castle-web-cli 0.4.113 → 0.4.115

package/dist/castleJson.d.ts

@@ -9,6 +9,7 @@ export interface CastleJson {
     deckId?: string;
     cardId?: string;
     imports?: Record<string, DeckImport>;
+    autoUpdateWhenImported?: boolean;
     [key: string]: unknown;
 }
 export declare function readCastleJson(dir: string): CastleJson | null;

package/dist/editorConfig.d.ts

@@ -0,0 +1,34 @@
+interface EditorPanelSpec {
+    type?: unknown;
+    file?: unknown;
+}
+interface EditorPanelGroup {
+    tabs?: unknown;
+}
+interface EditorPanelColumn {
+    column?: unknown;
+}
+export type InitialPanel = EditorPanelSpec | EditorPanelGroup | EditorPanelColumn;
+export interface FileTypeConfig {
+    ext: string;
+    label?: string;
+    new?: string;
+    icon?: string;
+    editor?: string;
+    data?: boolean;
+    unsupported?: string;
+}
+export interface ResolvedFileType extends FileTypeConfig {
+    from?: string;
+}
+export interface EditorConfig {
+    initialPanels?: InitialPanel[];
+    hiddenPaths?: string[];
+    visiblePaths?: string[];
+    fileTypes?: FileTypeConfig[];
+    extensions?: string[];
+    defaultPlayFile?: string;
+}
+export declare function readEditorConfig(deckDir: string): EditorConfig;
+export declare function resolveFileTypes(deckDir: string): ResolvedFileType[] | null;
+export {};

package/dist/editorConfig.js

@@ -0,0 +1,101 @@
+// A deck's `castle.json` `editor` block, and the resolution of the one part of
+// it that is not the deck's alone: its file types.
+//
+// A deck's vocabulary -- which extensions exist, what they are called, which
+// ones a kit editor opens, which ones are data -- is declared, never built in.
+// The declarations come from the deck itself AND from every deck it imports,
+// because a kit is just an imported deck: importing one is what gives a deck
+// scenes and drawings, so the import has to be able to say so. Imports are
+// flattened into one `imports/` dir at the deck root (a transitively-pulled kit
+// sits there like any other), so resolving is a read of each import's own
+// castle.json -- there is no graph to walk.
+//
+// Everything else in the block (`initialPanels`, `visiblePaths`/`hiddenPaths`,
+// `defaultPlayFile`) stays the deck's own, read from the deck root only.
+import * as fs from 'fs';
+import * as path from 'path';
+import { readCastleJson } from './castleJson.js';
+import { IMPORTS_DIR } from './imports.js';
+// An array with no usable entries stays an (empty) array rather than becoming
+// undefined: "I declare no file types" is a real answer, distinct from "I say
+// nothing about file types", and only the second one defers to the imports.
+function asFileTypes(value) {
+    if (!Array.isArray(value))
+        return undefined;
+    return value.filter((e) => Boolean(e) && typeof e === 'object' && typeof e.ext === 'string');
+}
+function asStringArray(value) {
+    if (Array.isArray(value) && value.every((e) => typeof e === 'string')) {
+        return value;
+    }
+    return undefined;
+}
+// Read one deck's `castle.json` `editor` block. Tolerates an absent /
+// unparseable file (returns {}). Folds the legacy top-level `editorExtensions`
+// into `editor.extensions` for decks saved before the `editor` block existed.
