craftar 0.28.2 → 0.30.0

package/dist/ui/page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"page.js","sourceRoot":"","sources":["../../src/ui/page.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;CAaxB,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCvB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAA2E;IACjG,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE;IACzD,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE;IAC/D,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE;IAC7D,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE;IAC9D,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,CAAC,EAAE;IACtE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE;IAC/D,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,cAAc,CAAC,EAAE;IAC9E,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,CAAC,EAAE;CACvE,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;cAKnB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;oBAGrB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;mBACtH,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmT9G,CAAC"}

package/dist/ui/routes.js

@@ -0,0 +1,132 @@
+import { catalogueContext, listIngredients, listRecipes, withLoadWarnings } from "../core/catalogue.js";
+import { renderDiff } from "../core/diff.js";
+import { oneLine } from "../core/doctor.js";
+import { isMissing, listWorkspaces, readRegistry } from "../core/registry.js";
+import { credentialFault, CREDENTIAL_HIDDEN, refHoldsCredentials } from "../core/remote.js";
+import { EXAMPLE_CONTENT_HIDDEN, diffReport, explainFile, statusReport } from "../core/report.js";
+import { loadWorkspace, plan, readLock, status, unsetSummary } from "../core/sync.js";
+import { hashNormalized } from "../core/text.js";
+export const NOT_FOUND = { error: "not found" };
+export const PATH_REQUIRED = { error: "path is required, once" };
+export const MISSING = "the directory or its craftar.yaml is gone — craftar workspaces prune";
+/** A workspace's id in a URL: 16 hex characters of the hash of its registered path — the path itself never travels. */
+export const workspaceId = (registeredPath) => hashNormalized(registeredPath).slice("sha256:".length, "sha256:".length + 16);
+/** Why a workspace cannot be shown, in one line — the wording `doctor` uses, so the table and a 409 agree. */
+export function routeReason(e) {
+    return e instanceof Error ? oneLine(e) : String(e).split("\n")[0];
+}
+/** The route a path names, as its pattern — what the one stderr line of a 500 prints, never the request's text. */
+export function routePattern(path) {
+    if (path === "/api/workspaces")
+        return path;
+    const m = /^\/api\/workspaces\/[0-9a-f]{16}(\/(diff|explain|recipes|ingredients))?$/.exec(path);
+    return m ? `/api/workspaces/<id>${m[1] ?? ""}` : null;
+}
+/** The query's `path`, given exactly once and decoded once (`+` is not a space) — or null. */
+function onePath(query) {
+    const given = query.split("&").filter((kv) => kv === "path" || kv.startsWith("path="));
+    if (given.length !== 1)
+        return null;
+    try {
+        return decodeURIComponent(given[0].slice("path=".length));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * A row of the table as the page is given it: its id, and — whatever the core answered — never a Forge URL that
+ * `credentialFault` flags. Since 0.28.1 the core gives the label itself for a `missing` or an `error` row; this
+ * is the page's own check, a second line: the label is the core's (`CREDENTIAL_HIDDEN`), and the key goes with it.
+ * A recorded `ref` that `refHoldsCredentials` flags is given the same label (`CREDENTIAL_HIDDEN`).
+ */
+export function servedRow(r) {
+    const row = { id: workspaceId(r.path), ...r };
+    if (credentialFault(r.forge.source))
+        row.forge = { ...r.forge, source: CREDENTIAL_HIDDEN, key: null };
+    if (r.forge.ref !== null && refHoldsCredentials(r.forge.ref))
+        row.forge = { ...row.forge, ref: CREDENTIAL_HIDDEN };
+    return row;
+}
+export async function route(req, deps) {
+    const pattern = routePattern(req.path);
+    if (pattern === null)
+        return { status: 404, body: NOT_FOUND };
+    if (pattern === "/api/workspaces") {
+        const t = await listWorkspaces(deps.home, { fetch: false, reason: routeReason });
+        const rows = t.rows.map(servedRow);
+        return {
+            status: 200,
+            body: { version: deps.version, registry: t.registry, fetch: false, workspaces: rows, warnings: t.warnings },
+        };
+    }
+    const [, , , id, what] = req.path.split("/");
+    // Decided from the request alone, before the registry is read.
