codebase-onboarder 0.5.0 → 0.7.0

package/public/js/api.js

@@ -1,228 +1,237 @@
 // Server round-trips. Thin and honest: JSON in, JSON (or an SSE stream) out,
 // server error messages surfaced untouched.
-
 // Browser access is an HttpOnly session cookie set by the themed self-hosted
 // login page. Same-origin fetches include it automatically, and JavaScript never
 // reads or stores the access key. API clients can still use `Authorization:
 // Bearer …`; local mode needs no credential at all.
-
 // 0.3.0 briefly stored a raw self-hosted key here. Remove that legacy value on
 // first load so upgrading also removes the old secret rather than merely ignoring it.
-try { localStorage.removeItem('onboarder.accessKey'); } catch { /* storage may be unavailable */ }
-
-async function postJSON(url, body) {
-  const res = await fetch(url, {
-    method: 'POST',
-    headers: { 'content-type': 'application/json' },
-    body: JSON.stringify(body),
-  });
-  let data = null;
-  try {
-    data = await res.json();
-  } catch {
-    /* error path handled below with a generic message */
-  }
-  if (!res.ok) {
-    throw new Error(data?.error || `The server said ${res.status}.`);
-  }
-  return data;
-}
-
-export function scanOnServer(payload) {
-  return postJSON('/api/scan', payload);
-}
-
+try {
+    localStorage.removeItem('onboarder.accessKey');
+}
+catch { /* storage may be unavailable */ }
+async function postJSON(url, body, options = {}) {
+    const res = await fetch(url, {
+        method: 'POST',
+        signal: options.signal,
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(body),
+    });
+    let data = null;
+    try {
+        data = await res.json();
+    }
+    catch {
+        /* error path handled below with a generic message */
+    }
+    if (!res.ok) {
+        throw new Error(data?.error || `The server said ${res.status}.`);
+    }
+    return data;
+}
+export function scanOnServer(payload, options = {}) {
+    return postJSON('/api/scan', payload, options);
+}
 export async function cleanupClone(cloneId) {
-  try {
-    await fetch('/api/scan/' + encodeURIComponent(cloneId), { method: 'DELETE' });
-  } catch {
-    /* best-effort: the temp dir expires on its own eventually */
-  }
+    try {
+        await fetch('/api/scan/' + encodeURIComponent(cloneId), { method: 'DELETE' });
+    }
+    catch {
+        /* best-effort: the temp dir expires on its own eventually */
+    }
 }
-
 export async function fetchFileText(scanId, path) {
-  const res = await fetch('/api/file?scan=' + encodeURIComponent(scanId) + '&path=' + encodeURIComponent(path));
-  if (!res.ok) throw new Error('Could not read that file from the server.');
-  return res.text();
+    const res = await fetch('/api/file?scan=' + encodeURIComponent(scanId) + '&path=' + encodeURIComponent(path));
+    if (!res.ok)
+        throw new Error('Could not read that file from the server.');
+    return res.text();
 }
-
 // Which deep analyzers this machine can run, and how. Server-side scans only —
 // a browser-picked folder has no scan id and no server-visible root to point a
 // tool at, and this returns that honestly instead of pretending.
 export async function fetchToolsStatus() {
-  try {
-    const res = await fetch('/api/tools');
-    if (!res.ok) return null;
-    const data = await res.json();
-    return data && data.tools ? data.tools : null;
-  } catch {
-    return null; // an unreachable server is just "no deep analysis here"
-  }
-}
-
+    try {
+        const res = await fetch('/api/tools');
+        if (!res.ok)
+            return null;
+        const data = await res.json();
+        return data && data.tools ? data.tools : null;
+    }
+    catch {
+        return null; // an unreachable server is just "no deep analysis here"
+    }
+}
 // Run the available analyzers against a live scan. `kinds`/`tools` narrow which
 // engines run; `options` carries the per-engine GUI settings, validated against
 // the registry schema on the server. The report normalizes every finding into
 // the shape the security view already draws, plus a per-engine pass list so
 // the UI can say which tool answered and which are missing.
 export function runAnalysisTools(scanId, options = {}) {
-  return postJSON('/api/tools/run', {
-    scanId,
-    kinds: options.kinds || undefined,
-    tools: options.tools || undefined,
-    options: options.options || undefined,
-  });
-}
-
+    return postJSON('/api/tools/run', {
+        scanId,
+        kinds: options.kinds || undefined,
+        tools: options.tools || undefined,
+        options: options.options || undefined,
+    });
+}
 // Install a missing engine, streaming progress events. The server emits SSE
 // frames shaped like the explain stream, minus the OpenAI envelope:
 //   { type: 'log', line } / { type: 'plan', label } / { type: 'done', ok, … }
 // `onEvent` gets each one as it arrives; the promise resolves with the final
 // `done` event (or throws if the request itself failed).