+export function readEditorConfig(deckDir) {
+    let data;
+    try {
+        data = JSON.parse(fs.readFileSync(path.join(deckDir, 'castle.json'), 'utf8'));
+    }
+    catch {
+        return {};
+    }
+    const editor = data.editor ?? {};
+    return {
+        initialPanels: Array.isArray(editor.initialPanels) ? editor.initialPanels : undefined,
+        hiddenPaths: asStringArray(editor.hiddenPaths),
+        visiblePaths: asStringArray(editor.visiblePaths),
+        fileTypes: asFileTypes(editor.fileTypes),
+        extensions: asStringArray(editor.extensions) ?? asStringArray(data.editorExtensions),
+        defaultPlayFile: typeof editor.defaultPlayFile === 'string' ? editor.defaultPlayFile : undefined,
+    };
+}
+// The deck's imports, in the order the deck pinned them (its castle.json
+// `imports` map), then anything on disk that isn't pinned. Pin order puts an
+// import the deck asked for ahead of one that came in behind it, which is the
+// order the deck itself would expect to be read in.
+function importAliases(deckDir) {
+    let onDisk;
+    try {
+        onDisk = fs
+            .readdirSync(path.join(deckDir, IMPORTS_DIR), { withFileTypes: true })
+            .filter((entry) => entry.isDirectory())
+            .map((entry) => entry.name)
+            .sort();
+    }
+    catch {
+        return [];
+    }
+    const pinned = Object.keys(readCastleJson(deckDir)?.imports ?? {}).filter((alias) => onDisk.includes(alias));
+    return [...pinned, ...onDisk.filter((alias) => !pinned.includes(alias))];
+}
+// Every file type this deck understands: its own, plus every import's. Keyed by
+// extension, first declaration wins -- so the deck overrides what it imports,
+// and among imports the one it pinned first does (the same order
+// syncImportDependencies merges dependencies in).
+//
+// Returns null when NOTHING anywhere declares file types, which is a different
+// answer from an empty list: a deck that declares none has none, while a deck
+// that says nothing is one written before file types existed, and callers with a
+// legacy fallback use it only for that one.
+export function resolveFileTypes(deckDir) {
+    const byExt = new Map();
+    let anyDeclared = false;
+    const add = (types, from) => {
+        anyDeclared = true;
+        for (const type of types) {
+            if (!byExt.has(type.ext))
+                byExt.set(type.ext, from ? { ...type, from } : { ...type });
+        }
+    };
+    const own = readEditorConfig(deckDir).fileTypes;
+    if (own)
+        add(own);
+    for (const alias of importAliases(deckDir)) {
+        const imported = readEditorConfig(path.join(deckDir, IMPORTS_DIR, alias)).fileTypes;
+        if (imported)
+            add(imported, alias);
+    }
+    return anyDeclared ? [...byExt.values()] : null;
+}

package/dist/ide.js

@@ -15,6 +15,8 @@ import headlessPkg from "@xterm/headless";
 import { SerializeAddon } from "@xterm/addon-serialize";
 import { WebSocketServer } from "ws";
 import { IMPORTS_DIR, importStatuses, updateImport } from "./imports.js";
+import { readEditorConfig, resolveFileTypes, } from "./editorConfig.js";
+import { UNSUPPORTED_MEDIA } from "./unsupportedMedia.js";
 import { IMPORT_API_PREFIX, handleImportApi } from "./importBrowse.js";
 import { readRequestBody, sendJson } from "./httpJson.js";
 import { envForUserShell, installCliShims } from "./byo-auth.js";
@@ -100,38 +102,34 @@ export const FILES_API_PREFIX = "/__castle/files/";
 // Directories never surfaced in the file list / never read or written through
 // the builtin editor: VCS, deck-private state, and dependency trees.
 const FILES_IGNORE_DIRS = new Set([".git", ".castle", "node_modules", "dist"]);
-// Fallback set of kit-owned rich-editor extensions: the known castle rich
-// content types across kit variants (.pxart in basic-2d, .drawing in older
-// kits). Only used when a kit is present but its getFileKind couldn't be parsed.
-// The builtin code editor renders everything else (and everything on a kitless
-// deck). Kept here -- one place -- rather than baked into the shell, so a future
-// kit manifest can supply it without a shell change.
-const FALLBACK_KIT_EDITOR_EXTS = [".scene", ".pxart", ".drawing"];
-// Extensions that are always code/text, even if a kit's getFileKind mentions
-// them -- these get the builtin editor, never a rich kit editor.
