@sverka/playground 0.2.11 → 0.2.13

package/dist/index.mjs

@@ -1,4 +1,5 @@
 import { Inflate, deflateSync } from "fflate";
+import { generateSarifHtml } from "@sverka/sarif-viewer-web/html-generator";
 //#region src/pipeline.ts
 /** Base class for all constructs. */
 var Construct = class {
@@ -269,6 +270,1158 @@ function decodeShareLink(hash) {
 	}
 }
 //#endregion
-export { Entry, FunctionStep, Pipeline, PlaygroundError, Project, SHARE_PAYLOAD_WARN_BYTES, decodeShareLink, encodeShareLink, runPipeline };
+//#region src/scanner.ts
+/** Non-ASCII whitespace code points beyond the Latin-1 range. */
+const WS_POINTS = /* @__PURE__ */ new Set([
+	160,
+	5760,
+	8232,
+	8233,
+	8239,
+	8287,
+	12288,
+	65279
+]);
+/** Whitespace per the JS grammar: \t \n \v \f \r space, NBSP, the unicode
+*  space separators (0x2000–0x200a), and ZWNBSP. */
+function isWsChar(c) {
+	if (c === void 0) return false;
+	const n = c.codePointAt(0) ?? 0;
+	if (n >= 9 && n <= 13 || n === 32) return true;
+	return n >= 8192 && n <= 8202 || WS_POINTS.has(n);
+}
+/** ASCII letter-or-digit — digits and both letter cases. */
+function isAsciiLetterOrDigit(n) {
+	return n >= 48 && n <= 57 || n >= 65 && n <= 90 || n >= 97 && n <= 122;
+}
+/** Identifier-part chars, approximated: ASCII ident chars plus any
+*  non-ASCII char that isn't JS whitespace — `export` + a non-ASCII
+*  letter keeps its boundary. Over-approximation only ever suppresses
+*  a false keyword match — it never corrupts code. */
+function isIdentChar(c) {
+	if (c === void 0) return false;
+	const n = c.codePointAt(0) ?? 0;
+	if (n >= 128) return !isWsChar(c);
+	return isAsciiLetterOrDigit(n) || c === "_" || c === "$";
+}
+function isQuote(c) {
+	return c === "\"" || c === "'" || c === "`";
+}
+function skipIdent(code, i) {
+	while (i < code.length && isIdentChar(code[i])) i++;
+	return i;
+}
+/** Index of the `\n` ending the `//` comment at `at` (code.length if none). */
+function lineCommentEnd(code, at) {
+	const end = code.indexOf("\n", at + 2);
+	return end === -1 ? code.length : end;
+}
+/** Index just past the closing star-slash ending the block comment at
+*  `at` — the literal marker is never written inside this doc comment
+*  or it would terminate the comment itself. */
+function blockCommentEnd(code, at) {
+	const end = code.indexOf("*/", at + 2);
+	return end === -1 ? code.length : end + 2;
+}
+/** True when `at` starts a `//` or `/*` comment. */
+function commentAt(code, at) {
+	return code[at] === "/" && (code[at + 1] === "/" || code[at + 1] === "*");
+}
+/** True when `at` opens a string literal or a comment. */
+function isOpaqueStart(code, at) {
+	return isQuote(code[at]) || commentAt(code, at);
+}
+/** End index of the string literal starting at `at` (quote char).
+*  Template literals may nest `${}` expressions — tracked by brace depth. */
+function scanString(code, at) {
+	const quote = code[at];
+	let i = at + 1;
+	while (i < code.length) {
+		const c = code[i];
+		if (c === "\\") {
+			i += 2;
+			continue;
+		}
+		if (c === quote) return i + 1;
+		if (quote === "`" && c === "$" && code[i + 1] === "{") {
+			i = scanTemplateExpr(code, i + 1);
+			continue;
+		}
+		i++;
+	}
+	return i;
+}
+/** End index of a regex literal starting at `at` (`/`): closes at the
+*  first unescaped `/` outside a `[]` class, then consumes flags. Stops at
+*  a newline or EOF when unterminated — the evaluator reports the syntax. */
+function scanRegex(code, at) {
+	let i = at + 1;
+	let inClass = false;
+	while (i < code.length) {
+		const c = code[i];
+		if (c === "\\") {
+			i += 2;
+			continue;
+		}
+		if (c === "[") inClass = true;
+		else if (c === "]") inClass = false;
+		else if (c === "/" && !inClass) return skipIdent(code, i + 1);
+		else if (c === "\n") return i;
+		i++;
+	}
+	return i;
+}
+/** End index of the opaque region at `i`, or i+1 for ordinary chars —
+*  plus whether the region was a string literal (an operand). */