 export async function streamToolInstall(tool, onEvent) {
-  const emit = typeof onEvent === 'function' ? onEvent : () => {};
-  const res = await fetch('/api/tools/install', {
-    method: 'POST',
-    headers: { 'content-type': 'application/json' },
-    body: JSON.stringify({ tool }),
-  });
-  if (!res.ok || !res.body) {
-    let detail = '';
-    try { detail = (await res.json()).error || ''; } catch { /* generic below */ }
-    throw new Error(detail || `The server said ${res.status}.`);
-  }
-
-  const reader = res.body.getReader();
-  const decoder = new TextDecoder();
-  let buffer = '';
-  let done = null;
-  while (true) {
-    const { done: ended, value } = await reader.read();
-    if (ended) break;
-    buffer += decoder.decode(value, { stream: true });
-    const frames = buffer.split('\n\n');
-    buffer = frames.pop();
-    for (const frame of frames) {
-      for (const line of frame.split('\n')) {
-        if (!line.startsWith('data:')) continue;
+    const emit = typeof onEvent === 'function' ? onEvent : (..._args) => { };
+    const res = await fetch('/api/tools/install', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ tool }),
+    });
+    if (!res.ok || !res.body) {
+        let detail = '';
         try {
-          const event = JSON.parse(line.slice(5).trim());
-          emit(event);
-          if (event.type === 'done') done = event;
-        } catch { /* a partial frame — the next chunk completes it */ }
-      }
+            detail = (await res.json()).error || '';
+        }
+        catch { /* generic below */ }
+        throw new Error(detail || `The server said ${res.status}.`);
     }
-  }
-  return done || { type: 'done', ok: false, error: 'The install stream ended without a verdict.' };
+    const reader = res.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = '';
+    let done = null;
+    while (true) {
+        const { done: ended, value } = await reader.read();
+        if (ended)
+            break;
+        buffer += decoder.decode(value, { stream: true });
+        const frames = buffer.split('\n\n');
+        buffer = frames.pop();
+        for (const frame of frames) {
+            for (const line of frame.split('\n')) {
+                if (!line.startsWith('data:'))
+                    continue;
+                try {
+                    const event = JSON.parse(line.slice(5).trim());
+                    emit(event);
+                    if (event.type === 'done')
+                        done = event;
+                }
+                catch { /* a partial frame — the next chunk completes it */ }
+            }
+        }
+    }
+    return done || { type: 'done', ok: false, error: 'The install stream ended without a verdict.' };
 }
-
 // The MCP button's three round-trips. The status one is a plain GET like
 // `/api/tools`; start and stop are POSTs because each one changes a process on
 // this machine, which is exactly the side effect `postJSON` is here for.
 export async function fetchMcpStatus() {
-  try {
-    const res = await fetch('/api/mcp');
-    if (!res.ok) return null;
-    return await res.json();
-  } catch {
-    return null; // no server means no button state, not an error to shout about
-  }
-}
-
+    try {
+        const res = await fetch('/api/mcp');
+        if (!res.ok)
+            return null;
+        return await res.json();
+    }
+    catch {
+        return null; // no server means no button state, not an error to shout about
+    }
+}
 export function startMcpServer() {
-  return postJSON('/api/mcp/start', {});
+    return postJSON('/api/mcp/start', {});
 }
-
 export function stopMcpServer() {
-  return postJSON('/api/mcp/stop', {});
+    return postJSON('/api/mcp/stop', {});
 }
-
 // The command an agent harness is configured with. Kept separate from the status
 // fetch because it never changes, so it is read once when the panel opens rather
 // than on every poll.
 export async function fetchMcpCommand() {
-  try {
-    const res = await fetch('/api/mcp/command');
-    if (!res.ok) return null;
-    return await res.json();
-  } catch {
-    return null;
-  }
-}
-
+    try {
+        const res = await fetch('/api/mcp/command');
+        if (!res.ok)
+            return null;
+        return await res.json();
+    }
+    catch {
+        return null;
+    }
+}
 // Streams an OpenAI-compatible chat completion through the local proxy.
 // Yields text deltas as they arrive; throws with the provider's message on
 // a non-200 from upstream.
