@svenroth-ai/shipwright 0.24.1-next.0

package/server/dist/external/design-review/serve.js

@@ -0,0 +1,184 @@
+/*
+ * external/design-review/serve.ts —
+ * GET /api/external/projects/:projectId/designs/:rest{.+}.
+ *
+ * Serves the design phase's emitted review viewer + its relative assets
+ * (`screens/*.html`, `flows/*.html`, css/js/images/fonts) so the WebUI can host
+ * the viewer full-fidelity in a sandboxed iframe (AC1). This is DELIBERATELY
+ * different from the generic `/file` read route (plan review R1):
+ *
+ *   - `.html` is served as **text/html** (not text/plain) so the viewer + the
+ *     mockups actually RENDER — the whole point of this feature.
+ *   - No `nosniff` / `default-src 'none'` CSP that would blank the viewer's
+ *     inline <script>/<style> or its nested screen iframes. Isolation comes from
+ *     the CLIENT-side iframe `sandbox` attribute, plus `frame-ancestors 'self'`
+ *     (blocks third-party framing) here.
+ *
+ * The splat is rooted at `.shipwright/designs/` (NOT the project root, R5) so a
+ * request can never reach elsewhere in the project; segments are URL-decoded
+ * (screen names may contain spaces / non-ASCII). Only `index.html` gets the
+ * feedback bridge injected (R4) — it overrides `window.showSaveFilePicker` so
+ * the viewer's own `exportFeedback()` posts its markdown to the host instead of
+ * downloading. Screen/flow files are served verbatim.
+ *
+ * Security posture (ADR — accepted trade-off, plan review R3): the served
+ * content is the project's own design-phase artifacts, served loopback-only.
+ * The client sandbox uses `allow-same-origin` (the viewer needs its own
+ * `localStorage`), which — being same-origin — does not fully wall the content
+ * off from the app. Acceptable for a local, single-user dev tool over the user's
+ * own files; documented rather than silently shipped.
+ */
+import { readFileSync } from "node:fs";
+import { stat } from "node:fs/promises";
+import { extname, basename } from "node:path";
+import path from "node:path";
+import { pathGuard, realPathGuard } from "../../core/path-guard.js";
+/** MIME map that RENDERS (text/html for .html) — the opposite of the /file
+ *  route's text/plain-everything policy. Unknown extensions → 415. */
+const SERVE_MIME = Object.freeze({
+    html: "text/html; charset=utf-8",
+    htm: "text/html; charset=utf-8",
+    css: "text/css; charset=utf-8",
+    js: "text/javascript; charset=utf-8",
+    mjs: "text/javascript; charset=utf-8",
+    json: "application/json; charset=utf-8",
+    map: "application/json; charset=utf-8",
+    svg: "image/svg+xml",
+    png: "image/png",
+    jpg: "image/jpeg",
+    jpeg: "image/jpeg",
+    gif: "image/gif",
+    webp: "image/webp",
+    ico: "image/x-icon",
+    woff: "font/woff",
+    woff2: "font/woff2",
+    ttf: "font/ttf",
+    otf: "font/otf",
+    eot: "application/vnd.ms-fontobject",
+});
+/** The bridge injected into `index.html` (and nothing else). Overrides the File
+ *  System Access save path so the viewer's existing `exportFeedback()` posts its
+ *  markdown to the WebUI host. `write()` captures the blob text and posts it;
+ *  it must NEVER reject (a throw would drop the viewer into its download
+ *  fallback). Posts with `targetOrigin === location.origin` (same-origin host). */
+const FEEDBACK_BRIDGE = `<script>
+(function () {
+  var HOST_ORIGIN = window.location.origin;
+  function post(text) {
+    try {
+      window.parent.postMessage(
+        { type: "shipwright:design-feedback", markdown: String(text) },
+        HOST_ORIGIN
+      );
+    } catch (e) { /* never let a post error trip the viewer's download fallback */ }
+  }
+  window.showSaveFilePicker = function () {
+    return Promise.resolve({
+      createWritable: function () {
+        return Promise.resolve({
+          write: function (blob) {
+            return Promise.resolve(
+              blob && typeof blob.text === "function" ? blob.text() : blob
+            ).then(post, function () { /* swallow */ });
+          },
+          close: function () { return Promise.resolve(); },
+        });
+      },
+    });
+  };
+})();
+</script>
+`;
+/** Insert the bridge before the first <script> (so the override is defined
+ *  before the viewer script runs), else before </body>, else append. */
+export function injectFeedbackBridge(html) {
+    const scriptIdx = html.search(/<script[\s>]/i);
+    if (scriptIdx !== -1) {
+        return html.slice(0, scriptIdx) + FEEDBACK_BRIDGE + html.slice(scriptIdx);
+    }
+    const bodyClose = html.search(/<\/body>/i);
+    if (bodyClose !== -1) {
+        return html.slice(0, bodyClose) + FEEDBACK_BRIDGE + html.slice(bodyClose);
+    }
+    return html + FEEDBACK_BRIDGE;
+}
+/** URL-decode each path segment; returns null on a malformed escape. */
+function decodeSplat(splat) {
+    try {
+        return splat
+            .split("/")
+            .map((seg) => decodeURIComponent(seg))
+            .join("/");
+    }
+    catch {
+        return null;
+    }
+}
+export function registerDesignServe(app, deps) {
+    const { getProjectById } = deps;
+    app.get("/api/external/projects/:projectId/designs/:rest{.+}", async (c) => {
+        const projectId = c.req.param("projectId");
+        const project = getProjectById?.(projectId);
+        if (!project) {
+            return c.json({ error: "project_not_found", projectId }, 404);
+        }
+        if (!project.path) {
+            return c.json({ error: "project_path_unavailable", projectId }, 400);
+        }
+        const rawSplat = c.req.param("rest");
+        const splat = decodeSplat(rawSplat ?? "");
+        if (splat === null || splat.length === 0) {
+            return c.json({ error: "path_required" }, 400);
+        }
+        // Root the guard at `.shipwright/designs` — a request can never escape the
+        // designs subtree into the rest of the project (plan review R5).
+        const designsRoot = path.join(project.path, ".shipwright", "designs");
+        const guard = pathGuard(designsRoot, splat);
+        if (!guard.ok) {
+            const err = guard.reason === "traversal" ? "path_traversal" : guard.reason;
+            return c.json({ error: err, detail: guard.reason }, 400);
+        }
+        let st;
+        try {
+            st = await stat(guard.absolute);
+        }
+        catch (err) {
+            const code = err?.code;
+            if (code === "ENOENT")
+                return c.json({ error: "not_found", path: splat }, 404);
+            return c.json({ error: "stat_failed", detail: String(err).slice(0, 200) }, 500);
+        }
+        if (!st.isFile())
+            return c.json({ error: "not_a_file", path: splat }, 400);
+        const realGuard = realPathGuard(designsRoot, guard.absolute);
+        if (!realGuard.ok) {
+            return c.json({ error: "path_traversal", detail: realGuard.reason }, 400);
+        }
+        const ext = extname(guard.absolute).toLowerCase().slice(1);
+        const mime = SERVE_MIME[ext];
+        if (!mime) {
+            return c.json({ error: "unsupported_asset", extension: ext || null }, 415);
+        }
+        let buf;
+        try {
+            buf = readFileSync(realGuard.absolute);
+        }
+        catch (err) {
+            const code = err?.code;
+            if (code === "ENOENT")
+                return c.json({ error: "not_found", path: splat }, 404);
+            return c.json({ error: "read_failed", detail: String(err).slice(0, 200) }, 500);
+        }
+        c.header("Content-Type", mime);
+        // Block third-party framing; do NOT set nosniff / default-src 'none' — the
+        // viewer must execute its own inline script and frame its screens.
+        c.header("Content-Security-Policy", "frame-ancestors 'self'");
+        c.header("Cache-Control", "no-store");
+        const isIndex = basename(guard.absolute).toLowerCase() === "index.html";
+        if (isIndex) {
+            return c.body(injectFeedbackBridge(buf.toString("utf-8")));
+        }
+        return c.body(new Uint8Array(buf));
+    });
+}
+//# sourceMappingURL=serve.js.map