-const CODE_TEXT_KINDS = new Set(["code", "text"]);
-// Parse the kit's `engine/files.js` getFileKind for extensions it maps to a
-// rich (non code/text) kind -- the authoritative, per-deck source of which
-// files the kit owns an editor for. Returns null if the file is absent so the
-// caller can fall back. Matches lines like:
-//   if (path.endsWith('.scene')) return 'scene';
-function parseKitEditorExtensions(deckDir) {
-    let src;
-    try {
-        src = fs.readFileSync(path.join(deckDir, "engine", "files.js"), "utf8");
-    }
-    catch {
-        return null;
-    }
-    const exts = [];
-    const re = /endsWith\(\s*['"](\.[^'"]+)['"]\s*\)\s*\)\s*return\s*['"]([^'"]+)['"]/g;
-    for (let m = re.exec(src); m; m = re.exec(src)) {
-        const [, ext, kind] = m;
-        if (!CODE_TEXT_KINDS.has(kind) && !exts.includes(ext))
-            exts.push(ext);
-    }
-    return exts;
-}
+// Ceiling on one uploaded file. A deck is saved whole (source tar + bundle), so
+// a huge asset is a problem for the deck long before it is a problem here --
+// refuse it at the door with a message rather than let it land and break `save`.
+const MAX_UPLOAD_BYTES = 32 * 1024 * 1024;
+// Content types for `files/raw`, which serves a deck file as bytes (the shell's
+// image/audio viewers read their file through it rather than through `read`,
+// which is text-only). Anything unlisted is served as opaque bytes -- a viewer
+// that asked for it knows what it is.
+const RAW_MIME = {
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".webp": "image/webp",
+    ".avif": "image/avif",
+    ".bmp": "image/bmp",
+    ".svg": "image/svg+xml",
+    ".mp3": "audio/mpeg",
+    ".wav": "audio/wav",
+    ".ogg": "audio/ogg",
+    ".m4a": "audio/mp4",
+    ".aac": "audio/aac",
+    ".flac": "audio/flac",
+    ".webm": "video/webm",
+    ".mp4": "video/mp4",
+    ".m4v": "video/x-m4v",
+    ".mov": "video/quicktime",
+};
 // Files under `imports/` came from another deck. They are readable like any
 // other deck file -- the engine, editors and pickers all reference them -- but a
 // deck can't edit them, because editing one would mean editing somebody else's
@@ -204,86 +202,16 @@ function listDeckFiles(deckDir) {
     out.sort((a, b) => a.localeCompare(b));
     return out;
 }
-function asFileTypes(value) {
-    if (!Array.isArray(value))
-        return undefined;
-    const out = value.filter((e) => Boolean(e) && typeof e === "object" && typeof e.ext === "string");
-    return out.length > 0 ? out : undefined;
-}
-function asStringArray(value) {
-    if (Array.isArray(value) && value.every((e) => typeof e === "string")) {
-        return value;
-    }
-    return undefined;
-}
-// Read the deck's `castle.json` `editor` block. Tolerates an absent /
-// unparseable file (returns {}). Folds the legacy top-level `editorExtensions`
-// into `editor.extensions` for decks saved before the `editor` block existed.
-function readEditorConfig(deckDir) {
-    let data;
-    try {
-        data = JSON.parse(fs.readFileSync(path.join(deckDir, "castle.json"), "utf8"));
-    }
-    catch {
-        return {};
-    }
-    const editor = data.editor ?? {};
-    const config = {
-        initialPanels: Array.isArray(editor.initialPanels)
-            ? editor.initialPanels
-            : undefined,
-        hiddenPaths: asStringArray(editor.hiddenPaths),
-        visiblePaths: asStringArray(editor.visiblePaths),
-        fileTypes: asFileTypes(editor.fileTypes),
-        extensions: asStringArray(editor.extensions) ?? asStringArray(data.editorExtensions),
-        defaultPlayFile: typeof editor.defaultPlayFile === "string" ? editor.defaultPlayFile : undefined,
-    };
-    return config;
-}
-// Extensions the kit owns a rich editor for. A kitless (bare) deck has no kit
-// entry, so this is empty and the builtin editor renders everything. A deck may
-// override the default list via `castle.json` `editor.extensions`.