+    let wanted = "";
+    if (what === "diff" || what === "explain") {
+        const given = onePath(req.query);
+        if (given === null)
+            return { status: 400, body: PATH_REQUIRED };
+        wanted = given;
+    }
+    // A registry that does not read is not this workspace's fault: it propagates, and the server answers 500.
+    const entry = (await readRegistry(deps.home)).workspaces.find((e) => workspaceId(e.path) === id);
+    if (!entry)
+        return { status: 404, body: NOT_FOUND };
+    if (await isMissing(entry))
+        return { status: 409, body: { error: MISSING, warnings: [] } };
+    // What cannot be loaded, planned or read is this workspace's state: 409, in one line. A failure past that point is ours: 500.
+    let ws;
+    let p;
+    let lock;
+    let st;
+    try {
+        ws = await loadWorkspace(entry.path, { mode: "no-fetch", home: deps.home });
+        if (what === "recipes" || what === "ingredients") {
+            // The catalogue resolves and never plans; it does not read the lock either.
+            const context = catalogueContext(ws.forge, { kind: "workspace", config: ws.config });
+            const listing = what === "recipes" ? listRecipes(ws.forge, context) : listIngredients(ws.forge, context);
+            return { status: 200, body: withLoadWarnings(listing, ws.warnings) };
+        }
+        p = await plan(ws);
+        lock = await readLock(ws.root);
+        st = await status(ws, p, lock);
+    }
+    catch (e) {
+        return { status: 409, body: { error: routeReason(e), warnings: ws?.warnings ?? [] } };
+    }
+    if (what === undefined) {
+        const report = statusReport(ws, p, lock, st);
+        return {
+            status: 200,
+            body: { id, path: entry.path, profile: ws.config.profile, recipes: p.resolution.recipes, targets: p.resolution.targets, ...report, refused: report.unsetParams.length ? unsetSummary(report.unsetParams) : null },
+        };
+    }
+    if (what === "explain") {
+        // Never `notProduced`'s message: it quotes the path asked.
+        const explained = explainFile(ws, p, wanted);
+        return explained ? { status: 200, body: explained } : { status: 404, body: NOT_FOUND };
+    }
+    // The row whose path is the string asked, character for character: nothing is opened that status() did not name.
+    const row = st.find((s) => s.path === wanted);
+    if (!row)
+        return { status: 404, body: NOT_FOUND };
+    const [d] = await diffReport(ws, [row], { withholdMcp: false });
+    if (!d)
+        return { status: 200, body: { path: row.path, state: row.state, from: null, to: null, hidden: false, note: null, diff: null } };
+    const from = `${row.path} (disk, ${row.state})`;
+    const to = row.state === "orphan-drift" ? null : row.state === "orphan" ? `${row.path} (forge: no longer produced — sync removes it)` : `${row.path} (forge)`;
+    return {
+        status: 200,
+        body: {
+            path: row.path,
+            state: row.state,
+            from,
+            to,
+            hidden: d.note === EXAMPLE_CONTENT_HIDDEN,
+            note: d.note,
+            diff: d.note === null ? renderDiff(d.disk ?? "", d.forge ?? "") : null,
+        },
+    };
+}
+//# sourceMappingURL=routes.js.map

package/dist/ui/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/ui/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxG,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAqB,MAAM,qBAAqB,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC5F,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAElG,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAA8C,MAAM,iBAAiB,CAAC;AAClI,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAwBjD,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AAChD,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;AACjE,MAAM,CAAC,MAAM,OAAO,GAAG,sEAAsE,CAAC;AAE9F,uHAAuH;AACvH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,cAAsB,EAAU,EAAE,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE7I,8GAA8G;AAC9G,MAAM,UAAU,WAAW,CAAC,CAAU;IACpC,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,IAAI,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,CAAC,GAAG,0EAA0E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChG,OAAO,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED,8FAA8F;AAC9F,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,MAAM,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACvF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,CAAe;IACvC,MAAM,GAAG,GAAG,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IAC9C,IAAI,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