-export async function* streamExplain({ baseUrl, apiKey, model, messages, maxTokens = 1200, providerOptions = {} }) {
-  const res = await fetch('/api/explain', {
-    method: 'POST',
-    headers: { 'content-type': 'application/json' },
-    body: JSON.stringify({ baseUrl, apiKey, model, messages, stream: true, max_tokens: maxTokens, ...providerOptions }),
-  });
-
-  if (!res.ok) {
-    let detail = '';
-    try {
-      const data = await res.json();
-      detail = data.detail || data.error || '';
-    } catch {
-      /* keep the generic line */
-    }
-    throw new Error(detail || `The provider said ${res.status}.`);
-  }
-
-  const reader = res.body.getReader();
-  const decoder = new TextDecoder();
-  let buffer = '';
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    buffer += decoder.decode(value, { stream: true });
-    const frames = buffer.split('\n\n');
-    buffer = frames.pop();
-    for (const frame of frames) {
-      for (const line of frame.split('\n')) {
-        if (!line.startsWith('data:')) continue;
-        const payload = line.slice(5).trim();
-        if (payload === '[DONE]') return;
+export async function* streamExplain({ baseUrl, apiKey, model, messages, maxTokens = 1200, providerOptions = {}, signal = undefined }) {
+    const res = await fetch('/api/explain', {
+        signal,
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ baseUrl, apiKey, model, messages, stream: true, max_tokens: maxTokens, ...providerOptions }),
+    });
+    if (!res.ok) {
+        let detail = '';
         try {
-          const json = JSON.parse(payload);
-          const delta = json.choices?.[0]?.delta?.content;
-          if (delta) yield delta;
-        } catch {
-          /* a partial JSON frame — the next chunk completes it */
+            const data = await res.json();
+            detail = data.detail || data.error || '';
+        }
+        catch {
+            /* keep the generic line */
+        }
+        throw new Error(detail || `The provider said ${res.status}.`);
+    }
+    const reader = res.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = '';
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        buffer += decoder.decode(value, { stream: true });
+        const frames = buffer.split('\n\n');
+        buffer = frames.pop();
+        for (const frame of frames) {
+            for (const line of frame.split('\n')) {
+                if (!line.startsWith('data:'))
+                    continue;
+                const payload = line.slice(5).trim();
+                if (payload === '[DONE]')
+                    return;
+                try {
+                    const json = JSON.parse(payload);
+                    const delta = json.choices?.[0]?.delta?.content;
+                    if (delta)
+                        yield delta;
+                }
+                catch {
+                    /* a partial JSON frame — the next chunk completes it */
+                }
+            }
         }
-      }
     }
-  }
 }
-
 // The Server drawer's three round-trips. The read is a GET that comes back
 // with the secret masked; writes go through PUT with only the changed keys;
 // rotation is a POST because it mints a new key on the server — the one and
 // only time a key ever crosses the wire in the clear.
 export async function fetchServerSettings() {
-  const res = await fetch('/api/settings');
-  const data = await res.json().catch(() => null);
-  if (!res.ok) throw new Error(data?.error || `The server said ${res.status}.`);
-  return data;
+    const res = await fetch('/api/settings');
+    const data = await res.json().catch(() => null);
+    if (!res.ok)
+        throw new Error(data?.error || `The server said ${res.status}.`);
+    return data;
 }
-
 export async function updateServerSettings(patch) {
-  const res = await fetch('/api/settings', {
-    method: 'PUT',
-    headers: { 'content-type': 'application/json' },
-    body: JSON.stringify(patch),
-  });
-  const data = await res.json().catch(() => null);
-  if (!res.ok) throw new Error(data?.error || `The server said ${res.status}.`);
-  return data;
-}
-
+    const res = await fetch('/api/settings', {
+        method: 'PUT',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(patch),
+    });
+    const data = await res.json().catch(() => null);
+    if (!res.ok)
+        throw new Error(data?.error || `The server said ${res.status}.`);
+    return data;
+}
 export function rotateServerAccessKey() {
-  return postJSON('/api/settings/access-key', {});
+    return postJSON('/api/settings/access-key', {});
 }
-
 export function logoutRemoteSession() {
-  return postJSON('/api/auth/logout', {});
+    return postJSON('/api/auth/logout', {});
 }
+//# sourceMappingURL=api.js.map

