@zuplo/editor 1.0.31094607111 → 1.0.31661404480

package/README.md

@@ -2,3 +2,28 @@
 
 This project is not meant to be used independently. It is part of the
 [Zuplo CLI](https://zuplo.com/docs/cli)
+
+## Publishing
+
+The published package is **`publish/`**, not this directory.
+
+```bash
+pnpm --filter @zuplo/editor build:package
+npm publish ./packages/editor/publish
+```
+
+This directory is a workspace member, so publishing it directly would ship the
+spec files and a `dependencies` list containing everything the editor imports.
+`build:package` assembles the real artifact instead: every runtime dependency is
+bundled and tree-shaken, only the declarations reachable from the entry points
+are copied, and the `package.json` is generated from scratch. **The published
+package has no dependencies** — see
+[`scripts/build-package.ts`](./scripts/build-package.ts).
+
+That last part is why `EditorApp.fetch` is a plain function and
+`AssetSource.serve` takes a `Request`, rather than the `Hono` and hono `Context`
+they really are: a published declaration can only name a type a consumer can
+resolve, and hono is bundled. The build fails if a reachable declaration names
+anything that isn't installable, so this can't regress quietly.
+
+`npm publish` from this directory fails on purpose.

package/dist/adapters/memory-fs.d.ts

@@ -41,4 +41,3 @@ export interface MemoryFileSystem extends FileSystemPort, ChangeNotifier {
  * no chokidar to drive it.
  */
 export declare function createMemoryFileSystem(options?: MemoryFileSystemOptions): MemoryFileSystem;
-//# sourceMappingURL=memory-fs.d.ts.map

package/dist/adapters/memory-preferences.d.ts

@@ -7,4 +7,3 @@ import type { EditorPreferencesPort } from "../ports.js";
  * simply forgotten when the isolate recycles.
  */
 export declare function createMemoryEditorPreferences(): EditorPreferencesPort;
-//# sourceMappingURL=memory-preferences.d.ts.map

package/dist/adapters/memory.d.ts

@@ -7,4 +7,3 @@
  */
 export { createMemoryFileSystem, type MemoryFileSystem, type MemoryFileSystemOptions, } from "./memory-fs.js";
 export { createMemoryEditorPreferences } from "./memory-preferences.js";
-//# sourceMappingURL=memory.d.ts.map

package/dist/adapters/memory.js

@@ -1,10 +1,194 @@
-/**
- * The platform-free adapters, collected so a consumer that must avoid `node:*`
- * has a single import that is guaranteed not to reach it.
- *
- * The preview Worker imports from here rather than from the package root, which
- * pulls in `LocalEditorServer` and with it `@hono/node-server` and chokidar.
- */
-export { createMemoryFileSystem, } from "./memory-fs.js";
-export { createMemoryEditorPreferences } from "./memory-preferences.js";
-//# sourceMappingURL=memory.js.map
+import {
+  editorConfig
+} from "../chunks/chunk-C7VL3DX7.js";
+import {
+  PathNotFoundError,
+  toSafeSegments
+} from "../chunks/chunk-FELEIEAB.js";
+import "../chunks/chunk-54KOYG5C.js";
+
+// src/adapters/memory-fs.ts
+var decoder = new TextDecoder();
+function createMemoryFileSystem(options = {}) {
+  const {
+    files: seed = {},
+    watchedDirs = editorConfig.watch.watchedDirs,
+    now = () => /* @__PURE__ */ new Date(),
+    // One timestamp for the whole seed rather than one per file, so `reset()`
+    // restores the project exactly as it was first loaded.
+    seedMtime = now()
+  } = options;
+  const files = /* @__PURE__ */ new Map();
+  const emptyDirs = /* @__PURE__ */ new Map();
+  const listeners = /* @__PURE__ */ new Set();
+  const key = (path) => toSafeSegments(path).join("/");
+  const parentOf = (path) => path.slice(0, Math.max(0, path.lastIndexOf("/")));
+  const isWatched = (path) => watchedDirs.some((dir) => path === dir || path.startsWith(`${dir}/`));
+  const emit = (path) => {
+    if (!isWatched(path)) {
+      return;
+    }
+    for (const listener of listeners) {
+      listener(path);
+    }
+  };
+  const hasChildren = (path) => {
+    const prefix = `${path}/`;
+    for (const filePath of files.keys()) {
+      if (filePath.startsWith(prefix)) {
+        return true;
+      }
+    }
+    for (const dirPath of emptyDirs.keys()) {
+      if (dirPath.startsWith(prefix)) {
+        return true;
+      }
+    }
+    return false;
+  };
+  const isDirectory = (path) => (
+    // The root always exists, even in an empty project.
+    path === "" || emptyDirs.has(path) || hasChildren(path)
+  );
+  const addDirs = (path, timestamp) => {
+    for (let dir = path; dir !== ""; dir = parentOf(dir)) {
+      if (!files.has(dir)) {
+        emptyDirs.set(dir, timestamp);
+      }
+    }
+  };
+  const write = (path, content, at) => {
+    const mtime = at ?? now();
+    emptyDirs.delete(path);
+    addDirs(parentOf(path), mtime);
+    files.set(path, { content, mtime });
+    return { type: "file", mtime };
+  };
+  const load = () => {
+    files.clear();
+    emptyDirs.clear();
+    for (const [path, content] of Object.entries(seed)) {
+      write(key(path), content, seedMtime);
+    }
+  };
+  load();
+  return {
+    onChange(listener) {
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    },
+    reset() {
+      load();
+    },
+    // Every method below is `async` even though nothing here awaits: it makes a
+    // rejected promise the only way these fail, matching the Node adapter. A
+    // sync throw from `key()` on a traversal attempt would otherwise escape
+    // before the promise existed, and callers would have to guard both ways.
+    async readFileWithStat(path) {
+      const file = files.get(key(path));
+      if (!file) {
+        throw new PathNotFoundError(path);
+      }
+      return {
+        content: typeof file.content === "string" ? file.content : decoder.decode(file.content),
+        mtime: file.mtime
+      };
+    },
+    async listDir(path) {
+      const dir = key(path);
+      if (!isDirectory(dir)) {
+        throw new PathNotFoundError(path);
+      }
+      const prefix = dir === "" ? "" : `${dir}/`;
+      const entries = /* @__PURE__ */ new Map();
+      const collect = (fullPath, type) => {
+        if (!fullPath.startsWith(prefix)) {
+          return;
+        }
+        const rest = fullPath.slice(prefix.length);
+        if (rest === "") {
+          return;
+        }
+        const slash = rest.indexOf("/");
+        const name = slash === -1 ? rest : rest.slice(0, slash);
+        entries.set(name, {
+          name,
+          type: slash === -1 ? type : "directory"
+        });
+      };
+      for (const filePath of files.keys()) {
+        collect(filePath, "file");
+      }
+      for (const dirPath of emptyDirs.keys()) {
+        collect(dirPath, "directory");
+      }
+      return [...entries.values()];
+    },
+    async statPath(path) {
+      const target = key(path);
+      const file = files.get(target);
+      if (file) {
+        return { type: "file", mtime: file.mtime };
+      }
+      if (isDirectory(target)) {
+        return {
+          type: "directory",
+          mtime: emptyDirs.get(target) ?? now()
+        };
+      }
+      return void 0;
+    },
+    async writeFile(path, content) {
+      const target = key(path);
+      const stat = write(target, content);
+      emit(target);
+      return stat;
+    },
+    async remove(path) {
+      const target = key(path);
+      if (!files.delete(target)) {
+        throw new PathNotFoundError(path);
+      }
+      addDirs(parentOf(target), now());
+      emit(target);
+    },
+    async rename(from, to) {
+      const fromKey = key(from);
+      const toKey = key(to);
+      const file = files.get(fromKey);
+      if (!file) {
+        throw new PathNotFoundError(from);
+      }
+      files.delete(fromKey);
+      addDirs(parentOf(fromKey), now());
+      emptyDirs.delete(toKey);
+      addDirs(parentOf(toKey), file.mtime);
+      files.set(toKey, file);
+      emit(fromKey);
+      emit(toKey);
+    },
+    async mkdirp(path) {
+      const target = key(path);
+      if (target !== "") {
+        addDirs(target, now());
+      }
+    }
+  };
+}
+
+// src/adapters/memory-preferences.ts
+function createMemoryEditorPreferences() {
+  let editor = null;
+  return {
+    get: () => Promise.resolve(editor),
+    set: (value) => {
+      editor = value;
+      return Promise.resolve();
+    }
+  };
+}
+export {
+  createMemoryEditorPreferences,
+  createMemoryFileSystem
+};
+//# sourceMappingURL=memory.js.map

