => refuse(500, "the proxy failed")
+    });
+    return new CredentialProxy(server, `http://127.0.0.1:${server.port}`, placeholder);
+  }
+  async disposeAsync() {
+    await this.server.stop(true);
+  }
+}
+function refuse(status, message) {
+  return new Response(`${message}
+`, {
+    status,
+    headers: { "content-type": "text/plain; charset=utf-8" }
+  });
+}
+function isLoopback(hostname) {
+  return hostname === "localhost" || hostname === "[::1]" || /^127\.\d+\.\d+\.\d+$/.test(hostname);
+}
+function randomHex(bytes) {
+  return Buffer.from(crypto.getRandomValues(new Uint8Array(bytes))).toString("hex");
+}
+// creds/credential-source.ts
+function credentialName(name) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+    throw new Error(`${JSON.stringify(name)} is not an environment variable name: use letters, digits and _, not starting with a digit`);
+  }
+  return name;
+}
+// creds/credentials.ts
+class Credentials {
+  sources;
+  label;
+  constructor(sources) {
+    this.sources = sources;
+    this.label = sources.map((source) => source.label).join(", or ");
+  }
+  async get(name) {
+    for (const source of this.sources) {
+      const value = await source.get(name);
+      if (value !== undefined && value !== "") {
+        return value;
+      }
+    }
+    return;
+  }
+  async require(name) {
+    const value = await this.get(name);
+    if (value === undefined) {
+      throw new Error(this.sources.length === 0 ? `${name} is not set: these credentials read from no source` : `${name} is not set in ${this.label}`);
+    }
+    return value;
+  }
+  async source(name) {
+    for (const source of this.sources) {
+      const value = await source.get(name);
+      if (value !== undefined && value !== "") {
+        return source;
+      }
+    }
+    return;
+  }
+}
+// creds/dotenv-file.ts
+import { NodeFs } from "../system/index.js";
+
+class DotenvFile {
+  path;
+  label;
+  fs;
+  values;
+  constructor(path, opts = {}) {
+    this.path = path;
+    this.fs = opts.fs ?? new NodeFs;
+    this.label = path;
+  }
+  async get(name) {
+    this.values ??= this.read();
+    const value = (await this.values).get(name);
+    return value === "" ? undefined : value;
+  }
+  async read() {
+    if (!await this.fs.exists(this.path)) {
+      return new Map;
+    }
+    return parse(await this.fs.read(this.path));
+  }
+}
+var LINE = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(?:"((?:\\.|[^"\\])*)"|'([^']*)'|([^#\r\n]*?))\s*(?:#.*)?$/;
+function parse(text) {
+  const values = new Map;
+  for (const line of text.split(/\r?\n/)) {
+    const match = LINE.exec(line);
+    if (match === null) {
+      continue;
+    }
+    const [, name, doubled, single, bare] = match;
+    const value = doubled !== undefined ? doubled.replace(/\\n/g, `
+`).replace(/\\(["\\])/g, "$1") : single ?? bare ?? "";
+    values.set(name, value);
+  }
+  return values;
+}
+// creds/environment.ts
+import { NodePs } from "../system/index.js";
+
+class Environment {
+  label = "the environment";
+  ps;
+  constructor(opts = {}) {
+    this.ps = opts.ps ?? new NodePs;
+  }
+  async get(name) {
+    const value = this.ps.env(name);
+    return value === "" ? undefined : value;
+  }
+}
+// creds/memory-secret-store.ts
+class MemorySecretStore {
+  label;
+  #values = new Map;
+  constructor(label = "this process's memory") {
+    this.label = label;
+  }
+  async get(name) {
+    return this.#values.get(name);
+  }
+  async set(name, value) {
+    this.#values.set(credentialName(name), value);
+  }
+  async delete(name) {
+    return this.#values.delete(name);
+  }
+  async names() {
+    return [...this.#values.keys()].toSorted();
+  }
+  clear() {
+    this.#values.clear();
+  }
+  dispose() {
+    this.clear();
+  }
+  toJSON() {
+    return { label: this.label, names: [...this.#values.keys()].toSorted() };
+  }
+}
+// creds/system-secret-store.ts
+import { basename, dirname } from "node:path";
+import { NodeFs as NodeFs2, NodePs as NodePs2 } from "../system/index.js";
+var NAMES = ".names";
+
+class SystemSecretStore {
+  service;
+  label;
+  constructor(service) {
+    this.service = service;
+    const system = process.platform === "darwin" ? "the macOS Keychain" : process.platform === "win32" ? "Windows Credential Manager" : "the system's secret service";
+    this.label = `${system} as "${service}"`;
+  }
+  static project(project) {
+    return new SystemSecretStore(`webappwiz:${project}`);
+  }
+  static async forProject(dir, opts = {}) {
+    return SystemSecretStore.project(await projectName(dir, opts));
+  }
+  static device() {
+    return new SystemSecretStore("webappwiz");
+  }
+  async get(name) {
+    return await Bun.secrets.get({ service: this.service, name }) ?? undefined;
+  }
+  async set(name, value) {
+    await Bun.secrets.set({
+      service: this.service,
+      name: credentialName(name),
+      value
+    });
+    const names = await this.names();
+    if (!names.includes(name)) {
+      await this.list([...names, name]);
+    }
+  }
+  async delete(name) {
+    const deleted = await Bun.secrets.delete({
+      service: this.service,
+      name: credentialName(name)
+    });
+    const names = await this.names();
+    if (names.includes(name)) {
+      await this.list(names.filter((kept) => kept !== name));
+    }
+    return deleted;
+  }
+  async names() {
+    const list = await Bun.secrets.get({ service: this.service, name: NAMES });
+    return (list ?? "").split(`
+`).filter((name) => name !== "");
+  }
+  async list(names) {
+    if (names.length === 0) {
+      await Bun.secrets.delete({ service: this.service, name: NAMES });
+    } else {
+      await Bun.secrets.set({
+        service: this.service,
+        name: NAMES,
+        value: names.toSorted().join(`
+`)
+      });
+    }
+  }
+}
+async function projectName(dir, opts = {}) {
+  const fs = opts.fs ?? new NodeFs2;
+  const ps = opts.ps ?? new NodePs2;
+  const from = dir ?? ps.cwd();
+  const { stdout, exitCode } = await ps.spawnCapture([
+    "git",
+    "-C",
+    from,
+    "rev-parse",
+    "--path-format=absolute",
+    "--show-toplevel",
+    "--git-common-dir"
+  ]);
+  const [root, common] = exitCode === 0 ? stdout.trim().split(`
+`) : [];
+  const home = ps.env("XDG_CONFIG_HOME") ?? `${ps.env("HOME") ?? "~"}/.config`;
+  let named;
+  for (const path of [
+    `${root ?? from}/.wiz/config.ts`,
+    `${home}/wiz/config.ts`
+  ]) {
+    if (await fs.exists(path)) {
+      const mod = await import(path).catch((cause) => {
+        throw new Error(`could not load ${path}: ${cause}`, { cause });
+      });
+      named = mod.default?.credentials?.project ?? named;
+    }
+  }
+  return named ?? basename(common === undefined ? from : dirname(common));
+}
+export {
+  CredentialProxy,
+  Credentials,
+  DotenvFile,
+  Environment,
+  MemorySecretStore,
+  SystemSecretStore,
+  credentialName,
+  projectName
+};

