memoir-cli 3.12.0 → 3.15.0

package/src/work/ui/style.css

@@ -0,0 +1,248 @@
+:root {
+  color-scheme: dark;
+  --ink: #eceeea;
+  --muted: #a0a59f;
+  --paper: #151816;
+  --panel: #1b1e1b;
+  --line: #343a34;
+  --accent: #c6dda5;
+  --soft: #2d3828;
+  --warn: #e7c48d;
+  --warn-bg: #382f20;
+  font: 14px/1.55 -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+}
+* { box-sizing: border-box; }
+body { margin: 0; background: var(--paper); color: var(--ink); }
+button, input, select, textarea { font: inherit; }
+button { cursor: pointer; border: 1px solid transparent; border-radius: 6px; padding: 8px 12px; font-weight: 500; color: inherit; background: var(--panel); transition: background .15s, border-color .15s; }
+button:hover { background: #30372e; border-color: #59644f; }
+button:disabled { opacity: .5; cursor: default; }
+:focus-visible { outline: 2px solid var(--accent); outline-offset: 4px; }
+[hidden] { display: none !important; }
+.workspace-bar { min-height: 68px; padding: 12px 32px; border-bottom: 1px solid var(--line); display: flex; align-items: center; gap: 20px; }
+.workspace-brand { display: inline-flex; align-items: center; gap: 10px; color: var(--ink); text-decoration: none; font-size: 22px; letter-spacing: -.8px; font-weight: 600; }
+.workspace-brand > span { color: var(--accent); font: 700 28px/1 Georgia,serif; border: 1px solid #617050; border-radius: 6px 6px 2px 2px; width: 30px; height: 31px; text-align: center; padding-bottom: 3px; }
+.workspace-divider { color: #737a6d; font-size: 21px; font-weight: 300; }
+#project { display: flex; align-items: center; gap: 12px; min-width: 0; }
+.project-name { font-size: 13px; font-weight: 550; }
+.branch-name { color: var(--muted); font: 11px/1.5 ui-monospace, SFMono-Regular, Menlo, monospace; border: 1px solid var(--line); padding: 3px 8px; border-radius: 5px; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; max-width: 230px; }
+.workspace-local { margin-left: auto; display: flex; align-items: center; gap: 8px; color: var(--muted); font-size: 11px; white-space: nowrap; }
+.workspace-local i { width: 5px; height: 5px; border-radius: 50%; background: var(--accent); }
+.quiet { background: transparent; border-color: var(--line); font-size: 12px; }
+#refresh { margin-left: auto; }
+.workspace-local + #refresh { margin-left: 0; }
+.workspace { max-width: 1380px; margin: auto; padding: 28px 32px 24px; }
+.workspace-heading { display: flex; align-items: center; justify-content: space-between; gap: 28px; margin-bottom: 30px; }
+.eyebrow { margin: 0 0 10px; color: #b4c49e; font-size: 10px; font-weight: 550; letter-spacing: 1.6px; }
+h1 { font-size: clamp(29px, 3vw, 38px); line-height: 1.15; letter-spacing: -1.2px; margin: 0 0 12px; font-weight: 550; }
+.subtitle { margin: 0; color: var(--muted); font-size: 13px; line-height: 1.7; }
+.primary, .map-add { background: var(--accent); color: #20271a; border-color: var(--accent); font-size: 12px; padding: 10px 16px; white-space: nowrap; }
+.primary:hover, .map-add:hover { background: #d5e9b9; border-color: #d5e9b9; }
+.workspace-tools { display: flex; align-items: center; gap: 18px; margin-bottom: 18px; }
+.search-label { position: relative; display: block; flex: 1; max-width: 470px; }
+.search-icon { position: absolute; top: 15px; left: 15px; width: 12px; height: 12px; border: 1.5px solid var(--muted); border-radius: 50%; }
+.search-icon::after { content: ''; position: absolute; width: 5px; height: 1.5px; background: var(--muted); transform: rotate(45deg); right: -4px; bottom: -2px; }
+input[type=search] { background: var(--panel); border: 1px solid var(--line); border-radius: 7px; padding: 11px 15px 11px 39px; width: 100%; font-size: 12px; color: var(--ink); }
+input::placeholder { color: #9ba296; }
+.view-switch { display: flex; gap: 3px; padding: 4px; background: #101310; border: 1px solid var(--line); border-radius: 7px; margin-left: auto; }