package/dist/adapters/memory.js.map

@@ -1 +1,7 @@
-{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../src/adapters/memory.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,sBAAsB,GAGvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC"}
+{
+  "version": 3,
+  "sources": ["../../../src/adapters/memory-fs.ts", "../../../src/adapters/memory-preferences.ts"],
+  "sourcesContent": ["import { editorConfig } from \"../constants.js\";\nimport {\n  type ChangeNotifier,\n  type DirEntry,\n  type FileSystemPort,\n  type FileWithStat,\n  PathNotFoundError,\n  type PathStat,\n  toSafeSegments,\n} from \"../ports.js\";\n\ninterface MemoryFile {\n  content: string | Uint8Array;\n  mtime: Date;\n}\n\nexport interface MemoryFileSystemOptions {\n  /**\n   * The project to start from, as project-relative path \u2192 file content. Parent\n   * directories are implied and don't need listing.\n   */\n  files?: Record<string, string>;\n\n  /**\n   * Top-level directories whose changes are reported to `onChange` listeners.\n   * Defaults to the same set chokidar watches on Node, so the preview's\n   * live-reload behaviour matches the CLI's rather than being broader.\n   */\n  watchedDirs?: readonly string[];\n\n  /** Injectable clock, so tests can control mtimes. */\n  now?: () => Date;\n\n  /**\n   * The mtime the seeded project starts with. Defaults to now.\n   *\n   * Worth setting to a constant wherever the same seed is loaded more than\n   * once \u2014 a Worker builds one of these per isolate, and if each picked its own\n   * startup time, a client that read a file from one isolate would be told its\n   * save conflicts when it landed on another. The file it read and the file it\n   * is saving over are byte-identical; only the clock disagreed.\n   */\n  seedMtime?: Date;\n}\n\nexport interface MemoryFileSystem extends FileSystemPort, ChangeNotifier {\n  /** Discards all edits and returns to the seeded project. */\n  reset(): void;\n}\n\nconst decoder = new TextDecoder();\n\n/**\n * A `FileSystemPort` held entirely in memory \u2014 what the per-PR preview Worker\n * runs against, since a Worker has no filesystem.\n *\n * Directories are implied by the paths of the files inside them, plus any\n * created explicitly, which is enough for a project tree and avoids maintaining\n * a parallel directory structure that could disagree with the files.\n *\n * It doubles as the `ChangeNotifier`: writes report themselves, so the SPA's\n * live-reload path stays exercised in the preview instead of going quiet with\n * no chokidar to drive it.\n */\nexport function createMemoryFileSystem(\n  options: MemoryFileSystemOptions = {},\n): MemoryFileSystem {\n  const {\n    files: seed = {},\n    watchedDirs = editorConfig.watch.watchedDirs,\n    now = () => new Date(),\n    // One timestamp for the whole seed rather than one per file, so `reset()`\n    // restores the project exactly as it was first loaded.\n    seedMtime = now(),\n  } = options;\n\n  const files = new Map<string, MemoryFile>();\n  /** Directories that exist without (yet) containing a file. */\n  const emptyDirs = new Map<string, Date>();\n  const listeners = new Set<(path: string) => void>();\n\n  /** Canonicalises a path and refuses traversal, exactly as Node's adapter does. */\n  const key = (path: string): string => toSafeSegments(path).join(\"/\");\n\n  const parentOf = (path: string): string =>\n    path.slice(0, Math.max(0, path.lastIndexOf(\"/\")));\n\n  const isWatched = (path: string): boolean =>\n    watchedDirs.some((dir) => path === dir || path.startsWith(`${dir}/`));\n\n  /**\n   * Announces a change the way chokidar does on Node \u2014 including for the\n   * editor's own saves, which also trip the real watcher.\n   */\n  const emit = (path: string): void => {\n    if (!isWatched(path)) {\n      return;\n    }\n    for (const listener of listeners) {\n      listener(path);\n    }\n  };\n\n  /** True when anything lives under `path`, which is what makes it a directory. */\n  const hasChildren = (path: string): boolean => {\n    const prefix = `${path}/`;\n    for (const filePath of files.keys()) {\n      if (filePath.startsWith(prefix)) {\n        return true;\n      }\n    }\n    for (const dirPath of emptyDirs.keys()) {\n      if (dirPath.startsWith(prefix)) {\n        return true;\n      }\n    }\n    return false;\n  };\n\n  const isDirectory = (path: string): boolean =>\n    // The root always exists, even in an empty project.\n    path === \"\" || emptyDirs.has(path) || hasChildren(path);\n\n  /**\n   * Records `path` and its ancestors as directories.\n   *\n   * They're only remembered while empty: once a file sits inside, the file's\n   * own path is what makes the directory exist, and keeping a second record\n   * would let the two disagree.