package/vendor/core/creds/memory-secret-store.d.ts

@@ -0,0 +1,33 @@
+import type { Resource } from "../disposable/index.js";
+import type { SecretStore } from "./secret-store";
+/**
+ * A store whose values live only in this process's memory: never written to
+ * disk, the environment, argv or a log, and gone when the process is. For a
+ * daemon handed keys over a socket that must not outlive it, such as a worker
+ * holding an agent's API key for the length of a task. `clear()` drops every
+ * value at once, and `dispose()` does the same, so it can sit in a disposer.
+ *
+ * The values sit in a private field, so neither `console.log`,
+ * `Bun.inspect` nor `JSON.stringify` of the store shows one; its label and
+ * errors never hold one either. JavaScript cannot wipe a string, so a dropped
+ * value lingers in the heap until the garbage collector reuses its memory:
+ * pair it with `makeUndumpable()` from `webappwiz/system`, so no other
+ * process can read that memory meanwhile.
+ */
+export declare class MemorySecretStore implements SecretStore, Resource {
+    #private;
+    readonly label: string;
+    constructor(label?: string);
+    get(name: string): Promise<string | undefined>;
+    set(name: string, value: string): Promise<void>;
+    delete(name: string): Promise<boolean>;
+    names(): Promise<string[]>;
+    /** Drops every value it keeps. */
+    clear(): void;
+    dispose(): void;
+    /** Its label and the names it keeps, never a value. */
+    toJSON(): {
+        label: string;
+        names: string[];
+    };
+}