-// Where the kit lives for this deck: the deck itself when it holds the kit's
-// files, else the import that provides one. A deck built on an imported kit has
-// no `main.jsx` of its own -- its entry point is the kit's, at
-// `imports/<alias>/main.jsx` -- so looking only in the deck root would read as
-// "no kit" and hand every .scene / .pxart to the builtin text editor.
-function findKitRoot(deckDir) {
-    if (fs.existsSync(path.join(deckDir, "main.jsx")))
-        return deckDir;
-    const importsDir = path.join(deckDir, IMPORTS_DIR);
-    let aliases;
-    try {
-        aliases = fs.readdirSync(importsDir);
-    }
-    catch {
-        return null;
+// Extensions a kit owns a rich editor for, from the deck's resolved file types
+// -- which say outright which extensions get a kit editor, and which kit
+// declared each one. A deck that declares none and imports none has no kit
+// editors, and the builtin code editor renders everything.
+function kitEditorExtensions(config, fileTypes) {
+    if (fileTypes) {
+        return fileTypes.filter((t) => t.editor === "kit").map((t) => t.ext);
     }
-    for (const alias of aliases.sort()) {
-        const root = path.join(importsDir, alias);
-        if (fs.existsSync(path.join(root, "main.jsx")))
-            return root;
-    }
-    return null;
-}
-function kitEditorExtensions(deckDir) {
-    const config = readEditorConfig(deckDir);
-    // Declared file types win: they say outright which extensions the kit edits.
-    if (config.fileTypes) {
-        return config.fileTypes.filter((t) => t.editor === "kit").map((t) => t.ext);
-    }
-    const configured = config.extensions;
-    if (configured)
-        return configured;
-    const kitRoot = findKitRoot(deckDir);
-    if (!kitRoot)
-        return [];
-    // Prefer the kit's own getFileKind (authoritative per deck); fall back to the
-    // known rich content types if it couldn't be read/parsed.
-    const parsed = parseKitEditorExtensions(kitRoot);
-    if (parsed && parsed.length > 0)
-        return parsed;
-    return FALLBACK_KIT_EDITOR_EXTS;
+    // A deck saved before file types existed named its kit extensions directly.
+    return config.extensions ?? [];
 }
 // Apply the deck's `editor.hiddenPaths` / `editor.visiblePaths` globs to a file
 // list (deck-relative POSIX paths). Only hidden -> drop matches; only visible ->
@@ -325,6 +253,30 @@ function filterImportedFiles(deckDir, imported) {
     }
     return out;
 }
+// Read a raw (binary) request body, refusing anything over `limit`. Uploads are
+// arbitrary device files, so the cap is enforced as bytes arrive rather than
+// after buffering the whole thing.
+function readRequestBuffer(req, limit) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        let over = false;
+        req.on("data", (c) => {
+            size += c.length;
+            // Past the cap, keep draining but stop KEEPING the bytes. Destroying the
+            // request here would reset the connection and the client would see a
+            // network failure instead of the reason it was refused.
+            if (size > limit) {
+                over = true;
+                chunks.length = 0;
+                return;
+            }
+            chunks.push(c);
+        });
+        req.on("end", () => over ? reject(new RangeError("too large")) : resolve(Buffer.concat(chunks)));
+        req.on("error", reject);
+    });
+}
 function withJsonBody(req, res, handler) {
     void (async () => {
         let body;
@@ -367,11 +319,16 @@ function handleFilesWrite(deckDir, req, res) {
     });
 }
 // Add `<rel>/**` to the deck's editor.visiblePaths so files created in a
-// newly-made folder show in the curated Files tree. Only touches a deck that is
+// newly-made folder show in the curated Files tree.