+function scanOpaqueEnd(code, i) {
+	const c = code[i];
+	if (isQuote(c)) return {
+		end: scanString(code, i),
+		isString: true
+	};
+	if (c === "/" && code[i + 1] === "/") return {
+		end: lineCommentEnd(code, i),
+		isString: false
+	};
+	if (c === "/" && code[i + 1] === "*") return {
+		end: blockCommentEnd(code, i),
+		isString: false
+	};
+	return {
+		end: i + 1,
+		isString: false
+	};
+}
+/** Keywords and contextual keywords after which `/` opens a regex rather
+*  than divides. Everything else — plain identifiers plus literals such
+*  as `this`/`true` — ends an operand, making `/` a division. */
+const NON_OPERAND_WORDS = /* @__PURE__ */ new Set([
+	"await",
+	"break",
+	"case",
+	"catch",
+	"class",
+	"const",
+	"continue",
+	"debugger",
+	"default",
+	"delete",
+	"do",
+	"else",
+	"enum",
+	"export",
+	"extends",
+	"finally",
+	"for",
+	"function",
+	"if",
+	"implements",
+	"import",
+	"in",
+	"instanceof",
+	"interface",
+	"let",
+	"new",
+	"package",
+	"private",
+	"protected",
+	"public",
+	"return",
+	"static",
+	"switch",
+	"throw",
+	"try",
+	"typeof",
+	"var",
+	"void",
+	"while",
+	"with",
+	"yield",
+	"as",
+	"async",
+	"from",
+	"get",
+	"of",
+	"set",
+	"type",
+	"declare"
+]);
+/** True when `word` ends an operand — a following `/` is division. */
+function operandAfterWord(word) {
+	return !NON_OPERAND_WORDS.has(word);
+}
+/** Consume one token at `i` for the brace-matching scans: opaque regions
+*  and regex literals advance wholesale, identifiers update operand
+*  state from the keyword table, braces report a depth delta. */
+function scanToken(code, i, operandEnd) {
+	const opaque = scanOpaqueEnd(code, i);
+	if (opaque.end > i + 1) return {
+		end: opaque.end,
+		operandEnd: opaque.isString || operandEnd,
+		brace: 0
+	};
+	const ch = code[i];
+	if (ch === "/" && !operandEnd) return {
+		end: scanRegex(code, i),
+		operandEnd: true,
+		brace: 0
+	};
+	if (isWsChar(ch)) return {
+		end: i + 1,
+		operandEnd,
+		brace: 0
+	};
+	if (isIdentChar(ch)) {
+		const wend = skipIdent(code, i);
+		return {
+			end: wend,
+			operandEnd: operandAfterWord(code.slice(i, wend)),
+			brace: 0
+		};
+	}
+	if (ch === "{") return {
+		end: i + 1,
+		operandEnd: false,
+		brace: 1
+	};
+	if (ch === "}") return {
+		end: i + 1,
+		operandEnd: true,
+		brace: -1
+	};
+	return {
+		end: i + 1,
+		operandEnd: false,
+		brace: 0
+	};
+}
+/**
+* Scan one operand-context token — an opaque span, a regex-or-division,
+* or an identifier run — returning where it ends and whether it leaves
+* an operand behind. Comments are transparent (operand context passes
+* through unchanged). Returns null for punctuation/whitespace the
+* caller's own loop owns.
+*/
+function scanOperand(code, i, operandEnd) {
+	const opaque = scanOpaqueEnd(code, i);
+	if (opaque.end > i + 1) return {
+		end: opaque.end,
+		operandEnd: operandEnd || opaque.isString
+	};
+	const c = code[i];
+	if (c === "/") return operandEnd ? {
+		end: i + 1,
+		operandEnd: false
+	} : {
+		end: scanRegex(code, i),
+		operandEnd: true
+	};
+	if (isIdentChar(c)) {
+		const wend = skipIdent(code, i);
+		return {
+			end: wend,
+			operandEnd: operandAfterWord(code.slice(i, wend))
+		};
+	}
+	return null;
+}
+/**
+* End index of the `${` expression whose `{` is at `at`. Strings,
+*  comments, nested templates, and regex literals inside the expression
+*  are all skipped correctly: `` `${ x["`"] }` `` and `` `${ /"/ }` ``
+*  must not treat literal text as syntax.
+*/
+function scanTemplateExpr(code, at) {
+	let depth = 1;
+	let i = at + 1;
+	let operandEnd = false;
+	while (i < code.length && depth > 0) {
+		const step = scanToken(code, i, operandEnd);
+		depth += step.brace;
+		operandEnd = step.operandEnd;
+		i = step.end;
+	}
+	return i;
+}
+/**
+* Index of the `}` matching the `{` at `open`; -1 when unbalanced.
+*  Operand tracking decides whether a `/` divides or opens a regex —
+*  braces inside `/[{]/` never reach the depth counter.
