isotone 1.1.2 → 1.2.0

package/dist/serve.d.ts

@@ -6,9 +6,11 @@ declare function readBundle(): string;
 
 declare const DEFAULT_PORT = 4123;
 interface ServeIterationOptions {
-    /** Background npm notice, at most once a day. false disables the check. */
-    checkForUpdates?: boolean;
-    /** Project directory for the suggested update command. Defaults to the notes directory. */
+    /** Background npm notice, at most once a day. false disables the check;
+     *  'note' also files an update note for your agent once per new version. */
+    checkForUpdates?: boolean | 'note';
+    /** Project directory for the suggested update command and for
+     *  `.isotone/knobs.json`. Defaults to the notes directory. */
     projectRoot?: string;
     /** Defaults to auto (page background); system follows the OS preference. */
     theme?: IterationTheme;

package/dist/serve.js

@@ -1,6 +1,8 @@
 import {
-  readBundle
-} from "./chunk-RQ2YI5KS.js";
+  autoUpdateNote,
+  readBundle,
+  updateResponse
+} from "./chunk-YPDV3PX4.js";
 import {
   HttpError,
   checkOrigin,
@@ -8,20 +10,42 @@ import {
   readNodeJson,
   sendFailure
 } from "./chunk-DDMHJ23I.js";
+import {
+  guardedScriptTag
+} from "./chunk-MX4RQJFV.js";
 import {
   UPDATE_ENDPOINT,
   startUpdateCheck
-} from "./chunk-I7CZUPDO.js";
+} from "./chunk-KRS57POF.js";
 import {
   NOTES_ENDPOINT,
   ensureFileIgnored,
-  notesResponse
-} from "./chunk-X6V2AKJL.js";
-import "./chunk-A4DX2V4C.js";
+  notesResponse,
+  readKnobs
+} from "./chunk-L6O4HYGP.js";
+import "./chunk-JCTWHR7U.js";
+import {
+  VARIANTS_ENDPOINT
+} from "./chunk-BTJHQXF7.js";
 
 // src/serve/index.ts
 import { createServer } from "http";
 import { dirname, resolve } from "path";
+
+// src/serve/mount-config.ts
+function serveMountOptions(origin, projectRoot, opts) {
+  const knobs = readKnobs({ root: projectRoot }).length > 0;
+  return {
+    endpoint: `${origin}${NOTES_ENDPOINT}`,
+    ...knobs ? { variants: "knobs", variantsEndpoint: `${origin}${VARIANTS_ENDPOINT}` } : {},
+    updateEndpoint: `${origin}${UPDATE_ENDPOINT}`,
+    key: opts.key ?? "",
+    rule: opts.rule ?? {},
+    theme: opts.theme
+  };
+}
+
+// src/serve/index.ts
 var DEFAULT_PORT = 4123;
 var BUNDLE_PATH = "/isotone.js";
 function allowedOrigin(origin) {
@@ -44,14 +68,8 @@ function cors(req, res) {
     res.setHeader("Access-Control-Max-Age", "600");
   }
 }
-function bundleWithMount(origin, opts) {
-  const config = JSON.stringify({
-    endpoint: `${origin}${NOTES_ENDPOINT}`,
-    updateEndpoint: `${origin}${UPDATE_ENDPOINT}`,
-    key: opts.key ?? "",
-    rule: opts.rule ?? {},
-    theme: opts.theme
-  });
+function bundleWithMount(origin, opts, projectRoot) {
+  const config = JSON.stringify(serveMountOptions(origin, projectRoot, opts));
   return `${readBundle()}
 ;window.__isotone&&window.__isotone.mount(${config});
 `;
@@ -65,7 +83,7 @@ function escapeHtml(v) {
   return v.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
 function indexPage(origin, file) {
-  const tag = `<script src="${origin}${BUNDLE_PATH}" defer></script>`;
+  const tag = guardedScriptTag(`${origin}${BUNDLE_PATH}`);
   const mark = bookmarklet(origin);
   return `<!doctype html>
 <html lang="en">
@@ -89,7 +107,7 @@ function indexPage(origin, file) {
          box-shadow: 0 0 10px rgba(74,222,128,.5); }
   h1 { font-family: var(--mono); font-size: 14px; font-weight: 500; letter-spacing: .02em; }
   .sub { color: var(--muted); font-size: 13px; margin-bottom: 40px; }
-  .sub code { font-family: var(--mono); font-size: 11.5px; color: var(--fg); }
+  .sub code, p.note code { font-family: var(--mono); font-size: 11.5px; color: var(--fg); }
   h2 { font-family: var(--mono); font-size: 10.5px; font-weight: 500;
        letter-spacing: .08em; text-transform: uppercase; color: var(--faint);
        margin: 32px 0 10px; }
@@ -122,12 +140,14 @@ function indexPage(origin, file) {
   <header><span class="dot"></span><h1>Isotone</h1></header>
   <p class="sub">Serving the feedback loop on <code>${escapeHtml(origin)}</code>.</p>
 
-  <h2>Script tag for your dev page</h2>
+  <h2>Script for your dev pages</h2>
   <div class="card row">
     <pre>${escapeHtml(tag)}</pre>
     <button type="button" class="copy" data-c="${escapeHtml(tag)}"
       onclick="navigator.clipboard.writeText(this.dataset.c);this.textContent='copied';setTimeout(()=>this.textContent='copy',1200)">copy</button>
   </div>
+  <p class="note">It loads the panel only on localhost, so it stays inert if the page ships.
+  Behind a development flag, a plain <code>&lt;script src="${escapeHtml(origin + BUNDLE_PATH)}" defer&gt;</code> works too.</p>
 
   <h2>Bookmarklet \u2014 drag to your bookmarks bar</h2>
   <a class="bm" href="${escapeHtml(mark)}">\u270E Iteration</a>
@@ -143,11 +163,14 @@ function indexPage(origin, file) {
 }
 function serveIteration(opts) {
   const file = resolve(opts.file);
+  const projectRoot = resolve(opts.projectRoot ?? dirname(file));
   const port = opts.port ?? DEFAULT_PORT;
   const host = opts.host ?? "127.0.0.1";
   if (!isLoopback(host)) throw new Error("isotone serve binds only to localhost, 127.0.0.1 or ::1.");
   ensureFileIgnored(file);
-  const updates = startUpdateCheck(opts.projectRoot ?? dirname(file), opts.checkForUpdates !== false);
+  const updates = startUpdateCheck(projectRoot, opts.checkForUpdates !== false);
+  if (opts.checkForUpdates === "note") void updates.ready.then(() => autoUpdateNote(file, updates.getSnapshot())).catch(() => {
+  });
   let boundPort = port;
   const server = createServer((req, res) => {
     cors(req, res);
@@ -167,16 +190,18 @@ function serveIteration(opts) {
       return;
     }
     if (path === UPDATE_ENDPOINT) {
-      res.setHeader("content-type", "application/json; charset=utf-8");
-      res.setHeader("cache-control", "no-store");
-      res.statusCode = method === "GET" ? 200 : 405;
-      res.end(JSON.stringify(method === "GET" ? updates.getSnapshot() : { error: "method not allowed" }));
+      (method === "POST" ? readNodeJson(req) : Promise.resolve(void 0)).then((body) => {
+        const out = updateResponse(file, updates.getSnapshot(), { method, body });
+        res.statusCode = out.status;
+        for (const [key, value] of Object.entries(out.headers)) res.setHeader(key, value);
+        res.end(JSON.stringify(out.body));
+      }).catch((error) => sendFailure(res, error));
       return;
     }
     if (path === BUNDLE_PATH && method === "GET") {
       let body;
       try {
-        body = bundleWithMount(origin, opts);
+        body = bundleWithMount(origin, opts, projectRoot);
       } catch (err) {
         res.statusCode = 500;
         res.setHeader("content-type", "text/plain; charset=utf-8");
@@ -189,6 +214,18 @@ function serveIteration(opts) {
       res.end(body);
       return;
     }
+    if (path === VARIANTS_ENDPOINT || path.startsWith(`${VARIANTS_ENDPOINT}/`)) {
+      res.setHeader("content-type", "application/json; charset=utf-8");
+      res.setHeader("cache-control", "no-store");
+      if (path === VARIANTS_ENDPOINT && method === "GET") {
+        res.statusCode = 200;
+        res.end(JSON.stringify({ variants: [], active: [], knobs: readKnobs({ root: projectRoot }) }));
+      } else {
+        res.statusCode = 405;
+        res.end(JSON.stringify({ error: "isotone serve has knobs only; file variants need the Vite plugin" }));
+      }
+      return;
+    }
     if (path === NOTES_ENDPOINT) {
       if (method !== "GET" && method !== "POST" && method !== "DELETE") {
         res.statusCode = 405;