+function ensureVisiblePath(deckDir, rel) {
+    return ensureVisibleGlob(deckDir, `${rel}/**`, `${rel}/__probe__`);
+}
+// Add `glob` to the deck's editor.visiblePaths. Only touches a deck that is
 // ALREADY curated (non-empty visiblePaths) -- when visiblePaths is empty
 // everything is visible, and adding a glob would wrongly start hiding things.
-// No-op if an existing glob already covers the folder. Returns whether it wrote.
-function ensureVisiblePath(deckDir, rel) {
+// No-op if an existing glob already covers `probe`, a path the new glob would
+// match. Returns whether it wrote.
+function ensureVisibleGlob(deckDir, glob, probe) {
     const file = path.join(deckDir, "castle.json");
     let data;
     try {
@@ -385,10 +342,9 @@ function ensureVisiblePath(deckDir, rel) {
         : null;
     if (!visible || visible.length === 0)
         return false; // not curated -> all visible
-    const glob = `${rel}/**`;
     if (visible.includes(glob))
         return false;
-    if (picomatch(visible)(`${rel}/__probe__`))
+    if (picomatch(visible)(probe))
         return false; // already covered
     visible.push(glob);
     data.editor.visiblePaths = visible;
@@ -412,6 +368,142 @@ function handleFilesMkdir(deckDir, req, res) {
         sendJson(res, 200, { ok: true, path: target.rel, visiblePathAdded });
     });
 }
+// Upload one file from the user's device: `POST files/upload?path=<rel>` with
+// the file's bytes as the whole body (no multipart -- the client sends one
+// request per file, so the path is all the metadata there is to carry). Refuses
+// to clobber: the client picks a free name first and a collision here means
+// something else took it in between.
+//
+// A curated deck (non-empty visiblePaths) also gets the destination registered,
+// the same way mkdir does -- otherwise an upload lands on disk and is invisible
+// in the very panel that put it there.
+function handleFilesUpload(deckDir, req, res) {
+    const url = new URL(req.url ?? "/", "http://localhost");
+    const target = resolveDeckPath(deckDir, url.searchParams.get("path"), {
+        mutation: true,
+    });
+    if (!target.ok)
+        return sendJson(res, 400, { error: target.error });
+    const tooBig = () => {
+        const mb = Math.round(MAX_UPLOAD_BYTES / (1024 * 1024));
+        sendJson(res, 413, {
+            error: `${path.posix.basename(target.rel)} is larger than ${mb} MB.`,
+        });
+    };
+    // An oversized body is drained and refused at its END, not the moment the cap
+    // is crossed: answering mid-upload closes the connection under a client that
+    // is still writing, and it sees a network error instead of the reason.
+    void readRequestBuffer(req, MAX_UPLOAD_BYTES).then((bytes) => {
+        if (fs.existsSync(target.abs)) {
+            return sendJson(res, 409, { error: `Already exists: ${target.rel}` });
+        }
+        try {
+            fs.mkdirSync(path.dirname(target.abs), { recursive: true });
+            fs.writeFileSync(target.abs, bytes);
+        }
+        catch (err) {
+            return sendFailure(res, "upload", target.rel, err);
+        }
+        const dir = path.posix.dirname(target.rel);
+        const visiblePathAdded = dir === "."
+            ? ensureVisibleGlob(deckDir, target.rel, target.rel)
+            : ensureVisiblePath(deckDir, dir);
+        sendJson(res, 200, { ok: true, path: target.rel, visiblePathAdded });
+    }, (err) => {
+        if (err instanceof RangeError)
+            return tooBig();
+        sendFailure(res, "upload", target.rel, err);
+    });
+}
+// Serve a deck file as bytes. `read` returns UTF-8 text in JSON, which mangles
+// anything binary; the shell's image/audio viewers read through this instead.