package/public/js/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/public/js/api.ts"],"names":[],"mappings":"AACA,6EAA6E;AAC7E,4CAA4C;AAE5C,6EAA6E;AAC7E,iFAAiF;AACjF,4EAA4E;AAC5E,oDAAoD;AAEpD,+EAA+E;AAC/E,sFAAsF;AACtF,IAAI,CAAC;IAAC,YAAY,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAAC,CAAC;AAAC,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC;AAElG,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,IAAa,EAAE,OAAO,GAA6B,EAAE;IACxF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IACH,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,mBAAmB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAoB,EAAE,OAAO,GAA6B,EAAE;IACvF,OAAO,QAAQ,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAO;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAM,EAAE,IAAI;IAC9C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,iBAAiB,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9G,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC1E,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,+EAA+E;AAC/E,+EAA+E;AAC/E,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,wDAAwD;IACvE,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,8EAA8E;AAC9E,4EAA4E;AAC5E,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB,CAAC,MAAM,EAAE,OAAO,GAAwB,EAAE;IACxE,OAAO,QAAQ,CAAC,gBAAgB,EAAE;QAChC,MAAM;QACN,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS;QACjC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS;QACjC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,SAAS;KACtC,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,oEAAoE;AACpE,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAI,EAAE,OAAO;IACnD,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,KAAgB,EAAE,EAAE,GAAE,CAAC,CAAC;IACnF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oBAAoB,EAAE;QAC5C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;KAC/B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC;YAAC,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,mBAAmB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,KAAK;YAAE,MAAM;QACjB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QACtB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;oBAAE,SAAS;gBACxC,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;oBAC/C,IAAI,CAAC,KAAK,CAAC,CAAC;oBACZ,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;wBAAE,IAAI,GAAG,KAAK,CAAC;gBAC1C,CAAC;gBAAC,MAAM,CAAC,CAAC,mDAAmD,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC;AACnG,CAAC;AAED,yEAAyE;AACzE,+EAA+E;AAC/E,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,+DAA+D;IAC9E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,QAAQ,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,iFAAiF;AACjF,iFAAiF;AACjF,sBAAsB;AACtB,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,2EAA2E;AAC3E,2BAA2B;AAC3B,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,GAAG,IAAI,EAAE,eAAe,GAAG,EAAE,EAAE,MAAM,GAAG,SAAoC,EAAE;IAC9J,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE;QACtC,MAAM;QACN,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,eAAe,EAAE,CAAC;KACpH,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,qBAAqB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QACtB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;oBAAE,SAAS;gBACxC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACrC,IAAI,OAAO,KAAK,QAAQ;oBAAE,OAAO;gBACjC,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACjC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC;oBAChD,IAAI,KAAK;wBAAE,MAAM,KAAK,CAAC;gBACzB,CAAC;gBAAC,MAAM,CAAC;oBACP,wDAAwD;gBAC1D,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,4EAA4E;AAC5E,4EAA4E;AAC5E,sDAAsD;AACtD,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,mBAAmB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAK;IAC9C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE;QACvC,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;KAC5B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,mBAAmB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,QAAQ,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,QAAQ,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC","sourcesContent":["import type { ScanRequest } from '../../shared/contracts.js';\n// Server round-trips. Thin and honest: JSON in, JSON (or an SSE stream) out,\n// server error messages surfaced untouched.\n\n// Browser access is an HttpOnly session cookie set by the themed self-hosted\n// login page. Same-origin fetches include it automatically, and JavaScript never\n// reads or stores the access key. API clients can still use `Authorization:\n// Bearer …`; local mode needs no credential at all.\n\n// 0.3.0 briefly stored a raw self-hosted key here. Remove that legacy value on\n// first load so upgrading also removes the old secret rather than merely ignoring it.\ntry { localStorage.removeItem('onboarder.accessKey'); } catch { /* storage may be unavailable */ }\n\nasync function postJSON(url: string, body: unknown, options: { signal?: AbortSignal } = {}) {\n  const res = await fetch(url, {\n    method: 'POST',\n    signal: options.signal,\n    headers: { 'content-type': 'application/json' },\n    body: JSON.stringify(body),\n  });\n  let data = null;\n  try {\n    data = await res.json();\n  } catch {\n    /* error path handled below with a generic message */\n  }\n  if (!res.ok) {\n    throw new Error(data?.error || `The server said ${res.status}.