dsh-code-review-graph 0.0.0-stage → 0.1.1

package/cordis.patch.yml

@@ -0,0 +1,3 @@
+- insert:
+    - id: code-review-graph
+      name: dsh-code-review-graph

package/dist/backend.js

@@ -0,0 +1,215 @@
+// src/backend.ts
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { spawn } from "node:child_process";
+
+// src/safety.ts
+import { realpath, stat, lstat, readdir } from "node:fs/promises";
+import { isAbsolute, relative, resolve, sep, dirname, basename, join } from "node:path";
+function contained(root, path) {
+  const part = relative(root, path);
+  return part === "" || !isAbsolute(part) && part !== ".." && !part.startsWith(`..${sep}`);
+}
+async function checkedPath(root, value, allowMissing = false) {
+  const candidate = resolve(root, value);
+  if (!contained(root, candidate)) throw new Error("Path is outside the authorized repository");
+  let current = candidate;
+  const suffix = [];
+  while (allowMissing && !await lstat(current).then(() => true, () => false)) {
+    suffix.unshift(basename(current));
+    current = dirname(current);
+  }
+  const canonical = join(await realpath(current), ...suffix);
+  if (!contained(root, canonical)) throw new Error("Symlink escapes the authorized repository");
+  return canonical;
+}
+function scrubEnv(env) {
+  return { ...Object.fromEntries(Object.entries(env).filter(([key, value]) => value !== void 0 && !/KEY|PASSWORD|SECRET|TOKEN|^(DSH|CRG|OPENAI|GOOGLE|GEMINI|MINIMAX|VOYAGE|HF)_/i.test(key))), HF_HUB_OFFLINE: "1", TRANSFORMERS_OFFLINE: "1", HF_HUB_DISABLE_TELEMETRY: "1" };
+}
+async function checkedData(root) {
+  const dir = resolve(root, ".code-review-graph");
+  if (!await lstat(dir).then(() => true, () => false)) return;
+  await checkedPath(root, dir);
+  const entries = await readdir(dir, { withFileTypes: true, recursive: true });
+  for (const entry of entries) {
+    if (entry.isSymbolicLink()) await checkedPath(root, join(entry.parentPath, entry.name));
+  }
+}
+
+// src/backend.ts
+var environment = (engine) => ({ ...scrubEnv(process.env), ...engine.env });
+function valueOf(result) {
+  const r = result;
+  const text = r.content?.filter((x) => x.type === "text").map((x) => x.text).join("\n") ?? "";
+  if (r.isError) throw new Error(text || "Engine tool failed");
+  const value = r.structuredContent ?? (() => {
+    try {
+      return JSON.parse(text);
+    } catch {
+      return { text };
+    }
+  })();
+  if (value.status === "error") throw new Error(String(value.error));
+  return value;
+}
+async function connect(engine, cwd) {
+  await checkedData(cwd);
+  const transport = new StdioClientTransport({ command: engine.command, args: [...engine.args, "serve", "--repo", cwd], cwd, env: environment(engine), stderr: "pipe" });
+  transport.stderr?.on("data", () => {
+  });
+  const client = new Client({ name: "dsh-code-review-graph", version: "0.1.1" });
+  try {
+    await client.connect(transport);
+    return client;
+  } catch (error) {
+    await transport.close();
+    throw new Error(`CRG engine unavailable. Run dsh-crg prepare explicitly. ${String(error)}`);
+  }
+}
+async function stop(child) {
+  if (!child || child.exitCode !== null || child.signalCode !== null) return;
+  await new Promise((resolve2) => {
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      resolve2();
+    }, 3e3);
+    child.once("exit", () => {
+      clearTimeout(timer);
+      resolve2();
+    });
+    child.kill();
+  });
+}
+var BackendPool = class {
+  constructor(engine) {
+    this.engine = engine;
+  }
+  entries = /* @__PURE__ */ new Map();
+  retired = /* @__PURE__ */ new Set();
+  closed = false;
+  activate(owner) {
+    this.retired.delete(owner);
+  }
+  async acquire(root, owner) {
+    if (this.closed || this.retired.has(owner)) throw new Error("Session has been released");
+    let promise = this.entries.get(root);
+    if (!promise) {
+      promise = connect(this.engine, root).then((client) => ({ client, owners: /* @__PURE__ */ new Set(), queue: Promise.resolve() }));
+      this.entries.set(root, promise);
+      promise.catch(() => {
+        if (this.entries.get(root) === promise) this.entries.delete(root);
+      });
+    }
+    const entry = await promise;
+    if (this.closed || this.retired.has(owner)) throw new Error("Session has been released");
+    entry.owners.add(owner);
+    return entry;
+  }
+  async call(root, owner, name, args, signal) {
+    const entry = await this.acquire(root, owner);
+    const work = entry.queue.catch(() => {
+    }).then(async () => {
+      signal.throwIfAborted();
+      const cancel = () => {
+        this.entries.delete(root);
+        void stop(entry.watcher);
+        void entry.client.close();
+      };
+      signal.addEventListener("abort", cancel, { once: true });
+      let result;
+      try {
+        await checkedData(root);
+        if (entry.watchError) throw new Error(`Incremental watcher stopped: ${entry.watchError}`);
+        result = await entry.client.callTool({ name, arguments: args }, void 0, { signal, timeout: this.engine.timeoutMs });
+      } catch (error) {
+        this.entries.delete(root);
