geneseed 3.14.0 → 3.16.0

package/js/web/api.mjs

@@ -1,16 +1,14 @@
 /**
- * The web console's read endpoints — `overview`, `themes`, `doctor`, `diff`, `installs`,
- * `excludes`, `setup`, `profile`, `catalog`, `item` and `wiki_item` — and the `WebState`
- * all eleven read from.
+ * The web console's dashboard and settings reads — `overview`, `recent`, `themes`, `setup`,
+ * `doctor`, `diff`, `installs`, `excludes` and the two `loops` reads.
  *
- * `PREFIX_ROUTES` below are the first routes that parse a path, which brings three things
- * no state-keyed route needs: `percentDecode` (NOT `decodeURIComponent`, which throws on a
- * `%` that is not an escape, where this shell instead answers a 404 naming the literal
- * text), the `NotFound` → 404 convention, and `flatName`'s traversal refusal — a GET
- * carries no token, so before that check the item route was an arbitrary-file read.
+ * WHAT IS NOT HERE, AND WHERE IT WENT: the Library read model (catalog sections, items, wiki,
+ * memory, `NotFound`) is `catalog.mjs`; the `WebState` every endpoint reads from is `state.mjs`;
+ * the fingerprint-guarded rules/profile editors are `user-files.mjs`; and the GET tables that
+ * bind paths to these functions are `routes.mjs`. This file imports none of its route siblings,
+ * which is what keeps the old `api ↔ actions` and `api ↔ activity` cycles from coming back.
  */
-import { createHash } from 'node:crypto';
-import { existsSync, readdirSync, statSync } from 'node:fs';
+import { statSync } from 'node:fs';
 import path from 'node:path';
 
 import { CONFIG, ROOT, THEMES, discoverNames } from '../build/source.mjs';
@@ -18,661 +16,31 @@ import { sourceReleaseVersion } from '../hosts/opencode.mjs';
 import { diffCollect } from '../inspect/diff.mjs';
 import { doctorCollect } from '../inspect/doctor.mjs';
 import { excludesSnapshot } from '../inspect/excludes.mjs';
-import { CLAUDE_STYLE, GLOBAL_MANIFEST, HOSTS, opencodeConfigDir, resolvePath } from '../hosts/hosts.mjs';
+import { CLAUDE_STYLE, HOSTS, resolvePath } from '../hosts/hosts.mjs';
 import {
-  doctrinesForBuild, excludedRulesOfDir, footprintOfDir, installState, installTargets,
-  installedDefaults, modeOfDir, trustOfDir,
-  postureOfDir, readJsonMaybe, readMaybe, themeOfDir,
+  footprintOfDir, installState, installTargets, modeOfDir, trustOfDir,
+  postureOfDir, readJsonMaybe, themeOfDir,
 } from '../hosts/installs.mjs';
-import { frontmatter } from '../hosts/memory-files.mjs';
-import { DEFAULT_PRESET, PRESETS } from '../loop/score.mjs';
+import { PRESETS } from '../loop/score.mjs';
 import { loadCatalog, catalogProblems } from '../loop/catalog.mjs';
 import { activeLoops } from '../loop/registry.mjs';
-import {
-  SKILL_CLASS, entityStatus, loadRegistry, tuiInventory,
-} from '../inspect/inventory.mjs';
-import { firstBlockquote } from '../hosts/native.mjs';
 import { EMIT_OPTIONS, themeOptions } from '../maintain/setup.mjs';
 import { accentFor, statusData } from '../inspect/status.mjs';
-import { readText, withDiscardableStderr, isDir, isFile } from '../lib/fs.mjs';
-import { comparePaths, normcase, within } from '../lib/paths.mjs';
-import { stripWhitespace, percentDecode } from '../lib/text.mjs';
-import { readJsonc } from '../hosts/settings.mjs';
-import { PROFILE_STUB } from '../build/stubs.mjs';
-import { apiActivity, apiActivityDetail } from './activity.mjs';
-import { apiMcp, apiRules } from './actions.mjs';
-
-/** A requested catalog section or item that does not exist. */
-export class NotFound extends Error {}
-
-/** Two resolved paths, compared case-folded on Windows. */
-const samePath = (a, b) => normcase(resolvePath(a)) === normcase(resolvePath(b));
-
-/** `??` would also swallow an explicit `null` the file declared; this does not. */
-const dget = (obj, key, dflt) => (Object.hasOwn(obj, key) ? obj[key] : dflt);
-
-/** SHA-256 hex, first 16 chars — `""` for an empty file. */
-export function fingerprint(text) {
-  return text ? createHash('sha256').update(text, 'utf-8').digest('hex').slice(0, 16) : '';
-}
-
-/**
- * `YYYY-MM-DD HH:MM`, LOCAL time — `toISOString` would be UTC, which reads wrong in every
- * timezone but one for a user-facing timestamp.
