mikser-io 9.26.0 → 9.27.0

package/favicon.svg

@@ -0,0 +1,12 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="123.751 38.751 148.498 148.498" role="img" aria-label="mikser">
+  <title>mikser</title>
+  <!-- The mark with its blend flattened, so it survives a transparent
+       backdrop. mikser-mark.svg draws three circles under
+       mix-blend-mode: multiply, which needs something to multiply against:
+       rasterised onto transparency the orange circle knocks a hole through
+       itself instead of compositing. The colours below are sampled from the
+       canonical render, so this is the same image with nothing to blend. -->
+  <circle cx="198"     cy="92"  r="46" fill="#0A0907"/>
+  <circle cx="222.249" cy="134" r="46" fill="#2F2E2C"/>
+  <circle cx="173.751" cy="134" r="46" fill="#FF3F00"/>
+</svg>

package/mikser-mark.svg

@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="123.751 38.751 148.498 148.498" role="img" aria-label="mikser">
+  <title>mikser</title>
+  <g style="isolation:isolate">
+    <g style="mix-blend-mode:multiply">
+      <circle cx="198" cy="92" r="46" fill="#0A0907"></circle>
+      <circle cx="222.249" cy="134" r="46" fill="#0A0907" opacity="0.85"></circle>
+      <circle cx="173.751" cy="134" r="46" fill="#FF3F00"></circle>
+    </g>
+  </g>
+</svg>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mikser-io",
-  "version": "9.26.0",
+  "version": "9.27.0",
   "description": "<p align=\"center\">   <img src=\"mikser-lockup-stacked.svg\" alt=\"mikser\" width=\"198\" /> </p>",
   "main": "index.js",
   "exports": {

package/src/plugins/api.js

@@ -1062,10 +1062,20 @@ export function api(options = {}) {
             // (allowRemote), so we keep the REMOTE OPEN warning in the
             // log. streaming:true — the `subscribe` op holds an open SSE
             // stream, so a facade must not buffer this route.
-            const reachability = ep.token ? 'token' : (ep.allowRemote ? 'public' : 'loopback')
-            const authLabel = ep.token
-                ? 'token'
-                : (ep.allowRemote ? 'public, REMOTE OPEN' : 'loopback-only')
+            //
+            // reachabilityOf rather than a local ternary: `auth` and `token`
+            // both mean gated, and one helper decides for every plugin that
+            // registers a route (ADR-0012) — webdav and mcp call it too. The
+            // value is not just the log bracket: it lands on runtime.routes,
+            // where 'loopback' tells a facade not to proxy, so reading it off
+            // `token` alone hides an auth-gated endpoint from a generated
+            // vhost while the boot log agrees that it is unreachable.
+            const reachability = reachabilityOf(ep)
+            const authLabel = ep.auth
+                ? (verifier?.name ?? 'auth')
+                : ep.token
+                    ? 'token'
+                    : (ep.allowRemote ? 'public, REMOTE OPEN' : 'loopback-only')
             registerRoute({
                 path:         `${base}/${name}`,
                 plugin:       'api',

package/src/server.js

@@ -20,6 +20,9 @@
 // block — same Express app, all the substrate-level concerns in one
 // place.
 
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
 import runtime from './runtime.js'
 import { useLogger } from './engine.js'
 import { onInitialized, onLoad, onLoaded } from './lifecycle.js'
@@ -174,6 +177,30 @@ export function setupServer() {
 
             runtime.options.app.use(express.static(runtime.options.outputFolder))
 
+            // A favicon, so the server has a mark instead of a browser's
+            // blank default. AFTER the static mount, which is the whole
+            // design: a project that puts favicon.ico in its output folder
+            // is served its own and never reaches this line. This is the
+            // fallback for everything else.
+            //
+            // Worth having because --server is not only a preview of the
+            // site. It is the surface WebDAV, the API and MCP mount on, and
+            // those pages sit above whatever the output folder contains —
+            // on a multi-language build the output root holds no page at
+            // all, so /favicon.ico there is a 404 by construction and every
+            // project would have to solve it the same way.
+            //
+            // Flattened artwork: the mark's mix-blend-mode has nothing to
+            // multiply against on a transparent backdrop and rasterises with
+            // a hole through it, so favicon.ico is the pre-composited copy.
+            const faviconFile = path.join(
+                path.dirname(fileURLToPath(import.meta.url)), '..', 'favicon.ico')
+            runtime.options.app.get('/favicon.ico', (req, res) => {
+                res.type('image/x-icon')
+                   .set('Cache-Control', 'public, max-age=3600')
+                   .sendFile(faviconFile)
+            })
+
             await new Promise(resolve => {
                 const httpServer = runtime.options.app.listen(runtime.options.port, () => {
                     // Public URL wins for operator-clickable log lines —