package/server/dist/external/design-review/serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../../src/external/design-review/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAOpE;sEACsE;AACtE,MAAM,UAAU,GAAqC,MAAM,CAAC,MAAM,CAAC;IACjE,IAAI,EAAE,0BAA0B;IAChC,GAAG,EAAE,0BAA0B;IAC/B,GAAG,EAAE,yBAAyB;IAC9B,EAAE,EAAE,gCAAgC;IACpC,GAAG,EAAE,gCAAgC;IACrC,IAAI,EAAE,iCAAiC;IACvC,GAAG,EAAE,iCAAiC;IACtC,GAAG,EAAE,eAAe;IACpB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,cAAc;IACnB,IAAI,EAAE,WAAW;IACjB,KAAK,EAAE,YAAY;IACnB,GAAG,EAAE,UAAU;IACf,GAAG,EAAE,UAAU;IACf,GAAG,EAAE,+BAA+B;CACrC,CAAC,CAAC;AAEH;;;;mFAImF;AACnF,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BvB,CAAC;AAEF;wEACwE;AACxE,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,GAAG,eAAe,CAAC;AAChC,CAAC;AAED,wEAAwE;AACxE,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,CAAC;QACH,OAAO,KAAK;aACT,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;aACrC,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAS,EAAE,IAAqB;IAClE,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAEhC,GAAG,CAAC,GAAG,CAAC,qDAAqD,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzE,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QAED,2EAA2E;QAC3E,iEAAiE;QACjE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;YAC3E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,EAAE,CAAC;QACP,IAAI,CAAC;YACH,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;YAClD,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;YAC/E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QAE3E,MAAM,SAAS,GAAG,aAAa,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,GAAG,IAAI,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;YAClD,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;YAC/E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAClF,CAAC;QAED,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QAC/B,2EAA2E;QAC3E,mEAAmE;QACnE,CAAC,CAAC,MAAM,CAAC,yBAAyB,EAAE,wBAAwB,CAAC,CAAC;QAC9D,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAEtC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC;QACxE,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/server/dist/external/events/routes.d.ts