- */
-export function stampMinute(ms) {
-  const d = new Date(ms);
-  const p2 = (n) => String(n).padStart(2, '0');
-  return `${d.getFullYear()}-${p2(d.getMonth() + 1)}-${p2(d.getDate())} `
-    + `${p2(d.getHours())}:${p2(d.getMinutes())}`;
-}
-
-// ---- WebState ---------------------------------------------------------------------------
-
-/**
- * The resolved view of the deployed harness a request reads from.
- *
- * A factory returning a plain object rather than a class, because the two cached
- * properties are the only behaviour and a getter pair expresses them without ceremony.
- * THE CACHING IS BEHAVIOUR, NOT AN OPTIMISATION: `doctorCollect` renders a theme per call
- * and the dashboard GETs `/api/overview` on every navigation, so an uncached `doctor`
- * would put a full build on the request path. `refresh()` is what a mutation calls to
- * drop both.
- */
-export function webState(theme = null, target = null) {
-  const st = {
-    // NOT resolved: `target` is printed by three endpoints, so resolving it here would
-    // change what they answer.
-    target: target || opencodeConfigDir(),
-    root: null,
-    theme: null,
-    emit: null,
-    footprint: null,
-    posture: null,
-    mode: null,
-    trust: null,
-    _inv: null,
-    _doctor: null,
-  };
-  // The INSTALL ROOT (== build --out). For globals it IS the data dir; a claude/bob
-  // PROJECT install keeps its data under <repo>/.claude while the markers land at <repo>/.
-  st.root = st.target;
-  st.theme = theme || themeOfDir(st.target) || 'neutral';
-  st.emit = installedDefaults().emit || 'opencode-global';
-  // The install's sigils, each defaulted when its marker is absent (footprint to 'full').
-  // Read from the ROOT, where every emit writes them.
-  const readMarkers = () => {
-    st.footprint = footprintOfDir(st.root);
-    st.posture = postureOfDir(st.root) || 'peer';
-    st.mode = modeOfDir(st.root) || 'direct';
-    st.trust = trustOfDir(st.root) || DEFAULT_PRESET;
-  };
-  readMarkers();
-
-  Object.defineProperty(st, 'inventory', {
-    get() {
-      if (st._inv === null) st._inv = inventoryFor(st);
-      return st._inv;
-    },
-  });
-  Object.defineProperty(st, 'doctor', {
-    get() {
-      if (st._doctor === null) {
-        const [, problems] = doctorCollect({ theme: st.theme });
-        st.stampDoctor(problems);
-      }
-      return st._doctor;
-    },
-  });
-  st.stampDoctor = (problems) => {
-    st._doctor = { ok: !problems.length, problems, checked_at: stampMinute(Date.now()) };
-  };
-  /**
-   * The CURRENT install's mode, from its `.geneseed-emit` marker: the ROOT first (where
-   * every emit writes it), then the data dir.
-   *
-   * `refresh()` below MUST call this: without it, `emit` goes stale after any write that
-   * re-themes or re-points the install, since the constructor only reads it once via
-   * `installedDefaults()`.
-   */
-  st.detectEmit = () => {
-    for (const d of [st.root, st.target]) {
-      try {
-        const em = path.join(d, '.geneseed-emit');
-        if (isFile(em)) {
-          const v = stripWhitespace(readText(em));
-          if (v) return v;
-        }
-      } catch { /* unreadable marker: try the next candidate */ }
-    }
-    return existsSync(path.join(st.root, 'CLAUDE.md')) ? 'claude-global' : 'opencode-global';
-  };
-  /**
-   * Re-point the console at another detected install's data dir.
-   *
-   * `root` is the install ROOT the markers and sigils live at. It defaults to `target` and
-   * differs only for claude/bob/openclaude PROJECT installs, where the data sits under
-   * `<repo>/.claude|.bob|.openclaude` while `.geneseed-emit`/`-theme`/`-footprint` land at
-   * `<repo>/` — reading them from the data dir mis-detects the install as opencode/neutral,
-   * and a Diff or a Restore would then overwrite it in the wrong dialect.
-   */
-  st.selectView = (target, root = null) => {
-    st.target = target;
-    st.root = root || target;
-    st.theme = themeOfDir(st.root) || themeOfDir(st.target) || 'neutral';
-    st.emit = st.detectEmit();
-    readMarkers();
-    st._inv = null;
-    st._doctor = null;
-  };
-  st.refresh = () => {
-    st._inv = null;
-    st._doctor = null;
-    st.theme = themeOfDir(st.root) || themeOfDir(st.target) || st.theme;
-    st.emit = st.detectEmit() || st.emit;
-    readMarkers();
-  };
-  return st;
-}
-
-export function deployed(state) {
-  return existsSync(path.join(state.target, GLOBAL_MANIFEST));
-}
-
-/**
- * A deployed spec's one-line purpose.