+.view-switch button { color: var(--muted); background: transparent; font-size: 12px; padding: 6px 17px; border-radius: 4px; border: 0; }
+.view-switch button[aria-pressed=true] { color: var(--ink); background: #343c2f; }
+nav { display: flex; align-items: center; gap: 20px; border-bottom: 1px solid var(--line); overflow-x: auto; scrollbar-width: thin; scrollbar-color: #535d49 transparent; }
+nav button { display: flex; align-items: center; gap: 8px; background: transparent; color: var(--muted); padding: 10px 1px 15px; font-size: 12px; border: 0; border-radius: 0; white-space: nowrap; }
+nav button:hover { background: transparent; color: var(--ink); }
+nav button[aria-current=page] { color: var(--accent); box-shadow: inset 0 -2px var(--accent); }
+.nav-icon { display: none; }
+nav .count { color: #b6bcae; font-size: 10px; background: #2b3028; padding: 0 5px; border-radius: 4px; font-variant-numeric: tabular-nums; }
+.review-summary { display: flex; align-items: flex-start; flex-wrap: wrap; gap: 0 24px; }
+.summary-strip { display: flex; flex-wrap: wrap; gap: 8px 24px; padding: 16px 0; flex: 1; }
+#goal { max-width: 440px; }
+.summary-item { display: flex; align-items: center; gap: 7px; padding: 0; background: transparent; border: 0; font-size: 12px; color: var(--muted); font-weight: 400; }
+.summary-item:hover { background: transparent; color: var(--ink); }
+.summary-item strong { color: var(--ink); font-size: 13px; font-weight: 550; font-variant-numeric: tabular-nums; }
+.summary-item.needs-attention strong { color: var(--warn); }
+.summary-arrow { font-size: 11px; color: #a9b19c; }
+.goal { padding: 16px 0; }
+.goal summary { cursor: pointer; color: #c8d3b9; font-size: 12px; }
+.goal p { margin: 12px 0; font-size: 13px; line-height: 1.7; overflow-wrap: anywhere; }
+.section-heading { display: flex; align-items: center; justify-content: space-between; gap: 20px; margin: 18px 0; }
+h2 { font-size: 19px; letter-spacing: -.4px; margin: 0; font-weight: 550; }
+.section-heading p { color: var(--muted); font-size: 12px; margin: 4px 0 0; }
+#view-caption { font-size: 11px; color: var(--muted); white-space: nowrap; }
+.group { margin-bottom: 26px; }
+.group-title { display: flex; justify-content: space-between; align-items: center; margin-bottom: 9px; }
+.group-title h3 { font-size: 12px; font-weight: 500; margin: 0; color: #bcc7ae; }
+.group-title button { font-size: 11px; padding: 3px 0 3px 10px; background: transparent; color: var(--muted); border: 0; }
+.cards { display: grid; grid-template-columns: 1fr; gap: 0; border: 1px solid var(--line); border-radius: 9px; overflow: hidden; background: var(--panel); }
+.card { padding: 20px 24px 17px; min-width: 0; }
+.cards > .card + .card { border-top: 1px solid var(--line); }
+.card-heading { display: flex; align-items: center; gap: 12px; margin-bottom: 7px; }
+.record-date { font-size: 11px; color: var(--muted); margin-left: auto; }
+.card h3 { font-size: 14px; margin: 5px 0 8px; font-weight: 550; line-height: 1.6; overflow-wrap: anywhere; color: var(--ink); }
+.card p { margin: 8px 0; overflow-wrap: anywhere; }
+.record-text, .card .answer { font-size: 13px; line-height: 1.75; color: #bdc4b6; white-space: pre-wrap; max-width: 100ch; }
+.has-preview:not(.expanded) .record-copy p, .has-preview:not(.expanded) .record-copy h3 { display: -webkit-box; -webkit-box-orient: vertical; -webkit-line-clamp: 2; overflow: hidden; }
+.read-more { color: #c4d3ad; font-size: 11px; padding: 2px 0; background: transparent; border: 0; }
+.read-more:hover { background: transparent; text-decoration: underline; }
+.badge { display: inline-flex; align-items: center; padding: 2px 6px; border-radius: 3px; background: #2c3626; color: #c5d6b0; font-size: 9px; letter-spacing: .5px; font-weight: 550; }
+.badge.warn { background: var(--warn-bg); color: var(--warn); }
+.badge.neutral, .done .badge { background: #30332e; color: var(--muted); }