@@ -0,0 +1,16 @@
+import { Hono } from "hono";
+import { type EventLogProjection } from "../../core/event-log-reader.js";
+import type { ExternalRouteProjectView } from "../_shared/helpers.js";
+export interface EventsRouterDeps {
+    getProjectById?: (id: string) => ExternalRouteProjectView | undefined;
+    /**
+     * Reads + projects a project's event log. Defaults to the real reader;
+     * tests inject a stub so they don't touch the filesystem (the reader's own
+     * parsing is covered in core/event-log-reader.test.ts).
+     */
+    readEvents?: (projectRoot: string, opts?: {
+        runId?: string;
+    }) => EventLogProjection;
+}
+export declare function createEventsRouter(deps: EventsRouterDeps): Hono;
+//# sourceMappingURL=routes.d.ts.map

package/server/dist/external/events/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/external/events/routes.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEtE,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,wBAAwB,GAAG,SAAS,CAAC;IACtE;;;;OAIG;IACH,UAAU,CAAC,EAAE,CACX,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,KACtB,kBAAkB,CAAC;CACzB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CA2B/D"}

package/server/dist/external/events/routes.js

@@ -0,0 +1,46 @@
+/*
+ * external/events/routes.ts — read-only observer of a project's tracked event
+ * log (`<project.path>/shipwright_events.jsonl`).
+ *
+ * Owns: GET /api/external/projects/:projectId/events[?runId=<adr_id>]
+ *
+ * The WebUI never writes the event log (CLAUDE.md rule 1 / rule 12 spirit —
+ * shipwright-iterate / pipeline emitters own every append). No
+ * POST/PATCH/PUT/DELETE handler exists; Hono 404s an undeclared
+ * method-on-known-path.
+ *
+ * Response shapes:
+ *   200 { status: "ok", ...EventLogProjection }
+ *        — an absent/unreadable log yields an ok payload with empty runs +
+ *          zero counts (graceful; the reader never throws).
+ *   404 { error: "project_not_found", projectId }
+ *   400 { error: "project_path_unavailable", projectId }
+ *
+ * `?runId=<adr_id>` filters `runs` to that single join key (the taskDetail
+ * "The Record" view); omit it for the whole project (Ship's-Log runs list).
+ *
+ * Sourced by core/event-log-reader.ts (path-guarded, tolerant JSONL parse).
+ */
+import { Hono } from "hono";
+import { readEventLog, } from "../../core/event-log-reader.js";
+export function createEventsRouter(deps) {
+    const app = new Hono();
+    const { getProjectById } = deps;
+    const reader = deps.readEvents ??
+        ((projectRoot, opts) => readEventLog(projectRoot, opts));
+    app.get("/api/external/projects/:projectId/events", (c) => {
+        const projectId = c.req.param("projectId");
+        const project = getProjectById?.(projectId);
+        if (!project) {
+            return c.json({ error: "project_not_found", projectId }, 404);
+        }
+        if (!project.path) {
+            return c.json({ error: "project_path_unavailable", projectId }, 400);
+        }
+        const runId = c.req.query("runId");
+        const projection = reader(project.path, runId ? { runId } : undefined);
+        return c.json({ status: "ok", ...projection });
+    });
+    return app;
+}
+//# sourceMappingURL=routes.js.map