- *
- * The `> blockquote` convention every rendered skill and agent carries, then the
- * frontmatter `description`, then the first prose paragraph. The fallbacks are for the
- * VENDORED skill folders, which ride in verbatim with no blockquote and would otherwise
- * show a blank Purpose cell.
- */
-export function specDesc(fm, body) {
-  const bq = firstBlockquote(body);
-  if (bq) return bq;
-  const desc = String(fm.has('description') ? fm.get('description') : '').trim();
-  if (desc) return desc.split(/\s+/).filter(Boolean).join(' ');
-  for (const para of body.split('\n\n')) {
-    const s = para.split(/\s+/).filter(Boolean).join(' ');
-    if (s && !(s.startsWith('#') || s.startsWith('---') || s.startsWith('<!--'))) return s;
-  }
-  return '';
-}
-
-/**
- * Agent/skill specs read straight off a DEPLOYED harness dir.
- *
- * Agents are flat `<root>/<name>.md` (skipping `_*` templates); skills use OpenCode's
- * folder layout `<root>/<name>/SKILL.md`. Matched case-INSENSITIVE on Windows via
- * `normcase`, not a bare `endsWith`. The frontmatter is stripped because it is host
- * plumbing rather than prose, which is what makes a deployed entry the same shape as a
- * source-rendered one and every consumer indifferent to the origin.
- */
-function specEntries(root, nested) {
-  const out = [];
-  if (!isDir(root)) return out;
-  let names;
-  try { names = readdirSync(root); } catch { return out; }
-  const files = nested
-    ? names.sort(comparePaths).filter((n) => isDir(path.join(root, n)))
-      .map((n) => path.join(root, n, 'SKILL.md'))
-    : names.filter((n) => normcase(n).endsWith('.md') && !n.startsWith('_'))
-      .sort(comparePaths).map((n) => path.join(root, n));
-  for (const p of files) {
-    if (!isFile(p)) continue;
-    const [fm, body] = frontmatter(readMaybe(p) ?? '');
-    const name = nested ? path.basename(path.dirname(p)) : path.basename(p, '.md');
-    out.push({ name, desc: specDesc(fm, body), body, source: resolvePath(p) });
-  }
-  out.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
-  return out;
-}
-
-/**
- * The agents and skills actually installed at `state.target`, not a fresh render of `src/`.
- *
- * All three constitutional tiers still come from the render: once deployed they live inside
- * AGENT.md rather than as separate files, so the deployed arm replaces the two ENTITY rosters
- * and none of the constitution. A deployed spec file carries neither a category nor a
- * lifecycle status, so each is tagged BY NAME from the same two sources the source render
- * uses — and an entity the registry does not know reads "personal" for both, which is the
- * honest answer rather than a borrowed one: filing it under the `build` fallback would claim
- * a Geneseed taxonomy slot it was never given.
- *
- * ⚠ THE PACK SELECTION IS THE ONE THING THE RENDER CANNOT KNOW. `renderAll` emits all four
- * pack files whatever `cfg.doctrines` says — measured: `makeCfg({doctrines:['craft']})` yields
- * the same 105 items — because the filtering happens when AGENT.md's §2 is assembled, not in
- * the walk. So the catalogue is always whole, and which packs this INSTALL built in comes from
- * its own carrier via `doctrinesForBuild`, which resolves "no marker" to every pack.
- */
-function deployedInventory(state) {
-  const render = tuiInventory(state.theme, doctrinesForBuild(state.target),
-    excludedRulesOfDir(state.target));
-  const registry = loadRegistry();
-  const skills = specEntries(path.join(state.target, 'skills'), true);
-  for (const e of skills) {
-    e.status = entityStatus(registry, `skills/${e.name}`);
-    e.klass = e.status === 'personal' ? 'personal'
-      : (Object.hasOwn(SKILL_CLASS, e.name) ? SKILL_CLASS[e.name] : 'build');
-  }
-  const agents = specEntries(path.join(state.target, 'agents'), false);
-  for (const e of agents) e.status = entityStatus(registry, `agents/${e.name}`);
-  return { agents,
-    skills,
-    laws: render.laws,
-    ontology: render.ontology,
-    doctrines: render.doctrines,
-    theme: state.theme };
-}
-
-/** The deployed record when there is one, else the source render. */
-function inventoryFor(state) {
-  return deployed(state) ? deployedInventory(state) : tuiInventory(state.theme);
-}
-
-// ---- the catalog stores overview counts ---------------------------------------------------
-
-/** Always `<target>/memory` — never the CWD-scanning resolver. */
-const memoryDir = (state) => path.join(state.target, 'memory');
-const notebookDir = (state) => path.join(state.target, 'notebook');
-
-/**
- * Matched case-insensitively on Windows.