+*/
+function matchBrace(code, open) {
+	let depth = 0;
+	let i = open;
+	let operandEnd = false;
+	while (i < code.length) {
+		const step = scanToken(code, i, operandEnd);
+		depth += step.brace;
+		operandEnd = step.operandEnd;
+		i = step.end;
+		if (step.brace === -1 && depth === 0) return i - 1;
+	}
+	return -1;
+}
+/** `word` starting at `at` with an identifier boundary on the right. */
+function keywordAt(code, at, word) {
+	return code.startsWith(word, at) && !isIdentChar(code[at + word.length]);
+}
+/** Skip whitespace and comments (including newlines). */
+function skipTrivia(code, at) {
+	let i = at;
+	for (;;) {
+		const c = code[i];
+		if (isWsChar(c)) {
+			i++;
+			continue;
+		}
+		if (c === "/" && code[i + 1] === "/") {
+			i = lineCommentEnd(code, i);
+			continue;
+		}
+		if (c === "/" && code[i + 1] === "*") {
+			i = blockCommentEnd(code, i);
+			continue;
+		}
+		return i;
+	}
+}
+//#endregion
+//#region src/engine.ts
+/** Default template shown in the editor. */
+const DEFAULT_CODE = [
+	"import { Project, Pipeline, FunctionStep, Entry } from \"@sverka/playground\";",
+	"",
+	"const proj = new Project(\"demo\");",
+	"const checks = new Pipeline(proj, \"checks\");",
+	"",
+	"new FunctionStep(checks, \"lint\", {",
+	"  fn: () => [",
+	"    { rule: \"no-unused-vars\", file: \"src/index.ts\", line: 5, severity: \"high\", message: \"Variable 'x' is declared but never used\" },",
+	"    { rule: \"no-console\", file: \"src/utils.ts\", line: 12, severity: \"medium\", message: \"Unexpected console.log statement\" },",
+	"  ],",
+	"});",
+	"",
+	"new FunctionStep(checks, \"typecheck\", {",
+	"  fn: () => [",
+	"    { rule: \"ts2322\", file: \"src/types.ts\", line: 8, severity: \"critical\", message: \"Type 'string' is not assignable to type 'number'\" },",
+	"  ],",
+	"});",
+	"",
+	"new FunctionStep(checks, \"test\", {",
+	"  fn: () => [",
+	"    { rule: \"assertion-failed\", file: \"test/index.test.ts\", line: 23, severity: \"high\", message: \"Expected 5 but got 3\" },",
+	"    { rule: \"assertion-failed\", file: \"test/index.test.ts\", line: 45, severity: \"low\", message: \"Expected 'hello' but got 'world'\" },",
+	"  ],",
+	"});",
+	"",
+	"new Entry(checks, \"on-push\", { trigger: { kind: \"push\" }, roots: [\"test\"] });",
+	"",
+	"export default proj;",
+	""
+].join("\n");
+/** Escape HTML special characters to prevent XSS. */
+function escapeHtml(text) {
+	return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+/** +1/−1 for bracket chars, 0 otherwise. */
+function bracketDelta(c) {
+	if (c === "{" || c === "(" || c === "[") return 1;
+	if (c === "}" || c === ")" || c === "]") return -1;
+	return 0;
+}
+/** Chars that end an import statement at depth ≤0: `;` (consumed) or a
+*  newline after the module-specifier string (left in place). */
+function stmtTerminator(c, depth, specSeen) {
+	if (c === ";" && depth <= 0) return "past";
+	if (c === "\n" && depth <= 0 && specSeen) return "at";
+	return null;
+}
+/** End index of the statement starting at `at`: first top-level `;`, or
+*  the first newline after the module-specifier string (covers multiline
+*  `import {…}\n from "x"` and `import "x"` without a semicolon). */
+function scanStatementEnd(code, at) {
+	let i = at;
+	let depth = 0;
+	let specSeen = false;
+	while (i < code.length) {
+		const opaque = scanOpaqueEnd(code, i);
+		if (opaque.end > i + 1) {
+			specSeen = specSeen || opaque.isString;
+			i = opaque.end;
+			continue;
+		}
+		const term = stmtTerminator(code[i], depth, specSeen);
+		if (term === "past") return i + 1;
+		if (term === "at") return i;
+		depth += bracketDelta(code[i]);
+		i++;
+	}
+	return i;
+}
+/** Same-line statement tail: horizontal whitespace then an optional `;`.
+*  Never eats the newline — the following line is the next statement. */
+function scanStmtTail(code, at) {
+	let i = at;
+	while (i < code.length && (code[i] === " " || code[i] === "	")) i++;
+	if (code[i] === ";") i++;
+	return i;
+}
+/** End index of the `from "…"` clause starting after `from`, or `at` when
+*  the clause is malformed — let the evaluator complain. */
+function scanFromClause(code, next) {
+	const specAt = skipTrivia(code, next + 4);
+	const q = code[specAt];
+	if (q === "\"" || q === "'") return scanStmtTail(code, scanString(code, specAt));
+	return next;
+}
+/** End index of `export * [as ns] [from "…"]` — the `*` is at `at`. */
+function scanExportStar(code, at) {
+	let i = skipTrivia(code, at + 1);
+	if (keywordAt(code, i, "as")) {
+		i = skipTrivia(code, i + 2);
+		i = skipIdent(code, i);
+	}
+	const next = skipTrivia(code, i);
+	if (keywordAt(code, next, "from")) return scanFromClause(code, next);
+	return scanStmtTail(code, i);
+}
+/**
+* End index of `export {…}` / `export * [as ns] [from "…"]` starting at
+* the `{` or `*`. A bare list ends at its `;` or newline — unlike an
+* import, a newline after the closing brace must end the statement or
+* the next line would be eaten with it.