package/vendor/core/creds/secret-store.d.ts

@@ -0,0 +1,14 @@
+import type { CredentialSource } from "./credential-source";
+/**
+ * A source a person can also keep values in, so code that needs one does
+ * not decide where it lives, and can list what it keeps. `SystemSecretStore` is the operating system's;
+ * `FakeSecretStore` is a map for tests.
+ */
+export interface SecretStore extends CredentialSource {
+    /** Keeps `value` under `name`, over whatever was there. */
+    set(name: string, value: string): Promise<void>;
+    /** Whether there was a value under `name` to delete. */
+    delete(name: string): Promise<boolean>;
+    /** Every name it keeps a value under, sorted. */
+    names(): Promise<string[]>;
+}

package/vendor/core/creds/system-secret-store.d.ts

@@ -0,0 +1,49 @@
+import { type Fs, type Ps } from "../system/index.js";
+import type { SecretStore } from "./secret-store";
+/** What `SystemSecretStore.forProject` reads through; the real ones by default. */
+export interface ForProjectOptions {
+    fs?: Fs;
+    ps?: Ps;
+}
+/**
+ * The operating system's own store, through `Bun.secrets`: the Keychain on
+ * macOS, Credential Manager on Windows, and on Linux whatever secret service
+ * daemon is running, such as GNOME Keyring or KWallet. A project's values are
+ * kept under the service `webappwiz:<project>`, so each project's are its
+ * own, and the device's under `webappwiz`, for keys that belong to the person
+ * rather than to one project. Encrypted at rest by the system. A headless
+ * server often has no secret service, which is why a deployed app reads the
+ * environment instead. The system cannot list a service's entries, so each
+ * keeps one more, `.names`, listing the rest.
+ */
+export declare class SystemSecretStore implements SecretStore {
+    /** The service its values are kept under. */
+    readonly service: string;
+    readonly label: string;
+    private constructor();
+    /** The store of the project named `project`, kept as `webappwiz:<project>`. */
+    static project(project: string): SystemSecretStore;
+    /**
+     * The store of the project around `dir` (the working directory by
+     * default). Its name is `credentials.project` from the user's
+     * `~/.config/wiz/config.ts`, else from the project's `.wiz/config.ts`,
+     * else the directory of the repository's main worktree, so a value added
+     * from one git worktree is there in every other.
+     */
+    static forProject(dir?: string, opts?: ForProjectOptions): Promise<SystemSecretStore>;
+    /** The device's store, kept as `webappwiz`, shared by every project. */
+    static device(): SystemSecretStore;
+    get(name: string): Promise<string | undefined>;
+    set(name: string, value: string): Promise<void>;
+    delete(name: string): Promise<boolean>;
+    names(): Promise<string[]>;
+    /** Keeps `names` as the service's list, sorted, or none when empty. */
+    private list;
+}
+/**
+ * What the project around `dir` is called on this device, which its
+ * credentials and anything else kept outside it go under: the last
+ * `credentials.project` among its config and the user's, else the directory
+ * of the repository's main worktree, so every worktree shares it.
+ */
+export declare function projectName(dir: string | undefined, opts?: ForProjectOptions): Promise<string>;

package/vendor/core/dictate/buffered-sink.d.ts

@@ -0,0 +1,9 @@
+import type { AudioSink } from "./microphone";
+/** Holds the audio a mic sends before the socket it goes to is open. */
+export declare class BufferedSink implements AudioSink {
+    private held;
+    private target;
+    send(pcm: Uint8Array<ArrayBuffer>): void;
+    /** Sends `target` what was held, then everything after. */
+    attach(target: AudioSink): void;
+}

