mnfst 0.5.163 → 0.5.164

package/lib/manifest.status.js

@@ -1,17 +1,12 @@
 /*  Manifest Status — config
 /*  By Andrew Matlock under MIT license
 /*  https://manifestx.dev
-/*
-/*  Reads the top-level `status` block from manifest.json and normalizes each
-/*  named entry into { signals[], rollup, refresh, ... }. Pure signal layer —
-/*  no UI. Each entry resolves to $status.<name> (see manifest.status.main.js).
 */
 
 (function () {
     'use strict';
 
-    // Infer a signal's provider type from which field is present (mirrors the
-    // data plugin's field-presence inference).
+    // Infer provider type from which field is present.
     function normalizeSignal(sig) {
         if (typeof sig === 'string') return { type: 'probe', url: sig, label: sig };
         if (!sig || typeof sig !== 'object') return { type: 'unknown', label: 'unknown' };
@@ -50,7 +45,7 @@
                 if (def.confirmations) opts.confirmations = def.confirmations;
                 if (def.staleAfter) opts.staleAfter = def.staleAfter;
             } else {
-                // Single-signal object (carries its own provider field).
+                // Single-signal object.
                 signals = [normalizeSignal(def)];
                 if (def.refresh) opts.refresh = def.refresh;
             }
@@ -61,9 +56,8 @@
         return { name, signals, ...opts };
     }
 
-    // Resolve manifest.json. Reuse a cached copy only if it actually carries the
-    // `status` block — other plugins may cache a normalized manifest that omits
-    // keys they don't consume, so fall through to a fresh fetch otherwise.
+    // Reuse a cached manifest only if it carries the `status` block; some plugins
+    // cache a normalized copy that omits keys they don't consume.
     async function ensureStatusManifest() {
         const cached = window.ManifestComponentsRegistry?.manifest || window.__manifestLoaded;
         if (cached && cached.status) return cached;
@@ -93,16 +87,12 @@
 /*  Manifest Status — store
 /*  By Andrew Matlock under MIT license
 /*  https://manifestx.dev
-/*
-/*  Internal reactive store backing $status. Mirrors store('data'):
-/*  named entries + a _version counter bumped on every update.
 */
 
 (function () {
     'use strict';
 
-    // Ordered severity. maintenance sits between operational and degraded so a
-    // worst-of rollup surfaces it over a fully-operational set. unknown = -1.
+    // Ordered severity; maintenance sits between operational and degraded.
     const LEVELS = {
         operational: 0,
         maintenance: 0.5,
@@ -134,11 +124,6 @@
 /*  Manifest Status — signal resolvers + rollup
 /*  By Andrew Matlock under MIT license
 /*  https://manifestx.dev
-/*
-/*  Each provider type resolves a normalized signal to { state, latencyMs }.
-/*  Generic providers (probe/feed/static/heartbeat) are fully implemented;
-/*  appwrite resolves via the public /health endpoint; mirror uses a small
-/*  registry of known upstream feeds; mcp is feed-based and pluggable.
 */
 
 (function () {
@@ -183,8 +168,7 @@
             return { state, latencyMs };
         } catch (err) {
             clearTimeout(t);
-            // Network error / CORS / timeout: can't distinguish down from blocked,
-            // so report unknown rather than a false outage.
+            // Can't distinguish down from CORS-blocked, so report unknown not outage.
             return { state: 'unknown', latencyMs: null, error: err && err.name ? err.name : 'fetch failed' };
         }
     }
@@ -194,13 +178,11 @@
             const res = await fetch(sig.url, { cache: 'no-store' });
             if (!res.ok) return { state: 'unknown', latencyMs: null, error: 'feed ' + res.status };
             const json = await res.json();
-            // The feed node may be a bare state string, or an object carrying
-            // both a state and a human update message.
+            // Feed node may be a bare state string or an object with state + message.
             const node = sig.path ? dig(json, sig.path) : json;
             const obj = (node && typeof node === 'object') ? node : null;
             const raw = obj ? (obj.state != null ? obj.state : obj.status) : node;
             const message = (obj && obj.message) ? obj.message : (json.message || null);
-            // Optional historical data a backend can hydrate.
             const history = Array.isArray(obj && obj.history) ? obj.history : (Array.isArray(json.history) ? json.history : undefined);
             const uptime = (obj && typeof obj.uptime === 'number') ? obj.uptime : (typeof json.uptime === 'number' ? json.uptime : undefined);
             const incidents = Array.isArray(obj && obj.incidents) ? obj.incidents : (Array.isArray(json.incidents) ? json.incidents : undefined);
@@ -324,21 +306,14 @@
 /*  Manifest Status — main
 /*  By Andrew Matlock under MIT license
 /*  https://manifestx.dev
-/*
-/*  Wires the store, polls each entry's signals, and registers the $status
-/*  magic. $status.<name> → rolled-up health object; $status.overall → worst
-/*  across all entries. The plugin renders nothing: the author drives their own
-/*  UI from these reactive values (:class, x-show, x-text, etc.).
 */
 