+*/
+function scanExportListEnd(code, at) {
+	if (code[at] === "*") return scanExportStar(code, at);
+	const close = matchBrace(code, at);
+	const i = close < 0 ? code.length : close + 1;
+	const next = skipTrivia(code, i);
+	if (keywordAt(code, next, "from")) return scanFromClause(code, next);
+	return scanStmtTail(code, i);
+}
+function atStmtLevel(st) {
+	return st.stack.length === 0 || st.stack.at(-1) === "block";
+}
+/** Copy a string literal or comment verbatim into `out`. */
+function copyOpaque(code, st, out) {
+	const opaque = scanOpaqueEnd(code, st.i);
+	if (opaque.end <= st.i + 1) return false;
+	out.push(code.slice(st.i, opaque.end));
+	if (opaque.isString) {
+		st.stmtStart = false;
+		st.operandEnd = true;
+	}
+	st.i = opaque.end;
+	return true;
+}
+/** Handle `{}`/`()`/`[]` — pushes onto the block/expr stack and sets the
+*  operand context: `}` closing an object literal ends a value, `}`
+*  closing a block ends a statement. */
+function applyBracket(code, st, out) {
+	const c = code[st.i];
+	if (c === "{") {
+		st.stack.push(st.stmtStart ? "block" : "expr");
+		st.operandEnd = false;
+	} else if (c === "}") {
+		const popped = st.stack.pop();
+		st.stmtStart = popped === "block";
+		st.operandEnd = popped === "expr";
+	} else if (c === "(" || c === "[") {
+		st.stack.push("expr");
+		st.stmtStart = false;
+		st.operandEnd = false;
+	} else if (c === ")" || c === "]") {
+		st.stack.pop();
+		st.stmtStart = false;
+		st.operandEnd = true;
+	} else return false;
+	out.push(c ?? "");
+	st.i++;
+	return true;
+}
+/** Handle `\n`, `;`, and whitespace — statement boundaries at statement
+*  level only (a `;` inside `for (;;)` doesn't count). A newline never
+*  resets operand context: `foo\n/bar/` divides, per ASI rules. */
+function applyTerminator(code, st, out) {
+	const c = code[st.i];
+	if (c !== ";" && c !== "\n" && !isWsChar(c)) return false;
+	if (c === ";") {
+		if (atStmtLevel(st)) st.stmtStart = true;
+		st.operandEnd = false;
+	} else if (c === "\n" && atStmtLevel(st)) st.stmtStart = true;
+	out.push(c ?? "");
+	st.i++;
+	return true;
+}
+/** Handle `/` — a regex literal when an operand is expected, a division
+*  operator when one just ended. Comments never reach here (copyOpaque
+*  already consumed them). */
+function applySlash(code, st, out) {
+	if (code[st.i] !== "/" || commentAt(code, st.i)) return false;
+	if (st.operandEnd) {
+		out.push("/");
+		st.i++;
+		st.operandEnd = false;
+	} else {
+		const end = scanRegex(code, st.i);
+		out.push(code.slice(st.i, end));
+		st.i = end;
+		st.operandEnd = true;
+	}
+	st.stmtStart = false;
+	return true;
+}
+/** Handle an `import` keyword at statement start. Dynamic `import (…)`
+*  and `import.meta` pass through verbatim — whitespace and comments may
+*  sit between the keyword and the paren. */
+function tryImport(code, st, out) {
+	if (!st.stmtStart || !keywordAt(code, st.i, "import")) return false;
+	const nc = code[skipTrivia(code, st.i + 6)];
+	if (nc === "(" || nc === ".") {
+		out.push("import");
+		st.i += 6;
+		st.stmtStart = false;
+		st.operandEnd = true;
+		return true;
+	}
+	st.i = scanStatementEnd(code, st.i + 6);
+	st.stmtStart = false;
+	st.operandEnd = false;
+	return true;
+}
+/** Handle `export default` (→ `return`), `export {…}`/`export *` (removed)
+*  and `export <decl>` (keyword dropped — the eval context is a function
+*  body, where `export const` would be a syntax error). */
+function tryExport(code, st, out) {
+	if (!st.stmtStart || !keywordAt(code, st.i, "export")) return false;
+	const j = skipTrivia(code, st.i + 6);
+	if (!st.exportDefaultDone && code.startsWith("default", j) && !isIdentChar(code[j + 7])) {
+		out.push("return ");
+		st.exportDefaultDone = true;
+		st.i = skipTrivia(code, j + 7);
+		st.stmtStart = false;
+		st.operandEnd = false;
+		return true;
+	}
+	if (code[j] === "{" || code[j] === "*") {
+		st.i = scanExportListEnd(code, j);
+		st.stmtStart = false;
+		st.operandEnd = false;
+		return true;
+	}
+	st.i = j;
+	st.stmtStart = false;
+	st.operandEnd = false;
+	return true;
+}
+/** Emit an identifier run — keyword table decides whether `/` after it
+*  divides (`foo /x/`) or opens a regex (`return /x/`). */
+function tryWord(code, st, out) {
+	if (!isIdentChar(code[st.i])) return false;
+	const wend = skipIdent(code, st.i);
+	out.push(code.slice(st.i, wend));
+	st.operandEnd = operandAfterWord(code.slice(st.i, wend));
+	st.stmtStart = false;
+	st.i = wend;
+	return true;
+}
+/** Char handlers tried in order — first true wins. Any char left over is
+*  copied verbatim as a non-operand punctuation token. */
+const HANDLERS = [
+	copyOpaque,
+	applyBracket,
+	applyTerminator,
+	applySlash,
+	tryImport,
+	tryExport,
+	tryWord
+];
+function advanceScan(code, st, out) {
+	for (const handle of HANDLERS) if (handle(code, st, out)) return;
+	st.stmtStart = false;
+	st.operandEnd = false;
+	out.push(code[st.i] ?? "");
+	st.i++;
+}
+/**
+* Strip import/export statements from user code for eval — a linear
+* single-pass scan, so multiline imports and comments/strings are handled
+* and pathological spacing cannot cause quadratic backtracking.
+*
+* `import …` statements are removed whole. `export default` becomes
+* `return`, `export {…}`/`export *` are removed, and `export` before a
+* declaration is dropped (the eval context is a function body, where
+* `export const` would be a syntax error).
+*
+* Note: TypeScript-specific syntax (type annotations, interfaces, enums)
+* is not stripped — the playground uses Monaco's TypeScript language mode
+* for editing, but evaluation is plain JavaScript. Users should write
+* JS-compatible code or use the `as any` escape hatch sparingly.
+*/
+function preprocessCode(code) {
+	const out = [];
+	const st = {
+		i: 0,
+		stmtStart: true,
+		exportDefaultDone: false,
+		stack: [],
+		operandEnd: false
+	};
+	while (st.i < code.length) {
+		if (code[st.i] === void 0) break;
+		advanceScan(code, st, out);
+	}
+	return out.join("");
+}
+/**
+* Evaluate user code and return the Project.
+*
+* SECURITY: This uses `new Function()` to execute user-provided code.