+        await stop(entry.watcher);
+        await entry.client.close();
+        throw error;
+      } finally {
+        signal.removeEventListener("abort", cancel);
+      }
+      valueOf(result);
+      return result;
+    });
+    entry.queue = work;
+    return work;
+  }
+  async ensure(root, owner, signal) {
+    const entry = await this.acquire(root, owner);
+    entry.ready ??= (async () => {
+      const update = valueOf(await this.call(root, owner, "build_or_update_graph_tool", { repo_root: root }, signal));
+      if (update.status === "partial" || Array.isArray(update.warnings) && update.warnings.length) entry.update = update;
+      signal.throwIfAborted();
+      const watcher = spawn(this.engine.command, [...this.engine.args, "watch", "--repo", root], { cwd: root, env: environment(this.engine), stdio: "ignore", windowsHide: true });
+      entry.watcher = watcher;
+      await new Promise((resolve2, reject) => {
+        watcher.once("spawn", resolve2);
+        watcher.once("error", reject);
+      });
+      watcher.on("error", (error) => {
+        entry.watchError = String(error);
+      });
+      watcher.on("exit", (code, reason) => {
+        if (entry.watcher === watcher) entry.watchError = `exit ${code ?? reason}`;
+      });
+    })().catch((error) => {
+      entry.ready = void 0;
+      throw error;
+    });
+    await entry.ready;
+    if (entry.watchError) throw new Error(`Incremental watcher stopped: ${entry.watchError}`);
+    return entry.update;
+  }
+  async release(owner) {
+    this.retired.add(owner);
+    for (const [root, promise] of this.entries) {
+      const entry = await promise.catch(() => void 0);
+      if (!entry) continue;
+      entry.owners.delete(owner);
+      if (!entry.owners.size) {
+        this.entries.delete(root);
+        const watcher = entry.watcher;
+        entry.watcher = void 0;
+        await stop(watcher);
+        await entry.client.close();
+      }
+    }
+  }
+  async dispose() {
+    this.closed = true;
+    const entries = [...this.entries.values()];
+    this.entries.clear();
+    for (const promise of entries) {
+      const entry = await promise.catch(() => void 0);
+      if (entry) {
+        const watcher = entry.watcher;
+        entry.watcher = void 0;
+        await stop(watcher);
+        await entry.client.close();
+      }
+    }
+  }
+};
+async function run(engine, args, cwd, signal) {
+  await checkedData(cwd);
+  signal = AbortSignal.any([signal, AbortSignal.timeout(engine.timeoutMs)]);
+  return new Promise((resolve2, reject) => {
+    let log = "";
+    const child = spawn(engine.command, [...engine.args, ...args], { cwd, env: environment(engine), stdio: ["ignore", "pipe", "pipe"], windowsHide: true, signal });
+    const capture = (bytes) => {
+      log = (log + bytes.toString()).slice(-16e3);
+    };
+    child.stdout?.on("data", capture);
+    child.stderr?.on("data", capture);
+    child.on("error", reject);
+    child.on("exit", (code) => code === 0 ? resolve2({ log }) : reject(new Error(`Engine command exited ${code}: ${log}`)));
+  });
+}
+export {
+  BackendPool,
+  connect,
+  run,
+  valueOf
+};
+//# sourceMappingURL=backend.js.map

package/dist/backend.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/backend.ts", "../src/safety.ts"],
+  "sourcesContent": ["import { Client } from '@modelcontextprotocol/sdk/client/index.js';\nimport { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';\nimport { spawn, type ChildProcess } from 'node:child_process';\nimport { checkedData, scrubEnv } from './safety.ts';\n\nexport interface Engine { command: string; args: string[]; timeoutMs: number; env?: Record<string, string> }\nconst environment = (engine: Engine) => ({ ...scrubEnv(process.env), ...engine.env });\nexport function valueOf(result: unknown): Record<string, unknown> {\n  const r = result as { isError?: boolean; structuredContent?: Record<string, unknown>; content?: { type: string; text?: string }[] };\n  const text = r.content?.filter(x => x.type === 'text').map(x => x.text).join('\\n') ?? '';\n  if (r.isError) throw new Error(text || 'Engine tool failed');\n  const value = r.structuredContent ?? (() => { try { return JSON.parse(text); } catch { return { text }; } })();\n  if (value.status === 'error') throw new Error(String(value.error));\n  return value;\n}\n\nexport async function connect(engine: Engine, cwd: string): Promise<Client> {\n  await checkedData(cwd);\n  const transport = new StdioClientTransport({ command: engine.command, args: [...engine.args, 'serve', '--repo', cwd], cwd, env: environment(engine), stderr: 'pipe' });\n  transport.stderr?.on('data', () => {});\n  const client = new Client({ name: 'dsh-code-review-graph', version: '0.1.1' });\n  try { await client.connect(transport); return client; }\n  catch (error) { await transport.close(); throw new Error(`CRG engine unavailable. Run dsh-crg prepare explicitly. ${String(error)}`); }\n}\n\nasync function stop(child?: ChildProcess): Promise<void> {\n  if (!child || child.exitCode !== null || child.signalCode !