package/dist/serve.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/serve/index.ts"],"sourcesContent":["/**\n * isotone — the standalone dev server.\n *\n * The plug-and-play path. Run it in the repo you are reviewing and it owns the\n * notes file, serves the endpoint, and hands out the panel as a single script\n * so the host app needs no build integration at all:\n *\n *   npx isotone serve\n *   # then, in dev only, one line in the host's HTML:\n *   <script src=\"http://127.0.0.1:4123/isotone.js\" defer></script>\n *\n * Running it inside the repo is what keeps a note unambiguous: the process that\n * owns the file is the checkout the agent is working in, so a route and a\n * selector always point somewhere. Nothing about which port served the page has\n * to be mapped back to a repo.\n *\n * The Vite plugin remains the two-line convenience for a Vite host; this is for\n * every other runtime, and for a page whose dev server you cannot configure at\n * all (paste the bookmarklet the index page prints).\n */\nimport { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http';\nimport { dirname, resolve } from 'node:path';\n\nimport type { RouteGateOptions } from '../core/index';\nimport type { IterationTheme } from '../react/theme';\nimport { checkOrigin, HttpError, isLoopback, readNodeJson, sendFailure } from '../server/http';\nimport { ensureFileIgnored, notesResponse, NOTES_ENDPOINT } from '../store';\n\nimport { readBundle } from '../standalone/bundle';\nimport { startUpdateCheck, UPDATE_ENDPOINT } from '../update';\nexport { readBundle } from '../standalone/bundle';\n\nexport const DEFAULT_PORT = 4123;\nconst BUNDLE_PATH = '/isotone.js';\n\nexport interface ServeIterationOptions {\n  /** Background npm notice, at most once a day. false disables the check. */\n  checkForUpdates?: boolean;\n  /** Project directory for the suggested update command. Defaults to the notes directory. */\n  projectRoot?: string;\n  /** Defaults to auto (page background); system follows the OS preference. */\n  theme?: IterationTheme;\n  /** Where notes persist. Git-ignored automatically via `.git/info/exclude`. */\n  file: string;\n  /** Defaults to 4123. */\n  port?: number;\n  /** Defaults to 127.0.0.1 — a dev loop has no business on 0.0.0.0. */\n  host?: string;\n  /** Route visibility rule handed to the panel. */\n  rule?: RouteGateOptions;\n  /** localStorage namespace for the panel. */\n  key?: string;\n}\n\nexport interface ServedIteration {\n  port: number;\n  url: string;\n  bundleUrl: string;\n  close(): Promise<void>;\n}\n\n/**\n * Only localhost may talk to this server.\n *\n * The endpoint writes a file, and a wide-open `*` would let any page you happen\n * to visit post notes into the repo you are reviewing. Restricting the allowed\n * origin to loopback keeps a drive-by from a public site out while leaving\n * every real dev origin (any localhost port, http or https) working.\n */\nfunction allowedOrigin(origin: string | undefined): string | null {\n  if (!origin) return null;\n  try {\n    const { hostname, protocol } = new URL(origin);\n    const loopback =\n      hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]' || hostname === '::1';\n    return loopback && (protocol === 'http:' || protocol === 'https:') ? origin : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction cors(req: IncomingMessage, res: ServerResponse): void {\n  const origin = allowedOrigin(req.headers.origin);\n  res.setHeader('Vary', 'Origin');\n  if (origin) {\n    res.setHeader('Access-Control-Allow-Origin', origin);\n    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');\n    res.setHeader('Access-Control-Allow-Headers', 'Content-Type');\n    res.setHeader('Access-Control-Max-Age', '600');\n  }\n}\n\n/** The bundle plus the mount call, with the config the server itself knows. */\nfunction bundleWithMount(origin: string, opts: ServeIterationOptions): string {\n  const config = JSON.stringify({\n    endpoint: `${origin}${NOTES_ENDPOINT}`,\n    updateEndpoint: `${origin}${UPDATE_ENDPOINT}`,\n    key: opts.key ?? '',\n    rule: opts.rule ?? {},\n    theme: opts.theme,\n  });\n  return `${readBundle()}\\n;window.__isotone&&window.__isotone.mount(${config});\\n`;\n}\n\nfunction bookmarklet(origin: string): string {\n  return `javascript:(function(){var s=document.createElement('script');s.src=${JSON.stringify(\n    `${origin}${BUNDLE_PATH}`,\n  )};s.defer=true;document.body.appendChild(s);})()`;\n}\n\nfunction escapeHtml(v: string): string {\n  return v\n    .replace(/&/g, '&amp;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n    .replace(/\"/g, '&quot;');\n}\n\nfunction indexPage(origin: string, file: string): string {\n  const tag = `<script src=\"${origin}${BUNDLE_PATH}\" defer></script>`;\n  const mark = bookmarklet(origin);\n  return `<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<title>Isotone</title>\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">\n<style>\n  * { box-sizing: border-box; margin: 0; }\n  :root {\n    --bg: #0d0d10; --card: #131317; --line: rgba(255,255,255,.09);\n    --fg: #ececf1; --muted: #8f8f9a; --faint: #5f5f6a;\n    --sans: Inter, ui-sans-serif, system-ui, -apple-system, sans-serif;\n    --mono: ui-monospace, \"SF Mono\", Menlo, monospace;\n  }\n  body { background: var(--bg); color: var(--fg); font: 14px/1.6 var(--sans);\n         -webkit-font-smoothing: antialiased; }\n  .wrap { max-width: 540px; margin: 0 auto; padding: 12vh 24px 8vh; }\n  header { display: flex; align-items: center; gap: 10px; margin-bottom: 6px; }\n  .dot { width: 7px; height: 7px; border-radius: 9999px; background: #4ade80;\n         box-shadow: 0 0 10px rgba(74,222,128,.5); }\n  h1 { font-family: var(--mono); font-size: 14px; font-weight: 500; letter-spacing: .02em; }\n  .sub { color: var(--muted); font-size: 13px; margin-bottom: 40px; }\n  .sub code { font-family: var(--mono); font-size: 11.5px; color: var(--fg); }\n  h2 { font-family: var(--mono); font-size: 10.5px; font-weight: 500;\n       letter-spacing: .08em; text-transform: uppercase; color: var(--faint);\n       margin: 32px 0 10px; }\n  .card { background: var(--card); border: 1px solid var(--line);\n          border-radius: 12px; padding: 13px 16px; }\n  .card.row { display: flex; align-items: center; gap: 14px; }\n  .card pre { font-family: var(--mono); font-size: 12px; line-height: 1.7;\n              color: var(--fg); overflow-x: auto; white-space: pre;\n              scrollbar-width: none; min-width: 0; }\n  .card.row pre { flex: 1; }\n  .card pre::-webkit-scrollbar { display: none; }\n  .card pre .c { color: var(--faint); }\n  .copy { flex: none; font-family: var(--mono); font-size: 10px;\n          color: var(--faint); background: none; padding: 4px 9px;\n          border: 1px solid var(--line); border-radius: 6px; cursor: pointer; }\n  .copy:hover { color: var(--fg); border-color: rgba(255,255,255,.2); }\n  p.note { color: var(--muted); font-size: 12.5px; margin-top: 10px; }\n  a.bm { display: inline-flex; align-items: center; gap: 8px; margin-top: 2px;\n         padding: 8px 14px; border: 1px solid var(--line); border-radius: 8px;\n         background: var(--card); color: var(--fg); text-decoration: none;\n         font-family: var(--mono); font-size: 12px; }\n  a.bm:hover { border-color: rgba(255,255,255,.2); }\n  footer { margin-top: 48px; padding-top: 16px; border-top: 1px solid var(--line);\n           font-family: var(--mono); font-size: 10.5px; color: var(--faint);\n           line-height: 2; overflow-wrap: anywhere; }\n</style>\n</head>\n<body>\n<div class=\"wrap\">\n  <header><span class=\"dot\"></span><h1>Isotone</h1></header>\n  <p class=\"sub\">Serving the feedback loop on <code>${escapeHtml(origin)}</code>.</p>\n\n  <h2>Script tag for your dev page</h2>\n  <div class=\"card row\">\n    <pre>${escapeHtml(tag)}</pre>\n    <button type=\"button\" class=\"copy\" data-c=\"${escapeHtml(tag)}\"\n      onclick=\"navigator.clipboard.writeText(this.dataset.c);this.textContent='copied';setTimeout(()=>this.textContent='copy',1200)\">copy</button>\n  </div>\n\n  <h2>Bookmarklet — drag to your bookmarks bar</h2>\n  <a class=\"bm\" href=\"${escapeHtml(mark)}\">✎ Iteration</a>\n\n  <footer>\n    notes → ${escapeHtml(file)}<br>\n    loopback origins only\n  </footer>\n</div>\n</body>\n</html>\n`;\n}\n\n/** Start the server. Resolves once it is listening. */\nexport function serveIteration(\n  opts: ServeIterationOptions,\n): Promise<ServedIteration> {\n  const file = resolve(opts.file);\n  const port = opts.port ?? DEFAULT_PORT;\n  const host = opts.host ?? '127.0.0.1';\n  if (!isLoopback(host)) throw new Error('isotone serve binds only to localhost, 127.0.0.1 or ::1.');\n  ensureFileIgnored(file);\n  const updates = startUpdateCheck(opts.projectRoot ?? dirname(file), opts.checkForUpdates !== false);\n\n  // The port we were ASKED for is not necessarily the one we got: 0 means \"any\n  // free port\". The panel's endpoint has to be the bound one or the bundle\n  // ships a URL that answers nothing.\n  let boundPort = port;\n\n  const server: Server = createServer((req, res) => {\n    cors(req, res);\n    const path = new URL(req.url ?? '/', 'http://localhost').pathname;\n    const method = req.method ?? 