 (function () {
     'use strict';
 
-    /* Shared global: ManifestUI — universal `_ui` text resolver. Defined once
-       and shared across plugins (datepicker/colorpicker/charts/status); the
-       `if (!window.ManifestUI)` guard means whichever loads first wins. Lets
-       baked-in labels be localized/overridden via any loaded data source's
-       `_ui` key, locale-reactive. Kept behaviourally identical across copies. */
+    /* Shared `_ui` text resolver — defined once across plugins, first load wins.
+       Localizes baked-in labels via any data source's `_ui` key. Kept identical
+       across copies. */
     if (!window.ManifestUI) {
         window.ManifestUI = {
             _loadedSourceNames() {
@@ -388,9 +363,8 @@
 
     function store() { return window.Alpine && window.Alpine.store('status'); }
 
-    // Debounce state changes: a new state must be observed `confirmations`
-    // times in a row before it replaces the committed state. confirmations:1
-    // (default) commits immediately.
+    // Debounce: a new state must be observed `confirmations` times in a row
+    // before it replaces the committed one (default 1 = commit immediately).
     function applyHysteresis(entry, observed) {
         const need = entry.confirmations || 1;
         const prev = committed[entry.name];
@@ -450,8 +424,7 @@
 
         const rolled = Signals.rollup(entry, resolved);
 
-        // Manual override wins and bypasses hysteresis; otherwise debounce the
-        // observed state through applyHysteresis.
+        // Manual override wins and bypasses hysteresis.
         let state, message = null;
         if (overrides[entry.name]) {
             state = overrides[entry.name].state;
@@ -474,8 +447,7 @@
             hist = rolled.history.slice(-entry.history);
             while (hist.length < entry.history) hist.unshift('unknown');
         } else {
-            // Pre-fill with `unknown` so the bar is always full width and fills
-            // from the right as checks accrue (StatusPage-style no-data segments).
+            // Pre-fill with `unknown` so the bar is full-width and fills from the right.
             hist = histories[entry.name] ? histories[entry.name].slice() : new Array(entry.history).fill('unknown');
             hist.push(state);
             if (hist.length > entry.history) hist = hist.slice(hist.length - entry.history);
@@ -532,8 +504,7 @@
         return known.reduce((a, b) => (level(b.state) > level(a.state) ? b : a)).state;
     }
 
-    // Default English labels per state; overridable per-locale via any loaded
-    // data source's `_ui.status.label` (same mechanism as datepicker/colorpicker).
+    // Default English labels; overridable per-locale via a data source's `_ui.status.label`.
     const UI_FALLBACK = {
         label: {
             operational: 'Operational',
@@ -545,9 +516,7 @@
         }
     };
 
-    // Resolve `$x`/`$locale`/`${…}` reference strings in `_ui` values (same
-    // treatment as the colorpicker's _resolveRefString — kept semantically
-    // identical). Reading inside the caller's effect registers the deps.
+    // Resolve `$x`/`$locale`/`${…}` reference strings in `_ui` values.
     function _resolveRefString(val) {
         if (typeof val !== 'string' || val.length === 0) return val;
         const trimmed = val.trim();
@@ -566,13 +535,9 @@
         return val;
     }
 