+* This is intentional — the playground is a local development tool where
+* the user writes and runs their own pipeline code. The code runs in the
+* browser's main page context (not a sandboxed iframe or worker) because
+* the playground needs to support synchronous FunctionStep execution and
+* direct access to the pipeline constructs. This is the same trust model
+* as a local REPL or `node -e`.
+*/
+function evaluateUserCode(code) {
+	const params = [
+		"Project",
+		"Pipeline",
+		"FunctionStep",
+		"Entry",
+		preprocessCode(code)
+	];
+	const result = new Function(...params)(Project, Pipeline, FunctionStep, Entry);
+	if (!(result instanceof Project)) throw new TypeError("Code must export a Project instance");
+	return result;
+}
+/**
+* Run a pipeline with a timeout. If a step returns a never-resolving
+* promise, the timeout ensures the UI recovers instead of staying
+* stuck in "Running" state forever.
+*/
+async function runPipelineWithTimeout(project, timeoutMs) {
+	let timer;
+	try {
+		return await Promise.race([runPipeline(project), new Promise((_, reject) => {
+			timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`Pipeline timed out after ${timeoutMs}ms`)), timeoutMs);
+		})]);
+	} finally {
+		if (timer !== void 0) clearTimeout(timer);
+	}
+}
+//#endregion
+//#region src/embed.ts
+const STYLE = `
+  font-family: monospace; font-size: 12px;
+  background: #0d1117; color: #c9d1d9;
+  border: 1px solid #30363d; border-radius: 6px;
+  display: flex; flex-direction: column; overflow: hidden;
+`;
+function createHeader(doc) {
+	const header = doc.createElement("div");
+	header.setAttribute("style", "display:flex;align-items:center;gap:0.5rem;padding:0.4rem 0.6rem;background:#161b22;border-bottom:1px solid #30363d;");
+	const runBtn = doc.createElement("button");
+	runBtn.textContent = "Run";
+	runBtn.setAttribute("style", "padding:0.2rem 0.8rem;border:1px solid #30363d;border-radius:6px;background:#1f6feb;color:#fff;cursor:pointer;font-size:0.8rem;");
+	const status = doc.createElement("span");
+	status.setAttribute("style", "font-size:0.75rem;color:#8b949e;");
+	status.textContent = "Ready";
+	header.append(runBtn, status);
+	return {
+		header,
+		runBtn,
+		status
+	};
+}
+function createCodeEl(doc, code, readonly) {
+	if (readonly) {
+		const pre = doc.createElement("pre");
+		pre.setAttribute("style", "margin:0;padding:0.75rem;overflow:auto;max-height:16rem;white-space:pre;");
+		pre.textContent = code;
+		return pre;
+	}
+	const textarea = doc.createElement("textarea");
+	textarea.value = code;
+	textarea.setAttribute("style", "flex:0 0 12rem;width:100%;background:#0d1117;color:#c9d1d9;border:none;border-bottom:1px solid #30363d;padding:0.75rem;resize:vertical;outline:none;font:inherit;");
+	return textarea;
+}
+function createFrame(doc) {
+	const frame = doc.createElement("iframe");
+	frame.setAttribute("sandbox", "allow-scripts");
+	frame.setAttribute("style", "flex:1;min-height:10rem;width:100%;border:none;background:#0d1117;");
+	return frame;
+}
+const BODY_DARK = "<body style=\"background:#0d1117;font-family:monospace;padding:1rem;";
+/** Failure banner HTML — string concat keeps user data flowing through
+*  escapeHtml explicitly, never through template interpolation. */
+function failureBanner(result) {
+	return [
+		"<div style=\"background:#3d1d1f;color:#f85149;padding:0.6rem 1rem;font-family:monospace;border-bottom:1px solid #30363d;\">",
+		"<strong>Run failed</strong>",
+		"<pre style=\"margin:0.4rem 0 0;white-space:pre-wrap;\">",
+		escapeHtml(result.steps.filter((s) => s.status === "failure").map((s) => `${s.stepId}: ${s.error ?? "failed"}`).join("\n") || `${result.steps.length} steps failed`),
+		"</pre></div>"
+	].join("");
+}
+/** Document shown when the run failed — partial findings still render
+*  underneath the banner so finished steps aren't hidden by the error. */
+function failureDoc(result, banner) {
+	if (result.findings.length === 0) return "<!DOCTYPE html><html>" + BODY_DARK + "color:#f85149;\">" + banner + "</body></html>";
+	const sarif = generateSarifHtml(result.findings);
+	return sarif.includes("<body>") ? sarif.replace("<body>", "<body>" + banner) : banner + sarif;
+}
+/** Document shown for a clean run with zero findings. */
+function successDoc(result) {
+	return [
+		"<!DOCTYPE html><html>",
+		BODY_DARK,
+		"color:#3fb950;\">",
+		"<h3>No findings — all checks passed</h3><p>",
+		escapeHtml(String(result.steps.length)),
+		" steps in ",
+		escapeHtml(String(result.totalDurationMs)),
+		"ms</p></body></html>"
+	].join("");
+}
+/** Document shown when the runner itself threw (eval or pipeline error). */
+function errorDoc(e) {
+	const msg = e instanceof Error ? e.message : String(e);
+	return [
+		"<!DOCTYPE html><html>",
+		BODY_DARK,
+		"color:#f85149;\">",
+		"<h3>Error</h3><pre>",
+		escapeHtml(msg),
+		"</pre></body></html>"
+	].join("");
+}
+function statusLine(result) {
+	if (result.success) return `${result.findings.length} findings · ${result.totalDurationMs}ms`;
+	return `${result.steps.filter((s) => s.status === "failure").length} step(s) failed · ${result.findings.length} findings`;
+}
+/** Render a completed run into the findings frame. */
+function renderResult(result, showFindings) {
+	if (!result.success) {
+		showFindings(failureDoc(result, failureBanner(result)));
+		return;
+	}
+	if (result.findings.length === 0) {
+		showFindings(successDoc(result));
+		return;
+	}
+	showFindings(generateSarifHtml(result.findings));
+}
+/**
+* Mount a self-contained runner inside `el`. `dispose()` tears the mount
+* down. With `autoRun: true` the runner executes `code` once on mount;
+* otherwise it waits for the Run button — embeds never auto-execute code
+* the embedder didn't explicitly allow.