+.card-actions { display: flex; align-items: center; gap: 16px; margin-top: 12px; flex-wrap: wrap; }
+.card-actions button { font-size: 11px; padding: 2px 0; background: transparent; border: 0; border-radius: 2px; color: #c0c9b5; }
+.card-actions button:hover { color: var(--accent); text-decoration: underline; }
+.card-actions .remove { margin-left: auto; color: #a0a69a; }
+#content[data-compact=true] .card.has-preview:not(.expanded) { display: grid; grid-template-columns: minmax(0,1fr) auto; gap: 2px 18px; padding: 15px 20px; }
+#content[data-compact=true] .card.has-preview:not(.expanded) .card-heading { margin: 0; }
+#content[data-compact=true] .card.has-preview:not(.expanded) .record-date { display: none; }
+#content[data-compact=true] .card.has-preview:not(.expanded) .record-copy { grid-column: 1; }
+#content[data-compact=true] .card.has-preview:not(.expanded) .record-copy h3 { margin: 4px 0 0; }
+#content[data-compact=true] .card.has-preview:not(.expanded) .record-copy p,
+#content[data-compact=true] .card.has-preview:not(.expanded) .card-actions,
+#content[data-compact=true] .card.has-preview:not(.expanded) .metadata { display: none; }
+#content[data-compact=true] .card.has-preview:not(.expanded) .read-more { grid-column: 2; grid-row: 1 / 3; align-self: center; border: 1px solid var(--line); padding: 6px 12px; }
+.archive-group { margin-top: 12px; border-top: 1px solid var(--line); padding-top: 14px; }
+.archive-group > summary { cursor: pointer; color: #b8c1ad; font-size: 12px; }
+.archive-group > .group { margin-top: 16px; }
+.metadata { font-size: 11px; color: var(--muted); margin-top: 12px; }
+.metadata p { white-space: pre-wrap; line-height: 1.8; }
+.metadata summary { cursor: pointer; color: #a8b29d; }
+.metadata[open] summary { color: var(--accent); }
+.metadata ul { padding-left: 19px; }
+.metadata code { font-size: 10px; word-break: break-all; }
+.metadata li { overflow-wrap: anywhere; }
+.reasons { border-left: 2px solid #b29768; padding-left: 11px; color: var(--warn); font-size: 12px; list-style: none; overflow-wrap: anywhere; }
+.hidden-note { color: var(--muted); font-size: 12px; line-height: 1.7; }
+.done .record-copy p { color: var(--muted); }
+.empty { padding: 45px 25px; border: 1px solid var(--line); background: var(--panel); border-radius: 9px; color: var(--muted); text-align: center; font-size: 13px; }
+.empty strong { display: block; color: var(--ink); margin-bottom: 6px; font-size: 16px; font-weight: 500; }
+.notice { padding: 12px 16px; color: #d3e4c8; background: #253320; border: 1px solid #46583b; border-radius: 7px; font-size: 12px; margin-bottom: 20px; display: flex; align-items: center; justify-content: space-between; gap: 12px; }
+.notice.error { background: #38271f; color: #f0cab4; border-color: #785641; }
+.notice button { font-size: 12px; background: transparent; text-decoration: underline; }
+footer { margin-top: 28px; border-top: 1px solid var(--line); padding-top: 18px; color: var(--muted); font-size: 11px; display: flex; justify-content: space-between; align-items: flex-start; gap: 22px; flex-wrap: wrap; }
+footer details { max-width: 550px; }
+footer summary { cursor: pointer; }
+footer p { line-height: 1.8; }
+.map-controls { display: flex; flex-wrap: wrap; gap: 10px 18px; align-items: center; justify-content: space-between; margin-bottom: 14px; }
+.map-controls p { margin: 0; font-size: 12px; color: var(--muted); }
+#map-suggestions { padding: 6px 10px; background: transparent; border-color: var(--line); color: #c5cdba; font-size: 11px; }
+#map-suggestions[aria-pressed=true] { color: var(--accent); border-color: #81946b; background: var(--soft); }
+.map-layout { display: grid; grid-template-columns: minmax(0,1fr) 320px; gap: 18px; align-items: start; }
+.map-surface { position: relative; min-width: 0; background: var(--panel); border: 1px solid var(--line); border-radius: 9px; overflow: hidden; }