\n   */\n  const addDirs = (path: string, timestamp: Date): void => {\n    for (let dir = path; dir !== \"\"; dir = parentOf(dir)) {\n      if (!files.has(dir)) {\n        emptyDirs.set(dir, timestamp);\n      }\n    }\n  };\n\n  const write = (\n    path: string,\n    content: string | Uint8Array,\n    at?: Date,\n  ): PathStat => {\n    const mtime = at ?? now();\n    // A file and a directory can't share a path, and the file wins \u2014 the same\n    // way writing over a directory on disk fails rather than merging.\n    emptyDirs.delete(path);\n    addDirs(parentOf(path), mtime);\n    files.set(path, { content, mtime });\n    return { type: \"file\", mtime };\n  };\n\n  const load = (): void => {\n    files.clear();\n    emptyDirs.clear();\n    for (const [path, content] of Object.entries(seed)) {\n      write(key(path), content, seedMtime);\n    }\n  };\n\n  load();\n\n  return {\n    onChange(listener) {\n      listeners.add(listener);\n      return () => listeners.delete(listener);\n    },\n\n    reset() {\n      load();\n    },\n\n    // Every method below is `async` even though nothing here awaits: it makes a\n    // rejected promise the only way these fail, matching the Node adapter. A\n    // sync throw from `key()` on a traversal attempt would otherwise escape\n    // before the promise existed, and callers would have to guard both ways.\n    async readFileWithStat(path: string): Promise<FileWithStat> {\n      const file = files.get(key(path));\n      if (!file) {\n        throw new PathNotFoundError(path);\n      }\n\n      // Content and mtime come from one immutable record, so they always\n      // describe the same version \u2014 the property the Node adapter needs an open\n      // file handle to get.\n      return {\n        content:\n          typeof file.content === \"string\"\n            ? file.content\n            : decoder.decode(file.content),\n        mtime: file.mtime,\n      };\n    },\n\n    async listDir(path: string): Promise<DirEntry[]> {\n      const dir = key(path);\n      if (!isDirectory(dir)) {\n        throw new PathNotFoundError(path);\n      }\n\n      const prefix = dir === \"\" ? \"\" : `${dir}/`;\n      const entries = new Map<string, DirEntry>();\n\n      const collect = (fullPath: string, type: DirEntry[\"type\"]): void => {\n        if (!fullPath.startsWith(prefix)) {\n          return;\n        }\n        const rest = fullPath.slice(prefix.length);\n        if (rest === \"\") {\n          return;\n        }\n        const slash = rest.indexOf(\"/\");\n        // A path continuing past the first segment describes a grandchild, so\n        // the segment itself is a directory rather than the entry.\n        const name = slash === -1 ? rest : rest.slice(0, slash);\n        entries.set(name, {\n          name,\n          type: slash === -1 ? type : \"directory\",\n        });\n      };\n\n      for (const filePath of files.keys()) {\n        collect(filePath, \"file\");\n      }\n      for (const dirPath of emptyDirs.keys()) {\n        collect(dirPath, \"directory\");\n      }\n\n      return [...entries.values()];\n    },\n\n    async statPath(path: string): Promise<PathStat | undefined> {\n      const target = key(path);\n\n      const file = files.get(target);\n      if (file) {\n        return { type: \"file\", mtime: file.mtime };\n      }\n\n      if (isDirectory(target)) {\n        return {\n          type: \"directory\",\n          mtime: emptyDirs.get(target) ?? now(),\n        };\n      }\n\n      return undefined;\n    },\n\n    async writeFile(\n      path: string,\n      content: string | Uint8Array,\n    ): Promise<PathStat> {\n      const target = key(path);\n      const stat = write(target, content);\n      emit(target);\n      return stat;\n    },\n\n    async remove(path: string): Promise<void> {\n      const target = key(path);\n      if (!files.delete(target)) {\n        throw new PathNotFoundError(path);\n      }\n      // The parent may have just become empty, and an empty directory still\n      // exists on disk after its last file is deleted.\n      addDirs(parentOf(target), now());\n      emit(target);\n    },\n\n    async rename(from: string, to: string): Promise<void> {\n      const fromKey = key(from);\n      const toKey = key(to);\n\n      const file = files.get(fromKey);\n      if (!file) {\n        throw new PathNotFoundError(from);\n      }\n\n      files.delete(fromKey);\n      addDirs(parentOf(fromKey), now());\n      // Carries its mtime across, as a rename on disk does \u2014 the content didn't\n      // change, so a client holding a `Last-Modified` for it stays valid.\n      emptyDirs.delete(toKey);\n      addDirs(parentOf(toKey), file.mtime);\n      files.set(toKey, file);\n\n      emit(fromKey);\n      emit(toKey);\n    },\n\n    async mkdirp(path: string): Promise<void> {\n      const target = key(path);\n      if (target !