-    // Human label for a state string, localized through `_ui` when available.
-    // Falls back to the English default, then a generic title-case for any
-    // custom/unrecognized state.
+    // Human label for a state, localized through `_ui`, else title-cased.
     function formatStateLabel(state) {
-        // Dep on the data store version so labels re-resolve when a `_ui`
-        // source loads late or reloads on locale switch (same fix as the
-        // datepicker's ui effect).
+        // Dep on the data store version so labels re-resolve when a `_ui` source loads late.
         try { void (window.Alpine && Alpine.store('data')?._dataVersion); } catch (_) { }
         const ui = window.ManifestUI ? window.ManifestUI.resolve('status', UI_FALLBACK) : UI_FALLBACK;
         const labels = (ui && ui.label) || UI_FALLBACK.label;
@@ -580,15 +545,14 @@
         return String(state == null ? '' : state).replace(/_/g, ' ').replace(/\b\w/g, c => c.toUpperCase());
     }
 
-    // Reserved accessor names — never treated as entry names or enumerated, so
-    // `x-for="(service, name) in $status"` iterates only real services.
+    // Reserved accessor names — never treated as entries or enumerated.
     const RESERVED = new Set(['overall', 'all', 'ready', 'incidents', 'label', 'set', 'clear', 'refresh', 'beat']);
 
     function setOverride(name, state, message) {
         overrides[name] = { state, message: message || null };
         committed[name] = state;
         delete pending[name];
-        // An operator update is an incident: open/append, or resolve when set back to operational.
+        // An operator update is an incident: open/append, or resolve when back to operational.
         if (state === 'operational') { if (message) logIncident(name, state, message); resolveIncident(name); }
         else { logIncident(name, state, message); }
         const e = config && config.entries[name];

package/lib/manifest.svg.js

@@ -2,19 +2,10 @@
 
 const svgCache = new Map();
 
-// Shared DOMPurify loader (only fetched when the .safe modifier is used).
-// SVG natively supports <script>, on* event handlers, javascript: URLs in
-// href, and <foreignObject> with HTML inside — any of which become an XSS
-// vector when the SVG source is user-supplied. The .safe modifier opts into
-// DOMPurify with the SVG profile so authors rendering user-uploaded SVGs
-// (e.g. profile avatars from an Appwrite bucket) don't have to write
-// per-source sanitization.
-//
-// Defined on window so manifest.markdown.js can share the same loader and
-// in-flight promise — otherwise both plugins' top-level `let purifyPromise`
-// declarations collide in the realm's global lexical env and the second
-// script throws SyntaxError ("Identifier 'purifyPromise' has already been
-// declared") at parse time, taking the whole plugin offline.
+// Shared DOMPurify loader for the .safe modifier (user-supplied SVG can carry
+// <script>, on* handlers, javascript: URLs, foreignObject HTML). On window so
+// manifest.markdown.js shares one loader/promise — separate top-level `let`
+// declarations would collide in the global lexical env and throw at parse time.
 if (!window.ManifestDOMPurify) {
     window.ManifestDOMPurify = {
         _promise: null,
@@ -23,8 +14,7 @@ if (!window.ManifestDOMPurify) {
             if (this._promise) return this._promise;
             this._promise = new Promise((resolve, reject) => {
                 const script = document.createElement('script');
-                // Pinned + Subresource Integrity (see manifest.markdown.js) — a
-                // floating `@latest` or tampered CDN file can't inject JS here.
+                // Pinned + SRI so a tampered/floating CDN file can't inject JS.
                 script.src = 'https://cdn.jsdelivr.net/npm/dompurify@3.4.10/dist/purify.min.js';
                 script.integrity = 'sha384-eguRoJERj8ghOpzO//Rl7+ScQsQIR1cH+ajll7+fG+IpbNPlkZsQn9h8ccr+wPXx';
                 script.crossOrigin = 'anonymous';
@@ -47,10 +37,7 @@ if (!window.ManifestDOMPurify) {
     };
 }
 