+function handleFilesRaw(deckDir, req, res) {
+    const url = new URL(req.url ?? "/", "http://localhost");
+    const resolved = resolveDeckPath(deckDir, url.searchParams.get("path"));
+    if (!resolved.ok)
+        return sendJson(res, 400, { error: resolved.error });
+    let stat;
+    try {
+        stat = fs.statSync(resolved.abs);
+    }
+    catch {
+        return sendJson(res, 404, { error: `Not found: ${resolved.rel}` });
+    }
+    if (!stat.isFile()) {
+        return sendJson(res, 404, { error: `Not a file: ${resolved.rel}` });
+    }
+    const headers = {
+        "content-type": RAW_MIME[path.extname(resolved.abs).toLowerCase()] ??
+            "application/octet-stream",
+        "cache-control": "no-store",
+        // Seeking an <audio>/<video> is a range request; without this the browser
+        // won't scrub (it re-requests from 0 and the playhead snaps back).
+        "accept-ranges": "bytes",
+    };
+    const range = parseByteRange(req.headers.range, stat.size);
+    if (range === "unsatisfiable") {
+        res.writeHead(416, { "content-range": `bytes */${stat.size}` }).end();
+        return;
+    }
+    if (!range) {
+        res.writeHead(200, { ...headers, "content-length": String(stat.size) });
+        fs.createReadStream(resolved.abs).pipe(res);
+        return;
+    }
+    res.writeHead(206, {
+        ...headers,
+        "content-length": String(range.end - range.start + 1),
+        "content-range": `bytes ${range.start}-${range.end}/${stat.size}`,
+    });
+    fs.createReadStream(resolved.abs, { start: range.start, end: range.end }).pipe(res);
+}
+// A single `Range: bytes=<start>-<end>` (the only form a media element sends).
+// null = serve the whole file; 'unsatisfiable' = a range past the end.
+function parseByteRange(header, size) {
+    const match = /^bytes=(\d*)-(\d*)$/.exec((header ?? "").trim());
+    if (!match || size === 0)
+        return null;
+    const [, rawStart, rawEnd] = match;
+    if (rawStart === "" && rawEnd === "")
+        return null;
+    // `bytes=-N`: the last N bytes.
+    const start = rawStart === "" ? Math.max(0, size - Number(rawEnd)) : Number(rawStart);
+    const end = rawStart === "" || rawEnd === "" ? size - 1 : Math.min(Number(rawEnd), size - 1);
+    if (!Number.isFinite(start) || start > end || start >= size)
+        return "unsatisfiable";
+    return { start, end };
+}
+// A NUL byte near the start is the practical test for "not text": no text file
+// a deck holds has one, and every binary format this is likely to meet does.
+function isBinary(bytes) {
+    return bytes.subarray(0, 8192).includes(0);
+}
+// Copy a file byte-for-byte. The Files panel's Duplicate goes through this
+// rather than read-then-write, which would corrupt anything binary.
+function handleFilesCopy(deckDir, req, res) {
+    withJsonBody(req, res, (body) => {
+        const from = resolveDeckPath(deckDir, body.from);
+        if (!from.ok)
+            return sendJson(res, 400, { error: from.error });
+        const to = resolveDeckPath(deckDir, body.to, { mutation: true });
+        if (!to.ok)
+            return sendJson(res, 400, { error: to.error });
+        if (!fs.existsSync(from.abs)) {
+            return sendJson(res, 404, { error: `Not found: ${from.rel}` });
+        }
+        if (fs.existsSync(to.abs)) {
+            return sendJson(res, 409, { error: `Already exists: ${to.rel}` });
+        }
+        try {
+            fs.mkdirSync(path.dirname(to.abs), { recursive: true });
+            fs.copyFileSync(from.abs, to.abs);
+            sendJson(res, 200, { ok: true, path: to.rel });
+        }
+        catch (err) {
+            sendFailure(res, "copy", from.rel, err);
+        }
+    });
+}
 // True when two paths resolve to the same underlying file (same inode+device) --
 // e.g. the source and target of a case-only rename on a case-insensitive FS.