+.canvas-caption { position: relative; z-index: 1; padding: 17px 20px 0; display: flex; align-items: center; justify-content: space-between; gap: 10px; color: var(--muted); font-size: 11px; }
+.canvas-caption button { background: transparent; color: #c2cbb6; font-size: 11px; border: 0; padding: 3px 0; }
+.map-canvas { position: relative; height: 440px; isolation: isolate; background-image: radial-gradient(#87937b25 .7px,transparent .7px); background-size: 22px 22px; }
+.map-lines { position: absolute; inset: 0; width: 100%; height: 100%; pointer-events: none; overflow: visible; }
+.map-line { stroke: #7b896e; stroke-width: 1; fill: none; vector-effect: non-scaling-stroke; opacity: .4; }
+.map-line.suggested { stroke: #b3a6c6; stroke-dasharray: 3 6; opacity: .5; }
+.map-line.focused { stroke: #bed49d; stroke-width: 1.5; opacity: .9; }
+.map-node { position: absolute; z-index: 1; transform: translate(-50%,-12px); width: 128px; padding: 0 5px 5px; border: 0; background: transparent; text-align: center; border-radius: 7px; color: #d6decf; --node-color: #b9a8d2; }
+.map-node:hover { background: transparent; color: white; }
+.map-node[data-kind=next], .index-entry[data-kind=next] { --node-color: #cbd69d; }
+.map-node[data-kind=answer], .index-entry[data-kind=answer] { --node-color: #9ccbb0; }
+.map-node[data-kind=check], .index-entry[data-kind=check] { --node-color: #9ebfd7; }
+.map-node[data-kind=goal], .index-entry[data-kind=goal] { --node-color: #d7b397; }
+.map-node[data-kind=project] { --node-color: var(--accent); transform: translate(-50%,-28px); width: 135px; }
+.node-dot { display: block; width: 10px; height: 10px; border-radius: 50%; margin: 5px auto 10px; background: var(--node-color); box-shadow: 0 0 0 5px var(--panel),0 0 0 6px #6c76534d; }
+.node-label { display: -webkit-box; -webkit-box-orient: vertical; -webkit-line-clamp: 2; overflow: hidden; line-height: 1.5; font-size: 12px; font-weight: 500; overflow-wrap: anywhere; background: var(--panel); padding: 1px 3px; }
+.node-kind { display: block; margin-top: 3px; font-size: 10px; color: #a7b198; font-weight: 400; }
+.map-node.selected:not([data-kind=project]) .node-dot { box-shadow: 0 0 0 5px var(--panel),0 0 0 6px var(--node-color); }
+.map-node[data-kind=project] .node-dot { width: 39px; height: 39px; margin-bottom: 12px; background: #303b27; border: 1px solid #9ab584; }
+.map-node[data-kind=project] .node-dot::after { content: 'm'; color: var(--accent); font: 700 31px/32px Georgia,serif; }
+.map-node[data-kind=project] .node-label { font-size: 15px; font-weight: 600; }
+.map-node[data-center=true]:not([data-kind=project]) .node-dot { width: 16px; height: 16px; margin-top: 2px; }
+.map-bottom { padding: 13px 20px 17px; }
+.map-legend { display: flex; flex-wrap: wrap; gap: 18px; color: var(--muted); font-size: 10px; }
+.map-legend span { display: inline-flex; align-items: center; gap: 7px; }
+.line-solid, .line-dashed { width: 19px; border-top: 1px solid #909e80; }
+.line-dashed { border-top: 1px dashed #b6a5c7; }
+.map-empty { position: absolute; left: 12px; right: 12px; bottom: 25px; text-align: center; font-size: 12px; color: var(--muted); }
+.map-inspector { min-width: 0; border: 1px solid var(--line); border-radius: 9px; background: var(--panel); padding: 22px; max-height: 533px; overflow: auto; scrollbar-color: #56624b var(--panel); }
+.inspector-eyebrow { color: #b5c2a4; font-size: 9px; letter-spacing: 1.4px; margin: 0 0 9px; }
+.map-inspector > h2 { font-size: 21px; font-weight: 500; margin: 0 0 16px; line-height: 1.4; overflow-wrap: anywhere; }
+.project-brief { color: #c4ceba; font-size: 13px; line-height: 1.8; margin: 0 0 16px; }
+.inspector-hint { color: var(--muted); font-size: 12px; line-height: 1.8; margin: 0 0 20px; }
+.map-add { width: 100%; }
+.inspector-index, .inspector-connections { margin-top: 22px; padding-top: 18px; border-top: 1px solid var(--line); }