- *
- * `comparePaths` and NOT a bare `.sort()`: on Windows, filenames sort case-insensitively, so
- * `MEMORY.md` sorts under `m` and lands after `a-fact.md`; JS's default comparator is UTF-16
- * code units, so `M` (0x4D) sorts before `a` (0x61) and the whole catalog comes back in a
- * different order. The `normcase` in the filter beside it only fixes matching, not
- * ordering — this is the other half.
- */
-function globMd(dir) {
-  if (!isDir(dir)) return [];
-  let names;
-  try { names = readdirSync(dir); } catch { return []; }
-  return names.filter((n) => normcase(n).endsWith('.md') && isFile(path.join(dir, n)))
-    .sort(comparePaths);
-}
-
-/** Filename without its extension — single owner, imported by `js/web/activity.mjs` too. */
-export const stemOf = (name) => name.slice(0, name.length - path.extname(name).length);
-
-export function memoryItems(state) {
-  const d = memoryDir(state);
-  if (!isDir(d)) return [];
-  return globMd(d).map((n) => {
-    const p = path.join(d, n);
-    const [fm] = frontmatter(readMaybe(p) ?? '');
-    const stem = stemOf(n);
-    return {
-      name: stem,
-      title: fm.has('name') ? fm.get('name') : stem,
-      desc: fm.has('description') ? fm.get('description') : '',
-      source: resolvePath(p),
-    };
-  });
-}
-
-function notebookItems(state) {
-  const d = notebookDir(state);
-  if (!isDir(d)) return [];
-  return globMd(d).map((n) => ({
-    name: stemOf(n), title: stemOf(n), desc: '', source: resolvePath(path.join(d, n)),
-  }));
-}
-
-/** The two setup manifests, in listing order. */
-const CONFIG_META = {
-  'context.json': ['Project context', 'what the agent loads for this project'],
-  'wiki.jsonc': ['Wiki manifest', 'your machine-wide knowledge base(s)'],
-};
-
-function configItems(state) {
-  const out = [];
-  for (const fname of ['context.json', 'wiki.jsonc']) {
-    const p = path.join(state.target, fname);
-    if (!isFile(p)) continue;
-    const [title, desc] = CONFIG_META[fname] ?? [fname, ''];
-    out.push({ name: fname, title, desc, type: 'config', kind: 'manifest',
-      source: resolvePath(p) });
-  }
-  return out;
-}
-
-const WIKI_FILE_CAP = 5000;
-
-/**
- * `resolvePath` for a path that came out of a HAND-MAINTAINED manifest — `null`, never a throw.
- *
- * The three wiki sites below, and `apiDeployCmd` in `js/web/actions.mjs`, are the
- * request-path callers of `expanduser`, and it REFUSES a `~user` form by printing and throwing
- * (`js/hosts/hosts.mjs`'s docblock). None of them may let that escape: `js/web/handler.mjs`
- * wraps the whole GET in a blanket `catch` → a JSON 500, so an unguarded refusal would turn
- * ONE bad line in a file the user hand-edits into a dead Knowledge section. That is the same
- * argument `sovereignBypass` makes in `js/hosts/hosts.mjs` — contain the refusal per entry
- * and take the site's OWN degrade — and each of the three already has one: `[]`, `continue`,
- * `continue`-into-404.
- *
- * `withDiscardableStderr` because `expanduser` prints its refusal at the RAISE SITE, and
- * this caller wants that swallowed along with the exception rather than logged.
- *
- * DELIBERATE PRODUCT DECISION: a `~otherUser` path is refused rather than resolved, even
- * where the account happens to exist — reading another account's files through a
- * hand-edited wiki manifest is not a feature.
- */
-function wikiPath(p) {
-  try {
-    return withDiscardableStderr(() => resolvePath(p));
-  } catch {
-    return null;
-  }
-}
-
-/**
- * `$GENESEED_WIKI` first, else `wiki.jsonc` beside the deployed bundle, read with the
- * harness's generic JSONC loader.
- *
- * `resolvePath`, not merely `expanduser`: harmless here because `p` is consumed by `isFile`
- * and `mcpLoad` and never reaches a response body, and both of those follow symlinks and
- * resolve a relative path against the same cwd anyway.
- */
-function wikiManifest(state) {
-  const cand = process.env.GENESEED_WIKI;
-  const p = cand ? wikiPath(cand) : path.join(state.target, 'wiki.jsonc');
-  if (!p || !isFile(p)) return [];
-  const cfg = mcpLoad(p);
-  const wikis = cfg.wikis;
-  return Array.isArray(wikis) ? wikis : [];
-}
-
-/**
- * The COMMENT-TOLERANT dict loader, `{}` for a file that is missing, unreadable,
- * unparseable, or not an object.