,GAAG,CAAC,KAAK,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACtG,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,IAAI,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,KAAK,GAAG,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC;IACnH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,GAAiB,EAAE,IAAe;IAC5D,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC9D,IAAI,OAAO,KAAK,iBAAiB,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACjF,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnC,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE;SAC5G,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,EAAE,AAAD,EAAG,AAAD,EAAG,EAAE,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,+DAA+D;IAC/D,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QAChE,MAAM,GAAG,KAAK,CAAC;IACjB,CAAC;IACD,0GAA0G;IAC1G,MAAM,KAAK,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACjG,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACpD,IAAI,MAAM,SAAS,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC;IAC3F,8HAA8H;IAC9H,IAAI,EAAyB,CAAC;IAC9B,IAAI,CAAO,CAAC;IACZ,IAAI,IAAiB,CAAC;IACtB,IAAI,EAAgB,CAAC;IACrB,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5E,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YACjD,4EAA4E;YAC5E,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;YACrF,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACzG,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvE,CAAC;QACD,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,IAAI,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC/B,EAAE,GAAG,MAAM,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,IAAI,EAAE,EAAE,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7C,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;SAClN,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,2DAA2D;QAC3D,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAC7C,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACzF,CAAC;IACD,iHAAiH;IACjH,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAClD,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;IACxI,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,IAAI,WAAW,GAAG,CAAC,KAAK,GAAG,CAAC;IAChD,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,gDAAgD,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,UAAU,CAAC;IAC9J,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACJ,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI;YACJ,EAAE;YACF,MAAM,EAAE,CAAC,CAAC,IAAI,KAAK,sBAAsB;YACzC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;SACvE;KACF,CAAC;AACJ,CAAC"}

package/dist/ui/server.js

@@ -0,0 +1,122 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import http from "node:http";
+import { errorText } from "../core/schema-fault.js";
+import { PAGE_CSS, PAGE_HTML, PAGE_JS } from "./page.js";
+import { route as defaultRoute, routePattern } from "./routes.js";
+/**
+ * The loopback server of `craftar ui` (spec 36 §4.5, §7) — the one file under `src/` that imports `node:http`.
+ * It never prints and never exits: what the terminal must see goes through `opts.onError`.
+ *
+ * Every request passes the same checks, in this order, and the order is the contract (§7.2):
+ * method → length of the target → `Host` → `Origin` and `Sec-Fetch-Site` → the route (a static one answers
+ * here; an unknown path is 404) → the run token → the queue of one → `route()`.
+ */
+export const MAX_TARGET_BYTES = 2048;
+export const CSP = "default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'";
+/** The names this server answers to. `localhost` is not one: it may resolve elsewhere, and a rebound name could read as it. */
+const names = (port) => (port === 80 ? ["127.0.0.1", "127.0.0.1:80"] : [`127.0.0.1:${port}`]);
+export const hostAllowed = (header, port) => header !== undefined && names(port).includes(header);
+/** Absent is allowed: a browser sends no `Origin` on a navigation or a same-origin GET. `null` is not. */
+export const originAllowed = (header, port) => header === undefined || names(port).some((n) => header === `http://${n}`);
+export const siteAllowed = (header) => header === undefined || header === "same-origin" || header === "none";
+const STATIC = {
+    "/": ["text/html; charset=utf-8", PAGE_HTML],
+    "/app.js": ["text/javascript; charset=utf-8", PAGE_JS],
+    "/app.css": ["text/css; charset=utf-8", PAGE_CSS],
+};
+/**
+ * A header as sent, once — read from `headersDistinct`, because Node keeps only the first `Host` or `Authorization`
+ * of a request that gives two. Given twice, it reads as one value no allowed spelling equals, whichever came first.