+*/
+function mountRunner(el, opts = {}) {
+	const doc = el.ownerDocument;
+	const code = opts.code ?? DEFAULT_CODE;
+	const root = doc.createElement("div");
+	root.setAttribute("style", STYLE);
+	const { header, runBtn, status } = createHeader(doc);
+	const codeEl = createCodeEl(doc, code, opts.readonly === true);
+	const frame = createFrame(doc);
+	root.append(header, codeEl, frame);
+	el.appendChild(root);
+	const getCode = () => opts.readonly === true ? code : codeEl.value;
+	const run = async () => {
+		runBtn.disabled = true;
+		status.textContent = "Running...";
+		let result;
+		try {
+			result = await runPipelineWithTimeout(evaluateUserCode(getCode()), 3e4);
+			renderResult(result, (html) => {
+				frame.srcdoc = html;
+			});
+			status.textContent = statusLine(result);
+		} catch (e) {
+			frame.srcdoc = errorDoc(e);
+			status.textContent = "Error";
+			runBtn.disabled = false;
+			return;
+		}
+		runBtn.disabled = false;
+		opts.onRun?.(result);
+	};
+	const onClick = () => {
+		run();
+	};
+	runBtn.addEventListener("click", onClick);
+	if (opts.autoRun === true) run();
+	return { dispose() {
+		runBtn.removeEventListener("click", onClick);
+		root.remove();
+	} };
+}
+//#endregion
+//#region src/transpile.ts
+function isOpenBracket(c) {
+	return c === "{" || c === "[" || c === "(";
+}
+function isCloseBracket(c) {
+	return c === "}" || c === "]" || c === ")";
+}
+function skipWs(code, i) {
+	while (i < code.length && isWsChar(code[i])) i++;
+	return i;
+}
+/** One token of an operand-tracking scan — identifiers (with `word`),
+*  opaque spans, and regex-vs-division resolve through the shared
+*  scanner; whitespace passes through. Null when `i` sits on
+*  punctuation the caller's own depth/branch logic owns. */
+function propToken(s, i, operandEnd) {
+	if (isWsChar(s[i])) return {
+		end: i + 1,
+		operandEnd
+	};
+	const op = scanOperand(s, i, operandEnd);
+	if (op === null) return null;
+	if (isIdentChar(s[i])) return {
+		...op,
+		word: s.slice(i, op.end)
+	};
+	return op;
+}
+/** Apply a bracket/other punctuation char to depth + operand state. */
+function applyPunctuation(c, st) {
+	if (isOpenBracket(c)) {
+		st.depth++;
+		st.operandEnd = false;
+	} else if (isCloseBracket(c)) {
+		st.depth--;
+		st.operandEnd = true;
+	} else st.operandEnd = false;
+}
+/**
+* Index of the `:` following a depth-0 `key` in a props object body, or -1.
+* A `dependencies` declared inside `fn` never counts — only top-level keys.
+*/
+function findPropKey(props, key) {
+	const st = {
+		depth: 0,
+		operandEnd: false
+	};
+	let i = 0;
+	while (i < props.length) {
+		const tok = propToken(props, i, st.operandEnd);
+		if (tok === null) {
+			applyPunctuation(props[i], st);
+			i++;
+			continue;
+		}
+		if (st.depth === 0 && tok.word === key) {
+			const hit = skipWs(props, tok.end);
+			if (props[hit] === ":") return hit;
+		}
+		st.operandEnd = tok.operandEnd;
+		i = tok.end;
+	}
+	return -1;
+}
+/** True when the comment at `k` is a top-level tail comment — `deps: [] //
+*  note` — and therefore not part of the value. Emitting it would comment
+*  out the generated `}` after `dependsOn: <value>`. */
+function isTailComment(props, k, after) {
+	const ahead = skipWs(props, after);
+	return ahead >= props.length || props[ahead] === ",";
+}
+/** End index of a prop value starting at `j` — the next top-level comma
+*  or the end of the props body, with strings/comments/brackets balanced. */
+function propValueEnd(props, j) {
+	const st = {
+		depth: 0,
+		operandEnd: false
+	};
+	let k = j;
+	while (k < props.length) {
+		if (isOpaqueStart(props, k)) {
+			const after = scanOpaqueEnd(props, k).end;
+			if (st.depth === 0 && isTailComment(props, k, after)) return k;
+			k = after;
+			continue;
+		}
+		const tok = propToken(props, k, st.operandEnd);
+		if (tok !== null) {
+			st.operandEnd = tok.operandEnd;
+			k = tok.end;
+			continue;
+		}
+		if (props[k] === "," && st.depth === 0) return k;
+		applyPunctuation(props[k], st);
+		k++;
+	}
+	return k;
+}
+/**
+* Extract a top-level `key: <value>` span from a props object body.