== null) return;\n  await new Promise<void>(resolve => {\n    const timer = setTimeout(() => { child.kill('SIGKILL'); resolve(); }, 3000);\n    child.once('exit', () => { clearTimeout(timer); resolve(); });\n    child.kill();\n  });\n}\ninterface Entry { client: Client; owners: Set<string>; ready?: Promise<void>; watcher?: ChildProcess; watchError?: string; queue: Promise<unknown>; update?: Record<string, unknown> }\nexport class BackendPool {\n  private entries = new Map<string, Promise<Entry>>();\n  private retired = new Set<string>();\n  private closed = false;\n  constructor(readonly engine: Engine) {}\n  activate(owner: string): void { this.retired.delete(owner); }\n\n  async acquire(root: string, owner: string): Promise<Entry> {\n    if (this.closed || this.retired.has(owner)) throw new Error('Session has been released');\n    let promise = this.entries.get(root);\n    if (!promise) {\n      promise = connect(this.engine, root).then(client => ({ client, owners: new Set<string>(), queue: Promise.resolve() }));\n      this.entries.set(root, promise);\n      promise.catch(() => { if (this.entries.get(root) === promise) this.entries.delete(root); });\n    }\n    const entry = await promise;\n    if (this.closed || this.retired.has(owner)) throw new Error('Session has been released');\n    entry.owners.add(owner);\n    return entry;\n  }\n\n  async call(root: string, owner: string, name: string, args: Record<string, unknown>, signal: AbortSignal) {\n    const entry = await this.acquire(root, owner);\n    // One mutation at a time per SQLite graph; cancellation restarts this repository's shared worker.\n    const work = entry.queue.catch(() => {}).then(async () => {\n      signal.throwIfAborted();\n      const cancel = () => { this.entries.delete(root); void stop(entry.watcher); void entry.client.close(); };\n      signal.addEventListener('abort', cancel, { once: true });\n      let result: unknown;\n      try {\n        await checkedData(root);\n        if (entry.watchError) throw new Error(`Incremental watcher stopped: ${entry.watchError}`);\n        result = await entry.client.callTool({ name, arguments: args }, undefined, { signal, timeout: this.engine.timeoutMs });\n      } catch (error) {\n        // A timed-out Python thread cannot safely be left mutating the graph.\n        this.entries.delete(root); await stop(entry.watcher); await entry.client.close();\n        throw error;\n      } finally { signal.removeEventListener('abort', cancel); }\n      // A normal tool error must not discard another call's pending refactor preview.\n      valueOf(result);\n      return result;\n    });\n    entry.queue = work;\n    return work;\n  }\n\n  async ensure(root: string, owner: string, signal: AbortSignal): Promise<Record<string, unknown> | undefined> {\n    const entry = await this.acquire(root, owner);\n    entry.ready ??= (async () => {\n      // An existing database can be stale after all sessions were closed.\n      const update = valueOf(await this.call(root, owner, 'build_or_update_graph_tool', { repo_root: root }, signal));\n      if (update.status === 'partial' || Array.isArray(update.warnings) && update.warnings.length) entry.update = update;\n      signal.throwIfAborted();\n      const watcher = spawn(this.engine.command, [...this.engine.args, 'watch', '--repo', root], { cwd: root, env: environment(this.engine), stdio: 'ignore', windowsHide: true });\n      entry.watcher = watcher;\n      await new Promise<void>((resolve, reject) => { watcher.once('spawn', resolve); watcher.once('error', reject); });\n      watcher.on('error', error => { entry.watchError = String(error); });\n      watcher.on('exit', (code, reason) => { if (entry.watcher === watcher) entry.watchError = `exit ${code ?? reason}`; });\n    })().catch(error => { entry.ready = undefined; throw error; });\n    await entry.ready;\n    if (entry.watchError) throw new Error(`Incremental watcher stopped: ${entry.watchError}`);\n    return entry.update;\n  }\n\n  async release(owner: string): Promise<void> {\n    this.retired.add(owner);\n    for (const [root, promise] of this.entries) {\n      const entry = await promise.catch(() => undefined);\n      if (!entry) continue;\n      entry.owners.delete(owner);\n      if (!entry.owners.size) { this.entries.delete(root); const watcher = entry.watcher; entry.watcher = undefined; await stop(watcher); await entry.client.close(); }\n    }\n  }\n\n  async dispose(): Promise<void> {\n    this.closed = true;\n    const entries = [...this.entries.values()]; this.entries.clear();\n    for (const promise of entries) {\n      const entry = await promise.catch(() => undefined);\n      if (entry) { const watcher = entry.watcher; entry.watcher = undefined; await stop(watcher); await entry.client.close(); }\n    }\n  }\n}\n\nexport async function run(engine: Engine, args: string[], cwd: string, signal: AbortSignal): Promise<{ log: string }> {\n  await checkedData(cwd);\n  signal = AbortSignal.any([signal, AbortSignal.timeout(engine.timeoutMs)]);\n  return new Promise((resolve, reject) => {\n    let log = '';\n    const child = spawn(engine.command, [...engine.args, ...args], { cwd, env: environment(engine), stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true, signal });\n    const capture = (bytes: Buffer) => { log = (log + bytes.toString()).slice(-16000); };\n    child.stdout?.on('data', capture); child.stderr?.on('data', capture);\n    child.on('error', reject);\n    child.on('exit', code => code === 0 ? resolve({ log }) : reject(new Error(`Engine command exited ${code}: ${log}`)));\n  });\n}\n", "import { realpath, stat, lstat, readdir } from 'node:fs/promises';\nimport { isAbsolute, relative, resolve, sep, dirname, basename, join } from 'node:path';\nimport { createHash } from 'node:crypto';\n\nexport const sha256 = (bytes: Uint8Array | string): string => createHash('sha256').update(bytes).digest('hex');\n\nexport function contained(root: string, path: string): boolean {\n  const part = relative(root, path);\n  return part === '' || (!isAbsolute(part) && part !== '..' && !part.startsWith(`..${sep}`));\n}\n\nexport async function checkedPath(root: string, value: string, allowMissing = false): Promise<string> {\n  const candidate = resolve(root, value);\n  if (!contained(root, candidate)) throw new Error('Path is outside the authorized repository');\n  let current = candidate;\n  const suffix: string[] = [];\n  while (allowMissing && !await lstat(current).then(() => true, () => false)) {\n    suffix.unshift(basename(current)); current = dirname(current);\n  }\n  const canonical = join(await realpath(current), ...suffix);\n  if (!contained(root, canonical)) throw new Error('Symlink escapes the authorized repository');\n  return canonical;\n}\n\nexport async function repository(cwd: string | undefined): Promise<string> {\n  if (!cwd || !isAbsolute(cwd)) throw new Error('This session has no local absolute workspace');\n  const root = await realpath(cwd);\n  if (!(await stat(root)).isDirectory()) throw new Error('Workspace is not a directory');\n  for (const marker of ['.git', '.svn']) {\n    if (await stat(resolve(root, marker)).then(() => true, () => false)) return root;\n  }\n  throw new Error('Select a Git or SVN repository before using the graph');\n}\n\nexport function scrubEnv(env: NodeJS.ProcessEnv): Record<string, string> {\n  return { ...Object.fromEntries(Object.entries(env).filter(([key, value]) => value !== undefined && !/KEY|PASSWORD|SECRET|TOKEN|^(DSH|CRG|OPENAI|GOOGLE|GEMINI|MINIMAX|VOYAGE|HF)_/i.test(key))), HF_HUB_OFFLINE: '1', TRANSFORMERS_OFFLINE: '1', HF_HUB_DISABLE_TELEMETRY: '1' } as Record<string, string>;\n}\n\nexport async function checkedData(root: string): Promise<void> {\n  const dir = resolve(root, '.code-review-graph');\n  if (!await lstat(dir).then(() => true, () => false)) return;\n  await checkedPath(root, dir);\n  const entries = await readdir(dir, { withFileTypes: true, recursive: true });\n  for (const entry of entries) {\n    if (entry.isSymbolicLink()) await checkedPath(root, join(entry.parentPath, entry.name));\n  }\n}\n"],
+  "mappings": ";AAAA,SAAS,cAAc;AACvB,SAAS,4BAA4B;AACrC,SAAS,aAAgC;;;ACFzC,SAAS,UAAU,MAAM,OAAO,eAAe;AAC/C,SAAS,YAAY,UAAU,SAAS,KAAK,SAAS,UAAU,YAAY;AAKrE,SAAS,UAAU,MAAc,MAAuB;AAC7D,QAAM,OAAO,SAAS,MAAM,IAAI;AAChC,SAAO,SAAS,MAAO,CAAC,WAAW,IAAI,KAAK,SAAS,QAAQ,CAAC,KAAK,WAAW,KAAK,GAAG,EAAE;AAC1F;AAEA,eAAsB,YAAY,MAAc,OAAe,eAAe,OAAwB;AACpG,QAAM,YAAY,QAAQ,MAAM,KAAK;AACrC,MAAI,CAAC,UAAU,MAAM,SAAS,EAAG,OAAM,IAAI,MAAM,2CAA2C;AAC5F,MAAI,UAAU;AACd,QAAM,SAAmB,CAAC;AAC1B,SAAO,gBAAgB,CAAC,MAAM,MAAM,OAAO,EAAE,KAAK,MAAM,MAAM,MAAM,KAAK,GAAG;AAC1E,WAAO,QAAQ,SAAS,OAAO,CAAC;AAAG,cAAU,QAAQ,OAAO;AAAA,EAC9D;AACA,QAAM,YAAY,KAAK,MAAM,SAAS,OAAO,GAAG,GAAG,MAAM;AACzD,MAAI,CAAC,UAAU,MAAM,SAAS,EAAG,OAAM,IAAI,MAAM,2CAA2C;AAC5F,SAAO;AACT;AAYO,SAAS,SAAS,KAAgD;AACvE,SAAO,EAAE,GAAG,OAAO,YAAY,OAAO,QAAQ,GAAG,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,MAAM,UAAU,UAAa,CAAC,gFAAgF,KAAK,GAAG,CAAC,CAAC,GAAG,gBAAgB,KAAK,sBAAsB,KAAK,0BAA0B,IAAI;AACjR;AAEA,eAAsB,YAAY,MAA6B;AAC7D,QAAM,MAAM,QAAQ,MAAM,oBAAoB;AAC9C,MAAI,CAAC,MAAM,MAAM,GAAG,EAAE,KAAK,MAAM,MAAM,MAAM,KAAK,EAAG;AACrD,QAAM,YAAY,MAAM,GAAG;AAC3B,QAAM,UAAU,MAAM,QAAQ,KAAK,EAAE,eAAe,MAAM,WAAW,KAAK,CAAC;AAC3E,aAAW,SAAS,SAAS;AAC3B,QAAI,MAAM,eAAe,EAAG,OAAM,YAAY,MAAM,KAAK,MAAM,YAAY,MAAM,IAAI,CAAC;AAAA,EACxF;AACF;;;ADxCA,IAAM,cAAc,CAAC,YAAoB,EAAE,GAAG,SAAS,QAAQ,GAAG,GAAG,GAAG,OAAO,IAAI;AAC5E,SAAS,QAAQ,QAA0C;AAChE,QAAM,IAAI;AACV,QAAM,OAAO,EAAE,SAAS,OAAO,OAAK,EAAE,SAAS,MAAM,EAAE,IAAI,OAAK,EAAE,IAAI,EAAE,KAAK,IAAI,KAAK;AACtF,MAAI,EAAE,QAAS,OAAM,IAAI,MAAM,QAAQ,oBAAoB;AAC3D,QAAM,QAAQ,EAAE,sBAAsB,MAAM;AAAE,QAAI;AAAE,aAAO,KAAK,MAAM,IAAI;AAAA,IAAG,QAAQ;AAAE,aAAO,EAAE,KAAK;AAAA,IAAG;AAAA,EAAE,GAAG;AAC7G,MAAI,MAAM,WAAW,QAAS,OAAM,IAAI,MAAM,OAAO,MAAM,KAAK,CAAC;AACjE,SAAO;AACT;AAEA,eAAsB,QAAQ,QAAgB,KAA8B;AAC1E,QAAM,YAAY,GAAG;AACrB,QAAM,YAAY,IAAI,qBAAqB,EAAE,SAAS,OAAO,SAAS,MAAM,CAAC,GAAG,OAAO,MAAM,SAAS,UAAU,GAAG,GAAG,KAAK,KAAK,YAAY,MAAM,GAAG,QAAQ,OAAO,CAAC;AACrK,YAAU,QAAQ,GAAG,QAAQ,MAAM;AAAA,EAAC,CAAC;AACrC,QAAM,SAAS,IAAI,OAAO,EAAE,MAAM,yBAAyB,SAAS,QAAQ,CAAC;AAC7E,MAAI;AAAE,UAAM,OAAO,QAAQ,SAAS;AAAG,WAAO;AAAA,EAAQ,SAC/C,OAAO;AAAE,UAAM,UAAU,MAAM;AAAG,UAAM,IAAI,MAAM,2DAA2D,OAAO,KAAK,CAAC,EAAE;AAAA,EAAG;AACxI;AAEA,eAAe,KAAK,OAAqC;AACvD,MAAI,CAAC,SAAS,MAAM,aAAa,QAAQ,MAAM,eAAe,KAAM;AACpE,QAAM,IAAI,QAAc,CAAAA,aAAW;AACjC,UAAM,QAAQ,WAAW,MAAM;AAAE,YAAM,KAAK,SAAS;AAAG,MAAAA,SAAQ;AAAA,IAAG,GAAG,GAAI;AAC1E,UAAM,KAAK,QAAQ,MAAM;AAAE,mBAAa,KAAK;AAAG,MAAAA,SAAQ;AAAA,IAAG,CAAC;AAC5D,UAAM,KAAK;AAAA,EACb,CAAC;AACH;AAEO,IAAM,cAAN,MAAkB;AAAA,EAIvB,YAAqB,QAAgB;AAAhB;AAAA,EAAiB;AAAA,EAH9B,UAAU,oBAAI,IAA4B;AAAA,EAC1C,UAAU,oBAAI,IAAY;AAAA,EAC1B,SAAS;AAAA,EAEjB,SAAS,OAAqB;AAAE,SAAK,QAAQ,OAAO,KAAK;AAAA,EAAG;AAAA,EAE5D,MAAM,QAAQ,MAAc,OAA+B;AACzD,QAAI,KAAK,UAAU,KAAK,QAAQ,IAAI,KAAK,EAAG,OAAM,IAAI,MAAM,2BAA2B;AACvF,QAAI,UAAU,KAAK,QAAQ,IAAI,IAAI;AACnC,QAAI,CAAC,SAAS;AACZ,gBAAU,QAAQ,KAAK,QAAQ,IAAI,EAAE,KAAK,aAAW,EAAE,QAAQ,QAAQ,oBAAI,IAAY,GAAG,OAAO,QAAQ,QAAQ,EAAE,EAAE;AACrH,WAAK,QAAQ,IAAI,MAAM,OAAO;AAC9B,cAAQ,MAAM,MAAM;AAAE,YAAI,KAAK,QAAQ,IAAI,IAAI,MAAM,QAAS,MAAK,QAAQ,OAAO,IAAI;AAAA,MAAG,CAAC;AAAA,IAC5F;AACA,UAAM,QAAQ,MAAM;AACpB,QAAI,KAAK,UAAU,KAAK,QAAQ,IAAI,KAAK,EAAG,OAAM,IAAI,MAAM,2BAA2B;AACvF,UAAM,OAAO,IAAI,KAAK;AACtB,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,KAAK,MAAc,OAAe,MAAc,MAA+B,QAAqB;AACxG,UAAM,QAAQ,MAAM,KAAK,QAAQ,MAAM,KAAK;AAE5C,UAAM,OAAO,MAAM,MAAM,MAAM,MAAM;AAAA,IAAC,CAAC,EAAE,KAAK,YAAY;AACxD,aAAO,eAAe;AACtB,YAAM,SAAS,MAAM;AAAE,aAAK,QAAQ,OAAO,IAAI;AAAG,aAAK,KAAK,MAAM,OAAO;AAAG,aAAK,MAAM,OAAO,MAAM;AAAA,MAAG;AACvG,aAAO,iBAAiB,SAAS,QAAQ,EAAE,MAAM,KAAK,CAAC;AACvD,UAAI;AACJ,UAAI;AACF,cAAM,YAAY,IAAI;AACtB,YAAI,MAAM,WAAY,OAAM,IAAI,MAAM,gCAAgC,MAAM,UAAU,EAAE;AACxF,iBAAS,MAAM,MAAM,OAAO,SAAS,EAAE,MAAM,WAAW,KAAK,GAAG,QAAW,EAAE,QAAQ,SAAS,KAAK,OAAO,UAAU,CAAC;AAAA,MACvH,SAAS,OAAO;AAEd,aAAK,QAAQ,OAAO,IAAI;AAAG,cAAM,KAAK,MAAM,OAAO;AAAG,cAAM,MAAM,OAAO,MAAM;AAC/E,cAAM;AAAA,MACR,UAAE;AAAU,eAAO,oBAAoB,SAAS,MAAM;AAAA,MAAG;AAEzD,cAAQ,MAAM;AACd,aAAO;AAAA,IACT,CAAC;AACD,UAAM,QAAQ;AACd,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,OAAO,MAAc,OAAe,QAAmE;AAC3G,UAAM,QAAQ,MAAM,KAAK,QAAQ,MAAM,KAAK;AAC5C,UAAM,WAAW,YAAY;AAE3B,YAAM,SAAS,QAAQ,MAAM,KAAK,KAAK,MAAM,OAAO,8BAA8B,EAAE,WAAW,KAAK,GAAG,MAAM,CAAC;AAC9G,UAAI,OAAO,WAAW,aAAa,MAAM,QAAQ,OAAO,QAAQ,KAAK,OAAO,SAAS,OAAQ,OAAM,SAAS;AAC5G,aAAO,eAAe;AACtB,YAAM,UAAU,MAAM,KAAK,OAAO,SAAS,CAAC,GAAG,KAAK,OAAO,MAAM,SAAS,UAAU,IAAI,GAAG,EAAE,KAAK,MAAM,KAAK,YAAY,KAAK,MAAM,GAAG,OAAO,UAAU,aAAa,KAAK,CAAC;AAC3K,YAAM,UAAU;AAChB,YAAM,IAAI,QAAc,CAACA,UAAS,WAAW;AAAE,gBAAQ,KAAK,SAASA,QAAO;AAAG,gBAAQ,KAAK,SAAS,MAAM;AAAA,MAAG,CAAC;AAC/G,cAAQ,GAAG,SAAS,WAAS;AAAE,cAAM,aAAa,OAAO,KAAK;AAAA,MAAG,CAAC;AAClE,cAAQ,GAAG,QAAQ,CAAC,MAAM,WAAW;AAAE,YAAI,MAAM,YAAY,QAAS,OAAM,aAAa,QAAQ,QAAQ,MAAM;AAAA,MAAI,CAAC;AAAA,IACtH,GAAG,EAAE,MAAM,WAAS;AAAE,YAAM,QAAQ;AAAW,YAAM;AAAA,IAAO,CAAC;AAC7D,UAAM,MAAM;AACZ,QAAI,MAAM,WAAY,OAAM,IAAI,MAAM,gCAAgC,MAAM,UAAU,EAAE;AACxF,WAAO,MAAM;AAAA,EACf;AAAA,EAEA,MAAM,QAAQ,OAA8B;AAC1C,SAAK,QAAQ,IAAI,KAAK;AACtB,eAAW,CAAC,MAAM,OAAO,KAAK,KAAK,SAAS;AAC1C,YAAM,QAAQ,MAAM,QAAQ,MAAM,MAAM,MAAS;AACjD,UAAI,CAAC,MAAO;AACZ,YAAM,OAAO,OAAO,KAAK;AACzB,UAAI,CAAC,MAAM,OAAO,MAAM;AAAE,aAAK,QAAQ,OAAO,IAAI;AAAG,cAAM,UAAU,MAAM;AAAS,cAAM,UAAU;AAAW,cAAM,KAAK,OAAO;AAAG,cAAM,MAAM,OAAO,MAAM;AAAA,MAAG;AAAA,IAClK;AAAA,EACF;AAAA,EAEA,MAAM,UAAyB;AAC7B,SAAK,SAAS;AACd,UAAM,UAAU,CAAC,GAAG,KAAK,QAAQ,OAAO,CAAC;AAAG,SAAK,QAAQ,MAAM;AAC/D,eAAW,WAAW,SAAS;AAC7B,YAAM,QAAQ,MAAM,QAAQ,MAAM,MAAM,MAAS;AACjD,UAAI,OAAO;AAAE,cAAM,UAAU,MAAM;AAAS,cAAM,UAAU;AAAW,cAAM,KAAK,OAAO;AAAG,cAAM,MAAM,OAAO,MAAM;AAAA,MAAG;AAAA,IAC1H;AAAA,EACF;AACF;AAEA,eAAsB,IAAI,QAAgB,MAAgB,KAAa,QAA+C;AACpH,QAAM,YAAY,GAAG;AACrB,WAAS,YAAY,IAAI,CAAC,QAAQ,YAAY,QAAQ,OAAO,SAAS,CAAC,CAAC;AACxE,SAAO,IAAI,QAAQ,CAACA,UAAS,WAAW;AACtC,QAAI,MAAM;AACV,UAAM,QAAQ,MAAM,OAAO,SAAS,CAAC,GAAG,OAAO,MAAM,GAAG,IAAI,GAAG,EAAE,KAAK,KAAK,YAAY,MAAM,GAAG,OAAO,CAAC,UAAU,QAAQ,MAAM,GAAG,aAAa,MAAM,OAAO,CAAC;AAC9J,UAAM,UAAU,CAAC,UAAkB;AAAE,aAAO,MAAM,MAAM,SAAS,GAAG,MAAM,KAAM;AAAA,IAAG;AACnF,UAAM,QAAQ,GAAG,QAAQ,OAAO;AAAG,UAAM,QAAQ,GAAG,QAAQ,OAAO;AACnE,UAAM,GAAG,SAAS,MAAM;AACxB,UAAM,GAAG,QAAQ,UAAQ,SAAS,IAAIA,SAAQ,EAAE,IAAI,CAAC,IAAI,OAAO,IAAI,MAAM,yBAAyB,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;AAAA,EACrH,CAAC;AACH;",
+  "names": ["resolve"]
+}

package/dist/client.js

@@ -0,0 +1,103 @@
+window.__ModuleLoader__.load({ id: "dsh-code-review-graph", factory: (require) => { var module = { exports: {} }; var exports = module.exports;
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name2 in all)
+    __defProp(target, name2, { get: all[name2], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/client.tsx
+var client_exports = {};
+__export(client_exports, {
+  apply: () => apply,
+  inject: () => inject,
+  name: () => name,
+  readAsset: () => readAsset
+});
+module.exports = __toCommonJS(client_exports);
+var import_react = __toESM(require("react"), 1);
+
+// src/html.ts
+async function inlineGraph(html, read) {
+  html = html.replace(/<script>\s*window\.d3\s*\|\|\s*document\.write\([\s\S]*?\);\s*<\/script>/gi, "");
+  const scripts = [...html.matchAll(/<script\b([^>]*?)\bsrc=["']([^"']+)["']([^>]*)>[\s\S]*?<\/script>/gi)];
+  for (const match of scripts) {
+    const path = match[2];
+    if (/^(?:https?:|data:|\/|\\)|\.\./i.test(path)) throw new Error("Graph contains a nonlocal script");
+    const script = await read(path);