package/vendor/core/dictate/cue.d.ts

@@ -0,0 +1,10 @@
+/** A sound that says the mic went live, or stopped. */
+export type Cue = "start" | "stop";
+/** How long a cue lasts, in milliseconds. */
+export declare function cueLength(cue: Cue): number;
+/**
+ * Plays `cue` on `context` as soft sine notes, so no file ships. Resolves
+ * when it has finished, or at once when the context cannot play, as one the
+ * system interrupted cannot.
+ */
+export declare function playCue(context: AudioContext, cue: Cue): Promise<void>;

package/vendor/core/dictate/dictation-failure.d.ts

@@ -0,0 +1,5 @@
+/** Why a take broke off, and the cred it needs, when that is why. */
+export declare class DictationFailure extends Error {
+    readonly cred: string | undefined;
+    constructor(message: string, cred: string | undefined);
+}

package/vendor/core/dictate/dictation-link.d.ts

@@ -0,0 +1,18 @@
+import type { Resource } from "../disposable/index.js";
+import type { Eventful } from "../events/index.js";
+import type { AudioSink } from "./microphone";
+export interface DictationLinkEvents extends Record<string, unknown> {
+    /** All the take's text so far, rough until it is done. */
+    heard: string;
+    /** Why the take broke off mid-way. */
+    failed: undefined;
+    /** The link closed before the take was done. */
+    closed: undefined;
+}
+/** One take on its way to the server: audio up, text back. */
+export interface DictationLink extends AudioSink, Eventful<DictationLinkEvents>, Resource {
+    /** Ends the take, resolving with its final text; rejects with a `DictationFailure`. */
+    finish(): Promise<string>;
+}
+/** Opens a take's link to the server. */
+export type OpenLink = () => Promise<DictationLink>;

package/vendor/core/dictate/dictation-message.d.ts

@@ -0,0 +1,24 @@
+/**
+ * What the server says on a dictation's socket, as JSON text. The page sends
+ * the take's audio as bytes, PCM16 at `SAMPLE_RATE`, then "finish" as text.
+ */
+export type DictationMessage = 
+/** All the take's text so far, rough until it is done. */
+{
+    type: "heard";
+    text: string;
+}
+/**
+ * Why the take broke off; `cred` names the cred it needs, which the Creds
+ * page now asks for.
+ */
+ | {
+    type: "failed";
+    message: string;
+    cred?: string;
+}
+/** The take's final text, after "finish". */
+ | {
+    type: "done";
+    text: string;
+};

package/vendor/core/dictate/dictation-relay.d.ts

@@ -0,0 +1,28 @@
+import type { Resource } from "../disposable/index.js";
+import type { Transcriber } from "./transcriber";
+/** The socket a relay answers on: a server's end of the page's `DictationSocket`. */
+export interface DictationPeer {
+    send(message: string): void;
+    /** Ends the take's socket, once it is done or failed. */
+    hangUp(): void;
+}
+/**
+ * One take's socket on the server, relaying the page's audio to a
+ * transcription and its text back as {@link DictationMessage}s. Hand
+ * `receive` each message the socket gets, and dispose it when the socket
+ * closes, which takes the transcription with it.
+ */
+export declare class DictationRelay implements Resource {
+    private readonly peer;
+    /** The take's transcription, or nothing once it failed to start. */
+    private readonly transcription;
+    /**
+     * Starts listening at once. A `transcriber` that rejects with a
+     * {@link DictationFailure} names the cred it needs to the page.
+     */
+    constructor(peer: DictationPeer, transcriber: Promise<Transcriber>);
+    /** Takes audio as bytes, PCM16 at `SAMPLE_RATE`, and "finish" as text. */
+    receive(message: string | Uint8Array<ArrayBuffer>): void;
+    dispose(): void;
+    private say;
+}

package/vendor/core/dictate/index.d.ts

@@ -0,0 +1,10 @@
+export { BufferedSink } from "./buffered-sink";
+export type { Cue } from "./cue";
+export { DictationFailure } from "./dictation-failure";
+export type { DictationLink, DictationLinkEvents, OpenLink, } from "./dictation-link";
+export type { DictationMessage } from "./dictation-message";
+export { type DictationPeer, DictationRelay } from "./dictation-relay";
+export { type AudioSink, type MicPermission, type Microphone, type Recording, type RecordingEvents, TICK, } from "./microphone";
+export { SAMPLE_RATE } from "./pcm";
+export { Pcm16Encoder } from "./pcm16-encoder";
+export type { Transcriber, Transcription, TranscriptionEvents, } from "./transcriber";