+.inspector-index h3, .inspector-connections h3 { font-size: 12px; font-weight: 500; color: #c2cdb7; margin: 0 0 12px; }
+.index-entry { --node-color: #b9a8d2; display: flex; align-items: center; gap: 9px; background: transparent; color: #c2cdb7; border: 0; padding: 10px 3px; width: 100%; text-align: left; font-size: 12px; font-weight: 400; }
+.index-entry > i { width: 5px; height: 5px; flex-shrink: 0; border-radius: 50%; background: var(--node-color); }
+.index-entry > span:nth-child(2) { flex: 1; }
+.index-entry:hover { background: #2a3325; }
+.inspector-back { display: block; background: transparent; color: var(--accent); font-size: 11px; padding: 10px 0 17px; border: 0; }
+.inspector-back:hover { background: transparent; text-decoration: underline; }
+.map-inspector .card { padding: 0; margin: 0; }
+.map-inspector .record-copy .record-text, .map-inspector .record-copy .answer { display: block; }
+.map-inspector .card .read-more { display: none; }
+.map-inspector .card-actions .remove { margin-left: 0; }
+.connection-row { display: grid; text-align: left; gap: 6px; padding: 12px; background: #232a20; border: 1px solid #3a4532; color: #c8d5ba; width: 100%; margin-bottom: 9px; border-radius: 6px; }
+.connection-type { font-size: 9px; letter-spacing: .7px; color: #c1d6a5; font-weight: 500; }
+.connection-type.suggested { color: #c5b3d8; }
+.connection-row strong { font-size: 12px; font-weight: 500; }
+.connection-reason, .connection-note { font-size: 11px; color: #aebc9e; font-weight: 400; line-height: 1.8; overflow-wrap: anywhere; }
+.map-footnote { color: var(--muted); font-size: 11px; margin: 16px 0 0; line-height: 1.8; }
+dialog { border: 1px solid #545f48; border-radius: 12px; padding: 26px; width: min(560px, calc(100% - 32px)); max-height: 90vh; color: var(--ink); background: var(--panel); box-shadow: 0 22px 90px #0008; }
+dialog::backdrop { background: #050805b0; backdrop-filter: blur(3px); }
+dialog form { display: grid; gap: 15px; }
+.dialog-heading, .dialog-actions { display: flex; align-items: center; justify-content: space-between; gap: 10px; }
+.dialog-heading { padding-bottom: 8px; }
+.dialog-heading h2 { font-size: 21px; }
+.dialog-heading button { font-size: 22px; padding: 0 10px; border: 0; }
+.dialog-actions { justify-content: flex-end; padding-top: 14px; border-top: 1px solid var(--line); }
+label { display: grid; gap: 6px; font-size: 12px; font-weight: 500; }
+textarea, select { width: 100%; border: 1px solid #4b5640; border-radius: 6px; padding: 9px 11px; font-size: 13px; color: var(--ink); background: #151a12; line-height: 1.7; }
+textarea { resize: vertical; }
+.hint, .optional { font-size: 11px; font-weight: 400; color: var(--muted); }
+.hint { margin: 0; line-height: 1.7; }
+.form-error { color: #f0cab4; font-size: 12px; margin: 0; }
+.comparison { padding: 14px; background: var(--soft); border-radius: 7px; font-size: 12px; }
+.comparison h3 { margin: 0 0 8px; font-size: 13px; }
+.comparison pre { white-space: pre-wrap; overflow-wrap: anywhere; font: inherit; }
+.sr-only { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0,0,0,0); white-space: nowrap; border: 0; }
+.skip-link { position: fixed; top: -100px; left: 12px; z-index: 10; padding: 12px; background: var(--accent); color: #20271a; }
+.skip-link:focus { top: 12px; }
+@media (max-width: 1050px) { .map-layout { grid-template-columns: minmax(0,1fr) 280px; gap: 14px; } .map-node { width: 108px; } }
+@media (max-width: 950px) {
+  .workspace-bar { padding: 12px 24px; gap: 15px; }
+  .workspace-local { display: none; }
+  .workspace-local + #refresh { margin-left: auto; }
+  .workspace { padding: 28px 24px 22px; }
+  .workspace-heading { margin-bottom: 24px; }
+  .branch-name { max-width: 190px; }
+  nav { gap: 19px; }
+  .map-layout { grid-template-columns: 1fr; }
+  .map-node { width: 128px; }
+  .map-inspector { max-height: none; }
+}