== \"\") {\n        addDirs(target, now());\n      }\n    },\n  };\n}\n", "import type { EditorPreferencesPort } from \"../ports.js\";\n\n/**\n * Keeps the user's external-editor choice in memory for the life of the process.\n *\n * Used by the preview Worker, which has no home directory to persist to. The\n * preference dialog and toolbar behave correctly within a session; the choice is\n * simply forgotten when the isolate recycles.\n */\nexport function createMemoryEditorPreferences(): EditorPreferencesPort {\n  let editor: string | null = null;\n\n  return {\n    get: () => Promise.resolve(editor),\n    set: (value: string) => {\n      editor = value;\n      return Promise.resolve();\n    },\n  };\n}\n"],
+  "mappings": ";;;;;;;;;;AAkDA,IAAM,UAAU,IAAI,YAAY;AAczB,SAAS,uBACd,UAAmC,CAAC,GAClB;AAClB,QAAM;AAAA,IACJ,OAAO,OAAO,CAAC;AAAA,IACf,cAAc,aAAa,MAAM;AAAA,IACjC,MAAM,MAAM,oBAAI,KAAK;AAAA;AAAA;AAAA,IAGrB,YAAY,IAAI;AAAA,EAClB,IAAI;AAEJ,QAAM,QAAQ,oBAAI,IAAwB;AAE1C,QAAM,YAAY,oBAAI,IAAkB;AACxC,QAAM,YAAY,oBAAI,IAA4B;AAGlD,QAAM,MAAM,CAAC,SAAyB,eAAe,IAAI,EAAE,KAAK,GAAG;AAEnE,QAAM,WAAW,CAAC,SAChB,KAAK,MAAM,GAAG,KAAK,IAAI,GAAG,KAAK,YAAY,GAAG,CAAC,CAAC;AAElD,QAAM,YAAY,CAAC,SACjB,YAAY,KAAK,CAAC,QAAQ,SAAS,OAAO,KAAK,WAAW,GAAG,GAAG,GAAG,CAAC;AAMtE,QAAM,OAAO,CAAC,SAAuB;AACnC,QAAI,CAAC,UAAU,IAAI,GAAG;AACpB;AAAA,IACF;AACA,eAAW,YAAY,WAAW;AAChC,eAAS,IAAI;AAAA,IACf;AAAA,EACF;AAGA,QAAM,cAAc,CAAC,SAA0B;AAC7C,UAAM,SAAS,GAAG,IAAI;AACtB,eAAW,YAAY,MAAM,KAAK,GAAG;AACnC,UAAI,SAAS,WAAW,MAAM,GAAG;AAC/B,eAAO;AAAA,MACT;AAAA,IACF;AACA,eAAW,WAAW,UAAU,KAAK,GAAG;AACtC,UAAI,QAAQ,WAAW,MAAM,GAAG;AAC9B,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,CAAC;AAAA;AAAA,IAEnB,SAAS,MAAM,UAAU,IAAI,IAAI,KAAK,YAAY,IAAI;AAAA;AASxD,QAAM,UAAU,CAAC,MAAc,cAA0B;AACvD,aAAS,MAAM,MAAM,QAAQ,IAAI,MAAM,SAAS,GAAG,GAAG;AACpD,UAAI,CAAC,MAAM,IAAI,GAAG,GAAG;AACnB,kBAAU,IAAI,KAAK,SAAS;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAEA,QAAM,QAAQ,CACZ,MACA,SACA,OACa;AACb,UAAM,QAAQ,MAAM,IAAI;AAGxB,cAAU,OAAO,IAAI;AACrB,YAAQ,SAAS,IAAI,GAAG,KAAK;AAC7B,UAAM,IAAI,MAAM,EAAE,SAAS,MAAM,CAAC;AAClC,WAAO,EAAE,MAAM,QAAQ,MAAM;AAAA,EAC/B;AAEA,QAAM,OAAO,MAAY;AACvB,UAAM,MAAM;AACZ,cAAU,MAAM;AAChB,eAAW,CAAC,MAAM,OAAO,KAAK,OAAO,QAAQ,IAAI,GAAG;AAClD,YAAM,IAAI,IAAI,GAAG,SAAS,SAAS;AAAA,IACrC;AAAA,EACF;AAEA,OAAK;AAEL,SAAO;AAAA,IACL,SAAS,UAAU;AACjB,gBAAU,IAAI,QAAQ;AACtB,aAAO,MAAM,UAAU,OAAO,QAAQ;AAAA,IACxC;AAAA,IAEA,QAAQ;AACN,WAAK;AAAA,IACP;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,MAAM,iBAAiB,MAAqC;AAC1D,YAAM,OAAO,MAAM,IAAI,IAAI,IAAI,CAAC;AAChC,UAAI,CAAC,MAAM;AACT,cAAM,IAAI,kBAAkB,IAAI;AAAA,MAClC;AAKA,aAAO;AAAA,QACL,SACE,OAAO,KAAK,YAAY,WACpB,KAAK,UACL,QAAQ,OAAO,KAAK,OAAO;AAAA,QACjC,OAAO,KAAK;AAAA,MACd;AAAA,IACF;AAAA,IAEA,MAAM,QAAQ,MAAmC;AAC/C,YAAM,MAAM,IAAI,IAAI;AACpB,UAAI,CAAC,YAAY,GAAG,GAAG;AACrB,cAAM,IAAI,kBAAkB,IAAI;AAAA,MAClC;AAEA,YAAM,SAAS,QAAQ,KAAK,KAAK,GAAG,GAAG;AACvC,YAAM,UAAU,oBAAI,IAAsB;AAE1C,YAAM,UAAU,CAAC,UAAkB,SAAiC;AAClE,YAAI,CAAC,SAAS,WAAW,MAAM,GAAG;AAChC;AAAA,QACF;AACA,cAAM,OAAO,SAAS,MAAM,OAAO,MAAM;AACzC,YAAI,SAAS,IAAI;AACf;AAAA,QACF;AACA,cAAM,QAAQ,KAAK,QAAQ,GAAG;AAG9B,cAAM,OAAO,UAAU,KAAK,OAAO,KAAK,MAAM,GAAG,KAAK;AACtD,gBAAQ,IAAI,MAAM;AAAA,UAChB;AAAA,UACA,MAAM,UAAU,KAAK,OAAO;AAAA,QAC9B,CAAC;AAAA,MACH;AAEA,iBAAW,YAAY,MAAM,KAAK,GAAG;AACnC,gBAAQ,UAAU,MAAM;AAAA,MAC1B;AACA,iBAAW,WAAW,UAAU,KAAK,GAAG;AACtC,gBAAQ,SAAS,WAAW;AAAA,MAC9B;AAEA,aAAO,CAAC,GAAG,QAAQ,OAAO,CAAC;AAAA,IAC7B;AAAA,IAEA,MAAM,SAAS,MAA6C;AAC1D,YAAM,SAAS,IAAI,IAAI;AAEvB,YAAM,OAAO,MAAM,IAAI,MAAM;AAC7B,UAAI,MAAM;AACR,eAAO,EAAE,MAAM,QAAQ,OAAO,KAAK,MAAM;AAAA,MAC3C;AAEA,UAAI,YAAY,MAAM,GAAG;AACvB,eAAO;AAAA,UACL,MAAM;AAAA,UACN,OAAO,UAAU,IAAI,MAAM,KAAK,IAAI;AAAA,QACtC;AAAA,MACF;AAEA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,UACJ,MACA,SACmB;AACnB,YAAM,SAAS,IAAI,IAAI;AACvB,YAAM,OAAO,MAAM,QAAQ,OAAO;AAClC,WAAK,MAAM;AACX,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,OAAO,MAA6B;AACxC,YAAM,SAAS,IAAI,IAAI;AACvB,UAAI,CAAC,MAAM,OAAO,MAAM,GAAG;AACzB,cAAM,IAAI,kBAAkB,IAAI;AAAA,MAClC;AAGA,cAAQ,SAAS,MAAM,GAAG,IAAI,CAAC;AAC/B,WAAK,MAAM;AAAA,IACb;AAAA,IAEA,MAAM,OAAO,MAAc,IAA2B;AACpD,YAAM,UAAU,IAAI,IAAI;AACxB,YAAM,QAAQ,IAAI,EAAE;AAEpB,YAAM,OAAO,MAAM,IAAI,OAAO;AAC9B,UAAI,CAAC,MAAM;AACT,cAAM,IAAI,kBAAkB,IAAI;AAAA,MAClC;AAEA,YAAM,OAAO,OAAO;AACpB,cAAQ,SAAS,OAAO,GAAG,IAAI,CAAC;AAGhC,gBAAU,OAAO,KAAK;AACtB,cAAQ,SAAS,KAAK,GAAG,KAAK,KAAK;AACnC,YAAM,IAAI,OAAO,IAAI;AAErB,WAAK,OAAO;AACZ,WAAK,KAAK;AAAA,IACZ;AAAA,IAEA,MAAM,OAAO,MAA6B;AACxC,YAAM,SAAS,IAAI,IAAI;AACvB,UAAI,WAAW,IAAI;AACjB,gBAAQ,QAAQ,IAAI,CAAC;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACF;;;ACjSO,SAAS,gCAAuD;AACrE,MAAI,SAAwB;AAE5B,SAAO;AAAA,IACL,KAAK,MAAM,QAAQ,QAAQ,MAAM;AAAA,IACjC,KAAK,CAAC,UAAkB;AACtB,eAAS;AACT,aAAO,QAAQ,QAAQ;AAAA,IACzB;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/app.d.ts