- *
- * Comment-tolerant is the whole point, and getting this wrong is silent: the two files it
- * reads are `wiki.jsonc` and `context.json`, hand-maintained, so a `//` line is expected.
- * Plain `JSON.parse` would throw on it and this loader would then answer `{}` — the wiki
- * section listing nothing and the config item's `manifest` coming back empty, with no
- * error surfaced anywhere.
- */
-function mcpLoad(p) {
-  if (!isFile(p)) return {};
-  let text;
-  try { text = readText(p); } catch { return {}; }
-  const [data] = readJsonc(text);
-  return data && typeof data === 'object' && !Array.isArray(data) ? data : {};
-}
-
-/**
- * Every `.md` under `dir`, recursively.
- *
- * `recursive: true` replaces a hand-rolled walk; its one caller re-sorts the result with
- * `comparePaths` before using it, so the order this returns is never observed.
- */
-function rglobMd(dir) {
-  let entries;
-  try { entries = readdirSync(dir, { recursive: true, withFileTypes: true }); } catch { return []; }
-  return entries
-    .filter((e) => e.isFile() && normcase(e.name).endsWith('.md'))
-    .map((e) => path.join(e.parentPath, e.name));
-}
-
-export function wikiItems(state) {
-  const items = [];
-  const seen = new Set();
-  for (const w of wikiManifest(state)) {
-    if (!w || typeof w !== 'object' || Array.isArray(w)) continue;
-    const wname = String(dget(w, 'name', null) || 'wiki');
-    // PER ENTRY, and the loop continues — one unusable `path` in the manifest must not
-    // blank every OTHER vault in it.
-    const root = wikiPath(String(dget(w, 'path', null) || ''));
-    if (!root || !isDir(root)) continue;
-    // A hand-edited `entries` that is not a list (`{}`, a string) is a malformed vault, not a
-    // crash: `/api/status` counts these, and one bad manifest must not fail the dashboard.
-    const rawEntries = dget(w, 'entries', null);
-    const entries = (Array.isArray(rawEntries) ? rawEntries : [])
-      .filter((e) => e && typeof e === 'object' && !Array.isArray(e));
-    const excludes = entries.filter((e) => dget(e, 'load', null) === 'exclude')
-      .map((e) => String(dget(e, 'path', null) || '').replace(/^\/+|\/+$/g, '').replace(/\\/g, '/'));
-    const excluded = (rel) => excludes.some((x) => x && (rel === x || rel.startsWith(`${x}/`)));
-
-    for (const e of entries) {
-      if (dget(e, 'load', null) === 'exclude') continue;
-      const rel = String(dget(e, 'path', null) || '').replace(/^\/+|\/+$/g, '').replace(/\\/g, '/');
-      const desc = String(dget(e, 'description', null) || '');
-      const fp = path.join(root, rel);
-      let mds;
-      if (isFile(fp) && path.extname(fp) === '.md') mds = [fp];
-      // Capped and sorted via `comparePaths`, for the reason `globMd` carries.
-      else if (isDir(fp)) mds = rglobMd(fp).sort(comparePaths).slice(0, WIKI_FILE_CAP);
-      else continue;
-      for (const md of mds) {
-        const r = path.relative(root, md).split(path.sep).join('/');
-        const key = `${wname}:${r}`;
-        if (seen.has(key) || excluded(r)) continue;
-        seen.add(key);
-        items.push({ name: key, title: path.basename(md, '.md'),
-          desc: mds.length === 1 ? desc : r, type: 'wiki', kind: 'page', group: wname,
-          source: resolvePath(md) });
-      }
-    }
-  }
-  return items;
-}
-
-/** One page by `<wiki>:<relpath>`, never outside the vault. */
-function apiWikiItem(state, name) {
-  const at = name.indexOf(':');
-  const wname = at < 0 ? name : name.slice(0, at);
-  const rel = (at < 0 ? '' : name.slice(at + 1))
-    .replace(/^\/+|\/+$/g, '').replace(/\\/g, '/');
-  for (const w of wikiManifest(state)) {
-    if (!w || typeof w !== 'object' || Array.isArray(w)) continue;
-    if (String(dget(w, 'name', null) || 'wiki') !== wname) continue;
-    // An unresolvable or refused root falls through to the `NotFound` below, the same as
-    // one that simply does not exist.
-    const root = wikiPath(String(dget(w, 'path', null) || ''));
-    if (!root) continue;
-    const p = resolvePath(path.join(root, rel));
-    if (rel && path.extname(p) === '.md' && within(p, root) && isFile(p)) {
-      const body = readMaybe(p) ?? '';
-      return { type: 'wiki', name, title: path.basename(p, '.md'), desc: '',
-        body, links: resolveLinks(state, body), source: p };
-    }
-  }
-  throw new NotFound(name);
-}
-
-/**
- * Re-exported from `js/lib/paths.mjs`, where the lib split put it.