+ */
+const one = (req, name) => {
+    const values = req.headersDistinct[name];
+    return values === undefined ? undefined : values.length === 1 ? values[0] : values.join(", ");
+};
+/** Starts listening; rejects with the bind error, its `code` kept. */
+export function startUi(opts) {
+    const token = opts.token ?? randomBytes(32).toString("base64url");
+    const want = Buffer.from(`Bearer ${token}`, "utf8");
+    const run = opts.route ?? defaultRoute;
+    // One data request at a time: each loads a Forge and plans a workspace.
+    let queue = Promise.resolve();
+    let port = opts.port;
+    let closed = false;
+    const server = http.createServer((req, res) => {
+        const send = (status, type, body, extra = {}) => {
+            res.writeHead(status, {
+                "Content-Type": type,
+                "Cache-Control": "no-store",
+                "X-Content-Type-Options": "nosniff",
+                "Referrer-Policy": "no-referrer",
+                ...extra,
+            });
+            res.end(body);
+        };
+        const json = (status, body, extra = {}) => send(status, "application/json; charset=utf-8", JSON.stringify(body), extra);
+        // Every refusal is the same bytes: which check refused is not said.
+        const forbidden = () => json(403, { error: "forbidden" });
+        if (req.method !== "GET")
+            return json(405, { error: "GET only" }, { Allow: "GET" });
+        const target = req.url ?? "/";
+        if (Buffer.byteLength(target, "utf8") > MAX_TARGET_BYTES)
+            return json(414, { error: "request too long" });
+        if (!hostAllowed(one(req, "host"), port))
+            return forbidden();
+        if (!originAllowed(one(req, "origin"), port) || !siteAllowed(one(req, "sec-fetch-site")))
+            return forbidden();
+        // The path is split from the query by hand: no URL is built from the request.
+        const q = target.indexOf("?");
+        const path = q === -1 ? target : target.slice(0, q);
+        const page = Object.hasOwn(STATIC, path) ? STATIC[path] : undefined;
+        if (page)
+            return send(200, page[0], page[1], path === "/" ? { "Content-Security-Policy": CSP } : {});
+        const pattern = routePattern(path);
+        if (pattern === null)
+            return json(404, { error: "not found" });
+        // The token: in the Authorization header and nowhere else, compared in constant time.
+        const got = Buffer.from(one(req, "authorization") ?? "", "utf8");
+        if (got.length !== want.length || !timingSafeEqual(got, want))
+            return forbidden();
+        // One request's failure must neither end the process nor stop the queue (see the catch at the end).
+        queue = queue.then(async () => {
+            // Work still queued when the server closed is dropped: its connection is gone, and nothing should keep loading.
+            if (closed)
+                return;
+            try {
+                const answer = await run({ path, query: q === -1 ? "" : target.slice(q + 1) }, { home: opts.home, version: opts.version });
+                json(answer.status, answer.body);
+            }
+            catch (e) {
+                // The pattern, never the request's text; the browser learns nothing of the message.
+                opts.onError(`ui: ${pattern}: ${errorText(e).split("\n")[0]}`);
+                json(500, { error: "internal error" });
+            }
+        }).catch(() => {
+            // Only the catch above can throw: a failing `onError`, or an answer that can no longer be written. Nothing
+            // more can be said then; the connection is closed rather than left unanswered, and the queue goes on.
+            res.destroy();
+        });
+    });
+    server.headersTimeout = 10_000;
+    server.requestTimeout = 30_000;
+    return new Promise((resolve, reject) => {
+        server.once("error", reject);
+        // The literal address: no option, flag or variable changes where this listens.