-// Return a sanitized SVG string when the .safe modifier is on; pass through
-// otherwise. Uses DOMPurify's SVG profile which strips <script>, on* event
-// handlers, javascript: URLs, and dangerous foreignObject HTML — while
-// keeping the visual SVG markup intact.
+// Sanitize with DOMPurify's SVG profile when .safe is on; pass through otherwise.
 async function maybeSanitizeSvg(svgText, safe) {
     if (!safe) return svgText;
     try {
@@ -190,10 +177,8 @@ async function initializeSvgPlugin() {
                 return;
             }
 
-            // Opt-in DOMPurify sanitization for user-supplied SVG. Default is
-            // unsanitized — Manifest keeps full SVG fidelity (filters, scripts
-            // used for animations, etc.). Use .safe when the SVG source can
-            // come from untrusted parties (uploaded avatars, third-party APIs).
+            // .safe opts into sanitization; default keeps full SVG fidelity (filters,
+            // animation scripts). Use it when the source is untrusted.
             const safe = Array.isArray(modifiers) && modifiers.includes('safe');
 
             const hasBakedContent =
@@ -268,8 +253,7 @@ async function initializeSvgPlugin() {
 
 let svgPluginInitialized = false;
 
-// True once Alpine has completed its initial DOM walk. Listener is bound at
-// module load so we never miss the event, whatever the script order.
+// True once Alpine finished its initial walk. Bound at load so we never miss it.
 let svgAlpineHasWalked = false;
 document.addEventListener('alpine:initialized', () => { svgAlpineHasWalked = true; });
 
@@ -284,11 +268,9 @@ async function ensureSvgPluginInitialized() {
     svgPluginInitialized = true;
     await initializeSvgPlugin();
 
-    // Only walk existing [x-svg] subtrees ourselves when Alpine has ALREADY
-    // finished its initial walk (i.e. this plugin loaded late). Otherwise we
-    // register the directive during `alpine:init` and let Alpine's one boot walk
-    // process every element with all sibling directives already registered —
-    // walking here during boot would drop nested plugin content.
+    // Walk existing [x-svg] subtrees only if Alpine already finished its boot walk
+    // (late load). During boot, let Alpine's own walk handle them with all sibling
+    // directives registered — walking here would drop nested plugin content.
     if (svgAlpineHasWalked && typeof window.Alpine.initTree === 'function') {
         const existing = document.querySelectorAll('[x-svg]');
         existing.forEach((el) => {

package/lib/manifest.tooltips.js

@@ -1,15 +1,4 @@
-/* Manifest Tooltips — singleton architecture.
- *
- * Instead of creating one <div popover="hint"> per x-tooltip trigger, this plugin
- * maintains ONE tooltip element per popover host (usually just document.body plus
- * optionally one per open popover). Every trigger with x-tooltip becomes a
- * lightweight content provider that asks the shared controller to show its text,
- * anchored to that trigger.
- *
- * Why: N triggers × 1 tooltip each = N extra DOM nodes that are empty 99% of the
- * time. For dense UIs like colorpicker libraries (~300+ swatches × 20 pickers),
- * this is the difference between a usable page and a laggy one.
- */
+/* Manifest Tooltips */
 
 // Hover delay from CSS var (with time-unit parsing). Defaults to 500ms.
 function getTooltipHoverDelay(element) {
@@ -36,9 +25,8 @@ function getTooltipHostForTrigger(triggerEl) {
 
 function initializeTooltipPlugin() {
 
-    // Chain mode: if another tooltip was dismissed this recently, the next one
-    // shows immediately (no hover delay). Also used to skip the hide-show flicker
-    // when gliding across many triggers — the singleton just re-anchors.
+    // Chain mode: a recently-dismissed tooltip lets the next show immediately (no
+    // delay), and gliding across triggers re-anchors the singleton without flicker.
     const TOOLTIP_CHAIN_GRACE_MS = 250;
     let _lastTooltipHideTime = 0;
     const markTooltipHidden = () => { _lastTooltipHideTime = Date.now(); };
@@ -46,11 +34,9 @@ function initializeTooltipPlugin() {
     const isInChainWindow = () => (Date.now() - _lastTooltipHideTime) < TOOLTIP_CHAIN_GRACE_MS;
 