package/server/dist/external/events/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../src/external/events/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EACL,YAAY,GAEb,MAAM,gCAAgC,CAAC;AAgBxC,MAAM,UAAU,kBAAkB,CAAC,IAAsB;IACvD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAChC,MAAM,MAAM,GACV,IAAI,CAAC,UAAU;QACf,CAAC,CAAC,WAAmB,EAAE,IAAyB,EAAE,EAAE,CAClD,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;IAErC,GAAG,CAAC,GAAG,CAAC,0CAA0C,EAAE,CAAC,CAAC,EAAE,EAAE;QACxD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,MAAM,CACvB,OAAO,CAAC,IAAI,EACZ,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAC9B,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/server/dist/external/file/_helpers.d.ts

@@ -0,0 +1,62 @@
+/** 5 MB — server-side cap per spec. Client applies a lower 1 MB cap for
+ * text/markdown/code; images may use the full 5 MB budget. */
+export declare const FILE_MAX_BYTES: number;
+/**
+ * Max bytes accepted by the markdown write endpoint (PUT /file). Markdown
+ * docs are small; the read-side client preview cap is 1 MB, so 2 MiB gives
+ * comfortable headroom while bounding the (first) write surface.
+ */
+export declare const MARKDOWN_WRITE_MAX_BYTES: number;
+/** Extensions the markdown write endpoint accepts (lowercased, no dot). */
+export declare const MARKDOWN_WRITE_EXTENSIONS: ReadonlySet<string>;
+/**
+ * Content-hash fingerprint for optimistic concurrency on file edits.
+ *
+ * A SHA-256 of the file bytes is robust to coarse filesystem mtime
+ * granularity (esp. Windows NTFS) and same-size sub-millisecond double-writes
+ * that an `mtime:size` pair would miss (external review #2). It is the single
+ * source of truth shared by the GET `ETag` header and the PUT `If-Match`
+ * precondition — both hash the same bytes so a GET→PUT round-trip matches.
+ */
+export declare function fileFingerprint(buffer: Buffer): string;
+/**
+ * Strip surrounding double-quotes from an `ETag` / `If-Match` header value so
+ * the strong-ETag wire form (`"sha256:…"`) compares equal to the bare
+ * fingerprint produced by {@link fileFingerprint}.
+ */
+export declare function unquoteEtag(raw: string): string;
+/**
+ * Explicit extension → Content-Type mapping. Any extension NOT in this table
+ * is treated as "not previewable" and rejected with 415 from the file route.
+ *
+ * Security rationale:
+ *   - Everything text-ish is served as text/plain (NOT application/javascript
+ *     or text/typescript) so the browser can't be tricked into executing it
+ *     even in a renderable-script context.
+ *   - Markdown is served as text/markdown; charset=utf-8 — some browsers
+ *     render it inline, but the nosniff header + Content-Disposition inline
+ *     with explicit filename prevents auto-download shenanigans.
+ *   - Image entries match the documented allowlist (png / jpg / jpeg / gif /
+ *     svg / webp).
+ */
+export declare const MIME_BY_EXTENSION: Record<string, string>;
+/**
+ * Sanitize a filename for use inside `Content-Disposition: inline;
+ * filename="<sanitized>"`.
+ *
+ * Contract:
+ *   - ASCII alphanumerics + `. _ -` + spaces are preserved.
+ *   - All other characters (including CR, LF, ", \, ;, non-ASCII) are
+ *     replaced with `_`. This blocks header-injection via CR/LF, avoids
+ *     the need for RFC 6266 percent-encoding, and produces a filename
+ *     the client can safely render back.
+ *   - Result is clamped to 120 characters. If the original was longer
+ *     we preserve the extension when possible.
+ *   - Empty result falls back to "file".
+ *
+ * This is intentionally MORE restrictive than RFC 6266 allows — the UI
+ * only needs the filename as a hint; we prefer a conservative char class
+ * over round-trip fidelity.
+ */
+export declare function sanitizeContentDispositionFilename(raw: string): string;
+//# sourceMappingURL=_helpers.d.ts.map

package/server/dist/external/file/_helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_helpers.d.ts","sourceRoot":"","sources":["../../../src/external/file/_helpers.ts"],"names":[],"mappings":"AAWA;8DAC8D;AAC9D,eAAO,MAAM,cAAc,QAAkB,CAAC;AAE9C;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,QAAkB,CAAC;AAExD,2EAA2E;AAC3E,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAGxD,CAAC;AAEH;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CA+CnD,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kCAAkC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAkBtE"}