`);\n  }\n  return data;\n}\n\nexport function scanOnServer(payload: ScanRequest, options: { signal?: AbortSignal } = {}) {\n  return postJSON('/api/scan', payload, options);\n}\n\nexport async function cleanupClone(cloneId) {\n  try {\n    await fetch('/api/scan/' + encodeURIComponent(cloneId), { method: 'DELETE' });\n  } catch {\n    /* best-effort: the temp dir expires on its own eventually */\n  }\n}\n\nexport async function fetchFileText(scanId, path) {\n  const res = await fetch('/api/file?scan=' + encodeURIComponent(scanId) + '&path=' + encodeURIComponent(path));\n  if (!res.ok) throw new Error('Could not read that file from the server.');\n  return res.text();\n}\n\n// Which deep analyzers this machine can run, and how. Server-side scans only —\n// a browser-picked folder has no scan id and no server-visible root to point a\n// tool at, and this returns that honestly instead of pretending.\nexport async function fetchToolsStatus() {\n  try {\n    const res = await fetch('/api/tools');\n    if (!res.ok) return null;\n    const data = await res.json();\n    return data && data.tools ? data.tools : null;\n  } catch {\n    return null; // an unreachable server is just \"no deep analysis here\"\n  }\n}\n\n// Run the available analyzers against a live scan. `kinds`/`tools` narrow which\n// engines run; `options` carries the per-engine GUI settings, validated against\n// the registry schema on the server. The report normalizes every finding into\n// the shape the security view already draws, plus a per-engine pass list so\n// the UI can say which tool answered and which are missing.\nexport function runAnalysisTools(scanId, options: Record<string, any> = {}) {\n  return postJSON('/api/tools/run', {\n    scanId,\n    kinds: options.kinds || undefined,\n    tools: options.tools || undefined,\n    options: options.options || undefined,\n  });\n}\n\n// Install a missing engine, streaming progress events. The server emits SSE\n// frames shaped like the explain stream, minus the OpenAI envelope:\n//   { type: 'log', line } / { type: 'plan', label } / { type: 'done', ok, … }\n// `onEvent` gets each one as it arrives; the promise resolves with the final\n// `done` event (or throws if the request itself failed).\nexport async function streamToolInstall(tool, onEvent) {\n  const emit = typeof onEvent === 'function' ? onEvent : (..._args: unknown[]) => {};\n  const res = await fetch('/api/tools/install', {\n    method: 'POST',\n    headers: { 'content-type': 'application/json' },\n    body: JSON.stringify({ tool }),\n  });\n  if (!res.ok || !res.body) {\n    let detail = '';\n    try { detail = (await res.json()).error || ''; } catch { /* generic below */ }\n    throw new Error(detail || `The server said ${res.status}.`);\n  }\n\n  const reader = res.body.getReader();\n  const decoder = new TextDecoder();\n  let buffer = '';\n  let done = null;\n  while (true) {\n    const { done: ended, value } = await reader.read();\n    if (ended) break;\n    buffer += decoder.decode(value, { stream: true });\n    const frames = buffer.split('\\n\\n');\n    buffer = frames.pop();\n    for (const frame of frames) {\n      for (const line of frame.split('\\n')) {\n        if (!line.startsWith('data:')) continue;\n        try {\n          const event = JSON.parse(line.slice(5).trim());\n          emit(event);\n          if (event.type === 'done') done = event;\n        } catch { /* a partial frame — the next chunk completes it */ }\n      }\n    }\n  }\n  return done || { type: 'done', ok: false, error: 'The install stream ended without a verdict.' };\n}\n\n// The MCP button's three round-trips. The status one is a plain GET like\n// `/api/tools`; start and stop are POSTs because each one changes a process on\n// this machine, which is exactly the side effect `postJSON` is here for.\nexport async function fetchMcpStatus() {\n  try {\n    const res = await fetch('/api/mcp');\n    if (!res.ok) return null;\n    return await res.json();\n  } catch {\n    return null; // no server means no button state, not an error to shout about\n  }\n}\n\nexport function startMcpServer() {\n  return postJSON('/api/mcp/start', {});\n}\n\nexport function stopMcpServer() {\n  return postJSON('/api/mcp/stop', {});\n}\n\n// The command an agent harness is configured with. Kept separate from the status\n// fetch because it never changes, so it is read once when the panel opens rather\n// than on every poll.\nexport async function fetchMcpCommand() {\n  try {\n    const res = await fetch('/api/mcp/command');\n    if (!res.ok) return null;\n    return await res.json();\n  } catch {\n    return null;\n  }\n}\n\n// Streams an OpenAI-compatible chat completion through the local proxy.\n// Yields text deltas as they arrive; throws with the provider's message on\n// a non-200 from upstream.\nexport async function* streamExplain({ baseUrl, apiKey, model, messages, maxTokens = 1200, providerOptions = {}, signal = undefined as AbortSignal | undefined }) {\n  const res = await fetch('/api/explain', {\n    signal,\n    method: 'POST',\n    headers: { 'content-type': 'application/json' },\n    body: JSON.stringify({ baseUrl, apiKey, model, messages, stream: true, max_tokens: maxTokens, ...providerOptions }),\n  });\n\n  if (!res.ok) {\n    let detail = '';\n    try {\n      const data = await res.json();\n      detail = data.detail || data.error || '';\n    } catch {\n      /* keep the generic line */\n    }\n    throw new Error(detail || `The provider said ${res.status}.