- *
- * ⚠ A SECOND, INDEPENDENT COPY lives in `js/inspect/scan.mjs`, written for the doctor's tree
- * walks. A change to the containment rule has to land on both, and nothing compares them.
- *
- * Re-exported here (rather than imported directly by callers) so `js/web/actions.mjs`'s
- * import path stays unchanged.
- */
-export { within };
-
-/**
- * Catalog names are flat basenames.
- *
- * A separator, a `..` or a drive colon in the URL segment is someone steering the join
- * outside the catalog dir. A GET carries no token, so before this check the endpoint was
- * an arbitrary-file read; it raises rather than resolving.
- */
-function flatName(name) {
-  if (!name || name.includes('/') || name.includes('\\') || name.includes('..')
-      || name.includes(':')) {
-    throw new NotFound(name);
-  }
-}
-
-const WIKILINK_RE = /\[\[([^\]]+)\]\]/g;
-
-/**
- * `[[name]]` matched against known agent and skill names.
- *
- * AGENTS FIRST, SKILLS SECOND, into ONE map — so a name that is both resolves as a SKILL.
- * This ordering is deliberate and must not be swapped.
- */
-export function resolveLinks(state, body) {
-  const inv = state.inventory;
-  const known = new Map();
-  for (const e of inv.agents) known.set(e.name, 'agent');
-  for (const e of inv.skills) known.set(e.name, 'skill');
-  const links = [];
-  const seen = new Set();
-  for (const m of body.matchAll(WIKILINK_RE)) {
-    // `stripWhitespace`, not `trim()` — the two whitespace classes differ, and both call
-    // sites on this regex must answer with the same rule.
-    const label = stripWhitespace(m[1]);
-    if (known.has(label) && !seen.has(label)) {
-      seen.add(label);
-      links.push({ label, type: known.get(label), name: label });
-    }
-  }
-  return links;
-}
-
-/**
- * A setup file parsed into the shape the detail pane renders as cards, or `null` so the
- * caller falls back to the raw body.
- */
-function configManifest(name, p) {
-  const cfg = mcpLoad(p);
-  if (name === 'wiki.jsonc') {
-    const wikis = cfg.wikis;
-    return { kind: 'wiki', wikis: Array.isArray(wikis) ? wikis : [] };
-  }
-  if (name === 'context.json') {
-    const ctx = cfg.context;
-    return { kind: 'context', context: Array.isArray(ctx) ? ctx : [] };
-  }
-  return null;
-}
-
-/**
- * A closed list; anything else is a 404.
- *
- * ⚠ `laws` STAYS ONE SECTION FOR ALL THREE TIERS, and that is a decision rather than an
- * oversight. The console has ONE Constitution entry, not three, so a reader keeps the "read it
- * top to bottom" property; the id stays `laws` because `tests/helpers/cli_golden.mjs`
- * hard-requires `web/src/pages/Laws.jsx` and because a route rename buys nothing and costs a
- * redirect. The tier lives on the ITEM (`tier: 'ontology' | 'invariant' | 'doctrine'`), which
- * is where a consumer can act on it.
- */
-export const SECTIONS = ['agents', 'skills', 'laws', 'memory', 'notebook', 'wiki', 'config'];
+import { isFile } from '../lib/fs.mjs';
+import { comparePaths, normcase } from '../lib/paths.mjs';
+import {
+  configItems, deployed, dget, memoryItems, notebookItems, wikiItems,
+} from './catalog.mjs';
+import { stampMinute } from './state.mjs';
 
 /**
- * The `laws` section's items — the whole constitution, in constitutional order, one flat list.
- *
- * FLAT AND NOT NESTED, because every other section is `{section, items}` and a second shape
- * for one section is a second client path for one roster. The pack's grouping metadata rides
- * on each doctrine row (`pack`, `packTitle`, `packDesc`, `active`), so a consumer groups by
- * `pack` and has everything a header needs without a second fetch.
- *
- * Names are ADDRESSES and the three shapes cannot collide: `ont:<slug>` carries a colon no
- * numeral has, an invariant is `[IVXLCDM]+`, a doctrine rule is `<pack>.<n>`. `apiItem`
- * resolves all three off the same list.
+ * `js/web/docs.mjs` imports these three from HERE, and that file is outside this split — so
+ * they are re-exported rather than moved out from under it. New code imports `catalog.mjs`.