@@ -1,14 +1,16 @@
-import { type Context, Hono } from "hono";
 import { type LocalEditorLabels } from "./config.js";
 import type { CommonLogger } from "./interfaces.js";
 import type { ChangeNotifier, EditorPreferencesPort, FileSystemPort } from "./ports.js";
 /**
  * The built SPA, however the platform happens to hold it.
  *
- * `serve` is handed the live Hono context rather than a path, because both
- * implementations are thin wrappers over something that already expects one —
- * `serveStatic` on Node, Cloudflare's assets binding in the Worker — and
- * synthesising a context for them is what breaks.
+ * `serve` is handed the request rather than the Hono context this app is holding
+ * when it calls: hono is bundled into the published package, so nothing that
+ * installs it can resolve a type naming `Context`. Which costs nothing here,
+ * because a request is already what the Worker's implementation wants —
+ * Cloudflare's assets binding takes one — and the Node implementation runs
+ * `serveStatic` in a Hono app of its own to get a real context rather than a
+ * synthesised one.
  */
 export interface AssetSource {
     /**
@@ -18,8 +20,26 @@ export interface AssetSource {
      */
     readDocument(): Promise<string | undefined>;
     /** The built asset the request is for, or `undefined` if there isn't one. */
-    serve(context: Context): Promise<Response | undefined>;
+    serve(request: Request): Promise<Response | undefined>;
 }
+/**
+ * A request handler, in the shape every listener the editor runs behind already
+ * wants: `serve` from `@hono/node-server` takes exactly this, and so does a
+ * Worker's `fetch` export.
+ *
+ * Stated structurally instead of as the `Hono` the app really is, for the same
+ * reason `AssetSource.serve` takes a request — hono is bundled, so it can't
+ * appear in the published types.
+ *
+ * The trailing arguments are the Worker's `env` and `ExecutionContext`, which
+ * Hono passes through to route handlers; nothing in this package reads them.
+ * They're `any[]` rather than `unknown[]` because parameters are checked
+ * contravariantly: the type has to accept Hono's own `fetch`, whose third
+ * parameter is a Cloudflare `ExecutionContext` and so cannot be handed an
+ * `unknown`. Here `any` is how you say "this type doesn't constrain these",
+ * which is the opposite of what `unknown` says in this position.
+ */
+export type EditorFetch = (request: Request, ...rest: any[]) => Response | Promise<Response>;
 export interface EditorAppOptions {
     /** The project the editor reads and writes. */
     fs: FileSystemPort;
@@ -48,10 +68,10 @@ export interface EditorAppOptions {
 }
 export interface EditorApp {
     /**
-     * The Hono app. Hand its `fetch` to whatever is listening — `@hono/node-server`
-     * on Node, the Worker's default export on Cloudflare.
+     * Hand this to whatever is listening — `@hono/node-server` on Node, the
+     * Worker's default export on Cloudflare.
      */
-    app: Hono;
+    fetch: EditorFetch;
     /** Releases SSE clients and stops listening for changes. */
     dispose: () => Promise<void>;
 }
@@ -64,4 +84,3 @@ export interface EditorApp {
  * routes rather than approximations of each other.
  */
 export declare function createEditorApp(options: EditorAppOptions): EditorApp;
-//# sourceMappingURL=app.d.ts.map