+* Only depth-0 keys match — a `dependencies` declared inside `fn` never
+* counts. The value runs to the next top-level `,`, with strings,
+* comments, and nested brackets all balanced.
+*/
+function extractProp(props, key) {
+	const colon = findPropKey(props, key);
+	if (colon < 0) return void 0;
+	const j = skipWs(props, colon + 1);
+	return props.slice(j, propValueEnd(props, j)).trim();
+}
+/** Consume trailing spaces/tabs plus one optional `;` — never the newline.
+*  Eating it would fuse the emitted import with the next line
+*  (`from "@sverka/workflow"const x = …`). */
+function stmtEndPos(source, i) {
+	let end = i;
+	while (source[end] === " " || source[end] === "	") end++;
+	if (source[end] === ";") end++;
+	return end;
+}
+/** Parse one import specifier: `Name` or `Name as alias`. */
+function parseImportSpec(spec) {
+	const a = skipWs(spec, 0);
+	const wend = skipIdent(spec, a);
+	const orig = spec.slice(a, wend);
+	const asPos = skipWs(spec, wend);
+	if (!spec.startsWith("as", asPos) || isIdentChar(spec[asPos + 2])) return {
+		orig,
+		local: orig
+	};
+	const b = skipWs(spec, asPos + 2);
+	const local = spec.slice(b, skipIdent(spec, b));
+	return local === "" ? {
+		orig,
+		local: orig
+	} : {
+		orig,
+		local
+	};
+}
+/** Map `{…}` import specifiers; FunctionStep becomes ShellStep (aliases
+*  survive: `FunctionStep as Fn` → `ShellStep as Fn`). */
+function mapImportSpecifiers(inner) {
+	const mapped = [];
+	const fnStepLocals = [];
+	for (const spec of inner.split(",")) {
+		const trimmed = spec.trim();
+		if (trimmed === "") continue;
+		const { orig, local } = parseImportSpec(trimmed);
+		if (orig === "FunctionStep") {
+			fnStepLocals.push(local);
+			mapped.push(orig === local ? "ShellStep" : `ShellStep as ${local}`);
+		} else mapped.push(trimmed);
+	}
+	return {
+		mapped: mapped.join(", "),
+		fnStepLocals
+	};
+}
+/** Parse `import {…} from "@sverka/playground"` at `i`, or null when the
+*  statement has another shape/module. Caller guarantees "import" at `i`. */
+function parsePlaygroundImport(source, i) {
+	const j = skipWs(source, i + 6);
+	if (source[j] !== "{") return null;
+	const namesEnd = matchBrace(source, j);
+	if (namesEnd < 0) return null;
+	const fromKw = skipWs(source, namesEnd + 1);
+	if (!keywordAt(source, fromKw, "from")) return null;
+	const qPos = skipWs(source, fromKw + 4);
+	const q = source[qPos];
+	if (q !== "\"" && q !== "'") return null;
+	const specEnd = scanString(source, qPos);
+	if (source.slice(qPos + 1, specEnd - 1) !== "@sverka/playground") return null;
+	const { mapped, fnStepLocals } = mapImportSpecifiers(source.slice(j + 1, namesEnd));
+	return {
+		stmtEnd: stmtEndPos(source, specEnd),
+		mapped,
+		fnStepLocals
+	};
+}
+/**
+* Rewrite `import {…} from "@sverka/playground"` statements linearly.
+*
+* Returns the rewritten source plus every local name bound to
+* FunctionStep, so constructor calls under an alias are transpiled too.
+*/
+function rewritePlaygroundImports(source) {
+	const fnStepNames = [];
+	let out = "";
+	let cursor = 0;
+	let i = 0;
+	while (i < source.length) {
+		const end = scanOpaqueEnd(source, i).end;
+		if (end > i + 1) {
+			i = end;
+			continue;
+		}
+		if (source.startsWith("import", i) && !isIdentChar(source[i + 6])) {
+			const stmt = parsePlaygroundImport(source, i);
+			if (stmt !== null) {
+				out += source.slice(cursor, i);
+				out += `import { ${stmt.mapped} } from "@sverka/workflow"`;
+				if (source[stmt.stmtEnd - 1] === ";") out += ";";
+				fnStepNames.push(...stmt.fnStepLocals);
+				cursor = stmt.stmtEnd;
+				i = stmt.stmtEnd;
+				continue;
+			}
+		}
+		i++;
+	}
+	return {
+		code: out + source.slice(cursor),
+		fnStepNames
+	};
+}
+/** Index of `(` after `new <name>` where <name> ∈ names, or null. */
+function stepCallParen(code, afterNew, names) {
+	const j = skipWs(code, afterNew);
+	for (const name of names) {
+		const next = code[j + name.length];
+		if (code.startsWith(name, j) && !isIdentChar(next)) {
+			const paren = skipWs(code, j + name.length);
+			if (code[paren] === "(") return paren;
+		}
+	}
+	return null;
+}
+/** Operand context after punctuation — closers end a value, everything
+*  else (openers, operators, separators) expects one. */
+function punctuationOperandEnd(c) {
+	return c === ")" || c === "]" || c === "}";
+}
+/**
+* Locate the next `new <name>(` call where <name> ∈ names. Whole-word
+* scanning makes boundary checks free — `myNew` or `newer` never match.
+* Opaque regions and regex literals are skipped inline, so a
+* `new FunctionStep(` inside a comment, string, or `/new Fn(/` pattern
+* is documentation, not a call.