'GET';\n    const origin = `http://${host.includes(':') && !host.startsWith('[') ? `[${host}]` : host}:${boundPort}`;\n    try {\n      if (!isLoopback(new URL(`http://${req.headers.host ?? ''}`).hostname)) throw new HttpError(403, 'host not allowed');\n      checkOrigin(req.headers.origin, req.headers.host ?? '', true);\n    } catch (error) { sendFailure(res, error); return; }\n\n    if (method === 'OPTIONS') {\n      res.statusCode = 204;\n      res.end();\n      return;\n    }\n\n    if (path === UPDATE_ENDPOINT) {\n      res.setHeader('content-type', 'application/json; charset=utf-8');\n      res.setHeader('cache-control', 'no-store');\n      res.statusCode = method === 'GET' ? 200 : 405;\n      res.end(JSON.stringify(method === 'GET' ? updates.getSnapshot() : { error: 'method not allowed' }));\n      return;\n    }\n\n    if (path === BUNDLE_PATH && method === 'GET') {\n      let body: string;\n      try {\n        body = bundleWithMount(origin, opts);\n      } catch (err) {\n        res.statusCode = 500;\n        res.setHeader('content-type', 'text/plain; charset=utf-8');\n        res.end(String(err instanceof Error ? err.message : err));\n        return;\n      }\n      res.statusCode = 200;\n      res.setHeader('content-type', 'text/javascript; charset=utf-8');\n      res.setHeader('cache-control', 'no-store');\n      res.end(body);\n      return;\n    }\n\n    if (path === NOTES_ENDPOINT) {\n      if (method !== 'GET' && method !== 'POST' && method !== 'DELETE') {\n        res.statusCode = 405;\n        res.setHeader('content-type', 'application/json; charset=utf-8');\n        res.end(JSON.stringify({ error: 'method not allowed' }));\n        return;\n      }\n      (method === 'POST' ? readNodeJson(req) : Promise.resolve(undefined)).then((body) => {\n        const out = notesResponse(file, { method, url: req.url, body });\n        res.statusCode = out.status;\n        for (const [key, value] of Object.entries(out.headers)) res.setHeader(key, value);\n        res.end(JSON.stringify(out.body));\n      }).catch((error) => sendFailure(res, error));\n      return;\n    }\n\n    if (path === '/' && method === 'GET') {\n      res.statusCode = 200;\n      res.setHeader('content-type', 'text/html; charset=utf-8');\n      res.end(indexPage(origin, file));\n      return;\n    }\n\n    res.statusCode = 404;\n    res.setHeader('content-type', 'text/plain; charset=utf-8');\n    res.end('not found');\n  });\n\n  server.once('close', updates.dispose);\n  return new Promise((ok, fail) => {\n    server.once('error', (error) => { updates.dispose(); fail(error); });\n    server.listen(port, host, () => {\n      const actual = server.address();\n      boundPort = typeof actual === 'object' && actual ? actual.port : port;\n      const url = `http://${host.includes(':') && !host.startsWith('[') ? `[${host}]` : host}:${boundPort}`;\n      ok({\n        port: boundPort,\n        url,\n        bundleUrl: `${url}${BUNDLE_PATH}`,\n        close: () =>\n          new Promise<void>((done) => {\n            server.close(() => done());\n          }),\n      });\n    });\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAoBA,SAAS,oBAA4E;AACrF,SAAS,SAAS,eAAe;AAW1B,IAAM,eAAe;AAC5B,IAAM,cAAc;AAoCpB,SAAS,cAAc,QAA2C;AAChE,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI;AACF,UAAM,EAAE,UAAU,SAAS,IAAI,IAAI,IAAI,MAAM;AAC7C,UAAM,WACJ,aAAa,eAAe,aAAa,eAAe,aAAa,WAAW,aAAa;AAC/F,WAAO,aAAa,aAAa,WAAW,aAAa,YAAY,SAAS;AAAA,EAChF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,KAAK,KAAsB,KAA2B;AAC7D,QAAM,SAAS,cAAc,IAAI,QAAQ,MAAM;AAC/C,MAAI,UAAU,QAAQ,QAAQ;AAC9B,MAAI,QAAQ;AACV,QAAI,UAAU,+BAA+B,MAAM;AACnD,QAAI,UAAU,gCAAgC,4BAA4B;AAC1E,QAAI,UAAU,gCAAgC,cAAc;AAC5D,QAAI,UAAU,0BAA0B,KAAK;AAAA,EAC/C;AACF;AAGA,SAAS,gBAAgB,QAAgB,MAAqC;AAC5E,QAAM,SAAS,KAAK,UAAU;AAAA,IAC5B,UAAU,GAAG,MAAM,GAAG,cAAc;AAAA,IACpC,gBAAgB,GAAG,MAAM,GAAG,eAAe;AAAA,IAC3C,KAAK,KAAK,OAAO;AAAA,IACjB,MAAM,KAAK,QAAQ,CAAC;AAAA,IACpB,OAAO,KAAK;AAAA,EACd,CAAC;AACD,SAAO,GAAG,WAAW,CAAC;AAAA,4CAA+C,MAAM;AAAA;AAC7E;AAEA,SAAS,YAAY,QAAwB;AAC3C,SAAO,uEAAuE,KAAK;AAAA,IACjF,GAAG,MAAM,GAAG,WAAW;AAAA,EACzB,CAAC;AACH;AAEA,SAAS,WAAW,GAAmB;AACrC,SAAO,EACJ,QAAQ,MAAM,OAAO,EACrB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,QAAQ;AAC3B;AAEA,SAAS,UAAU,QAAgB,MAAsB;AACvD,QAAM,MAAM,gBAAgB,MAAM,GAAG,WAAW;AAChD,QAAM,OAAO,YAAY,MAAM;AAC/B,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,sDAqD6C,WAAW,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,WAI7D,WAAW,GAAG,CAAC;AAAA,iDACuB,WAAW,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,wBAKxC,WAAW,IAAI,CAAC;AAAA;AAAA;AAAA,mBAG1B,WAAW,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAO9B;AAGO,SAAS,eACd,MAC0B;AAC1B,QAAM,OAAO,QAAQ,KAAK,IAAI;AAC9B,QAAM,OAAO,KAAK,QAAQ;AAC1B,QAAM,OAAO,KAAK,QAAQ;AAC1B,MAAI,CAAC,WAAW,IAAI,EAAG,OAAM,IAAI,MAAM,0DAA0D;AACjG,oBAAkB,IAAI;AACtB,QAAM,UAAU,iBAAiB,KAAK,eAAe,QAAQ,IAAI,GAAG,KAAK,oBAAoB,KAAK;AAKlG,MAAI,YAAY;AAEhB,QAAM,SAAiB,aAAa,CAAC,KAAK,QAAQ;AAChD,SAAK,KAAK,GAAG;AACb,UAAM,OAAO,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB,EAAE;AACzD,UAAM,SAAS,IAAI,UAAU;AAC7B,UAAM,SAAS,UAAU,KAAK,SAAS,GAAG,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,SAAS;AACtG,QAAI;AACF,UAAI,CAAC,WAAW,IAAI,IAAI,UAAU,IAAI,QAAQ,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAG,OAAM,IAAI,UAAU,KAAK,kBAAkB;AAClH,kBAAY,IAAI,QAAQ,QAAQ,IAAI,QAAQ,QAAQ,IAAI,IAAI;AAAA,IAC9D,SAAS,OAAO;AAAE,kBAAY,KAAK,KAAK;AAAG;AAAA,IAAQ;AAEnD,QAAI,WAAW,WAAW;AACxB,UAAI,aAAa;AACjB,UAAI,IAAI;AACR;AAAA,IACF;AAEA,QAAI,SAAS,iBAAiB;AAC5B,UAAI,UAAU,gBAAgB,iCAAiC;AAC/D,UAAI,UAAU,iBAAiB,UAAU;AACzC,UAAI,aAAa,WAAW,QAAQ,MAAM;AAC1C,UAAI,IAAI,KAAK,UAAU,WAAW,QAAQ,QAAQ,YAAY,IAAI,EAAE,OAAO,qBAAqB,CAAC,CAAC;AAClG;AAAA,IACF;AAEA,QAAI,SAAS,eAAe,WAAW,OAAO;AAC5C,UAAI;AACJ,UAAI;AACF,eAAO,gBAAgB,QAAQ,IAAI;AAAA,MACrC,SAAS,KAAK;AACZ,YAAI,aAAa;AACjB,YAAI,UAAU,gBAAgB,2BAA2B;AACzD,YAAI,IAAI,OAAO,eAAe,QAAQ,IAAI,UAAU,GAAG,CAAC;AACxD;AAAA,MACF;AACA,UAAI,aAAa;AACjB,UAAI,UAAU,gBAAgB,gCAAgC;AAC9D,UAAI,UAAU,iBAAiB,UAAU;AACzC,UAAI,IAAI,IAAI;AACZ;AAAA,IACF;AAEA,QAAI,SAAS,gBAAgB;AAC3B,UAAI,WAAW,SAAS,WAAW,UAAU,WAAW,UAAU;AAChE,YAAI,aAAa;AACjB,YAAI,UAAU,gBAAgB,iCAAiC;AAC/D,YAAI,IAAI,KAAK,UAAU,EAAE,OAAO,qBAAqB,CAAC,CAAC;AACvD;AAAA,MACF;AACA,OAAC,WAAW,SAAS,aAAa,GAAG,IAAI,QAAQ,QAAQ,MAAS,GAAG,KAAK,CAAC,SAAS;AAClF,cAAM,MAAM,cAAc,MAAM,EAAE,QAAQ,KAAK,IAAI,KAAK,KAAK,CAAC;AAC9D,YAAI,aAAa,IAAI;AACrB,mBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,OAAO,EAAG,KAAI,UAAU,KAAK,KAAK;AAChF,YAAI,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC;AAAA,MAClC,CAAC,EAAE,MAAM,CAAC,UAAU,YAAY,KAAK,KAAK,CAAC;AAC3C;AAAA,IACF;AAEA,QAAI,SAAS,OAAO,WAAW,OAAO;AACpC,UAAI,aAAa;AACjB,UAAI,UAAU,gBAAgB,0BAA0B;AACxD,UAAI,IAAI,UAAU,QAAQ,IAAI,CAAC;AAC/B;AAAA,IACF;AAEA,QAAI,aAAa;AACjB,QAAI,UAAU,gBAAgB,2BAA2B;AACzD,QAAI,IAAI,WAAW;AAAA,EACrB,CAAC;AAED,SAAO,KAAK,SAAS,QAAQ,OAAO;AACpC,SAAO,IAAI,QAAQ,CAAC,IAAI,SAAS;AAC/B,WAAO,KAAK,SAAS,CAAC,UAAU;AAAE,cAAQ,QAAQ;AAAG,WAAK,KAAK;AAAA,IAAG,CAAC;AACnE,WAAO,OAAO,MAAM,MAAM,MAAM;AAC9B,YAAM,SAAS,OAAO,QAAQ;AAC9B,kBAAY,OAAO,WAAW,YAAY,SAAS,OAAO,OAAO;AACjE,YAAM,MAAM,UAAU,KAAK,SAAS,GAAG,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,SAAS;AACnG,SAAG;AAAA,QACD,MAAM;AAAA,QACN;AAAA,QACA,WAAW,GAAG,GAAG,GAAG,WAAW;AAAA,QAC/B,OAAO,MACL,IAAI,QAAc,CAAC,SAAS;AAC1B,iBAAO,MAAM,MAAM,KAAK,CAAC;AAAA,QAC3B,CAAC;AAAA,MACL,CAAC;AAAA,IACH,CAAC;AAAA,EACH,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../src/serve/index.ts","../src/serve/mount-config.ts"],"sourcesContent":["/**\n * isotone — the standalone dev server.\n *\n * The plug-and-play path. Run it in the repo you are reviewing and it owns the\n * notes file, serves the endpoint, and hands out the panel as a single script\n * so the host app needs no build integration at all:\n *\n *   npx isotone serve\n *   # then, in dev only, one line in the host's HTML:\n *   <script src=\"http://127.0.0.1:4123/isotone.js\" defer></script>\n *\n * Running it inside the repo is what keeps a note unambiguous: the process that\n * owns the file is the checkout the agent is working in, so a route and a\n * selector always point somewhere. Nothing about which port served the page has\n * to be mapped back to a repo.\n *\n * The Vite plugin remains the two-line convenience for a Vite host; this is for\n * every other runtime, and for a page whose dev server you cannot configure at\n * all (paste the bookmarklet the index page prints).