+@media (max-width: 560px) {
+  .workspace-bar { padding: 12px 17px; gap: 12px; min-height: 62px; }
+  .workspace-brand { font-size: 20px; }
+  .branch-name { display: none; }
+  .project-name { font-size: 12px; }
+  .workspace { padding: 25px 17px 20px; }
+  .workspace-heading { align-items: flex-start; flex-wrap: wrap; gap: 16px; }
+  .workspace-heading .primary { padding: 8px 12px; }
+  .eyebrow { font-size: 9px; }
+  h1 { font-size: 30px; }
+  .subtitle { font-size: 12px; }
+  .workspace-tools { gap: 10px; }
+  .view-switch button { padding: 6px 10px; font-size: 11px; }
+  input[type=search] { padding-left: 32px; font-size: 11px; }
+  .search-icon { left: 12px; }
+  nav { gap: 18px; }
+  nav button { font-size: 11px; }
+  .summary-strip { gap: 12px 18px; }
+  .summary-item { font-size: 11px; }
+  .section-heading { margin: 24px 0 18px; }
+  #view-caption { display: none; }
+  .card { padding: 17px; }
+  .card-actions { gap: 14px; }
+  .card-actions .remove { margin-left: 0; }
+  .map-node { width: min(96px,24vw); }
+  .node-label { font-size: 11px; }
+  .node-kind { font-size: 9px; }
+  .map-node[data-kind=project] { width: 98px; }
+  .canvas-caption { font-size: 10px; padding: 13px 12px 0; }
+  .canvas-caption button { font-size: 10px; }
+  .map-bottom { padding: 13px 12px; }
+  .map-inspector { padding: 20px; }
+}
+@media (prefers-reduced-motion: reduce) { button { transition: none; } }

package/src/work/view.js

@@ -0,0 +1,93 @@
+// A bounded local editor, never a shell or general filesystem endpoint.
+import http from 'node:http';
+import fs from 'node:fs/promises';
+import crypto from 'node:crypto';
+import { z } from 'zod';
+import { workRoot, reviewWork, recordWork, retractWork, restoreWork } from './store.js';
+import { workErrorMessage } from './errors.js';
+
+const assets = new Map([
+  ['/', ['index.html', 'text/html; charset=utf-8']],
+  ['/app.js', ['app.js', 'text/javascript; charset=utf-8']],
+  ['/style.css', ['style.css', 'text/css; charset=utf-8']],
+]);
+const actionSchema = z.object({
+  action: z.enum(['save', 'remove', 'restore']),
+  branch: z.string().max(1024).nullable(),
+  id: z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,79}$/),
+  expected_revision: z.number().int().nonnegative(),
+  category: z.enum(['record', 'check']).default('record'),
+  fields: z.object({ kind: z.enum(['goal', 'answer', 'decision', 'next']), text: z.string().min(1).max(2000), answer: z.string().max(2000).optional(), why: z.string().max(2000).optional(), status: z.enum(['open', 'done']).default('open') }).strict().optional(),
+}).strict();
+
+const headers = {
+  'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff',
+  'Referrer-Policy': 'no-referrer', 'X-Frame-Options': 'DENY',
+  'Cross-Origin-Resource-Policy': 'same-origin', 'Cross-Origin-Opener-Policy': 'same-origin',
+  'Permissions-Policy': 'camera=(), microphone=(), geolocation=()',
+  'Content-Security-Policy': "default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'none'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; form-action 'none'",
+};
+function reply(res, status, value, type = 'application/json; charset=utf-8') {
+  res.writeHead(status, { ...headers, 'Content-Type': type });
+  res.end(type.startsWith('application/json') ? JSON.stringify(value) : value);
+}
+async function body(req) {
+  const parts = []; let bytes = 0;
+  for await (const chunk of req) {
+    bytes += chunk.length;
+    if (bytes > 16384) throw new Error('Request is too large. Nothing was saved.');
+    parts.push(chunk);
+  }
+  return JSON.parse(Buffer.concat(parts).toString());
+}
+
+export async function startWorkView(project, { port = 0 } = {}) {
+  if (!Number.isInteger(port) || port < 0 || port > 65535) throw new Error('Choose a port between 0 and 65535.');
+  const root = await workRoot(project);
+  await reviewWork(root); // Refuse damaged data before announcing a working view.