package/dist/app.js

@@ -1,116 +1,10 @@
-import { ApiError, HttpStatusCode } from "@zuplo/errors";
-import { Hono } from "hono";
-import { bodyLimit } from "hono/body-limit";
-import { cors } from "hono/cors";
-import { getLocalEditorConfig } from "./config.js";
-import { editorConfig } from "./constants.js";
-import { createErrorHandler, createNotFoundHandler } from "./error-handler.js";
-import { createApiRoutes } from "./routes/api.js";
-const staticFileExtensions = [".css", ".js", ".json", ".svg", ".png", ".ico"];
-/**
- * Builds the editor's HTTP app from injected platform capabilities.
- *
- * This is the whole server minus the platform: no listener, no filesystem, no
- * file watcher, no logger implementation. `LocalEditorServer` wraps it for Node
- * and the preview Worker wraps it for Cloudflare, so both run these exact
- * routes rather than approximations of each other.
- */
-export function createEditorApp(options) {
-    const { fs, preferences, assets, changes, logger, deploymentUrl, sourceDirectory, labels, } = options;
-    const app = new Hono();
-    const sseClients = new Set();
-    app.onError(createErrorHandler(logger));
-    app.notFound(createNotFoundHandler());
-    // Middleware only wraps routes registered after it, so this has to come
-    // before the routes below.
-    app.use(bodyLimit({
-        maxSize: editorConfig.server.bodyLimit,
-        onError: () => {
-            throw new ApiError({
-                type: "https://zup.fail/http-status/413",
-                title: "Payload Too Large",
-                status: HttpStatusCode.PAYLOAD_TOO_LARGE,
-                detail: `Request body exceeds the maximum size of ${editorConfig.server.bodyLimit} bytes`,
-            });
-        },
-    }));
-    app.use(cors({
-        origin: (origin) => origin ?? "*",
-        allowMethods: [
-            "GET",
-            "POST",
-            "PATCH",
-            "PUT",
-            "DELETE",
-            "OPTIONS",
-            "HEAD",
-        ],
-        allowHeaders: ["*"],
-        exposeHeaders: ["*"],
-    }));
-    app.route("/api", createApiRoutes({
-        fs,
-        editorPreferences: preferences,
-        sourceDirectory,
-        logger,
-        sseClients,
-        deploymentUrl,
-    }));
-    if (assets) {
-        app.on(["GET", "HEAD"], "*", async (c) => {
-            const isDocumentRequest = c.req.header("accept")?.includes("text/html") &&
-                !staticFileExtensions.some((ext) => c.req.path.endsWith(ext));
-            if (!isDocumentRequest) {
-                return ((await assets.serve(c)) ??
-                    // The asset source hands misses back rather than 404ing itself, so
-                    // they get the same problem+json every other miss does.
-                    c.notFound());
-            }
-            // Every navigation gets index.html — the SPA owns routing.
-            const template = await assets.readDocument();
-            if (!template) {
-                // No client build yet, which is normal in development: Vite is in front
-                // and this handler is never reached there.
-                return c.notFound();
-            }
-            const localEditorConfig = await getLocalEditorConfig({
-                deploymentUrl,
-                fs,
-                logger,
-                labels,
-            });
-            // Inject localEditorConfig into the HTML
-            const html = template.replace(`"{{localEditorConfig}}"`, // Note the quotes are correct
-            // A replacer function, so `$&` and friends in the JSON aren't treated
-            // as substitution patterns.
-            () => JSON.stringify(localEditorConfig));
-            return c.html(html);
-        });
-    }
-    const stopWatching = changes?.onChange((filePath) => {
-        // Broadcast to all SSE clients
-        const data = JSON.stringify({ type: "change", filePath });
-        for (const client of sseClients) {
-            client.send("change", data).catch((err) => {
-                logger.warn({ err }, "Error sending SSE change event");
-            });
-        }
-        logger.info(`File changed: ${filePath}`);
-    });
-    const dispose = async () => {
-        stopWatching?.();
-        for (const client of sseClients) {
-            try {
-                if (!client.closed) {
-                    await client.close();
-                }
-            }
-            catch (err) {
-                logger.warn({ err }, "Error closing SSE client");
-            }
-        }
-        sseClients.clear();
-    };
-    return { app, dispose };
-}
-//# sourceMappingURL=app.js.map
+import {
+  createEditorApp
+} from "./chunks/chunk-HDZMPWV2.js";
+import "./chunks/chunk-C7VL3DX7.js";
+import "./chunks/chunk-FELEIEAB.js";
+import "./chunks/chunk-54KOYG5C.js";
+export {
+  createEditorApp
+};
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -1 +1,7 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAA0B,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAO/E,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAmElD,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,MAAM,EACJ,EAAE,EACF,WAAW,EACX,MAAM,EACN,OAAO,EACP,MAAM,EACN,aAAa,EACb,eAAe,EACf,MAAM,GACP,GAAG,OAAO,CAAC;IAEZ,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAa,CAAC;IAExC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IACxC,GAAG,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAEtC,wEAAwE;IACxE,2BAA2B;IAC3B,GAAG,CAAC,GAAG,CACL,SAAS,CAAC;QACR,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,SAAS;QACtC,OAAO,EAAE,GAAG,EAAE;YACZ,MAAM,IAAI,QAAQ,CAAC;gBACjB,IAAI,EAAE,kCAAkC;gBACxC,KAAK,EAAE,mBAAmB;gBAC1B,MAAM,EAAE,cAAc,CAAC,iBAAiB;gBACxC,MAAM,EAAE,4CAA4C,YAAY,CAAC,MAAM,CAAC,SAAS,QAAQ;aAC1F,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CACH,CAAC;IACF,GAAG,CAAC,GAAG,CACL,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,GAAG;QACjC,YAAY,EAAE;YACZ,KAAK;YACL,MAAM;YACN,OAAO;YACP,KAAK;YACL,QAAQ;YACR,SAAS;YACT,MAAM;SACP;QACD,YAAY,EAAE,CAAC,GAAG,CAAC;QACnB,aAAa,EAAE,CAAC,GAAG,CAAC;KACrB,CAAC,CACH,CAAC;IAEF,GAAG,CAAC,KAAK,CACP,MAAM,EACN,eAAe,CAAC;QACd,EAAE;QACF,iBAAiB,EAAE,WAAW;QAC9B,eAAe;QACf,MAAM;QACN,UAAU;QACV,aAAa;KACd,CAAC,CACH,CAAC;IAEF,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACvC,MAAM,iBAAiB,GACrB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC;gBAC7C,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAEhE,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,OAAO,CACL,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBACvB,mEAAmE;oBACnE,wDAAwD;oBACxD,CAAC,CAAC,QAAQ,EAAE,CACb,CAAC;YACJ,CAAC;YAED,2DAA2D;YAC3D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;YAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,wEAAwE;gBACxE,2CAA2C;gBAC3C,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;YACtB,CAAC;YAED,MAAM,iBAAiB,GAAG,MAAM,oBAAoB,CAAC;gBACnD,aAAa;gBACb,EAAE;gBACF,MAAM;gBACN,MAAM;aACP,CAAC,CAAC;YAEH,yCAAyC;YACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAC3B,yBAAyB,EAAE,8BAA8B;YACzD,sEAAsE;YACtE,4BAA4B;YAC5B,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,CACxC,CAAC;YAEF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,EAAE;QAClD,+BAA+B;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1D,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACxC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,gCAAgC,CAAC,CAAC;YACzD,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;QACxC,YAAY,EAAE,EAAE,CAAC;QAEjB,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;oBACnB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBACvB,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,0BAA0B,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QACD,UAAU,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC,CAAC;IAEF,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC"}
+{
+  "version": 3,
+  "sources": [],
+  "sourcesContent": [],
+  "mappings": "",
+  "names": []
+}