\n */\nimport { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http';\nimport { dirname, resolve } from 'node:path';\n\nimport type { RouteGateOptions } from '../core/index';\nimport type { IterationTheme } from '../react/theme';\nimport { checkOrigin, HttpError, isLoopback, readNodeJson, sendFailure } from '../server/http';\nimport { ensureFileIgnored, notesResponse, NOTES_ENDPOINT } from '../store';\nimport { VARIANTS_ENDPOINT } from '../core/variants';\nimport { readKnobs } from '../variants-store';\n\nimport { readBundle } from '../standalone/bundle';\nimport { serveMountOptions } from './mount-config';\nimport { guardedScriptTag } from './tag';\nimport { startUpdateCheck, UPDATE_ENDPOINT } from '../update';\nimport { autoUpdateNote, updateResponse } from '../update-note';\nexport { readBundle } from '../standalone/bundle';\n\nexport const DEFAULT_PORT = 4123;\nconst BUNDLE_PATH = '/isotone.js';\n\nexport interface ServeIterationOptions {\n  /** Background npm notice, at most once a day. false disables the check;\n   *  'note' also files an update note for your agent once per new version. */\n  checkForUpdates?: boolean | 'note';\n  /** Project directory for the suggested update command and for\n   *  `.isotone/knobs.json`. Defaults to the notes directory. */\n  projectRoot?: string;\n  /** Defaults to auto (page background); system follows the OS preference. */\n  theme?: IterationTheme;\n  /** Where notes persist. Git-ignored automatically via `.git/info/exclude`. */\n  file: string;\n  /** Defaults to 4123. */\n  port?: number;\n  /** Defaults to 127.0.0.1 — a dev loop has no business on 0.0.0.0. */\n  host?: string;\n  /** Route visibility rule handed to the panel. */\n  rule?: RouteGateOptions;\n  /** localStorage namespace for the panel. */\n  key?: string;\n}\n\nexport interface ServedIteration {\n  port: number;\n  url: string;\n  bundleUrl: string;\n  close(): Promise<void>;\n}\n\n/**\n * Only localhost may talk to this server.\n *\n * The endpoint writes a file, and a wide-open `*` would let any page you happen\n * to visit post notes into the repo you are reviewing. Restricting the allowed\n * origin to loopback keeps a drive-by from a public site out while leaving\n * every real dev origin (any localhost port, http or https) working.\n */\nfunction allowedOrigin(origin: string | undefined): string | null {\n  if (!origin) return null;\n  try {\n    const { hostname, protocol } = new URL(origin);\n    const loopback =\n      hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]' || hostname === '::1';\n    return loopback && (protocol === 'http:' || protocol === 'https:') ? origin : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction cors(req: IncomingMessage, res: ServerResponse): void {\n  const origin = allowedOrigin(req.headers.origin);\n  res.setHeader('Vary', 'Origin');\n  if (origin) {\n    res.setHeader('Access-Control-Allow-Origin', origin);\n    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');\n    res.setHeader('Access-Control-Allow-Headers', 'Content-Type');\n    res.setHeader('Access-Control-Max-Age', '600');\n  }\n}\n\n/** The bundle plus the mount call, with the config the server itself knows. */\nfunction bundleWithMount(origin: string, opts: ServeIterationOptions, projectRoot: string): string {\n  const config = JSON.stringify(serveMountOptions(origin, projectRoot, opts));\n  return `${readBundle()}\\n;window.__isotone&&window.__isotone.mount(${config});\\n`;\n}\n\nfunction bookmarklet(origin: string): string {\n  return `javascript:(function(){var s=document.createElement('script');s.src=${JSON.stringify(\n    `${origin}${BUNDLE_PATH}`,\n  )};s.defer=true;document.body.appendChild(s);})()`;\n}\n\nfunction escapeHtml(v: string): string {\n  return v\n    .replace(/&/g, '&amp;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n    .replace(/\"/g, '&quot;');\n}\n\nfunction indexPage(origin: string, file: string): string {\n  const tag = guardedScriptTag(`${origin}${BUNDLE_PATH}`);\n  const mark = bookmarklet(origin);\n  return `<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<title>Isotone</title>\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">\n<style>\n  * { box-sizing: border-box; margin: 0; }\n  :root {\n    --bg: #0d0d10; --card: #131317; --line: rgba(255,255,255,.09);\n    --fg: #ececf1; --muted: #8f8f9a; --faint: #5f5f6a;\n    --sans: Inter, ui-sans-serif, system-ui, -apple-system, sans-serif;\n    --mono: ui-monospace, \"SF Mono\", Menlo, monospace;\n  }\n  body { background: var(--bg); color: var(--fg); font: 14px/1.6 var(--sans);\n         -webkit-font-smoothing: antialiased; }\n  .wrap { max-width: 540px; margin: 0 auto; padding: 12vh 24px 8vh; }\n  header { display: flex; align-items: center; gap: 10px; margin-bottom: 6px; }\n  .dot { width: 7px; height: 7px; border-radius: 9999px; background: #4ade80;\n         box-shadow: 0 0 10px rgba(74,222,128,.5); }\n  h1 { font-family: var(--mono); font-size: 14px; font-weight: 500; letter-spacing: .02em; }\n  .sub { color: var(--muted); font-size: 13px; margin-bottom: 40px; }\n  .sub code, p.note code { font-family: var(--mono); font-size: 11.5px; color: var(--fg); }\n  h2 { font-family: var(--mono); font-size: 10.5px; font-weight: 500;\n       letter-spacing: .08em; text-transform: uppercase; color: var(--faint);\n       margin: 32px 0 10px; }\n  .card { background: var(--card); border: 1px solid var(--line);\n          border-radius: 12px; padding: 13px 16px; }\n  .card.row { display: flex; align-items: center; gap: 14px; }\n  .card pre { font-family: var(--mono); font-size: 12px; line-height: 1.7;\n              color: var(--fg); overflow-x: auto; white-space: pre;\n              scrollbar-width: none; min-width: 0; }\n  .card.row pre { flex: 1; }\n  .card pre::-webkit-scrollbar { display: none; }\n  .card pre .c { color: var(--faint); }\n  .copy { flex: none; font-family: var(--mono); font-size: 10px;\n          color: var(--faint); background: none; padding: 4px 9px;\n          border: 1px solid var(--line); border-radius: 6px; cursor: pointer; }\n  .copy:hover { color: var(--fg); border-color: rgba(255,255,255,.2); }\n  p.note { color: var(--muted); font-size: 12.5px; margin-top: 10px; }\n  a.bm { display: inline-flex; align-items: center; gap: 8px; margin-top: 2px;\n         padding: 8px 14px; border: 1px solid var(--line); border-radius: 8px;\n         background: var(--card); color: var(--fg); text-decoration: none;\n         font-family: var(--mono); font-size: 12px; }\n  a.bm:hover { border-color: rgba(255,255,255,.2); }\n  footer { margin-top: 48px; padding-top: 16px; border-top: 1px solid var(--line);\n           font-family: var(--mono); font-size: 10.5px; color: var(--faint);\n           line-height: 2; overflow-wrap: anywhere; }\n</style>\n</head>\n<body>\n<div class=\"wrap\">\n  <header><span class=\"dot\"></span><h1>Isotone</h1></header>\n  <p class=\"sub\">Serving the feedback loop on <code>${escapeHtml(origin)}</code>.</p>\n\n  <h2>Script for your dev pages</h2>\n  <div class=\"card row\">\n    <pre>${escapeHtml(tag)}</pre>\n    <button type=\"button\" class=\"copy\" data-c=\"${escapeHtml(tag)}\"\n      onclick=\"navigator.clipboard.writeText(this.dataset.c);this.textContent='copied';setTimeout(()=>this.textContent='copy',1200)\">copy</button>\n  </div>\n  <p class=\"note\">It loads the panel only on localhost, so it stays inert if the page ships.\n  Behind a development flag, a plain <code>&lt;script src=\"${escapeHtml(origin + BUNDLE_PATH)}\" defer&gt;</code> works too.</p>\n\n  <h2>Bookmarklet — drag to your bookmarks bar</h2>\n  <a class=\"bm\" href=\"${escapeHtml(mark)}\">✎ Iteration</a>\n\n  <footer>\n    notes → ${escapeHtml(file)}<br>\n    loopback origins only\n  </footer>\n</div>\n</body>\n</html>\n`;\n}\n\n/** Start the server. Resolves once it is listening. */\nexport function serveIteration(\n  opts: ServeIterationOptions,\n): Promise<ServedIteration> {\n  const file = resolve(opts.file);\n  const projectRoot = resolve(opts.projectRoot ?? dirname(file));\n  const port = opts.port ?? DEFAULT_PORT;\n  const host = opts.host ?? '127.0.0.1';\n  if (!isLoopback(host)) throw new Error('isotone serve binds only to localhost, 127.0.0.1 or ::1.');\n  ensureFileIgnored(file);\n  const updates = startUpdateCheck(projectRoot, opts.checkForUpdates !== false);\n  if (opts.checkForUpdates === 'note') void updates.ready.then(() => autoUpdateNote(file, updates.getSnapshot())).catch(() => {});\n\n  // The port we were ASKED for is not necessarily the one we got: 0 means \"any\n  // free port\". The panel's endpoint has to be the bound one or the bundle\n  // ships a URL that answers nothing.\n  let boundPort = port;\n\n  const server: Server = createServer((req, res) => {\n    cors(req, res);\n    const path = new URL(req.url ?? '/', 'http://localhost').pathname;\n    const method = req.method ?? 'GET';\n    const origin = `http://${host.includes(':') && !host.startsWith('[') ? `[${host}]` : host}:${boundPort}`;\n    try {\n      if (!isLoopback(new URL(`http://${req.headers.host ?? ''}`).hostname)) throw new HttpError(403, 'host not allowed');\n      checkOrigin(req.headers.origin, req.headers.host ?? '', true);\n    } catch (error) { sendFailure(res, error); return; }\n\n    if (method === 'OPTIONS') {\n      res.statusCode = 204;\n      res.end();\n      return;\n    }\n\n    if (path === UPDATE_ENDPOINT) {\n      // POST asks for the update note, built from this server's own check.