package/server/dist/external/file/_helpers.js

@@ -0,0 +1,146 @@
+/*
+ * external/file/_helpers.ts — file-route constants + Content-Disposition
+ * filename sanitization, extracted from the historical routes.ts. The
+ * shell (../routes.ts) re-exports these for back-compat with the 14
+ * sibling test files that imported `FILE_MAX_BYTES`, `MIME_BY_EXTENSION`,
+ * and `sanitizeContentDispositionFilename` from `./routes.js`.
+ */
+import { basename } from "node:path";
+import { createHash } from "node:crypto";
+/** 5 MB — server-side cap per spec. Client applies a lower 1 MB cap for
+ * text/markdown/code; images may use the full 5 MB budget. */
+export const FILE_MAX_BYTES = 5 * 1024 * 1024;
+/**
+ * Max bytes accepted by the markdown write endpoint (PUT /file). Markdown
+ * docs are small; the read-side client preview cap is 1 MB, so 2 MiB gives
+ * comfortable headroom while bounding the (first) write surface.
+ */
+export const MARKDOWN_WRITE_MAX_BYTES = 2 * 1024 * 1024;
+/** Extensions the markdown write endpoint accepts (lowercased, no dot). */
+export const MARKDOWN_WRITE_EXTENSIONS = new Set([
+    "md",
+    "markdown",
+]);
+/**
+ * Content-hash fingerprint for optimistic concurrency on file edits.
+ *
+ * A SHA-256 of the file bytes is robust to coarse filesystem mtime
+ * granularity (esp. Windows NTFS) and same-size sub-millisecond double-writes
+ * that an `mtime:size` pair would miss (external review #2). It is the single
+ * source of truth shared by the GET `ETag` header and the PUT `If-Match`
+ * precondition — both hash the same bytes so a GET→PUT round-trip matches.
+ */
+export function fileFingerprint(buffer) {
+    return `sha256:${createHash("sha256").update(buffer).digest("hex")}`;
+}
+/**
+ * Strip surrounding double-quotes from an `ETag` / `If-Match` header value so
+ * the strong-ETag wire form (`"sha256:…"`) compares equal to the bare
+ * fingerprint produced by {@link fileFingerprint}.
+ */
+export function unquoteEtag(raw) {
+    const t = raw.trim();
+    if (t.length >= 2 && t.startsWith('"') && t.endsWith('"'))
+        return t.slice(1, -1);
+    return t;
+}
+/**
+ * Explicit extension → Content-Type mapping. Any extension NOT in this table
+ * is treated as "not previewable" and rejected with 415 from the file route.
+ *
+ * Security rationale:
+ *   - Everything text-ish is served as text/plain (NOT application/javascript
+ *     or text/typescript) so the browser can't be tricked into executing it
+ *     even in a renderable-script context.
+ *   - Markdown is served as text/markdown; charset=utf-8 — some browsers
+ *     render it inline, but the nosniff header + Content-Disposition inline
+ *     with explicit filename prevents auto-download shenanigans.
+ *   - Image entries match the documented allowlist (png / jpg / jpeg / gif /
+ *     svg / webp).
+ */
+export const MIME_BY_EXTENSION = Object.freeze({
+    // Text-ish — all served as text/plain regardless of semantic type.
+    txt: "text/plain; charset=utf-8",
+    md: "text/markdown; charset=utf-8",
+    markdown: "text/markdown; charset=utf-8",
+    log: "text/plain; charset=utf-8",
+    json: "text/plain; charset=utf-8",
+    yaml: "text/plain; charset=utf-8",
+    yml: "text/plain; charset=utf-8",
+    toml: "text/plain; charset=utf-8",
+    csv: "text/plain; charset=utf-8",
+    xml: "text/plain; charset=utf-8",
+    html: "text/plain; charset=utf-8",
+    css: "text/plain; charset=utf-8",
+    js: "text/plain; charset=utf-8",
+    jsx: "text/plain; charset=utf-8",
+    ts: "text/plain; charset=utf-8",
+    tsx: "text/plain; charset=utf-8",
+    mjs: "text/plain; charset=utf-8",
+    cjs: "text/plain; charset=utf-8",
+    sh: "text/plain; charset=utf-8",
+    bash: "text/plain; charset=utf-8",
+    zsh: "text/plain; charset=utf-8",
+    py: "text/plain; charset=utf-8",
+    rb: "text/plain; charset=utf-8",
+    go: "text/plain; charset=utf-8",
+    rs: "text/plain; charset=utf-8",
+    java: "text/plain; charset=utf-8",
+    kt: "text/plain; charset=utf-8",
+    swift: "text/plain; charset=utf-8",
+    c: "text/plain; charset=utf-8",
+    h: "text/plain; charset=utf-8",
+    cpp: "text/plain; charset=utf-8",
+    hpp: "text/plain; charset=utf-8",
+    sql: "text/plain; charset=utf-8",
+    env: "text/plain; charset=utf-8",
+    gitignore: "text/plain; charset=utf-8",
+    dockerfile: "text/plain; charset=utf-8",
+    mmd: "text/plain; charset=utf-8",
+    mermaid: "text/plain; charset=utf-8",
+    // Image allowlist.
+    png: "image/png",
+    jpg: "image/jpeg",
+    jpeg: "image/jpeg",
+    gif: "image/gif",
+    svg: "image/svg+xml",
+    webp: "image/webp",
+});
+/**
+ * Sanitize a filename for use inside `Content-Disposition: inline;
+ * filename="<sanitized>"`.
+ *
+ * Contract:
+ *   - ASCII alphanumerics + `. _ -` + spaces are preserved.
+ *   - All other characters (including CR, LF, ", \, ;, non-ASCII) are
+ *     replaced with `_`. This blocks header-injection via CR/LF, avoids
+ *     the need for RFC 6266 percent-encoding, and produces a filename
+ *     the client can safely render back.
+ *   - Result is clamped to 120 characters. If the original was longer
+ *     we preserve the extension when possible.
+ *   - Empty result falls back to "file".
+ *
+ * This is intentionally MORE restrictive than RFC 6266 allows — the UI
+ * only needs the filename as a hint; we prefer a conservative char class
+ * over round-trip fidelity.
+ */
+export function sanitizeContentDispositionFilename(raw) {
+    const base = basename(raw || "").normalize("NFKC");
+    if (base.length === 0)
+        return "file";
+    // Replace anything outside the allowed class with `_`.
+    const cleaned = base.replace(/[^A-Za-z0-9._ -]/g, "_");
+    if (cleaned.length === 0)
+        return "file";
+    if (cleaned.length <= 120)
+        return cleaned;
+    // Clamp to 120, preserving the extension if we can.
+    const dot = cleaned.lastIndexOf(".");
+    if (dot > 0 && cleaned.length - dot <= 16) {
+        const ext = cleaned.slice(dot);
+        const headLen = 120 - ext.length;
+        return cleaned.slice(0, headLen) + ext;
+    }
+    return cleaned.slice(0, 120);
+}
+//# sourceMappingURL=_helpers.js.map