+        server.listen(opts.port, "127.0.0.1", () => {
+            const address = server.address();
+            port = address.port;
+            resolve({
+                url: `http://127.0.0.1:${port}/#${token}`,
+                port,
+                address,
+                close: () => new Promise((done) => {
+                    closed = true;
+                    server.close(() => done());
+                    // A browser's keep-alive connection, or a route still running, would hold the listener open; that route's answer is abandoned.
+                    server.closeAllConnections();
+                }),
+            });
+        });
+    });
+}
+//# sourceMappingURL=server.js.map

package/dist/ui/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/ui/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,YAAY,EAAuD,MAAM,aAAa,CAAC;AAEvH;;;;;;;GAOG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AACrC,MAAM,CAAC,MAAM,GAAG,GACd,0IAA0I,CAAC;AAsB7I,+HAA+H;AAC/H,MAAM,KAAK,GAAG,CAAC,IAAY,EAAY,EAAE,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;AAEhH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAA0B,EAAE,IAAY,EAAW,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACvI,0GAA0G;AAC1G,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAA0B,EAAE,IAAY,EAAW,EAAE,CACjF,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,UAAU,CAAC,EAAE,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAA0B,EAAW,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK,MAAM,CAAC;AAE1I,MAAM,MAAM,GAA0D;IACpE,GAAG,EAAE,CAAC,0BAA0B,EAAE,SAAS,CAAC;IAC5C,SAAS,EAAE,CAAC,gCAAgC,EAAE,OAAO,CAAC;IACtD,UAAU,EAAE,CAAC,yBAAyB,EAAE,QAAQ,CAAC;CAClD,CAAC;AAEF;;;GAGG;AACH,MAAM,GAAG,GAAG,CAAC,GAAyB,EAAE,IAAY,EAAsB,EAAE;IAC1E,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChG,CAAC,CAAC;AAEF,sEAAsE;AACtE,MAAM,UAAU,OAAO,CAAC,IAAe;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACvC,wEAAwE;IACxE,IAAI,KAAK,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7C,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACrB,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,IAAY,EAAE,QAAgC,EAAE,EAAQ,EAAE;YACpG,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;gBACpB,cAAc,EAAE,IAAI;gBACpB,eAAe,EAAE,UAAU;gBAC3B,wBAAwB,EAAE,SAAS;gBACnC,iBAAiB,EAAE,aAAa;gBAChC,GAAG,KAAK;aACT,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,IAAa,EAAE,QAAgC,EAAE,EAAQ,EAAE,CACvF,IAAI,CAAC,MAAM,EAAE,iCAAiC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/E,oEAAoE;QACpE,MAAM,SAAS,GAAG,GAAS,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAEhE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAC9B,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,gBAAgB;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC1G,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC;YAAE,OAAO,SAAS,EAAE,CAAC;QAC7D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YAAE,OAAO,SAAS,EAAE,CAAC;QAE7G,8EAA8E;QAC9E,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrG,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAE/D,sFAAsF;QACtF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC;YAAE,OAAO,SAAS,EAAE,CAAC;QAElF,oGAAoG;QACpG,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC5B,gHAAgH;YAChH,IAAI,MAAM;gBAAE,OAAO;YACnB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC3H,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,oFAAoF;gBACpF,IAAI,CAAC,OAAO,CAAC,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC/D,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACzC,CAAC;QACH,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,2GAA2G;YAC3G,sGAAsG;YACtG,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;IAC/B,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;IAE/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,+EAA+E;QAC/E,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;YAChD,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YACpB,OAAO,CAAC;gBACN,GAAG,EAAE,oBAAoB,IAAI,KAAK,KAAK,EAAE;gBACzC,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,IAAI,EAAE,EAAE;oBACzB,MAAM,GAAG,IAAI,CAAC;oBACd,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;oBAC3B,+HAA+H;oBAC/H,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBAC/B,CAAC,CAAC;aACL,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "craftar",
-  "version": "0.28.2",
+  "version": "0.30.0",
   "description": "Craft, sync and convert AI-coding workspace harnesses across clients and tools.",
   "license": "MIT",
   "type": "module",