\n      (method === 'POST' ? readNodeJson(req) : Promise.resolve(undefined)).then((body) => {\n        const out = updateResponse(file, updates.getSnapshot(), { method, body });\n        res.statusCode = out.status;\n        for (const [key, value] of Object.entries(out.headers)) res.setHeader(key, value);\n        res.end(JSON.stringify(out.body));\n      }).catch((error) => sendFailure(res, error));\n      return;\n    }\n\n    if (path === BUNDLE_PATH && method === 'GET') {\n      let body: string;\n      try {\n        body = bundleWithMount(origin, opts, projectRoot);\n      } catch (err) {\n        res.statusCode = 500;\n        res.setHeader('content-type', 'text/plain; charset=utf-8');\n        res.end(String(err instanceof Error ? err.message : err));\n        return;\n      }\n      res.statusCode = 200;\n      res.setHeader('content-type', 'text/javascript; charset=utf-8');\n      res.setHeader('cache-control', 'no-store');\n      res.end(body);\n      return;\n    }\n\n    if (path === VARIANTS_ENDPOINT || path.startsWith(`${VARIANTS_ENDPOINT}/`)) {\n      res.setHeader('content-type', 'application/json; charset=utf-8');\n      res.setHeader('cache-control', 'no-store');\n      if (path === VARIANTS_ENDPOINT && method === 'GET') {\n        res.statusCode = 200;\n        res.end(JSON.stringify({ variants: [], active: [], knobs: readKnobs({ root: projectRoot }) }));\n      } else {\n        res.statusCode = 405;\n        res.end(JSON.stringify({ error: 'isotone serve has knobs only; file variants need the Vite plugin' }));\n      }\n      return;\n    }\n\n    if (path === NOTES_ENDPOINT) {\n      if (method !== 'GET' && method !== 'POST' && method !== 'DELETE') {\n        res.statusCode = 405;\n        res.setHeader('content-type', 'application/json; charset=utf-8');\n        res.end(JSON.stringify({ error: 'method not allowed' }));\n        return;\n      }\n      (method === 'POST' ? readNodeJson(req) : Promise.resolve(undefined)).then((body) => {\n        const out = notesResponse(file, { method, url: req.url, body });\n        res.statusCode = out.status;\n        for (const [key, value] of Object.entries(out.headers)) res.setHeader(key, value);\n        res.end(JSON.stringify(out.body));\n      }).catch((error) => sendFailure(res, error));\n      return;\n    }\n\n    if (path === '/' && method === 'GET') {\n      res.statusCode = 200;\n      res.setHeader('content-type', 'text/html; charset=utf-8');\n      res.end(indexPage(origin, file));\n      return;\n    }\n\n    res.statusCode = 404;\n    res.setHeader('content-type', 'text/plain; charset=utf-8');\n    res.end('not found');\n  });\n\n  server.once('close', updates.dispose);\n  return new Promise((ok, fail) => {\n    server.once('error', (error) => { updates.dispose(); fail(error); });\n    server.listen(port, host, () => {\n      const actual = server.address();\n      boundPort = typeof actual === 'object' && actual ? actual.port : port;\n      const url = `http://${host.includes(':') && !host.startsWith('[') ? `[${host}]` : host}:${boundPort}`;\n      ok({\n        port: boundPort,\n        url,\n        bundleUrl: `${url}${BUNDLE_PATH}`,\n        close: () =>\n          new Promise<void>((done) => {\n            server.close(() => done());\n          }),\n      });\n    });\n  });\n}\n","import type { RouteGateOptions } from '../core/index';\nimport { VARIANTS_ENDPOINT } from '../core/variants';\nimport type { MountIterationOptions } from '../react/IterationMount';\nimport type { IterationTheme } from '../react/theme';\nimport { NOTES_ENDPOINT } from '../store';\nimport { UPDATE_ENDPOINT } from '../update';\nimport { readKnobs } from '../variants-store';\n\n/**\n * What `isotone serve` hands `mountIteration` in its bundle.\n *\n * Knobs only: file variants need a bundler to swap modules, which a script tag\n * on another dev server does not have. So the panel gets a Variants tool only\n * when `.isotone/knobs.json` holds valid knobs, and its empty list then asks\n * for knobs rather than variants. The bundle is never cached, so reloading the\n * page after the first knob is written brings the tool in.\n */\nexport function serveMountOptions(\n  origin: string,\n  projectRoot: string,\n  opts: { key?: string; rule?: RouteGateOptions; theme?: IterationTheme },\n): MountIterationOptions {\n  const knobs = readKnobs({ root: projectRoot }).length > 0;\n  return {\n    endpoint: `${origin}${NOTES_ENDPOINT}`,\n    ...(knobs ? { variants: 'knobs' as const, variantsEndpoint: `${origin}${VARIANTS_ENDPOINT}` } : {}),\n    updateEndpoint: `${origin}${UPDATE_ENDPOINT}`,\n    key: opts.key ?? '',\n    rule: opts.rule ?? {},\n    theme: opts.theme,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoBA,SAAS,oBAA4E;AACrF,SAAS,SAAS,eAAe;;;ACJ1B,SAAS,kBACd,QACA,aACA,MACuB;AACvB,QAAM,QAAQ,UAAU,EAAE,MAAM,YAAY,CAAC,EAAE,SAAS;AACxD,SAAO;AAAA,IACL,UAAU,GAAG,MAAM,GAAG,cAAc;AAAA,IACpC,GAAI,QAAQ,EAAE,UAAU,SAAkB,kBAAkB,GAAG,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAAC;AAAA,IACjG,gBAAgB,GAAG,MAAM,GAAG,eAAe;AAAA,IAC3C,KAAK,KAAK,OAAO;AAAA,IACjB,MAAM,KAAK,QAAQ,CAAC;AAAA,IACpB,OAAO,KAAK;AAAA,EACd;AACF;;;ADMO,IAAM,eAAe;AAC5B,IAAM,cAAc;AAsCpB,SAAS,cAAc,QAA2C;AAChE,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI;AACF,UAAM,EAAE,UAAU,SAAS,IAAI,IAAI,IAAI,MAAM;AAC7C,UAAM,WACJ,aAAa,eAAe,aAAa,eAAe,aAAa,WAAW,aAAa;AAC/F,WAAO,aAAa,aAAa,WAAW,aAAa,YAAY,SAAS;AAAA,EAChF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,KAAK,KAAsB,KAA2B;AAC7D,QAAM,SAAS,cAAc,IAAI,QAAQ,MAAM;AAC/C,MAAI,UAAU,QAAQ,QAAQ;AAC9B,MAAI,QAAQ;AACV,QAAI,UAAU,+BAA+B,MAAM;AACnD,QAAI,UAAU,gCAAgC,4BAA4B;AAC1E,QAAI,UAAU,gCAAgC,cAAc;AAC5D,QAAI,UAAU,0BAA0B,KAAK;AAAA,EAC/C;AACF;AAGA,SAAS,gBAAgB,QAAgB,MAA6B,aAA6B;AACjG,QAAM,SAAS,KAAK,UAAU,kBAAkB,QAAQ,aAAa,IAAI,CAAC;AAC1E,SAAO,GAAG,WAAW,CAAC;AAAA,4CAA+C,MAAM;AAAA;AAC7E;AAEA,SAAS,YAAY,QAAwB;AAC3C,SAAO,uEAAuE,KAAK;AAAA,IACjF,GAAG,MAAM,GAAG,WAAW;AAAA,EACzB,CAAC;AACH;AAEA,SAAS,WAAW,GAAmB;AACrC,SAAO,EACJ,QAAQ,MAAM,OAAO,EACrB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,QAAQ;AAC3B;AAEA,SAAS,UAAU,QAAgB,MAAsB;AACvD,QAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,WAAW,EAAE;AACtD,QAAM,OAAO,YAAY,MAAM;AAC/B,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,sDAqD6C,WAAW,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,WAI7D,WAAW,GAAG,CAAC;AAAA,iDACuB,WAAW,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA,6DAIH,WAAW,SAAS,WAAW,CAAC;AAAA;AAAA;AAAA,wBAGrE,WAAW,IAAI,CAAC;AAAA;AAAA;AAAA,mBAG1B,WAAW,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAO9B;AAGO,SAAS,eACd,MAC0B;AAC1B,QAAM,OAAO,QAAQ,KAAK,IAAI;AAC9B,QAAM,cAAc,QAAQ,KAAK,eAAe,QAAQ,IAAI,CAAC;AAC7D,QAAM,OAAO,KAAK,QAAQ;AAC1B,QAAM,OAAO,KAAK,QAAQ;AAC1B,MAAI,CAAC,WAAW,IAAI,EAAG,OAAM,IAAI,MAAM,0DAA0D;AACjG,oBAAkB,IAAI;AACtB,QAAM,UAAU,iBAAiB,aAAa,KAAK,oBAAoB,KAAK;AAC5E,MAAI,KAAK,oBAAoB,OAAQ,MAAK,QAAQ,MAAM,KAAK,MAAM,eAAe,MAAM,QAAQ,YAAY,CAAC,CAAC,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AAK9H,MAAI,YAAY;AAEhB,QAAM,SAAiB,aAAa,CAAC,KAAK,QAAQ;AAChD,SAAK,KAAK,GAAG;AACb,UAAM,OAAO,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB,EAAE;AACzD,UAAM,SAAS,IAAI,UAAU;AAC7B,UAAM,SAAS,UAAU,KAAK,SAAS,GAAG,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,SAAS;AACtG,QAAI;AACF,UAAI,CAAC,WAAW,IAAI,IAAI,UAAU,IAAI,QAAQ,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAG,OAAM,IAAI,UAAU,KAAK,kBAAkB;AAClH,kBAAY,IAAI,QAAQ,QAAQ,IAAI,QAAQ,QAAQ,IAAI,IAAI;AAAA,IAC9D,SAAS,OAAO;AAAE,kBAAY,KAAK,KAAK;AAAG;AAAA,IAAQ;AAEnD,QAAI,WAAW,WAAW;AACxB,UAAI,aAAa;AACjB,UAAI,IAAI;AACR;AAAA,IACF;AAEA,QAAI,SAAS,iBAAiB;AAE5B,OAAC,WAAW,SAAS,aAAa,GAAG,IAAI,QAAQ,QAAQ,MAAS,GAAG,KAAK,CAAC,SAAS;AAClF,cAAM,MAAM,eAAe,MAAM,QAAQ,YAAY,GAAG,EAAE,QAAQ,KAAK,CAAC;AACxE,YAAI,aAAa,IAAI;AACrB,mBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,OAAO,EAAG,KAAI,UAAU,KAAK,KAAK;AAChF,YAAI,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC;AAAA,MAClC,CAAC,EAAE,MAAM,CAAC,UAAU,YAAY,KAAK,KAAK,CAAC;AAC3C;AAAA,IACF;AAEA,QAAI,SAAS,eAAe,WAAW,OAAO;AAC5C,UAAI;AACJ,UAAI;AACF,eAAO,gBAAgB,QAAQ,MAAM,WAAW;AAAA,MAClD,SAAS,KAAK;AACZ,YAAI,aAAa;AACjB,YAAI,UAAU,gBAAgB,2BAA2B;AACzD,YAAI,IAAI,OAAO,eAAe,QAAQ,IAAI,UAAU,GAAG,CAAC;AACxD;AAAA,MACF;AACA,UAAI,aAAa;AACjB,UAAI,UAAU,gBAAgB,gCAAgC;AAC9D,UAAI,UAAU,iBAAiB,UAAU;AACzC,UAAI,IAAI,IAAI;AACZ;AAAA,IACF;AAEA,QAAI,SAAS,qBAAqB,KAAK,WAAW,GAAG,iBAAiB,GAAG,GAAG;AAC1E,UAAI,UAAU,gBAAgB,iCAAiC;AAC/D,UAAI,UAAU,iBAAiB,UAAU;AACzC,UAAI,SAAS,qBAAqB,WAAW,OAAO;AAClD,YAAI,aAAa;AACjB,YAAI,IAAI,KAAK,UAAU,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,GAAG,OAAO,UAAU,EAAE,MAAM,YAAY,CAAC,EAAE,CAAC,CAAC;AAAA,MAC/F,OAAO;AACL,YAAI,aAAa;AACjB,YAAI,IAAI,KAAK,UAAU,EAAE,OAAO,mEAAmE,CAAC,CAAC;AAAA,MACvG;AACA;AAAA,IACF;AAEA,QAAI,SAAS,gBAAgB;AAC3B,UAAI,WAAW,SAAS,WAAW,UAAU,WAAW,UAAU;AAChE,YAAI,aAAa;AACjB,YAAI,UAAU,gBAAgB,iCAAiC;AAC/D,YAAI,IAAI,KAAK,UAAU,EAAE,OAAO,qBAAqB,CAAC,CAAC;AACvD;AAAA,MACF;AACA,OAAC,WAAW,SAAS,aAAa,GAAG,IAAI,QAAQ,QAAQ,MAAS,GAAG,KAAK,CAAC,SAAS;AAClF,cAAM,MAAM,cAAc,MAAM,EAAE,QAAQ,KAAK,IAAI,KAAK,KAAK,CAAC;AAC9D,YAAI,aAAa,IAAI;AACrB,mBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,OAAO,EAAG,KAAI,UAAU,KAAK,KAAK;AAChF,YAAI,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC;AAAA,MAClC,CAAC,EAAE,MAAM,CAAC,UAAU,YAAY,KAAK,KAAK,CAAC;AAC3C;AAAA,IACF;AAEA,QAAI,SAAS,OAAO,WAAW,OAAO;AACpC,UAAI,aAAa;AACjB,UAAI,UAAU,gBAAgB,0BAA0B;AACxD,UAAI,IAAI,UAAU,QAAQ,IAAI,CAAC;AAC/B;AAAA,IACF;AAEA,QAAI,aAAa;AACjB,QAAI,UAAU,gBAAgB,2BAA2B;AACzD,QAAI,IAAI,WAAW;AAAA,EACrB,CAAC;AAED,SAAO,KAAK,SAAS,QAAQ,OAAO;AACpC,SAAO,IAAI,QAAQ,CAAC,IAAI,SAAS;AAC/B,WAAO,KAAK,SAAS,CAAC,UAAU;AAAE,cAAQ,QAAQ;AAAG,WAAK,KAAK;AAAA,IAAG,CAAC;AACnE,WAAO,OAAO,MAAM,MAAM,MAAM;AAC9B,YAAM,SAAS,OAAO,QAAQ;AAC9B,kBAAY,OAAO,WAAW,YAAY,SAAS,OAAO,OAAO;AACjE,YAAM,MAAM,UAAU,KAAK,SAAS,GAAG,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,SAAS;AACnG,SAAG;AAAA,QACD,MAAM;AAAA,QACN;AAAA,QACA,WAAW,GAAG,GAAG,GAAG,WAAW;AAAA,QAC/B,OAAO,MACL,IAAI,QAAc,CAAC,SAAS;AAC1B,iBAAO,MAAM,MAAM,KAAK,CAAC;AAAA,QAC3B,CAAC;AAAA,MACL,CAAC;AAAA,IACH,CAAC;AAAA,EACH,CAAC;AACH;","names":[]}