     // ---- Singletons per host ----
-    //
-    // Most pages only need one singleton (under document.body). Open popovers (menus,
-    // dialogs) require their own singleton because CSS anchor positioning can't resolve
-    // across the top-layer boundary. We create them lazily on first use and keep them
-    // (small, hidden <div>s) for the life of the host.
+    // One under document.body; open popovers (menus, dialogs) need their own because
+    // CSS anchor positioning can't resolve across the top-layer boundary. Created
+    // lazily, kept for the host's life.
     const _singletons = new WeakMap();
 
     function getSingleton(host) {
@@ -87,12 +73,8 @@ function initializeTooltipPlugin() {
     }
 
     // ---- Controller ----
-    //
-    // Single pending-show timer shared across the whole plugin. If a trigger arms a
-    // show and the user moves to another trigger before it fires, the first timer is
-    // cancelled in favor of the new one. If the singleton is already visible, the new
-    // trigger updates it in place (chain mode) — no hide/show flicker.
-
+    // One shared pending-show timer: moving to another trigger cancels the first. If
+    // the singleton is already visible, the new trigger updates it in place (chain mode).
     let _showTimer = null;
     let _pendingTrigger = null;
     // Hide is deferred briefly so an incoming show on a different trigger can take
@@ -109,9 +91,8 @@ function initializeTooltipPlugin() {
     }
 
 
-    // Update the singleton to point at a trigger (anchor, content, classes) and show it.
-    // Switches between triggers happen by re-anchoring — no positional animation. Any
-    // previous transform state is cleared so the tooltip sits squarely at its anchor.
+    // Point the singleton at a trigger (anchor, content, classes) and show it. Switches
+    // re-anchor with no animation; residual transform state is cleared.
     function showSingletonFor(trigger, contentHtml, positions, allowHtml = true) {
         const host = getTooltipHostForTrigger(trigger);
         const s = getSingleton(host);
@@ -126,9 +107,8 @@ function initializeTooltipPlugin() {
         if (positions.length) s.el.classList.add(positions.join('-'));
         s.currentPositions = positions;
 
-        // Escape by default: dynamic ($x / runtime) content can carry attacker
-        // markup, so it goes in as TEXT. Author-authored literal HTML and the
-        // explicit `.html`/`.safe` opt-in render as markup (allowHtml=true).
+        // Escape by default (dynamic content can carry attacker markup); author HTML
+        // and the .html/.safe opt-in render as markup.
         if (allowHtml) s.el.innerHTML = contentHtml || '';
         else s.el.textContent = contentHtml || '';
 
@@ -139,9 +119,7 @@ function initializeTooltipPlugin() {
         s.activeTrigger = trigger;
         s.currentAnchorName = anchorName;
 
-        // A11y: link the trigger to the tooltip so screen readers announce the
-        // tooltip text as a description when the trigger receives focus or hover.
-        // Per WAI-ARIA, aria-describedby is the standard for this relationship.
+        // A11y: aria-describedby links trigger → tooltip for screen readers.
         if (!s.el.id) s.el.id = 'mnfst-tooltip-' + Math.random().toString(36).slice(2, 9);
         s.el.setAttribute('role', 'tooltip');
         // Preserve any author-provided aria-describedby so we don't stomp it.
@@ -160,11 +138,10 @@ function initializeTooltipPlugin() {
         let wasOpen = false;
         document.querySelectorAll('.tooltip[popover="hint"]:popover-open').forEach(el => {
             wasOpen = true;
-            try { el.hidePopover(); } catch {}
+            try { el.hidePopover(); } catch { }
         });
-        // Restore each tooltip's prior aria-describedby on the trigger it had been
-        // bound to. We can't reach the trigger from the popover alone, so we walk
-        // the tooltipped triggers and remove our id from their describedby list.
+        // Restore each trigger's prior aria-describedby (can't reach it from the
+        // popover, so walk tooltipped triggers).
         document.querySelectorAll('[aria-describedby]').forEach((el) => {
             if (!el._tooltipPriorDescribedBy && el._tooltipPriorDescribedBy !== '') return;
             const prior = el._tooltipPriorDescribedBy;
@@ -172,8 +149,8 @@ function initializeTooltipPlugin() {
             else el.removeAttribute('aria-describedby');
             el._tooltipPriorDescribedBy = undefined;
         });
-        // Only arm the chain window when something was actually open — marking
-        // unconditionally let a plain click fast-track the next focus show.
+        // Only arm the chain window when something was open (else a plain click
+        // would fast-track the next focus show).
         if (wasOpen) markTooltipHidden();
     }
 