`);\n  }\n\n  const reader = res.body.getReader();\n  const decoder = new TextDecoder();\n  let buffer = '';\n  while (true) {\n    const { done, value } = await reader.read();\n    if (done) break;\n    buffer += decoder.decode(value, { stream: true });\n    const frames = buffer.split('\\n\\n');\n    buffer = frames.pop();\n    for (const frame of frames) {\n      for (const line of frame.split('\\n')) {\n        if (!line.startsWith('data:')) continue;\n        const payload = line.slice(5).trim();\n        if (payload === '[DONE]') return;\n        try {\n          const json = JSON.parse(payload);\n          const delta = json.choices?.[0]?.delta?.content;\n          if (delta) yield delta;\n        } catch {\n          /* a partial JSON frame — the next chunk completes it */\n        }\n      }\n    }\n  }\n}\n\n// The Server drawer's three round-trips. The read is a GET that comes back\n// with the secret masked; writes go through PUT with only the changed keys;\n// rotation is a POST because it mints a new key on the server — the one and\n// only time a key ever crosses the wire in the clear.\nexport async function fetchServerSettings() {\n  const res = await fetch('/api/settings');\n  const data = await res.json().catch(() => null);\n  if (!res.ok) throw new Error(data?.error || `The server said ${res.status}.`);\n  return data;\n}\n\nexport async function updateServerSettings(patch) {\n  const res = await fetch('/api/settings', {\n    method: 'PUT',\n    headers: { 'content-type': 'application/json' },\n    body: JSON.stringify(patch),\n  });\n  const data = await res.json().catch(() => null);\n  if (!res.ok) throw new Error(data?.error || `The server said ${res.status}.`);\n  return data;\n}\n\nexport function rotateServerAccessKey() {\n  return postJSON('/api/settings/access-key', {});\n}\n\nexport function logoutRemoteSession() {\n  return postJSON('/api/auth/logout', {});\n}\n"]}

package/public/js/atlas.d.ts

@@ -0,0 +1,6 @@
+export declare function initAtlas(options: any): void;
+export declare function renderAtlasList(): void;
+export declare function openCardDiagram(): {
+    source: string;
+    nodes: {};
+};

package/public/js/atlas.js

@@ -9,90 +9,82 @@
 //
 // Deciding what is in the list and drawing one card are both pure, and live in
 // shared/diagram/atlas.js with tests. What is left here is the DOM.
-
 import { atlasSpecs, atlasDiagram, filterAtlasItems } from '/shared/diagram/atlas.js';
 import { escapeHtml } from './html.js';
 import { state, focusFile, focusFolder, clearFocus } from './state.js';
-
-let host = null;      // #canvasContent — the pannable layer inside the canvas
-let canvas = null;    // #canvas — the viewport, which is what fixes the list's size
+let host = null; // #canvasContent — the pannable layer inside the canvas
+let canvas = null; // #canvas — the viewport, which is what fixes the list's size
 let hooks = {
-  onSyncInspector: () => {},
-  onRender: () => {},
-  onHome: () => {},
+    onSyncInspector: (..._args) => { },
+    onRender: (..._args) => { },
+    onHome: (..._args) => { },
 };
-
 export function initAtlas(options) {
-  host = options.host;
-  canvas = options.canvas;
-  hooks = { ...hooks, ...options };
+    host = options.host;
+    canvas = options.canvas;
+    hooks = { ...hooks, ...options };
 }
-
 // Built once per repo and kept: the catalogue is a function of the scan, and the
 // scan does not change while it is loaded. `unloadRepo` resets the flag.
 function specs() {
-  if (!state.atlas.built) {
-    const { scan, facts, manifest, patterns } = state;
-    state.atlas = { built: true, items: atlasSpecs(scan, facts, manifest, patterns) };
-  }
-  return state.atlas.items;
+    if (!state.atlas.built) {
+        const { scan, facts, manifest, patterns } = state;
+        state.atlas = { built: true, items: atlasSpecs(scan, facts, manifest, patterns) };
+    }
+    return state.atlas.items;
 }
-
 export function renderAtlasList() {
-  const items = filterAtlasItems(specs(), state.filters);
-  host.classList.add('atlas-mode');
-  hooks.onHome(); // the list is a document — never inherit a diagram's zoom
-
-  const list = document.createElement('div');
-  list.className = 'atlas-list';
-  // Exact viewport fit, because the list scrolls itself rather than being panned.
-  list.style.width = canvas.clientWidth + 'px';
-  list.style.height = canvas.clientHeight + 'px';
-
-  const head = document.createElement('p');
-  head.className = 'atlas-head';
-  head.textContent = `${items.length} maps, drawn from the import graph — no AI involved. `
-    + `Open one; if it doesn't satisfy you, the AI draft button redraws it.`;
-  list.appendChild(head);
-
-  const grid = document.createElement('div');
-  grid.className = 'atlas-grid';
-  for (const it of items) {
-    const card = document.createElement('div');
-    card.className = 'atlas-card';
-    card.innerHTML = `
+    const items = filterAtlasItems(specs(), state.filters);
+    host.classList.add('atlas-mode');
+    hooks.onHome(); // the list is a document — never inherit a diagram's zoom
+    const list = document.createElement('div');
+    list.className = 'atlas-list';
+    // Exact viewport fit, because the list scrolls itself rather than being panned.