package/dist/chunks/chunk-54KOYG5C.js

@@ -0,0 +1,10 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+export {
+  __export
+};
+//# sourceMappingURL=chunk-54KOYG5C.js.map

package/dist/chunks/chunk-54KOYG5C.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": [],
+  "sourcesContent": [],
+  "mappings": "",
+  "names": []
+}

package/dist/chunks/chunk-C7VL3DX7.js

@@ -0,0 +1,47 @@
+// src/constants.ts
+var editorConfig = {
+  /**
+   * Server configuration
+   */
+  server: {
+    /** Default port for the editor server */
+    port: 9100,
+    /** Default port for the local Zuplo gateway */
+    gatewayPort: 9e3,
+    /** Maximum request body size (100MB) */
+    bodyLimit: 100 * 1024 * 1024,
+    /** Default host for the server */
+    host: "localhost"
+  },
+  /**
+   * Server-Sent Events configuration
+   */
+  sse: {
+    /**
+     * Keep-alive interval in milliseconds (30 seconds)
+     * Prevents proxy/browser timeouts for long-lived connections
+     */
+    keepAliveInterval: 3e4
+  },
+  /**
+   * File operation configuration
+   */
+  file: {
+    /** Maximum file size for uploads (100MB) */
+    maxFileSize: 100 * 1024 * 1024,
+    /** Allowed directories for file operations */
+    allowedDirs: ["config", "modules", "schemas"]
+  },
+  /**
+   * File watching configuration
+   */
+  watch: {
+    /** Directories to watch for changes */
+    watchedDirs: ["config", "modules", "schemas"]
+  }
+};
+
+export {
+  editorConfig
+};
+//# sourceMappingURL=chunk-C7VL3DX7.js.map

package/dist/chunks/chunk-C7VL3DX7.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/constants.ts"],
+  "sourcesContent": ["/**\n * Configuration constants for the local editor server.\n * Centralizes all magic numbers and configuration values.\n */\nexport const editorConfig = {\n  /**\n   * Server configuration\n   */\n  server: {\n    /** Default port for the editor server */\n    port: 9100,\n    /** Default port for the local Zuplo gateway */\n    gatewayPort: 9000,\n    /** Maximum request body size (100MB) */\n    bodyLimit: 100 * 1024 * 1024,\n    /** Default host for the server */\n    host: \"localhost\",\n  },\n\n  /**\n   * Server-Sent Events configuration\n   */\n  sse: {\n    /**\n     * Keep-alive interval in milliseconds (30 seconds)\n     * Prevents proxy/browser timeouts for long-lived connections\n     */\n    keepAliveInterval: 30000,\n  },\n\n  /**\n   * File operation configuration\n   */\n  file: {\n    /** Maximum file size for uploads (100MB) */\n    maxFileSize: 100 * 1024 * 1024,\n\n    /** Allowed directories for file operations */\n    allowedDirs: [\"config\", \"modules\", \"schemas\"] as const,\n  },\n\n  /**\n   * File watching configuration\n   */\n  watch: {\n    /** Directories to watch for changes */\n    watchedDirs: [\"config\", \"modules\", \"schemas\"] as const,\n  },\n} as const;\n"],
+  "mappings": ";AAIO,IAAM,eAAe;AAAA;AAAA;AAAA;AAAA,EAI1B,QAAQ;AAAA;AAAA,IAEN,MAAM;AAAA;AAAA,IAEN,aAAa;AAAA;AAAA,IAEb,WAAW,MAAM,OAAO;AAAA;AAAA,IAExB,MAAM;AAAA,EACR;AAAA;AAAA;AAAA;AAAA,EAKA,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,IAKH,mBAAmB;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM;AAAA;AAAA,IAEJ,aAAa,MAAM,OAAO;AAAA;AAAA,IAG1B,aAAa,CAAC,UAAU,WAAW,SAAS;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO;AAAA;AAAA,IAEL,aAAa,CAAC,UAAU,WAAW,SAAS;AAAA,EAC9C;AACF;",
+  "names": []
+}

package/dist/chunks/chunk-FELEIEAB.js

@@ -0,0 +1,40 @@
+// src/ports.ts
+var UnsafePathError = class extends Error {
+  path;
+  constructor(path) {
+    super(`Path escapes the project directory: ${path}`);
+    this.name = "UnsafePathError";
+    this.path = path;
+  }
+};
+var PathNotFoundError = class extends Error {
+  path;
+  constructor(path) {
+    super(`Path not found: ${path}`);
+    this.name = "PathNotFoundError";
+    this.path = path;
+  }
+};
+function toSafeSegments(path) {
+  if (/^[a-zA-Z]:/.test(path) || path.startsWith("\\\\")) {
+    throw new UnsafePathError(path);
+  }
+  const segments = [];
+  for (const segment of path.split(/[/\\]+/)) {
+    if (segment === "" || segment === ".") {
+      continue;
+    }
+    if (segment === "..") {
+      throw new UnsafePathError(path);
+    }
+    segments.push(segment);
+  }
+  return segments;
+}
+
+export {
+  UnsafePathError,
+  PathNotFoundError,
+  toSafeSegments
+};
+//# sourceMappingURL=chunk-FELEIEAB.js.map