package/server/dist/external/file/_helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_helpers.js","sourceRoot":"","sources":["../../../src/external/file/_helpers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;8DAC8D;AAC9D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAExD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC;IACpE,IAAI;IACJ,UAAU;CACX,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA2B,MAAM,CAAC,MAAM,CAAC;IACrE,mEAAmE;IACnE,GAAG,EAAE,2BAA2B;IAChC,EAAE,EAAE,8BAA8B;IAClC,QAAQ,EAAE,8BAA8B;IACxC,GAAG,EAAE,2BAA2B;IAChC,IAAI,EAAE,2BAA2B;IACjC,IAAI,EAAE,2BAA2B;IACjC,GAAG,EAAE,2BAA2B;IAChC,IAAI,EAAE,2BAA2B;IACjC,GAAG,EAAE,2BAA2B;IAChC,GAAG,EAAE,2BAA2B;IAChC,IAAI,EAAE,2BAA2B;IACjC,GAAG,EAAE,2BAA2B;IAChC,EAAE,EAAE,2BAA2B;IAC/B,GAAG,EAAE,2BAA2B;IAChC,EAAE,EAAE,2BAA2B;IAC/B,GAAG,EAAE,2BAA2B;IAChC,GAAG,EAAE,2BAA2B;IAChC,GAAG,EAAE,2BAA2B;IAChC,EAAE,EAAE,2BAA2B;IAC/B,IAAI,EAAE,2BAA2B;IACjC,GAAG,EAAE,2BAA2B;IAChC,EAAE,EAAE,2BAA2B;IAC/B,EAAE,EAAE,2BAA2B;IAC/B,EAAE,EAAE,2BAA2B;IAC/B,EAAE,EAAE,2BAA2B;IAC/B,IAAI,EAAE,2BAA2B;IACjC,EAAE,EAAE,2BAA2B;IAC/B,KAAK,EAAE,2BAA2B;IAClC,CAAC,EAAE,2BAA2B;IAC9B,CAAC,EAAE,2BAA2B;IAC9B,GAAG,EAAE,2BAA2B;IAChC,GAAG,EAAE,2BAA2B;IAChC,GAAG,EAAE,2BAA2B;IAChC,GAAG,EAAE,2BAA2B;IAChC,SAAS,EAAE,2BAA2B;IACtC,UAAU,EAAE,2BAA2B;IACvC,GAAG,EAAE,2BAA2B;IAChC,OAAO,EAAE,2BAA2B;IACpC,mBAAmB;IACnB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,eAAe;IACpB,IAAI,EAAE,YAAY;CACnB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kCAAkC,CAAC,GAAW;IAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAErC,uDAAuD;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;IAEvD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,OAAO,CAAC;IAE1C,oDAAoD;IACpD,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,IAAI,EAAE,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;QACjC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC;IACzC,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC"}