 function isSameFile(a, b) {
@@ -475,15 +567,23 @@ function handleFilesApi(deckDir, req, res, reqPath) {
     const action = reqPath.slice(FILES_API_PREFIX.length);
     if (action === "info") {
         const config = readEditorConfig(deckDir);
+        // File types come from the deck AND its imports (a kit is an imported deck,
+        // so importing one is what gives a deck scenes and drawings); everything
+        // else in the block is the deck's own.
+        const fileTypes = resolveFileTypes(deckDir);
         sendJson(res, 200, {
             // Stable per-deck id for client-side layout persistence (localStorage key).
             deckId: path.resolve(deckDir),
-            kitEditorExtensions: kitEditorExtensions(deckDir),
-            fileTypes: config.fileTypes ?? null,
+            kitEditorExtensions: kitEditorExtensions(config, fileTypes),
+            fileTypes,
             defaultPlayFile: config.defaultPlayFile ?? null,
             initialPanels: config.initialPanels ?? null,
             hiddenPaths: config.hiddenPaths ?? [],
             visiblePaths: config.visiblePaths ?? [],
+            // Formats the platform knows won't survive publishing. Sent alongside the
+            // deck's own types rather than merged into them: these are not things the
+            // deck understands, they are things this CLI refuses to let it ship.
+            unsupportedMedia: UNSUPPORTED_MEDIA,
         });
         return true;
     }
@@ -549,14 +649,31 @@ function handleFilesApi(deckDir, req, res, reqPath) {
         if (!resolved.ok)
             return (sendJson(res, 400, { error: resolved.error }), true);
         try {
-            const contents = fs.readFileSync(resolved.abs, "utf8");
-            sendJson(res, 200, { path: resolved.rel, contents });
+            const bytes = fs.readFileSync(resolved.abs);
+            // Binary files (an uploaded image, a sound) come back EMPTY and flagged.
+            // Decoding one as UTF-8 mangles it, and the code editor saves what it
+            // holds -- opening a .png would quietly destroy it on the first keystroke.
+            if (isBinary(bytes)) {
+                sendJson(res, 200, {
+                    path: resolved.rel,
+                    contents: "",
+                    binary: true,
+                    size: bytes.length,
+                });
+            }
+            else {
+                sendJson(res, 200, { path: resolved.rel, contents: bytes.toString("utf8") });
+            }
         }
         catch {
             sendJson(res, 404, { error: `Not found: ${resolved.rel}` });
         }
         return true;
     }
+    if (action === "copy") {
+        handleFilesCopy(deckDir, req, res);
+        return true;
+    }
     if (action === "write") {
         handleFilesWrite(deckDir, req, res);
         return true;
@@ -573,6 +690,14 @@ function handleFilesApi(deckDir, req, res, reqPath) {
         handleFilesMkdir(deckDir, req, res);
         return true;
     }
+    if (action === "upload") {
+        handleFilesUpload(deckDir, req, res);
+        return true;
+    }
+    if (action === "raw") {
+        handleFilesRaw(deckDir, req, res);
+        return true;
+    }
     return (sendJson(res, 404, { error: `Unknown files action: ${action}` }),
         true);
 }

package/dist/imports.d.ts

@@ -35,6 +35,12 @@ export declare function addImport(dir: string, options?: {
     deckRef?: string;
     alias?: string;
 }): Promise<void>;
+export interface AutoUpdatedImport {
+    alias: string;
+    from: string;
+    to: string;
+}
+export declare function autoUpdateImports(deckDir: string): Promise<AutoUpdatedImport[]>;
 export declare function updateImport(dir: string, options?: {
     alias?: string;
     check?: boolean;