+  const token = crypto.randomBytes(32).toString('base64url');
+  const expectedAuth = Buffer.from('Bearer ' + token);
+  let origin;
+  const server = http.createServer(async (req, res) => {
+    try {
+      // Reject alternate Host names (including DNS rebinding) and cross-site
+      // browser requests. No CORS permission is granted, including preflight.
+      if (req.headers.host !== new URL(origin).host) return reply(res, 403, { error: 'This view only accepts its local address.' });
+      if (req.headers.origin && req.headers.origin !== origin || req.headers['sec-fetch-site'] && !['same-origin', 'none'].includes(req.headers['sec-fetch-site'])) return reply(res, 403, { error: 'Open the local Memoir view directly.' });
+      const url = new URL(req.url, origin);
+      const asset = assets.get(url.pathname);
+      if (req.method === 'GET' && asset && !url.search) return reply(res, 200, await fs.readFile(new URL('./ui/' + asset[0], import.meta.url)), asset[1]);
+      if (!url.pathname.startsWith('/api/')) return reply(res, 404, { error: 'Not found.' });
+      const auth = Buffer.from(req.headers.authorization || '');
+      if (auth.length !== expectedAuth.length || !crypto.timingSafeEqual(auth, expectedAuth)) return reply(res, 401, { error: 'Reopen the view with its local link.' });
+      if (req.method === 'GET' && url.pathname === '/api/state' && !url.search) return reply(res, 200, await reviewWork(root));
+      if (req.method !== 'POST' || url.pathname !== '/api/action' || url.search) return reply(res, 405, { error: 'This action is unavailable.' });
+      if (req.headers.origin !== origin || req.headers['content-type'] !== 'application/json') return reply(res, 403, { error: 'Save changes from the local view.' });
+      const input = actionSchema.parse(await body(req));
+      const guard = { expectedBranch: input.branch };
+      if (input.action === 'save') {
+        if (input.category !== 'record' || !input.fields) return reply(res, 400, { error: 'Only project records can be edited.' });
+        const { answer, why, ...fields } = input.fields;
+        await recordWork(root, { ...fields, ...(answer ? { answer } : {}), ...(why ? { why } : {}), id: input.id, expected_revision: input.expected_revision, scope: 'project', source: 'Saved in the local project view; previous versions remain in history.' }, guard);
+      } else if (input.action === 'remove') {
+        await retractWork(root, input, guard);
+      } else {
+        if (input.category !== 'record') return reply(res, 400, { error: 'Run a new authorized check to replace a removed receipt.' });
+        await restoreWork(root, input, guard);
+      }
+      return reply(res, 200, await reviewWork(root));
+    } catch (error) {
+      const message = workErrorMessage(error);
+      const conflict = /branch changed|Record changed|Record was removed|expected revision|before retracting/.test(message);
+      if (!res.headersSent && !res.destroyed) reply(res, 409, conflict
+        ? { error: 'Another session changed this item or branch. Review the latest version before saving. Your draft has been kept.', code: 'refresh_required' }
+        : { error: message });
+    }
+  });
+  server.requestTimeout = 10000; server.headersTimeout = 10000; server.keepAliveTimeout = 1000;
+  await new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(port, '127.0.0.1', () => { origin = `http://127.0.0.1:${server.address().port}`; resolve(); });
+  });
+  return { server, origin, url: `${origin}/#token=${token}`, close: () => new Promise(resolve => { server.close(resolve); server.closeIdleConnections?.(); }) };
+}