package/dist/chunks/chunk-FELEIEAB.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/ports.ts"],
+  "sourcesContent": ["/**\n * The platform capabilities the editor's routes need, stated in the routes' own\n * terms rather than as a subset of `node:fs`.\n *\n * Everything here is injected, so the same Hono app runs against a developer's\n * real project directory (the Zuplo CLI) and against an in-memory project (the\n * per-PR preview Worker). Keeping the seam this narrow is what stops the two\n * from drifting: a route can't reach for `node:fs` without adding a method\n * here, and the preview build fails when something does.\n */\n\n/**\n * A path that escaped the project root, e.g. `?path=../../../etc/passwd`.\n *\n * Rejecting traversal is the port's job rather than each route's, because a\n * route that forgets is a directory-traversal hole and there is no other\n * chokepoint every path passes through.\n */\nexport class UnsafePathError extends Error {\n  readonly path: string;\n\n  constructor(path: string) {\n    super(`Path escapes the project directory: ${path}`);\n    this.name = \"UnsafePathError\";\n    this.path = path;\n  }\n}\n\n/**\n * A path that doesn't exist.\n *\n * Routes branch on this instead of on `ENOENT`, so a miss reports identically\n * however the filesystem is implemented \u2014 the case an errno-shaped port gets\n * subtly wrong.\n */\nexport class PathNotFoundError extends Error {\n  readonly path: string;\n\n  constructor(path: string) {\n    super(`Path not found: ${path}`);\n    this.name = \"PathNotFoundError\";\n    this.path = path;\n  }\n}\n\nexport type PathType = \"file\" | \"directory\";\n\nexport interface DirEntry {\n  /** The entry's own name, not a path. */\n  name: string;\n  type: PathType;\n}\n\nexport interface PathStat {\n  type: PathType;\n  mtime: Date;\n}\n\nexport interface FileWithStat {\n  content: string;\n  /** The mtime of the content returned alongside it \u2014 see `readFileWithStat`. */\n  mtime: Date;\n}\n\n/**\n * A project directory the editor can read and write.\n *\n * Every path is relative to the project root and slash-separated\n * (`config/routes.oas.json`), with or without a leading slash. Implementations\n * reject paths that climb out of the root with `UnsafePathError`.\n */\nexport interface FileSystemPort {\n  /**\n   * Reads a file and the mtime describing *that* content, together.\n   *\n   * The pair has to be consistent: the portal saves the returned mtime as\n   * `Last-Modified` and sends it back as `If-Unmodified-Since` to detect\n   * clobbering, so a stat taken separately from the read can describe a\n   * different version of the file and produce phantom conflicts \u2014 or miss real\n   * ones. How that's achieved is the adapter's problem (Node holds a single\n   * file handle open across both).\n   *\n   * @throws PathNotFoundError when the file doesn't exist.\n   */\n  readFileWithStat(path: string): Promise<FileWithStat>;\n\n  /**\n   * Lists a directory's immediate children. Order is not significant.\n   *\n   * @throws PathNotFoundError when the directory doesn't exist.\n   */\n  listDir(path: string): Promise<DirEntry[]>;\n\n  /** Returns `undefined` when nothing exists at `path`. */\n  statPath(path: string): Promise<PathStat | undefined>;\n\n  /**\n   * Writes a file, creating any missing parent directories, and returns the\n   * stat it now has \u2014 the caller hands that mtime straight back to the client.\n   */\n  writeFile(path: string, content: string | Uint8Array): Promise<PathStat>;\n\n  /** @throws PathNotFoundError when `from` doesn't exist. */\n  rename(from: string, to: string): Promise<void>;\n\n  /** @throws PathNotFoundError when `path` doesn't exist. */\n  remove(path: string): Promise<void>;\n\n  /** Creates a directory and any missing parents. Succeeds if it exists. */\n  mkdirp(path: string): Promise<void>;\n}\n\n/**\n * Which external editor the user picked for \"open in editor\".\n *\n * Separate from `FileSystemPort` because this lives outside the project \u2014 an\n * XDG config file under the user's home directory on Node, and nowhere at all\n * in a Worker, which has no home directory to write to.\n */\nexport interface EditorPreferencesPort {\n  /** The saved editor id, or `null` if the user hasn't chosen one. */\n  get(): Promise<string | null>;\n  set(editor: string): Promise<void>;\n}\n\n/**\n * Tells the editor a file changed underneath it, so the SPA can reload it.\n *\n * On Node this is chokidar watching the project directory. In the preview it's\n * the in-memory filesystem reporting its own writes, which is what keeps the\n * SPA's live-reload path exercised there rather than dormant.\n */\nexport interface ChangeNotifier {\n  /**\n   * Registers `listener`, called with a project-relative path on each change.\n   * Returns a function that unsubscribes.\n   */\n  onChange(listener: (path: string) => void): () => void;\n}\n\n/**\n * Splits a project-relative path into its segments, rejecting anything that\n * climbs out of the project or isn't relative to begin with.\n *\n * Both adapters route every path through this, so traversal is refused once, at\n * the boundary, instead of relying on each route to remember.\n */\nexport function toSafeSegments(path: string): string[] {\n  // A Windows drive letter or a UNC path is absolute but survives POSIX\n  // normalization, so it has to be caught by shape rather than by segment.\n  if (/^[a-zA-Z]:/.test(path) || path.startsWith(\"\\\\\\\\\")) {\n    throw new UnsafePathError(path);\n  }\n\n  const segments: string[] = [];\n  // Backslashes are separators on Windows; treating them as ordinary characters\n  // would let `..\\..` through as a single innocuous-looking segment.\n  for (const segment of path.split(/[/\\\\]+/)) {\n    if (segment === \"\" || segment === \".\") {\n      continue;\n    }\n    if (segment === \"..\") {\n      // Refuse rather than resolve. `config/../modules` is legitimate but\n      // nothing the portal sends, and allowing it means the guard depends on\n      // segment order \u2014 every prefix would have to stay inside the root too.\n      throw new UnsafePathError(path);\n    }\n    segments.push(segment);\n  }\n\n  return segments;\n}\n"],
+  "mappings": ";AAkBO,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAChC;AAAA,EAET,YAAY,MAAc;AACxB,UAAM,uCAAuC,IAAI,EAAE;AACnD,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AASO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAClC;AAAA,EAET,YAAY,MAAc;AACxB,UAAM,mBAAmB,IAAI,EAAE;AAC/B,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAwGO,SAAS,eAAe,MAAwB;AAGrD,MAAI,aAAa,KAAK,IAAI,KAAK,KAAK,WAAW,MAAM,GAAG;AACtD,UAAM,IAAI,gBAAgB,IAAI;AAAA,EAChC;AAEA,QAAM,WAAqB,CAAC;AAG5B,aAAW,WAAW,KAAK,MAAM,QAAQ,GAAG;AAC1C,QAAI,YAAY,MAAM,YAAY,KAAK;AACrC;AAAA,IACF;AACA,QAAI,YAAY,MAAM;AAIpB,YAAM,IAAI,gBAAgB,IAAI;AAAA,IAChC;AACA,aAAS,KAAK,OAAO;AAAA,EACvB;AAEA,SAAO;AACT;",
+  "names": []
+}