+*/
+function findStepCall(code, names, from) {
+	let operandEnd = false;
+	let i = from;
+	while (i < code.length) {
+		const tok = propToken(code, i, operandEnd);
+		if (tok !== null) {
+			if (tok.word === "new") {
+				const paren = stepCallParen(code, tok.end, names);
+				if (paren !== null) return {
+					start: i,
+					paren
+				};
+			}
+			operandEnd = tok.operandEnd;
+			i = tok.end;
+			continue;
+		}
+		operandEnd = punctuationOperandEnd(code[i]);
+		i++;
+	}
+	return null;
+}
+/** End of the scope expression — the first top-level comma after `from`,
+*  or -1 when the argument list closes/ends first. */
+function scanScopeEnd(code, from) {
+	const st = {
+		depth: 0,
+		operandEnd: false
+	};
+	let k = from;
+	while (k < code.length) {
+		const tok = propToken(code, k, st.operandEnd);
+		if (tok !== null) {
+			st.operandEnd = tok.operandEnd;
+			k = tok.end;
+			continue;
+		}
+		const c = code[k];
+		if (c === "," && st.depth === 0) return k;
+		if (isCloseBracket(c) && st.depth === 0) return -1;
+		applyPunctuation(c, st);
+		k++;
+	}
+	return -1;
+}
+/** Parse `(scope, "id", {` after the `(` at `paren`; null when the call
+*  shape differs. A template id throws immediately — never half-converts. */
+function parseStepArgs(code, paren) {
+	const scopeStart = skipWs(code, paren + 1);
+	const comma = scanScopeEnd(code, scopeStart);
+	if (comma < 0) return null;
+	const qPos = skipWs(code, comma + 1);
+	const q = code[qPos];
+	if (q === "`") throw new PlaygroundError("TRANSPILE_FAILED", "cannot parse FunctionStep — template-literal step id");
+	if (q !== "\"" && q !== "'") return null;
+	const idEnd = scanString(code, qPos);
+	const afterId = skipWs(code, idEnd);
+	if (code[afterId] !== ",") return null;
+	const propsOpen = skipWs(code, afterId + 1);
+	if (code[propsOpen] !== "{") return null;
+	return {
+		scope: code.slice(scopeStart, comma).trim(),
+		id: code.slice(qPos + 1, idEnd - 1),
+		propsOpen
+	};
+}
+/** Emit the ShellStep placeholder replacing one FunctionStep call. */
+function shellStepCall(args, dependencies) {
+	return `new ShellStep(${args.scope}, "${args.id}", { command: "echo 'TODO: port '${args.id}' — replace with the real shell command'"` + (dependencies !== void 0 ? ", dependsOn: " + dependencies : "") + " }";
+}
+/** Rewrite every `new Fn(scope, "id", {…})` call under the given local
+*  names into ShellStep placeholders; `dependencies` → `dependsOn`. */
+function rewriteStepCalls(code, names) {
+	let result = "";
+	let cursor = 0;
+	for (;;) {
+		const call = findStepCall(code, names, cursor);
+		if (call === null) break;
+		const args = parseStepArgs(code, call.paren);
+		if (args === null) {
+			result += code.slice(cursor, call.start + 3);
+			cursor = call.start + 3;
+			continue;
+		}
+		const propsClose = matchBrace(code, args.propsOpen);
+		if (propsClose < 0) throw new PlaygroundError("TRANSPILE_FAILED", `cannot parse FunctionStep "${args.id}" — unbalanced props object`);
+		const dependencies = extractProp(code.slice(args.propsOpen + 1, propsClose), "dependencies");
+		result += code.slice(cursor, call.start) + shellStepCall(args, dependencies);
+		cursor = propsClose + 1;
+	}
+	return result + code.slice(cursor);
+}
+/** A surviving step call means a shape we could not convert — computed
+*  scope/id or a malformed alias call. Fail loud rather than emit a
+*  half-converted file. */
+function assertNoLeftoverSteps(code, names) {
+	const call = findStepCall(code, names, 0);
+	if (call === null) return;
+	const scopeStart = skipWs(code, call.paren + 1);
+	const scopeEnd = scanScopeEnd(code, scopeStart);
+	throw new PlaygroundError("TRANSPILE_FAILED", `cannot parse FunctionStep with scope '${scopeEnd < 0 ? "?" : code.slice(scopeStart, scopeEnd).trim() || "?"}' — unsupported expression`);
+}
+/**
+* Transpile playground source into `sverka.config.ts`.
+*
+* Rewrites the `@sverka/playground` import to `@sverka/workflow` and each
+* `new FunctionStep(scope, "id", { fn, dependencies })` into a ShellStep
+* whose command echoes a placeholder — the function body has no shell
+* equivalent.
+* `dependencies` maps onto `dependsOn`. Aliased FunctionStep imports
+* (`FunctionStep as Fn`) are followed too.
+*
+* Throws `PlaygroundError(TRANSPILE_FAILED)` naming the offending step when
+* a FunctionStep cannot be parsed — a half-converted file is never emitted.
+*/
+function toSverkaConfig(source) {
+	const { code, fnStepNames } = rewritePlaygroundImports(source);
+	if (fnStepNames.length === 0) fnStepNames.push("FunctionStep");
+	const out = rewriteStepCalls(code, fnStepNames);
+	assertNoLeftoverSteps(out, fnStepNames);
+	return out;
+}
+//#endregion
+export { DEFAULT_CODE, Entry, FunctionStep, Pipeline, PlaygroundError, Project, SHARE_PAYLOAD_WARN_BYTES, decodeShareLink, encodeShareLink, evaluateUserCode, mountRunner, runPipeline, runPipelineWithTimeout, toSverkaConfig };
 
 //# sourceMappingURL=index.mjs.map