+    html = html.replace(match[0], () => `<script>${script.replace(/<\/script/gi, "<\\/script")}<\/script>`);
+  }
+  const policy = `<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src data: blob:; connect-src 'none'; font-src 'none'">`;
+  return html.replace(/<head>/i, `<head>${policy}`);
+}
+
+// src/client.tsx
+var inject = ["slots", "sidebarRightTabs", "remote", "remote.workspaceFiles"];
+var name = "code-review-graph-client";
+async function readAsset(reader, session, path, signal, base) {
+  const result = reader.readBytes ? await reader.readBytes(session, path, base ? { baseFile: base } : {}, signal) : base && reader.readRelated ? await reader.readRelated(session, base, path, signal) : reader.readAll ? await reader.readAll(session, path, signal) : (() => {
+    throw new Error("Unsupported DSH file reader");
+  })();
+  if (!result.ok) throw new Error(result.error.message);
+  if (result.value.data instanceof Uint8Array) return new TextDecoder().decode(result.value.data);
+  const base64 = result.value.data;
+  if (typeof base64 !== "string") throw new Error("Invalid graph asset response");
+  return new TextDecoder().decode(Uint8Array.from(atob(base64), (c) => c.charCodeAt(0)));
+}
+function apply(ctx) {
+  const id = "dsh-code-review-graph";
+  ctx.effect(() => ctx.sidebarRightTabs.register({ id, kind: "code-review-graph", priority: "builtin", title: () => "Code graph / \u4EE3\u7801\u56FE\u8C31", guide: [{ id: "graph", order: 30, title: () => "Code graph / \u4EE3\u7801\u56FE\u8C31", description: () => "Explore dependencies, changes and execution paths locally." }] }));
+  function Graph({ sessionId, useTabInfo }) {
+    const { tab } = useTabInfo();
+    const [html, setHtml] = (0, import_react.useState)("");
+    const [error, setError] = (0, import_react.useState)("");
+    const [generation, refresh] = (0, import_react.useState)(0);
+    const download = () => {
+      const url = URL.createObjectURL(new Blob([html], { type: "text/html;charset=utf-8" }));
+      const link = document.createElement("a");
+      link.href = url;
+      link.download = "code-review-graph.html";
+      link.click();
+      setTimeout(() => URL.revokeObjectURL(url), 1e3);
+    };
+    (0, import_react.useEffect)(() => {
+      const life = new AbortController();
+      const signal = AbortSignal.any([life.signal, tab.signal]);
+      const base = ".code-review-graph/graph.html";
+      const reader = ctx.remote.workspaceFiles;
+      setError("");
+      void readAsset(reader, sessionId, base, signal).then((html2) => inlineGraph(html2, (path) => readAsset(reader, sessionId, path, signal, base))).then((result) => {
+        if (!signal.aborted) setHtml(result);
+      }).catch((error2) => {
+        if (!signal.aborted) setError(String(error2));
+      });
+      return () => life.abort();
+    }, [sessionId, generation, tab.signal]);
+    return /* @__PURE__ */ import_react.default.createElement("section", { style: { height: "100%", display: "flex", flexDirection: "column", gap: 8 } }, /* @__PURE__ */ import_react.default.createElement("div", null, /* @__PURE__ */ import_react.default.createElement("button", { type: "button", onClick: () => refresh((n) => n + 1) }, "Refresh / \u5237\u65B0"), " ", /* @__PURE__ */ import_react.default.createElement("button", { type: "button", disabled: !html, onClick: download }, "Export HTML / \u5BFC\u51FA HTML")), error && /* @__PURE__ */ import_react.default.createElement("p", { role: "status" }, "Generate the graph with crg_visualize, then refresh. / \u4F7F\u7528 crg_visualize \u751F\u6210\u56FE\u8C31\u540E\u5237\u65B0\u3002", /* @__PURE__ */ import_react.default.createElement("br", null), error), html && /* @__PURE__ */ import_react.default.createElement("iframe", { title: "Interactive code graph / \u4EA4\u4E92\u4EE3\u7801\u56FE\u8C31", sandbox: "allow-scripts allow-downloads", srcDoc: html, style: { width: "100%", flex: 1, border: 0 } }));
+  }
+  ctx.effect(() => ctx.slots.inject("sidebar.right.pane.tab", () => ctx.slots.register({ name: "sidebar.right.pane.tab", key: id }, Graph)));
+}
+return module.exports; } });
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/client.tsx", "../src/html.ts"],
+  "sourcesContent": ["import React, { useEffect, useState } from 'react';\nimport type { Context } from '@deepseek-ai/cordis';\nimport type {} from '@deepseek-ai/dsh-client-ui-sidebar-right/client';\nimport type {} from '@deepseek-ai/dsh-client-ui-slots';\nimport type {} from '@deepseek-ai/dsh-client-ui-renderer/client';\nimport type {} from '@deepseek-ai/dsh-api-remotes/client';\nimport type {} from '@deepseek-ai/dsh-api-workspace-files/client';\nimport { inlineGraph } from './html.ts';\n\nexport const inject = ['slots', 'sidebarRightTabs', 'remote', 'remote.workspaceFiles'];\nexport const name = 'code-review-graph-client';\ntype ReadResult = { ok: true; value: { data: Uint8Array | string } } | { ok: false; error: { message: string } };\ntype WorkspaceReader = {\n  readBytes?: (session: string, path: string, options: object, signal: AbortSignal) => Promise<ReadResult>;\n  readAll?: (session: string, path: string, signal: AbortSignal) => Promise<ReadResult>;\n  readRelated?: (session: string, base: string, path: string, signal: AbortSignal) => Promise<ReadResult>;\n};\nexport async function readAsset(reader: WorkspaceReader, session: string, path: string, signal: AbortSignal, base?: string): Promise<string> {\n  const result = reader.readBytes ? await reader.readBytes(session, path, base ? { baseFile: base } : {}, signal)\n    : base && reader.readRelated ? await reader.readRelated(session, base, path, signal)\n    : reader.readAll ? await reader.readAll(session, path, signal) : (() => { throw new Error('Unsupported DSH file reader'); })();\n  if (!result.ok) throw new Error(result.error.message);\n  if (result.value.data instanceof Uint8Array) return new TextDecoder().decode(result.value.data);\n  const base64 = result.value.data;\n  if (typeof base64 !== 'string') throw new Error('Invalid graph asset response');\n  return new TextDecoder().decode(Uint8Array.from(atob(base64), c => c.charCodeAt(0)));\n}\n\nexport function apply(ctx: Context): void {\n  const id = 'dsh-code-review-graph';\n  ctx.effect(() => ctx.sidebarRightTabs.register({ id, kind: 'code-review-graph', priority: 'builtin', title: () => 'Code graph / \u4EE3\u7801\u56FE\u8C31', guide: [{ id: 'graph', order: 30, title: () => 'Code graph / \u4EE3\u7801\u56FE\u8C31', description: () => 'Explore dependencies, changes and execution paths locally.' }] }));\n  function Graph({ sessionId, useTabInfo }: { sessionId: string; useTabInfo: () => { tab: { signal: AbortSignal } } }) {\n    const { tab } = useTabInfo();\n    const [html, setHtml] = useState('');\n    const [error, setError] = useState('');\n    const [generation, refresh] = useState(0);\n    const download = () => {\n      const url = URL.createObjectURL(new Blob([html], { type: 'text/html;charset=utf-8' }));\n      const link = document.createElement('a'); link.href = url; link.download = 'code-review-graph.html'; link.click();\n      setTimeout(() => URL.revokeObjectURL(url), 1000);\n    };\n    useEffect(() => {\n      const life = new AbortController();\n      const signal = AbortSignal.any([life.signal, tab.signal]);\n      const base = '.code-review-graph/graph.html';\n      const reader = ctx.remote.workspaceFiles as unknown as WorkspaceReader;\n      setError('');\n      void readAsset(reader, sessionId, base, signal).then(html => inlineGraph(html, path => readAsset(reader, sessionId, path, signal, base))).then(result => {\n        if (!signal.aborted) setHtml(result);\n      }).catch(error => { if (!signal.aborted) setError(String(error)); });\n      return () => life.abort();\n    }, [sessionId, generation, tab.signal]);\n    return <section style={{ height: '100%', display: 'flex', flexDirection: 'column', gap: 8 }}>\n      <div><button type=\"button\" onClick={() => refresh(n => n + 1)}>Refresh / \u5237\u65B0</button> <button type=\"button\" disabled={!html} onClick={download}>Export HTML / \u5BFC\u51FA HTML</button></div>\n      {error && <p role=\"status\">Generate the graph with crg_visualize, then refresh. / \u4F7F\u7528 crg_visualize \u751F\u6210\u56FE\u8C31\u540E\u5237\u65B0\u3002<br />{error}</p>}\n      {html && <iframe title=\"Interactive code graph / \u4EA4\u4E92\u4EE3\u7801\u56FE\u8C31\" sandbox=\"allow-scripts allow-downloads\" srcDoc={html} style={{ width: '100%', flex: 1, border: 0 }} />}\n    </section>;\n  }\n  ctx.effect(() => ctx.slots.inject('sidebar.right.pane.tab', () => ctx.slots.register({ name: 'sidebar.right.pane.tab', key: id }, Graph)));\n}\n", "/** Inline only bundled scripts and local data; the iframe never fetches remote assets. */\nexport async function inlineGraph(html: string, read: (path: string) => Promise<string>): Promise<string> {\n  // The upstream CDN fallback contains a literal script tag inside a JS string.\n  // Local D3 is required here, so remove that loader before inspecting HTML tags.\n  html = html.replace(/<script>\\s*window\\.d3\\s*\\|\\|\\s*document\\.write\\([\\s\\S]*?\\);\\s*<\\/script>/gi, '');\n  const scripts = [...html.matchAll(/<script\\b([^>]*?)\\bsrc=[\"']([^\"']+)[\"']([^>]*)>[\\s\\S]*?<\\/script>/gi)];\n  for (const match of scripts) {\n    const path = match[2];\n    if (/^(?:https?:|data:|\\/|\\\\)|\\.\\./i.test(path)) throw new Error('Graph contains a nonlocal script');\n    const script = await read(path);\n    html = html.replace(match[0], () => `<script>${script.replace(/<\\/script/gi, '<\\\\/script')}</script>`);\n  }\n  const policy = `<meta http-equiv=\"Content-Security-Policy\" content=\"default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src data: blob:; connect-src 'none'; font-src 'none'\">`;\n  return