package/server/dist/external/file/routes.d.ts

@@ -0,0 +1,7 @@
+import { Hono } from "hono";
+import type { ExternalRouteProjectView } from "../_shared/helpers.js";
+export interface FileRouterDeps {
+    getProjectById?: (id: string) => ExternalRouteProjectView | undefined;
+}
+export declare function createFileRouter(deps: FileRouterDeps): Hono;
+//# sourceMappingURL=routes.d.ts.map

package/server/dist/external/file/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/external/file/routes.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAStE,MAAM,WAAW,cAAc;IAC7B,cAAc,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,wBAAwB,GAAG,SAAS,CAAC;CACvE;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CA2H3D"}

package/server/dist/external/file/routes.js

@@ -0,0 +1,122 @@
+/*
+ * external/file/routes.ts — GET /api/external/projects/:projectId/file.
+ *
+ * Byte-streams a project-local file with:
+ *   - X-Content-Type-Options: nosniff
+ *   - Explicit Content-Type per extension (never inferred)
+ *   - Content-Disposition: inline; filename="<sanitized>"
+ *   - CSP default-src 'none' (defense-in-depth for SVG)
+ *
+ * Status codes per _c2_api_baseline.json:
+ *   400 on traversal / absolute input / not-a-file
+ *   404 on missing project / missing file
+ *   413 if > 5 MB
+ *   415 if extension not in the text/markdown/image allowlist
+ *   500 on file_read_failed / file_stat_failed
+ *
+ * CLAUDE.md rule 10 / ADR-044: null-byte input hard-rejected via the
+ * path-guard; realpath escape via symlink → 400 path_traversal.
+ */
+import { Hono } from "hono";
+import { readFileSync } from "node:fs";
+import { stat } from "node:fs/promises";
+import { extname, basename } from "node:path";
+import { pathGuard, realPathGuard } from "../../core/path-guard.js";
+import { FILE_MAX_BYTES, MIME_BY_EXTENSION, fileFingerprint, sanitizeContentDispositionFilename, } from "./_helpers.js";
+import { registerMarkdownWrite } from "./write.js";
+export function createFileRouter(deps) {
+    const app = new Hono();
+    const { getProjectById } = deps;
+    app.get("/api/external/projects/:projectId/file", async (c) => {
+        const projectId = c.req.param("projectId");
+        const project = getProjectById?.(projectId);
+        if (!project) {
+            return c.json({ error: "project_not_found", projectId }, 404);
+        }
+        if (!project.path) {
+            return c.json({ error: "project_path_unavailable", projectId }, 400);
+        }
+        const relpath = c.req.query("path");
+        if (!relpath || relpath.length === 0) {
+            return c.json({ error: "path_required" }, 400);
+        }
+        const guard = pathGuard(project.path, relpath);
+        if (!guard.ok) {
+            const err = guard.reason === "traversal" ? "path_traversal" : guard.reason;
+            return c.json({ error: err, detail: guard.reason }, 400);
+        }
+        let st;
+        try {
+            st = await stat(guard.absolute);
+        }
+        catch (err) {
+            const code = err?.code;
+            if (code === "ENOENT") {
+                return c.json({ error: "not_found", path: relpath }, 404);
+            }
+            return c.json({ error: "file_stat_failed", detail: String(err).slice(0, 200) }, 500);
+        }
+        if (!st.isFile()) {
+            return c.json({ error: "not_a_file", path: relpath }, 400);
+        }
+        // Symlink-escape defense. The stat above already succeeded, so the
+        // target exists — realpath will verify it's still under project root.
+        // If the file is a symlink whose target is outside the root, reject.
+        const realGuard = realPathGuard(project.path, guard.absolute);
+        if (!realGuard.ok) {
+            return c.json({ error: "path_traversal", detail: realGuard.reason }, 400);
+        }
+        if (st.size > FILE_MAX_BYTES) {
+            return c.json({ error: "file_too_large", maxBytes: FILE_MAX_BYTES, size: st.size }, 413);
+        }
+        const rawExt = extname(guard.absolute).toLowerCase().slice(1);
+        const mime = MIME_BY_EXTENSION[rawExt];
+        if (!mime) {
+            return c.json({
+                error: "binary_not_previewable",
+                mime: `application/octet-stream`,
+                extension: rawExt || null,
+            }, 415);
+        }
+        const filename = sanitizeContentDispositionFilename(basename(guard.absolute));
+        // Read the full file into memory. This is safe because the 5 MB cap is
+        // already enforced above. We avoid streaming to dodge a race in test
+        // teardown (file disappearing before drain) AND to make
+        // Content-Length + body atomic.
+        let body;
+        try {
+            body = readFileSync(guard.absolute);
+        }
+        catch (err) {
+            const code = err?.code;
+            if (code === "ENOENT") {
+                return c.json({ error: "not_found", path: relpath }, 404);
+            }
+            return c.json({ error: "file_read_failed", detail: String(err).slice(0, 200) }, 500);
+        }
+        // Set security headers BEFORE sending body.
+        c.header("Content-Type", mime);
+        c.header("X-Content-Type-Options", "nosniff");
+        // Strong content-hash ETag — the optimistic-concurrency token for the
+        // SmartViewer markdown editor's PUT (If-Match). NOT used for HTTP cache
+        // validation: this route ignores conditional If-None-Match requests.
+        c.header("ETag", `"${fileFingerprint(body)}"`);
+        c.header("Content-Disposition", `inline; filename="${filename}"`);
+        c.header("Content-Length", String(body.length));
+        c.header("Cache-Control", "private, max-age=0, must-revalidate");
+        // Defense-in-depth for SVG (CAN embed <script>): when an SVG is loaded
+        // via <iframe>, browsers WILL execute inline script. CSP blocks that
+        // in every viewer. For non-SVG responses the CSP is harmless.
+        // `default-src 'none'` also prevents sub-resource loads (the
+        // SmartViewer image renderer uses <img src>, which is unaffected).
+        c.header("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; sandbox");
+        // Return the raw bytes. Hono wraps a Uint8Array into the Response body
+        // as-is; Content-Type is NOT mutated (we set it above).
+        return c.body(new Uint8Array(body));
+    });
+    // PUT /file — the markdown write surface (FR-01.34). Shares the same
+    // path-guard + project-scope posture as the GET handler above.
+    registerMarkdownWrite(app, { getProjectById });
+    return app;
+}
+//# sourceMappingURL=routes.js.map