package/vendor/core/dictate/index.js

@@ -0,0 +1,132 @@
+import {
+  SAMPLE_RATE2
+} from "../index-qk5dj664.js";
+
+// dictate/buffered-sink.ts
+class BufferedSink {
+  held = [];
+  target;
+  send(pcm) {
+    if (this.target === undefined) {
+      this.held.push(pcm);
+    } else {
+      this.target.send(pcm);
+    }
+  }
+  attach(target) {
+    for (const pcm of this.held) {
+      target.send(pcm);
+    }
+    this.held = [];
+    this.target = target;
+  }
+}
+// dictate/dictation-failure.ts
+class DictationFailure extends Error {
+  cred;
+  constructor(message, cred) {
+    super(message);
+    this.cred = cred;
+  }
+}
+// dictate/dictation-relay.ts
+class DictationRelay {
+  peer;
+  transcription;
+  constructor(peer, transcriber) {
+    this.peer = peer;
+    this.transcription = transcriber.then(async (each) => {
+      const transcription = await each.listen();
+      transcription.events.on("heard", (text) => this.say({ type: "heard", text }));
+      transcription.events.on("failed", (error) => this.say({ type: "failed", message: error.message }));
+      return transcription;
+    }).catch((error) => {
+      this.say(failed(error));
+      peer.hangUp();
+      return;
+    });
+  }
+  receive(message) {
+    this.transcription.then(async (transcription) => {
+      if (transcription === undefined) {
+        return;
+      }
+      if (typeof message !== "string") {
+        transcription.append(message);
+        return;
+      }
+      if (message !== "finish") {
+        return;
+      }
+      this.say(await transcription.finish().then((text) => ({ type: "done", text }), failed));
+      this.peer.hangUp();
+    });
+  }
+  dispose() {
+    this.transcription.then((transcription) => transcription?.dispose());
+  }
+  say(message) {
+    this.peer.send(JSON.stringify(message));
+  }
+}
+function failed(error) {
+  if (error instanceof DictationFailure && error.cred !== undefined) {
+    return { type: "failed", message: error.message, cred: error.cred };
+  }
+  return {
+    type: "failed",
+    message: error instanceof Error ? error.message : String(error)
+  };
+}
+// dictate/microphone.ts
+import { Duration } from "../time/index.js";
+var TICK = Duration.ms(100);
+// dictate/pcm16-encoder.ts
+var CHUNK = SAMPLE_RATE2 / 10;
+
+class Pcm16Encoder {
+  sink;
+  step;
+  position = 0;
+  previous = 0;
+  chunk = new DataView(new ArrayBuffer(CHUNK * 2));
+  filled = 0;
+  constructor(inputRate, sink) {
+    this.sink = sink;
+    this.step = inputRate / SAMPLE_RATE2;
+  }
+  push(samples) {
+    while (this.position < samples.length - 1) {
+      const index = Math.floor(this.position);
+      const from = index < 0 ? this.previous : samples[index] ?? 0;
+      const to = samples[index + 1] ?? 0;
+      this.write(from + (to - from) * (this.position - index));
+      this.position += this.step;
+    }
+    this.position -= samples.length;
+    this.previous = samples[samples.length - 1] ?? this.previous;
+  }
+  flush() {
+    if (this.filled > 0) {
+      this.sink.send(new Uint8Array(this.chunk.buffer, 0, this.filled * 2));
+      this.chunk = new DataView(new ArrayBuffer(CHUNK * 2));
+      this.filled = 0;
+    }
+  }
+  write(sample) {
+    const clamped = Math.max(-1, Math.min(1, sample));
+    this.chunk.setInt16(this.filled * 2, Math.round(clamped < 0 ? clamped * 32768 : clamped * 32767), true);
+    this.filled++;
+    if (this.filled === CHUNK) {
+      this.flush();
+    }
+  }
+}
+export {
+  BufferedSink,
+  DictationFailure,
+  DictationRelay,
+  Pcm16Encoder,
+  SAMPLE_RATE2 as SAMPLE_RATE,
+  TICK
+};