+    list.style.width = canvas.clientWidth + 'px';
+    list.style.height = canvas.clientHeight + 'px';
+    const head = document.createElement('p');
+    head.className = 'atlas-head';
+    head.textContent = `${items.length} maps, drawn from the import graph — no AI involved. `
+        + `Open one; if it doesn't satisfy you, the AI draft button redraws it.`;
+    list.appendChild(head);
+    const grid = document.createElement('div');
+    grid.className = 'atlas-grid';
+    for (const it of items) {
+        const card = document.createElement('div');
+        card.className = 'atlas-card';
+        card.innerHTML = `
       <div class="atlas-card-top">
         <span class="atlas-kind is-${escapeHtml(it.kind)}">${escapeHtml(it.kind)}</span>
         <span class="atlas-title" title="${escapeHtml(it.path || it.title)}">${escapeHtml(it.title)}</span>
       </div>
       <div class="atlas-sub">${escapeHtml(it.sub)}</div>
     `;
-    card.addEventListener('click', () => openAtlasItem(it));
-    grid.appendChild(card);
-  }
-  list.appendChild(grid);
-
-  host.innerHTML = '';
-  host.appendChild(list);
+        card.addEventListener('click', () => openAtlasItem(it));
+        grid.appendChild(card);
+    }
+    list.appendChild(grid);
+    host.innerHTML = '';
+    host.appendChild(list);
 }
-
 // Opening a card points the rest of the app at the same subject, so the sidebar,
 // the inspector and the breadcrumbs agree with the picture on the canvas.
 function openAtlasItem(item) {
-  state.atlasOpen = item;
-  if (item.kind === 'file') focusFile(item.path);
-  else if (item.kind === 'folder') focusFolder(item.path);
-  else clearFocus();
-
-  hooks.onSyncInspector();
-  hooks.onRender();
+    state.atlasOpen = item;
+    if (item.kind === 'file')
+        focusFile(item.path);
+    else if (item.kind === 'folder')
+        focusFolder(item.path);
+    else
+        clearFocus();
+    hooks.onSyncInspector();
+    hooks.onRender();
 }
-
 // The diagram for whichever card is open, drawn fresh on each canvas render.
 // Fresh matters: a Mermaid source carries its own palette, so a cached one keeps
 // the theme it was born under. The old atlas stored the source on the item and
 // an opened card stayed light after switching to dark.
 export function openCardDiagram() {
-  const { scan, facts, manifest, patterns } = state;
-  return atlasDiagram(state.atlasOpen, { scan, facts, manifest, patterns });
+    const { scan, facts, manifest, patterns } = state;
+    return atlasDiagram(state.atlasOpen, { scan, facts, manifest, patterns });
 }
+//# sourceMappingURL=atlas.js.map

package/public/js/atlas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atlas.js","sourceRoot":"","sources":["../../src/public/js/atlas.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,gFAAgF;AAChF,iFAAiF;AACjF,8EAA8E;AAC9E,wCAAwC;AACxC,EAAE;AACF,+EAA+E;AAC/E,oEAAoE;AAEpE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACtF,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEvE,IAAI,IAAI,GAAG,IAAI,CAAC,CAAM,wDAAwD;AAC9E,IAAI,MAAM,GAAG,IAAI,CAAC,CAAI,8DAA8D;AACpF,IAAI,KAAK,GAAG;IACV,eAAe,EAAE,CAAC,GAAG,KAAgB,EAAE,EAAE,GAAE,CAAC;IAC5C,QAAQ,EAAE,CAAC,GAAG,KAAgB,EAAE,EAAE,GAAE,CAAC;IACrC,MAAM,EAAE,CAAC,GAAG,KAAgB,EAAE,EAAE,GAAE,CAAC;CACpC,CAAC;AAEF,MAAM,UAAU,SAAS,CAAC,OAAO;IAC/B,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IACpB,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IACxB,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,iFAAiF;AACjF,yEAAyE;AACzE,SAAS,KAAK;IACZ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QAClD,KAAK,CAAC,KAAK,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACjC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,0DAA0D;IAE1E,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,SAAS,GAAG,YAAY,CAAC;IAC9B,gFAAgF;IAChF,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;IAE/C,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,SAAS,GAAG,YAAY,CAAC;IAC9B,IAAI,CAAC,WAAW,GAAG,GAAG,KAAK,CAAC,MAAM,uDAAuD;UACrF,sEAAsE,CAAC;IAC3E,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAEvB,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,SAAS,GAAG,YAAY,CAAC;IAC9B,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,GAAG,YAAY,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG;;qCAEgB,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC;2CACrC,UAAU,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC;;+BAEpE,UAAU,CAAC,EAAE,CAAC,GAAG,CAAC;KAC5C,CAAC;QACF,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAEvB,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;IACpB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,iFAAiF;AACjF,0EAA0E;AAC1E,SAAS,aAAa,CAAC,IAAI;IACzB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;QACnD,UAAU,EAAE,CAAC;IAElB,KAAK,CAAC,eAAe,EAAE,CAAC;IACxB,KAAK,CAAC,QAAQ,EAAE,CAAC;AACnB,CAAC;AAED,6EAA6E;AAC7E,iFAAiF;AACjF,+EAA+E;AAC/E,uDAAuD;AACvD,MAAM,UAAU,eAAe;IAC7B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAClD,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC5E,CAAC","sourcesContent":["// The atlas view: a scrollable catalogue of every map, and the card that opens.