html.replace(/<head>/i, `<head>${policy}`);\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAA2C;;;ACC3C,eAAsB,YAAY,MAAc,MAA0D;AAGxG,SAAO,KAAK,QAAQ,8EAA8E,EAAE;AACpG,QAAM,UAAU,CAAC,GAAG,KAAK,SAAS,qEAAqE,CAAC;AACxG,aAAW,SAAS,SAAS;AAC3B,UAAM,OAAO,MAAM,CAAC;AACpB,QAAI,iCAAiC,KAAK,IAAI,EAAG,OAAM,IAAI,MAAM,kCAAkC;AACnG,UAAM,SAAS,MAAM,KAAK,IAAI;AAC9B,WAAO,KAAK,QAAQ,MAAM,CAAC,GAAG,MAAM,WAAW,OAAO,QAAQ,eAAe,YAAY,CAAC,YAAW;AAAA,EACvG;AACA,QAAM,SAAS;AACf,SAAO,KAAK,QAAQ,WAAW,SAAS,MAAM,EAAE;AAClD;;;ADLO,IAAM,SAAS,CAAC,SAAS,oBAAoB,UAAU,uBAAuB;AAC9E,IAAM,OAAO;AAOpB,eAAsB,UAAU,QAAyB,SAAiB,MAAc,QAAqB,MAAgC;AAC3I,QAAM,SAAS,OAAO,YAAY,MAAM,OAAO,UAAU,SAAS,MAAM,OAAO,EAAE,UAAU,KAAK,IAAI,CAAC,GAAG,MAAM,IAC1G,QAAQ,OAAO,cAAc,MAAM,OAAO,YAAY,SAAS,MAAM,MAAM,MAAM,IACjF,OAAO,UAAU,MAAM,OAAO,QAAQ,SAAS,MAAM,MAAM,KAAK,MAAM;AAAE,UAAM,IAAI,MAAM,6BAA6B;AAAA,EAAG,GAAG;AAC/H,MAAI,CAAC,OAAO,GAAI,OAAM,IAAI,MAAM,OAAO,MAAM,OAAO;AACpD,MAAI,OAAO,MAAM,gBAAgB,WAAY,QAAO,IAAI,YAAY,EAAE,OAAO,OAAO,MAAM,IAAI;AAC9F,QAAM,SAAS,OAAO,MAAM;AAC5B,MAAI,OAAO,WAAW,SAAU,OAAM,IAAI,MAAM,8BAA8B;AAC9E,SAAO,IAAI,YAAY,EAAE,OAAO,WAAW,KAAK,KAAK,MAAM,GAAG,OAAK,EAAE,WAAW,CAAC,CAAC,CAAC;AACrF;AAEO,SAAS,MAAM,KAAoB;AACxC,QAAM,KAAK;AACX,MAAI,OAAO,MAAM,IAAI,iBAAiB,SAAS,EAAE,IAAI,MAAM,qBAAqB,UAAU,WAAW,OAAO,MAAM,yCAAqB,OAAO,CAAC,EAAE,IAAI,SAAS,OAAO,IAAI,OAAO,MAAM,yCAAqB,aAAa,MAAM,6DAA6D,CAAC,EAAE,CAAC,CAAC;AAChS,WAAS,MAAM,EAAE,WAAW,WAAW,GAA8E;AACnH,UAAM,EAAE,IAAI,IAAI,WAAW;AAC3B,UAAM,CAAC,MAAM,OAAO,QAAI,uBAAS,EAAE;AACnC,UAAM,CAAC,OAAO,QAAQ,QAAI,uBAAS,EAAE;AACrC,UAAM,CAAC,YAAY,OAAO,QAAI,uBAAS,CAAC;AACxC,UAAM,WAAW,MAAM;AACrB,YAAM,MAAM,IAAI,gBAAgB,IAAI,KAAK,CAAC,IAAI,GAAG,EAAE,MAAM,0BAA0B,CAAC,CAAC;AACrF,YAAM,OAAO,SAAS,cAAc,GAAG;AAAG,WAAK,OAAO;AAAK,WAAK,WAAW;AAA0B,WAAK,MAAM;AAChH,iBAAW,MAAM,IAAI,gBAAgB,GAAG,GAAG,GAAI;AAAA,IACjD;AACA,gCAAU,MAAM;AACd,YAAM,OAAO,IAAI,gBAAgB;AACjC,YAAM,SAAS,YAAY,IAAI,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC;AACxD,YAAM,OAAO;AACb,YAAM,SAAS,IAAI,OAAO;AAC1B,eAAS,EAAE;AACX,WAAK,UAAU,QAAQ,WAAW,MAAM,MAAM,EAAE,KAAK,CAAAA,UAAQ,YAAYA,OAAM,UAAQ,UAAU,QAAQ,WAAW,MAAM,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,YAAU;AACvJ,YAAI,CAAC,OAAO,QAAS,SAAQ,MAAM;AAAA,MACrC,CAAC,EAAE,MAAM,CAAAC,WAAS;AAAE,YAAI,CAAC,OAAO,QAAS,UAAS,OAAOA,MAAK,CAAC;AAAA,MAAG,CAAC;AACnE,aAAO,MAAM,KAAK,MAAM;AAAA,IAC1B,GAAG,CAAC,WAAW,YAAY,IAAI,MAAM,CAAC;AACtC,WAAO,6BAAAC,QAAA,cAAC,aAAQ,OAAO,EAAE,QAAQ,QAAQ,SAAS,QAAQ,eAAe,UAAU,KAAK,EAAE,KACxF,6BAAAA,QAAA,cAAC,aAAI,6BAAAA,QAAA,cAAC,YAAO,MAAK,UAAS,SAAS,MAAM,QAAQ,OAAK,IAAI,CAAC,KAAG,wBAAY,GAAS,KAAC,6BAAAA,QAAA,cAAC,YAAO,MAAK,UAAS,UAAU,CAAC,MAAM,SAAS,YAAU,iCAAqB,CAAS,GAC5K,SAAS,6BAAAA,QAAA,cAAC,OAAE,MAAK,YAAS,sIAAgF,6BAAAA,QAAA,cAAC,UAAG,GAAG,KAAM,GACvH,QAAQ,6BAAAA,QAAA,cAAC,YAAO,OAAM,iEAAkC,SAAQ,iCAAgC,QAAQ,MAAM,OAAO,EAAE,OAAO,QAAQ,MAAM,GAAG,QAAQ,EAAE,GAAG,CAC/J;AAAA,EACF;AACA,MAAI,OAAO,MAAM,IAAI,MAAM,OAAO,0BAA0B,MAAM,IAAI,MAAM,SAAS,EAAE,MAAM,0BAA0B,KAAK,GAAG,GAAG,KAAK,CAAC,CAAC;AAC3I;",
+  "names": ["html", "error", "React"]
+}

package/dist/html.js

@@ -0,0 +1,17 @@
+// src/html.ts
+async function inlineGraph(html, read) {
+  html = html.replace(/<script>\s*window\.d3\s*\|\|\s*document\.write\([\s\S]*?\);\s*<\/script>/gi, "");
+  const scripts = [...html.matchAll(/<script\b([^>]*?)\bsrc=["']([^"']+)["']([^>]*)>[\s\S]*?<\/script>/gi)];
+  for (const match of scripts) {
+    const path = match[2];
+    if (/^(?:https?:|data:|\/|\\)|\.\./i.test(path)) throw new Error("Graph contains a nonlocal script");
+    const script = await read(path);
+    html = html.replace(match[0], () => `<script>${script.replace(/<\/script/gi, "<\\/script")}</script>`);
+  }
+  const policy = `<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src data: blob:; connect-src 'none'; font-src 'none'">`;
+  return html.replace(/<head>/i, `<head>${policy}`);
+}
+export {
+  inlineGraph
+};
+//# sourceMappingURL=html.js.map

package/dist/html.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/html.ts"],
+  "sourcesContent": ["/** Inline only bundled scripts and local data; the iframe never fetches remote assets. */\nexport async function inlineGraph(html: string, read: (path: string) => Promise<string>): Promise<string> {\n  // The upstream CDN fallback contains a literal script tag inside a JS string.\n  // Local D3 is required here, so remove that loader before inspecting HTML tags.\n  html = html.replace(/<script>\\s*window\\.d3\\s*\\|\\|\\s*document\\.write\\([\\s\\S]*?\\);\\s*<\\/script>/gi, '');\n  const scripts = [...html.matchAll(/<script\\b([^>]*?)\\bsrc=[\"']([^\"']+)[\"']([^>]*)>[\\s\\S]*?<\\/script>/gi)];\n  for (const match of scripts) {\n    const path = match[2];\n    if (/^(?:https?:|data:|\\/|\\\\)|\\.\\./i.test(path)) throw new Error('Graph contains a nonlocal script');\n    const script = await read(path);\n    html = html.replace(match[0], () => `<script>${script.replace(/<\\/script/gi, '<\\\\/script')}</script>`);\n  }\n  const policy = `<meta http-equiv=\"Content-Security-Policy\" content=\"default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src data: blob:; connect-src 'none'; font-src 'none'\">`;\n  return html.replace(/<head>/i, `<head>${policy}`);\n}\n"],
+  "mappings": ";AACA,eAAsB,YAAY,MAAc,MAA0D;AAGxG,SAAO,KAAK,QAAQ,8EAA8E,EAAE;AACpG,QAAM,UAAU,CAAC,GAAG,KAAK,SAAS,qEAAqE,CAAC;AACxG,aAAW,SAAS,SAAS;AAC3B,UAAM,OAAO,MAAM,CAAC;AACpB,QAAI,iCAAiC,KAAK,IAAI,EAAG,OAAM,IAAI,MAAM,kCAAkC;AACnG,UAAM,SAAS,MAAM,KAAK,IAAI;AAC9B,WAAO,KAAK,QAAQ,MAAM,CAAC,GAAG,MAAM,WAAW,OAAO,QAAQ,eAAe,YAAY,CAAC,WAAW;AAAA,EACvG;AACA,QAAM,SAAS;AACf,SAAO,KAAK,QAAQ,WAAW,SAAS,MAAM,EAAE;AAClD;",
+  "names": []
+}