package/dist/server.d.ts

@@ -103,6 +103,13 @@ interface ServeRequestOptions {
      * Off by default: only the API's own origin is accepted.
      */
     loopbackOrigins?: boolean;
+    /**
+     * Answer even when `NODE_ENV` is `production`. Off by default: the handler
+     * reads and writes a file in the project, which a deployed app has no
+     * business exposing, so a production runtime gets a 404 instead. Set it only
+     * for a deliberate, access-controlled review deployment.
+     */
+    allowProduction?: boolean;
 }
 /**
  * A convenience Next-compatible adapter: given a `Request`/`NextRequest` and the

package/dist/server.js

@@ -6,27 +6,38 @@ import {
 import {
   ACTIVE_FILE,
   DEFAULT_VARIANTS_DIR,
-  listVariants,
-  readActive,
-  variantsResponse,
-  writeActive
-} from "./chunk-TGAU3WTF.js";
-import {
-  VARIANTS_ENDPOINT
-} from "./chunk-PUXQGUMQ.js";
-import {
   NOTES_ENDPOINT,
   PAYLOAD_MAX,
   ensureFileIgnored,
+  listVariants,
   notesResponse,
+  readActive,
   readNotes,
   updateNotes,
+  variantsResponse,
+  writeActive,
   writeNotes
-} from "./chunk-X6V2AKJL.js";
-import "./chunk-A4DX2V4C.js";
+} from "./chunk-L6O4HYGP.js";
+import "./chunk-JCTWHR7U.js";
+import {
+  VARIANTS_ENDPOINT
+} from "./chunk-BTJHQXF7.js";
 
 // src/server/index.ts
+function refusedInProduction(options) {
+  if (options.allowProduction || !isProductionRuntime()) return null;
+  return {
+    status: 404,
+    headers: { "content-type": "application/json; charset=utf-8" },
+    body: { error: "isotone is development-only; this endpoint is off because NODE_ENV is production" }
+  };
+}
+function isProductionRuntime() {
+  return typeof process !== "undefined" && process.env?.NODE_ENV === "production";
+}
 async function serveNotesRequest(file, request, options = {}) {
+  const refused = refusedInProduction(options);
+  if (refused) return refused;
   try {
     const url = new URL(request.url);
     checkOrigin(request.headers.get("origin"), url.host, options.loopbackOrigins);
@@ -41,6 +52,8 @@ async function serveNotesRequest(file, request, options = {}) {
   }
 }
 async function serveVariantsRequest(opts, request, options = {}) {
+  const refused = refusedInProduction(options);
+  if (refused) return refused;
   try {
     const url = new URL(request.url);
     checkOrigin(request.headers.get("origin"), url.host, options.loopbackOrigins);