  */
-function constitutionItems(inv) {
-  return [
-    ...(inv.ontology ?? []).map((e) => ({ name: `ont:${e.id}`, title: e.title, desc: '',
-      tier: 'ontology' })),
-    ...inv.laws.map((e) => ({ name: e.num, title: `Rule ${e.num} — ${e.title}`, desc: '',
-      klass: e.klass ?? 'craft', tier: 'invariant' })),
-    ...(inv.doctrines ?? []).flatMap((p) => p.rules.map((r) => ({
-      name: `${r.pack}.${r.n}`,
-      title: `Doctrine ${r.pack} ${r.n} — ${r.title}`,
-      desc: '',
-      klass: r.klass ?? p.pack,
-      tier: 'doctrine',
-      pack: p.pack,
-      packTitle: p.title,
-      packDesc: p.desc,
-      // ⚠ EVERY RULE IS LISTED WHETHER OR NOT IT IS BUILT IN, and `active` is the RULE's own
-      // — a pack can be on with one rule excluded. A row that vanished from the payload would
-      // be indistinguishable from one that never shipped, and the console could not then
-      // offer the switch that turns it back on.
-      active: r.active !== false,
-      packActive: p.active,
-    }))),
-  ];
-}
+export { NotFound, deployed, resolveLinks } from './catalog.mjs';
 
-export function apiCatalog(state, section) {
-  if (!SECTIONS.includes(section)) throw new NotFound(section);
-  const inv = state.inventory;
-  let items;
-  if (section === 'agents') {
-    items = inv.agents.map((e) => ({ name: e.name, title: e.name, desc: e.desc,
-      source: e.source ?? null, status: e.status ?? 'unknown' }));
-  } else if (section === 'skills') {
-    items = inv.skills.map((e) => ({ name: e.name, title: e.name, desc: e.desc,
-      source: e.source ?? null, klass: e.klass ?? 'build', status: e.status ?? 'unknown' }));
-  } else if (section === 'laws') {
-    items = constitutionItems(inv);
-  } else if (section === 'memory') {
-    items = memoryItems(state);
-  } else if (section === 'notebook') {
-    items = notebookItems(state);
-  } else if (section === 'wiki') {
-    items = wikiItems(state);
-  } else {
-    items = configItems(state);
-  }
-  return { section, items };
-}
-
-export function apiItem(state, type, name) {
-  const inv = state.inventory;
-  if (type === 'agent' || type === 'skill') {
-    const e = (type === 'agent' ? inv.agents : inv.skills).find((x) => x.name === name);
-    if (!e) throw new NotFound(name);
-    const out = { type, name, title: name, desc: e.desc, body: e.body,
-      links: resolveLinks(state, e.body), source: e.source ?? null };
-    if (type === 'skill') out.klass = e.klass ?? 'build';
-    out.status = e.status ?? 'unknown';
-    return out;
-  }
-  if (type === 'law') {
-    // ONE ARM FOR THREE TIERS, resolved off the same list the catalogue publishes — so a name
-    // that appears in `/api/catalog/laws` always opens, and one that does not always 404s.
-    // Building the list twice is what would let the two drift.
-    const e = constitutionItems(inv).find((x) => x.name === name);
-    if (!e) throw new NotFound(name);
-    const body = e.tier === 'ontology'
-      ? (inv.ontology.find((s) => `ont:${s.id}` === name)?.body ?? '')
-      : (e.tier === 'invariant'
-        ? (inv.laws.find((x) => x.num === name)?.body ?? '')
-        : (inv.doctrines.flatMap((p) => p.rules)
-          .find((r) => `${r.pack}.${r.n}` === name)?.body ?? ''));
-    // `links: []` — a constitution body is not link-resolved. It cites its siblings by
-    // ADDRESS (`Rule IV`, `Doctrine ops 1`, `Ontology: Telos`), not by path, and there is no
-    // file behind those to resolve to.
-    return { ...e, type, name, body, links: [] };
-  }
-  if (type === 'memory' || type === 'notebook') {
-    flatName(name);
-    const d = type === 'notebook' ? notebookDir(state) : memoryDir(state);
-    const p = path.join(d, `${name}.md`);
-    if (!isFile(p)) throw new NotFound(name);
-    const body = readMaybe(p) ?? '';
-    return { type, name, title: name, desc: '', body,
-      links: resolveLinks(state, body), source: resolvePath(p) };
-  }
-  if (type === 'wiki') return apiWikiItem(state, name);
-  if (type === 'config') {
-    flatName(name);
-    const p = path.join(state.target, name);
-    if (!isFile(p)) throw new NotFound(name);
-    const raw = readMaybe(p) ?? '';
-    const [title, desc] = CONFIG_META[name] ?? [name, ''];
-    return { type, name, title, desc, manifest: configManifest(name, p),
-      body: `\`\`\`json\n${raw}\n\`\`\``, links: [], source: resolvePath(p) };
-  }
-  throw new NotFound(type);
-}
+/** Two resolved paths, compared case-folded on Windows. */
+const samePath = (a, b) => normcase(resolvePath(a)) === normcase(resolvePath(b));
 
 // ---- the eight endpoints -------------------------------------------------------------
 
@@ -717,10 +85,18 @@ export function apiDoctor(state) {
     checked_at: state.doctor.checked_at };
 }
 
+/**
+ * `deployed` and `diffable` are TWO FACTS, and they used to be one field. `diffCollect` answers
+ * `files: null` for every PROJECT install (it only knows how to re-render a global emit), so
+ * `deployed: files !== null` told the Diff page a perfectly real project install was "No deployed
+ * harness". `deployed` is the manifest's answer, the same one every other endpoint gives;
+ * `diffable` is whether a drift check exists for this install at all.