package/server/dist/external/file/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../src/external/file/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEpE,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,kCAAkC,GACnC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAMnD,MAAM,UAAU,gBAAgB,CAAC,IAAoB;IACnD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAEhC,GAAG,CAAC,GAAG,CAAC,wCAAwC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5D,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;YAC3E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,EAAE,CAAC;QACP,IAAI,CAAC;YACH,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;YAClD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAChE,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7D,CAAC;QAED,mEAAmE;QACnE,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,EACrD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,EAAE,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC;YAC7B,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EACpE,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,wBAAwB;gBAC/B,IAAI,EAAE,0BAA0B;gBAChC,SAAS,EAAE,MAAM,IAAI,IAAI;aAC1B,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,kCAAkC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE9E,uEAAuE;QACvE,qEAAqE;QACrE,wDAAwD;QACxD,gCAAgC;QAChC,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;YAClD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAChE,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,4CAA4C;QAC5C,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC,MAAM,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAC9C,sEAAsE;QACtE,wEAAwE;QACxE,qEAAqE;QACrE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,CAAC,CAAC,MAAM,CAAC,qBAAqB,EAAE,qBAAqB,QAAQ,GAAG,CAAC,CAAC;QAClE,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAChD,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;QACjE,uEAAuE;QACvE,qEAAqE;QACrE,8DAA8D;QAC9D,6DAA6D;QAC7D,mEAAmE;QACnE,CAAC,CAAC,MAAM,CACN,yBAAyB,EACzB,wDAAwD,CACzD,CAAC;QAEF,uEAAuE;QACvE,wDAAwD;QACxD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,+DAA+D;IAC/D,qBAAqB,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;IAE/C,OAAO,GAAG,CAAC;AACb,CAAC"}