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/server/index.ts"],"sourcesContent":["import { checkOrigin, httpFailure, readWebJson } from './http';\n/**\n * isotone — server.\n *\n * The transport-agnostic side of the loop: the file store and a pure request\n * handler that any dev runtime (Vite middleware, Next route handler, Bun.serve,\n * Vercel function, plain `node:http`) can render. No React and no Vite here —\n * keep this subpath framework-free.\n */\n\nexport {\n  ensureFileIgnored,\n  notesResponse,\n  readNotes,\n  writeNotes,\n  updateNotes,\n  NOTES_ENDPOINT,\n  PAYLOAD_MAX,\n} from '../store';\nimport { notesResponse } from '../store';\nexport type {\n  NotesRequest,\n  NotesResponse,\n  StoredNote,\n} from '../store';\n\nexport {\n  ACTIVE_FILE,\n  DEFAULT_VARIANTS_DIR,\n  listVariants,\n  readActive,\n  variantsResponse,\n  writeActive,\n} from '../variants-store';\nimport { variantsResponse } from '../variants-store';\nimport type { VariantsStoreOptions } from '../variants-store';\nexport type { VariantsStoreOptions } from '../variants-store';\nexport { VARIANTS_ENDPOINT } from '../core/variants';\nimport { VARIANTS_ENDPOINT } from '../core/variants';\n\nexport interface ServeRequestOptions {\n  /**\n   * Accept requests from any loopback page (localhost, 127.0.0.1, [::1]) on\n   * any port. Needed when the app's dev server and this API listen on\n   * different ports, since the page's origin then never matches the API host.\n   * Off by default: only the API's own origin is accepted.\n   */\n  loopbackOrigins?: boolean;\n}\n\n/**\n * A convenience Next-compatible adapter: given a `Request`/`NextRequest` and the\n * `file`, return a `NextResponse`-shaped `{ status, headers, body }`. Frameworks\n * that expose a `(req, res)` pair call `notesResponse` and render it directly.\n */\nexport async function serveNotesRequest(\n  file: string,\n  request: Request,\n  options: ServeRequestOptions = {},\n): Promise<{ status: number; headers: Record<string, string>; body: unknown }> {\n  try {\n    const url = new URL(request.url);\n    checkOrigin(request.headers.get('origin'), url.host, options.loopbackOrigins);\n    const body = request.method === 'POST' ? await readWebJson(request) : undefined;\n    return notesResponse(file, {\n      method: request.method,\n      url: `${url.pathname}?${url.searchParams.toString()}`,\n      body,\n    });\n  } catch (error) {\n    return httpFailure(error);\n  }\n}\n\n/**\n * Like {@link serveNotesRequest}, for the variants endpoint: given a\n * `Request` whose path ends with `VARIANTS_ENDPOINT` (or a sub-path of it,\n * such as `.../active`), strip the mount prefix before handing the rest to\n * `variantsResponse`, which routes on the path relative to the mount.\n */\nexport async function serveVariantsRequest(\n  opts: VariantsStoreOptions,\n  request: Request,\n  options: ServeRequestOptions = {},\n): Promise<{ status: number; headers: Record<string, string>; body: unknown }> {\n  try {\n    const url = new URL(request.url);\n    checkOrigin(request.headers.get('origin'), url.host, options.loopbackOrigins);\n    const body = request.method === 'POST' ? await readWebJson(request) : undefined;\n    const mounted = url.pathname.startsWith(VARIANTS_ENDPOINT)\n      ? url.pathname.slice(VARIANTS_ENDPOINT.length)\n      : url.pathname;\n    return variantsResponse(opts, {\n      method: request.method,\n      url: `${mounted || '/'}?${url.searchParams.toString()}`,\n      body,\n    });\n  } catch (error) {\n    return httpFailure(error);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,eAAsB,kBACpB,MACA,SACA,UAA+B,CAAC,GAC6C;AAC7E,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,gBAAY,QAAQ,QAAQ,IAAI,QAAQ,GAAG,IAAI,MAAM,QAAQ,eAAe;AAC5E,UAAM,OAAO,QAAQ,WAAW,SAAS,MAAM,YAAY,OAAO,IAAI;AACtE,WAAO,cAAc,MAAM;AAAA,MACzB,QAAQ,QAAQ;AAAA,MAChB,KAAK,GAAG,IAAI,QAAQ,IAAI,IAAI,aAAa,SAAS,CAAC;AAAA,MACnD;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,YAAY,KAAK;AAAA,EAC1B;AACF;AAQA,eAAsB,qBACpB,MACA,SACA,UAA+B,CAAC,GAC6C;AAC7E,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,gBAAY,QAAQ,QAAQ,IAAI,QAAQ,GAAG,IAAI,MAAM,QAAQ,eAAe;AAC5E,UAAM,OAAO,QAAQ,WAAW,SAAS,MAAM,YAAY,OAAO,IAAI;AACtE,UAAM,UAAU,IAAI,SAAS,WAAW,iBAAiB,IACrD,IAAI,SAAS,MAAM,kBAAkB,MAAM,IAC3C,IAAI;AACR,WAAO,iBAAiB,MAAM;AAAA,MAC5B,QAAQ,QAAQ;AAAA,MAChB,KAAK,GAAG,WAAW,GAAG,IAAI,IAAI,aAAa,SAAS,CAAC;AAAA,MACrD;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,YAAY,KAAK;AAAA,EAC1B;AACF;","names":[]}
+{"version":3,"sources":["../src/server/index.ts"],"sourcesContent":["import { checkOrigin, httpFailure, readWebJson } from './http';\n/**\n * isotone — server.\n *\n * The transport-agnostic side of the loop: the file store and a pure request\n * handler that any dev runtime (Vite middleware, Next route handler, Bun.serve,\n * Vercel function, plain `node:http`) can render. No React and no Vite here —\n * keep this subpath framework-free.\n */\n\nexport {\n  ensureFileIgnored,\n  notesResponse,\n  readNotes,\n  writeNotes,\n  updateNotes,\n  NOTES_ENDPOINT,\n  PAYLOAD_MAX,\n} from '../store';\nimport { notesResponse } from '../store';\nexport type {\n  NotesRequest,\n  NotesResponse,\n  StoredNote,\n} from '../store';\n\nexport {\n  ACTIVE_FILE,\n  DEFAULT_VARIANTS_DIR,\n  listVariants,\n  readActive,\n  variantsResponse,\n  writeActive,\n} from '../variants-store';\nimport { variantsResponse } from '../variants-store';\nimport type { VariantsStoreOptions } from '../variants-store';\nexport type { VariantsStoreOptions } from '../variants-store';\nexport { VARIANTS_ENDPOINT } from '../core/variants';\nimport { VARIANTS_ENDPOINT } from '../core/variants';\n\nexport interface ServeRequestOptions {\n  /**\n   * Accept requests from any loopback page (localhost, 127.0.0.1, [::1]) on\n   * any port. Needed when the app's dev server and this API listen on\n   * different ports, since the page's origin then never matches the API host.\n   * Off by default: only the API's own origin is accepted.\n   */\n  loopbackOrigins?: boolean;\n  /**\n   * Answer even when `NODE_ENV` is `production`. Off by default: the handler\n   * reads and writes a file in the project, which a deployed app has no\n   * business exposing, so a production runtime gets a 404 instead. Set it only\n   * for a deliberate, access-controlled review deployment.\n   */\n  allowProduction?: boolean;\n}\n\n/** The answer a production runtime gets unless the host opted in. */\nfunction refusedInProduction(options: ServeRequestOptions): { status: number; headers: Record<string, string>; body: unknown } | null {\n  if (options.allowProduction || !isProductionRuntime()) return null;\n  return {\n    status: 404,\n    headers: { 'content-type': 'application/json; charset=utf-8' },\n    body: { error: 'isotone is development-only; this endpoint is off because NODE_ENV is production' },\n  };\n}\n\n/**\n * Whether this process runs as a production build. Only an explicit\n * `NODE_ENV=production` counts: test runners and hand-started dev servers\n * often leave it unset, and every common production runtime (`next start`,\n * Vercel, Netlify, most container images) sets it.\n */\nfunction isProductionRuntime(): boolean {\n  return typeof process !== 'undefined' && process.env?.NODE_ENV === 'production';\n}\n\n/**\n * A convenience Next-compatible adapter: given a `Request`/`NextRequest` and the\n * `file`, return a `NextResponse`-shaped `{ status, headers, body }`. Frameworks\n * that expose a `(req, res)` pair call `notesResponse` and render it directly.\n */\nexport async function serveNotesRequest(\n  file: string,\n  request: Request,\n  options: ServeRequestOptions = {},\n): Promise<{ status: number; headers: Record<string, string>; body: unknown }> {\n  const refused = refusedInProduction(options);\n  if (refused) return refused;\n  try {\n    const url = new URL(request.url);\n    checkOrigin(request.headers.get('origin'), url.host, options.loopbackOrigins);\n    const body = request.method === 'POST' ? await readWebJson(request) : undefined;\n    return notesResponse(file, {\n      method: request.method,\n      url: `${url.pathname}?${url.searchParams.toString()}`,\n      body,\n    });\n  } catch (error) {\n    return httpFailure(error);\n  }\n}\n\n/**\n * Like {@link serveNotesRequest}, for the variants endpoint: given a\n * `Request` whose path ends with `VARIANTS_ENDPOINT` (or a sub-path of it,\n * such as `.../active`), strip the mount prefix before handing the rest to\n * `variantsResponse`, which routes on the path relative to the mount.\n */\nexport async function serveVariantsRequest(\n  opts: VariantsStoreOptions,\n  request: Request,\n  options: ServeRequestOptions = {},\n): Promise<{ status: number; headers: Record<string, string>; body: unknown }> {\n  const refused = refusedInProduction(options);\n  if (refused) return refused;\n  try {\n    const url = new URL(request.url);\n    checkOrigin(request.headers.get('origin'), url.host, options.loopbackOrigins);\n    const body = request.method === 'POST' ? await readWebJson(request) : undefined;\n    const mounted = url.pathname.startsWith(VARIANTS_ENDPOINT)\n      ? url.pathname.slice(VARIANTS_ENDPOINT.length)\n      : url.pathname;\n    return variantsResponse(opts, {\n      method: request.method,\n      url: `${mounted || '/'}?${url.searchParams.toString()}`,\n      body,\n    });\n  } catch (error) {\n    return httpFailure(error);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA0DA,SAAS,oBAAoB,SAAyG;AACpI,MAAI,QAAQ,mBAAmB,CAAC,oBAAoB,EAAG,QAAO;AAC9D,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,kCAAkC;AAAA,IAC7D,MAAM,EAAE,OAAO,mFAAmF;AAAA,EACpG;AACF;AAQA,SAAS,sBAA+B;AACtC,SAAO,OAAO,YAAY,eAAe,QAAQ,KAAK,aAAa;AACrE;AAOA,eAAsB,kBACpB,MACA,SACA,UAA+B,CAAC,GAC6C;AAC7E,QAAM,UAAU,oBAAoB,OAAO;AAC3C,MAAI,QAAS,QAAO;AACpB,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,gBAAY,QAAQ,QAAQ,IAAI,QAAQ,GAAG,IAAI,MAAM,QAAQ,eAAe;AAC5E,UAAM,OAAO,QAAQ,WAAW,SAAS,MAAM,YAAY,OAAO,IAAI;AACtE,WAAO,cAAc,MAAM;AAAA,MACzB,QAAQ,QAAQ;AAAA,MAChB,KAAK,GAAG,IAAI,QAAQ,IAAI,IAAI,aAAa,SAAS,CAAC;AAAA,MACnD;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,YAAY,KAAK;AAAA,EAC1B;AACF;AAQA,eAAsB,qBACpB,MACA,SACA,UAA+B,CAAC,GAC6C;AAC7E,QAAM,UAAU,oBAAoB,OAAO;AAC3C,MAAI,QAAS,QAAO;AACpB,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,gBAAY,QAAQ,QAAQ,IAAI,QAAQ,GAAG,IAAI,MAAM,QAAQ,eAAe;AAC5E,UAAM,OAAO,QAAQ,WAAW,SAAS,MAAM,YAAY,OAAO,IAAI;AACtE,UAAM,UAAU,IAAI,SAAS,WAAW,iBAAiB,IACrD,IAAI,SAAS,MAAM,kBAAkB,MAAM,IAC3C,IAAI;AACR,WAAO,iBAAiB,MAAM;AAAA,MAC5B,QAAQ,QAAQ;AAAA,MAChB,KAAK,GAAG,WAAW,GAAG,IAAI,IAAI,aAAa,SAAS,CAAC;AAAA,MACrD;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,YAAY,KAAK;AAAA,EAC1B;AACF;","names":[]}

package/dist/vite-plugin.d.ts

@@ -1,13 +1,14 @@
 import { RouteGateOptions } from './core.js';
-import { I as IterationShortcut } from './IterationPanel-phJRYtUO.js';
+import { I as IterationShortcut } from './IterationPanel-Bq77d5NT.js';
 import { I as IterationTheme } from './theme-BWv_ZNhC.js';
 import 'react';
 
 interface IterationViteOptions {
     /** Inject the bundled panel. false keeps endpoints and variants for a manual mount. */
     panel?: boolean;
-    /** Background npm notice, at most once a day. false disables the check. */
-    checkForUpdates?: boolean;
+    /** Background npm notice, at most once a day. false disables the check;
+     *  'note' also files an update note for your agent once per new version. */
+    checkForUpdates?: boolean | 'note';
     /** Defaults to auto (page background); system follows the OS preference. */
     theme?: IterationTheme;
     /** Defaults to Cmd/Ctrl+Shift+Period; customize or disable with false. */