+ */
 export function apiDiff(state) {
   const { target, theme, files } = diffCollect({
     target: state.target, theme: state.theme, emit: state.emit });
-  return { deployed: files !== null, target, theme, files: files || [] };
+  return { deployed: deployed(state), diffable: files !== null, target, theme,
+    files: files || [] };
 }
 
 /** The union across every global install, verbatim. */
@@ -747,7 +123,7 @@ export function apiInstalls(state) {
       footprint: footprintOfDir(root),
       posture: postureOfDir(root),
       mode: modeOfDir(root),
-      trust: trustOfDir(root),
+      trust: trustOfDir(root, host),
       selected: samePath(viewCfg(host, scope, root), state.target),
     });
   }
@@ -755,20 +131,6 @@ export function apiInstalls(state) {
     modes: discoverNames('modes', 'direct'), trusts: Object.keys(PRESETS) };
 }
 
-/** Beside the deployed AGENT.md. */
-export const PROFILE_FILE = 'PROFILE.md';
-const profilePath = (state) => path.join(state.target, PROFILE_FILE);
-
-function apiProfile(state) {
-  const p = profilePath(state);
-  if (!isFile(p)) return { exists: false, path: p, text: '', fingerprint: '' };
-  const text = readMaybe(p) ?? '';
-  // `seeded`: the file is still the template the build wrote once and never touched since.
-  // `readMaybe` normalises line endings, so a CRLF copy (the emit writes the platform's, and
-  // an editor may re-save either way) still compares equal to the LF literal.
-  const seeded = text === PROFILE_STUB;
-  return { exists: true, path: p, text, fingerprint: fingerprint(text), seeded };
-}
 
 /** The dashboard aggregate. */
 export function apiOverview(state) {
@@ -986,49 +348,3 @@ function releaseLabel() {
   return v && v !== '0.0.0' ? v : null;
 }
 
-/**
- * The prefix routes — path in, response out.
- *
- * `percentDecode` and not `decodeURIComponent`: the JS builtin throws a `URIError` on a `%`
- * that is not an escape, where this shell instead answers a 404 naming the literal text.
- */
-export const PREFIX_ROUTES = [
-  ['/api/catalog/', (state, p) => apiCatalog(state, p.split('/').pop())],
-  // /api/item/<type>/<name> — TYPE has no slash, the NAME keeps its slashes so a wiki
-  // page's relpath survives. A missing name is a 404 here rather than a 500 two frames down.
-  ['/api/item/', (state, p) => {
-    const m = /^\/api\/item\/([^/]+)\/(.+)$/.exec(p);
-    if (!m) throw new NotFound(p);
-    return apiItem(state, m[1], percentDecode(m[2]));
-  }],
-  // The sid is passed through unquoted — `apiActivityDetail`'s safe-name scheme is what
-  // makes the lookup safe, rather than a check out here.
-  ['/api/activity/', (state, p) => apiActivityDetail(
-    state, percentDecode(p.slice('/api/activity/'.length)))],
-];
-
-/**
- * A literal path to `api_X(state)`, table-keyed rather than a chain of `if`s — the reason
- * it is a table is `tests/unit/web_server.test.mjs`'s cross-check, which requires this
- * table plus `PREFIX_ROUTES` and `GET_INLINE` to equal a surface list written out in the
- * test, so a route cannot appear or vanish unenumerated.
- */
-export const STATE_ROUTES = {
-  '/api/overview': apiOverview,
-  '/api/recent': apiRecent,
-  '/api/themes': apiThemes,
-  '/api/setup': apiSetup,
-  '/api/doctor': apiDoctor,
-  '/api/installs': apiInstalls,
-  '/api/excludes': apiExcludes,
-  '/api/profile': apiProfile,
-  '/api/diff': apiDiff,
-  '/api/activity': apiActivity,
-  // `/api/rules` must exist as a PAIR with its POST: `apiRulesMutate` splices `parseRules`'
-  // line indices, and the fingerprint every mutation must send back is what this GET
-  // answers — a daemon whose POST worked and whose GET 501'd would have no way to obtain one.
-  '/api/rules': apiRules,
-  '/api/mcp': apiMcp,
-  '/api/loops': apiLoops,
-  '/api/loops/active': apiLoopsActive,
-};