\n//\n// Two things make this view unlike the others. It is a document rather than a\n// diagram, so it opts out of the canvas's pan and zoom (`atlas-mode`, which\n// diagramPane.js checks before it swallows a drag or a wheel). And a card, once\n// opened, *becomes* another view: the canvas draws the card's diagram and the AI\n// draft button borrows that view's fact sheet. Which is why `atlasOpen` holds\n// the whole item and not just an index.\n//\n// Deciding what is in the list and drawing one card are both pure, and live in\n// shared/diagram/atlas.js with tests. What is left here is the DOM.\n\nimport { atlasSpecs, atlasDiagram, filterAtlasItems } from '/shared/diagram/atlas.js';\nimport { escapeHtml } from './html.js';\nimport { state, focusFile, focusFolder, clearFocus } from './state.js';\n\nlet host = null;      // #canvasContent — the pannable layer inside the canvas\nlet canvas = null;    // #canvas — the viewport, which is what fixes the list's size\nlet hooks = {\n  onSyncInspector: (..._args: unknown[]) => {},\n  onRender: (..._args: unknown[]) => {},\n  onHome: (..._args: unknown[]) => {},\n};\n\nexport function initAtlas(options) {\n  host = options.host;\n  canvas = options.canvas;\n  hooks = { ...hooks, ...options };\n}\n\n// Built once per repo and kept: the catalogue is a function of the scan, and the\n// scan does not change while it is loaded. `unloadRepo` resets the flag.\nfunction specs() {\n  if (!state.atlas.built) {\n    const { scan, facts, manifest, patterns } = state;\n    state.atlas = { built: true, items: atlasSpecs(scan, facts, manifest, patterns) };\n  }\n  return state.atlas.items;\n}\n\nexport function renderAtlasList() {\n  const items = filterAtlasItems(specs(), state.filters);\n  host.classList.add('atlas-mode');\n  hooks.onHome(); // the list is a document — never inherit a diagram's zoom\n\n  const list = document.createElement('div');\n  list.className = 'atlas-list';\n  // Exact viewport fit, because the list scrolls itself rather than being panned.\n  list.style.width = canvas.clientWidth + 'px';\n  list.style.height = canvas.clientHeight + 'px';\n\n  const head = document.createElement('p');\n  head.className = 'atlas-head';\n  head.textContent = `${items.length} maps, drawn from the import graph — no AI involved. `\n    + `Open one; if it doesn't satisfy you, the AI draft button redraws it.`;\n  list.appendChild(head);\n\n  const grid = document.createElement('div');\n  grid.className = 'atlas-grid';\n  for (const it of items) {\n    const card = document.createElement('div');\n    card.className = 'atlas-card';\n    card.innerHTML = `\n      <div class=\"atlas-card-top\">\n        <span class=\"atlas-kind is-${escapeHtml(it.kind)}\">${escapeHtml(it.kind)}</span>\n        <span class=\"atlas-title\" title=\"${escapeHtml(it.path || it.title)}\">${escapeHtml(it.title)}</span>\n      </div>\n      <div class=\"atlas-sub\">${escapeHtml(it.sub)}</div>\n    `;\n    card.addEventListener('click', () => openAtlasItem(it));\n    grid.appendChild(card);\n  }\n  list.appendChild(grid);\n\n  host.innerHTML = '';\n  host.appendChild(list);\n}\n\n// Opening a card points the rest of the app at the same subject, so the sidebar,\n// the inspector and the breadcrumbs agree with the picture on the canvas.\nfunction openAtlasItem(item) {\n  state.atlasOpen = item;\n  if (item.kind === 'file') focusFile(item.path);\n  else if (item.kind === 'folder') focusFolder(item.path);\n  else clearFocus();\n\n  hooks.onSyncInspector();\n  hooks.onRender();\n}\n\n// The diagram for whichever card is open, drawn fresh on each canvas render.\n// Fresh matters: a Mermaid source carries its own palette, so a cached one keeps\n// the theme it was born under. The old atlas stored the source on the item and\n// an opened card stayed light after switching to dark.\nexport function openCardDiagram() {\n  const { scan, facts, manifest, patterns } = state;\n  return atlasDiagram(state.atlasOpen, { scan, facts, manifest, patterns });\n}\n"]}

package/public/js/blameView.d.ts

@@ -0,0 +1,2 @@
+export declare function initBlameView(container: any): (blameData: any, options?: Record<string, any>) => void;
+export declare function fetchBlame(scanId: any, path: any): Promise<any>;