package/dist/vite-plugin.js

@@ -1,14 +1,28 @@
 import {
-  readBundle
-} from "./chunk-RQ2YI5KS.js";
+  autoUpdateNote,
+  readBundle,
+  updateResponse
+} from "./chunk-YPDV3PX4.js";
 import {
   checkOrigin,
   readNodeJson,
   sendFailure
 } from "./chunk-DDMHJ23I.js";
+import {
+  isRouteModule,
+  scanExports
+} from "./chunk-BDTB3DFR.js";
+import {
+  UPDATE_ENDPOINT,
+  startUpdateCheck
+} from "./chunk-KRS57POF.js";
 import {
   ACTIVE_FILE,
+  NOTES_ENDPOINT,
+  ensureDirIgnored,
+  ensureFileIgnored,
   listVariants,
+  notesResponse,
   overrideSourcePath,
   readActive,
   readVariant,
@@ -17,22 +31,12 @@ import {
   variantDir,
   variantsDir,
   variantsResponse
-} from "./chunk-TGAU3WTF.js";
+} from "./chunk-L6O4HYGP.js";
+import "./chunk-JCTWHR7U.js";
 import {
   VARIANTS_ENDPOINT,
   overlayGroups
-} from "./chunk-PUXQGUMQ.js";
-import {
-  UPDATE_ENDPOINT,
-  startUpdateCheck
-} from "./chunk-I7CZUPDO.js";
-import {
-  NOTES_ENDPOINT,
-  ensureDirIgnored,
-  ensureFileIgnored,
-  notesResponse
-} from "./chunk-X6V2AKJL.js";
-import "./chunk-A4DX2V4C.js";
+} from "./chunk-BTJHQXF7.js";
 
 // src/vite/index.ts
 import { existsSync, mkdirSync, readFileSync, realpathSync } from "fs";
@@ -41,101 +45,6 @@ import {
   normalizePath
 } from "vite";
 
-// src/vite/exports.ts
-var ROUTE_EXPORTS = /* @__PURE__ */ new Set([
-  "loader",
-  "action",
-  "clientLoader",
-  "clientAction",
-  "headers",
-  "links",
-  "meta",
-  "handle",
-  "shouldRevalidate",
-  "middleware",
-  "clientMiddleware",
-  "unstable_middleware",
-  "unstable_clientMiddleware",
-  "HydrateFallback"
-]);
-var IDENT = /^[A-Za-z_$][\w$]*$/;
-function scanExports(code) {
-  const names = /* @__PURE__ */ new Set();
-  const lines = code.split("\n");
-  for (let i = 0; i < lines.length; i++) {
-    const line = (lines[i] ?? "").replace(/^(?:\/\*.*?\*\/\s*)+/, "");
-    if (!line.startsWith("export")) continue;
-    const rest = line.slice("export".length);
-    if (rest !== "" && !/^[\s{*]/.test(rest)) continue;
-    const body = rest.trim();
-    if (body.startsWith("{") || body.startsWith("type {")) {
-      if (body.startsWith("type")) continue;
-      let clause = body;
-      while (!clause.includes("}") && i + 1 < lines.length) clause += ` ${lines[++i]}`;
-      const inner = clause.slice(clause.indexOf("{") + 1, clause.indexOf("}"));
-      for (const raw of inner.split(",")) {
-        const spec = raw.replace(/\/\/.*$/, "").trim();
-        if (!spec || spec.startsWith("type ")) continue;
-        const as = spec.split(/\s+as\s+/);
-        const name = (as[1] ?? as[0] ?? "").trim().replace(/^["']|["']$/g, "");
-        if (!name) return null;
-        names.add(name);
-      }
-      continue;
-    }
-    if (/^type\s*\*/.test(body)) continue;
-    const star = body.match(/^\*\s+as\s+([A-Za-z_$][\w$]*)/);
-    if (star?.[1]) {
-      names.add(star[1]);
-      continue;
-    }
-    if (body.startsWith("*")) return null;
-    if (/^default\b/.test(body)) {
-      names.add("default");
-      continue;
-    }
-    if (/^(?:declare\s|type\s|interface\s)/.test(body)) continue;
-    if (/^(?:=|import\s|namespace\s|module\s|as\s)/.test(body)) return null;
-    const decl = body.match(
-      /^(?:async\s+)?function\s*\*?\s*([A-Za-z_$][\w$]*)|^(?:abstract\s+)?class\s+([A-Za-z_$][\w$]*)|^(?:const\s+)?enum\s+([A-Za-z_$][\w$]*)/
-    );
-    const declared = decl?.[1] ?? decl?.[2] ?? decl?.[3];
-    if (declared) {
-      names.add(declared);
-      continue;
-    }
-    const variable = body.match(/^(?:const|let|var)\s+(.*)$/);
-    if (variable) {
-      const target = (variable[1] ?? "").trim();
-      if (target.startsWith("{") || target.startsWith("[")) return null;
-      const name = target.match(/^([A-Za-z_$][\w$]*)/)?.[1];
-      if (!name) return null;
-      if (hasSecondDeclarator(target)) return null;
-      names.add(name);
-      continue;
-    }
-    return null;
-  }
-  for (const name of names) if (name !== "default" && !IDENT.test(name)) return null;
-  return [...names];
-}
-function isRouteModule(names) {
-  return names.includes("default") && names.some((name) => ROUTE_EXPORTS.has(name));
-}
-function hasSecondDeclarator(declaration) {
-  const text = declaration.replace(/\/\/.*$/, "").replace(/'(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"|`(?:[^`\\]|\\.)*`/g, '""');
-  let depth = 0;
-  let initialized = false;
-  for (let i = 0; i < text.length; i++) {
-    const ch = text[i];
-    if (ch === "(" || ch === "[" || ch === "{" || ch === "<") depth++;
-    else if (ch === ")" || ch === "]" || ch === "}" || ch === ">" && text[i - 1] !== "=") depth = Math.max(0, depth - 1);
-    else if (depth === 0 && ch === "=" && text[i + 1] !== "=" && text[i + 1] !== ">" && text[i - 1] !== "=") initialized = true;
-    else if (depth === 0 && ch === "," && initialized) return true;
-  }
-  return depth === 0 && /,\s*$/.test(text);
-}
-
 // src/vite/live.ts
 var VERSION_QUERY = "isotone";
 var BASE_VERSION = "_base";
@@ -747,12 +656,16 @@ function iteration(options = {}) {
       };
       const updates = startUpdateCheck(server.config.root, options.checkForUpdates !== false);
       server.httpServer?.once("close", updates.dispose);
+      if (options.checkForUpdates === "note") {
+        void updates.ready.then(() => autoUpdateNote(file, updates.getSnapshot())).catch(() => {
+        });
+      }
       server.middlewares.use(UPDATE_ENDPOINT, (req, res) => {
         if (!guardOrigin(req, res)) return;
-        res.setHeader("content-type", "application/json; charset=utf-8");
-        res.setHeader("cache-control", "no-store");
-        res.statusCode = req.method === "GET" ? 200 : 405;
-        res.end(JSON.stringify(req.method === "GET" ? updates.getSnapshot() : { error: "method not allowed" }));
+        const method = req.method ?? "";
+        (method === "POST" ? readNodeJson(req) : Promise.resolve(void 0)).then((body) => {
+          answer(res, () => updateResponse(file, updates.getSnapshot(), { method, body }));
+        }).catch((error) => sendFailure(res, error));
       });
       server.middlewares.use(NOTES_ENDPOINT, (req, res, next) => {
         if (!guardOrigin(req, res)) return;
@@ -768,20 +681,23 @@ function iteration(options = {}) {
       if (variantsOptions) {
         activeIds = readActive(vopts);
         live = (variantsOptions.live ?? hasReact) && server.environments !== void 0;
-        const clientGraph = () => server.environments?.client?.moduleGraph ?? server.moduleGraph;
+        const graphs = () => server.environments ? Object.values(server.environments).map((env) => env.moduleGraph) : [server.moduleGraph];
+        const covered = /* @__PURE__ */ new Set();
         const signature = () => JSON.stringify(readManifests().map((v) => [v.id, v.group ?? "", Object.keys(v.files).sort()]));
-        let listed = live ? signature() : "";
+        let listed = signature();
         reloadPage = () => {
           if (reloadTimer) clearTimeout(reloadTimer);
           reloadTimer = setTimeout(() => {
             reloadTimer = null;
-            const graph = clientGraph();
-            const paths = /* @__PURE__ */ new Set([...dispatched.keys(), ...versionsByFile().keys()]);
-            for (const path of paths) {
-              for (const mod of graph.getModulesByFile(path) ?? []) graph.invalidateModule(mod);
+            const paths = /* @__PURE__ */ new Set([...dispatched.keys(), ...versionsByFile().keys(), ...covered]);
+            for (const graph of graphs()) {
+              for (const path of paths) {
+                for (const mod of graph.getModulesByFile(path) ?? []) graph.invalidateModule(mod);
+              }
+              const runtime = graph.getModuleById(RESOLVED_LIVE_MODULE);
+              if (runtime) graph.invalidateModule(runtime);
             }
-            const runtime = graph.getModuleById(RESOLVED_LIVE_MODULE);
-            if (runtime) graph.invalidateModule(runtime);
+            covered.clear();
             dispatched.clear();
             server.ws.send({ type: "full-reload", path: "*" });
           }, 50);
@@ -881,13 +797,17 @@ function iteration(options = {}) {
           if (path === activeFile) {
             void activate(readActive(vopts));
           } else if (isInside(vDir, path)) {
+            for (const variant of manifests ?? []) {
+              for (const key of Object.keys(variant.files)) covered.add(normalizePath(join(vopts.root, key)));
+            }
             forgetManifests();
-            if (live) {
-              const now = signature();
-              if (now !== listed) {
-                listed = now;
-                reloadPage();
-              }
+            const stillActive = readActive(vopts);
+            const activeChanged = stillActive.join() !== currentActive().join();
+            if (activeChanged) void activate(stillActive);
+            const now = signature();
+            if (now !== listed) {
+              listed = now;
+              if (live || activeChanged || stillActive.length > 0) reloadPage();
             }
           }
         });