@@ -187,10 +164,7 @@ function initializeTooltipPlugin() {
             expression.startsWith('$x.') ||
             (expression.includes('+') || expression.includes('`') || expression.includes('${'));
 
-        // Whether to render the resolved content as HTML. Default false (escape):
-        // dynamic/runtime content can carry attacker markup. Author-authored
-        // literal HTML in the attribute, or an explicit `.html`/`.safe` modifier,
-        // opts into raw markup.
+        // Render as HTML? Default false (escape); author literal HTML or .html/.safe opts in.
         let allowHtml = modifiers.includes('html') || modifiers.includes('safe');
 
         if (expression.startsWith('$x.')) {
@@ -204,8 +178,7 @@ function initializeTooltipPlugin() {
                 }
             });
         } else if (expression.includes('<') && expression.includes('>')) {
-            // Literal HTML string typed into the attribute — author-authored, as
-            // trusted as the surrounding template, so render it as markup.
+            // Literal HTML in the attribute — author-authored, trusted as the template.
             allowHtml = true;
             const escaped = expression.replace(/'/g, "\\'");
             getContent = evaluateLater(`'${escaped}'`);
@@ -276,17 +249,15 @@ function initializeTooltipPlugin() {
         el.addEventListener('mouseenter', requestShow);
         el.addEventListener('mouseleave', requestHide);
 
-        // Keyboard / focus interactions — WCAG 2.1 SC 1.4.13 requires tooltip
-        // content to be accessible to keyboard users via focus, not hover only.
-        // Gated on :focus-visible so mouse-click focus doesn't flash the tooltip.
+        // Keyboard focus (WCAG 2.1 SC 1.4.13). Gated on :focus-visible so mouse-click
+        // focus doesn't flash the tooltip.
         el.addEventListener('focus', () => {
             if (el.matches(':focus-visible')) requestShow();
         });
         el.addEventListener('blur', requestHide);
 
-        // Mousedown/click hides immediately and clears the chain window so a
-        // synthetic re-hover (e.g. content shifting under the cursor after
-        // navigation) waits the full delay instead of showing instantly.
+        // Mousedown/click hides now and clears the chain window, so a synthetic
+        // re-hover (content shifting under the cursor) waits the full delay.
         const hideOnInteraction = () => {
             cancelPendingShow();
             hideAnySingleton();
@@ -306,18 +277,10 @@ function initializeTooltipPlugin() {
     }, true);
 
     // ---- Public programmatic-show API ----
-    //
-    // Flash a tooltip in response to an action (e.g. the code plugin's inline
-    // copy confirmation) without requiring the trigger to carry an x-tooltip
-    // directive. The trigger element acts as the anchor; the singleton is
-    // reused, so this respects chain mode / focus behaviour just like a
-    // hover-shown tooltip would. Auto-hides after `durationMs`.
-    //
-    // `positions` accepts the same vocabulary as the x-tooltip directive's
-    // modifiers — array of any subset of ['top','bottom','start','end',
-    // 'center','corner']. Joined with '-' to form the position class
-    // (e.g. ['top','end'] → '.top-end'), matching what `x-tooltip.top.end`
-    // would emit.
+    // Flash a tooltip for an action (e.g. code plugin's copy confirmation) without an
+    // x-tooltip directive; the trigger is the anchor, the singleton is reused. Auto-
+    // hides after `durationMs`. `positions` is the directive modifier vocabulary
+    // (subset of ['top','bottom','start','end','center','corner'], joined with '-').
     window.ManifestTooltips = window.ManifestTooltips || {};
     window.ManifestTooltips.showTransient = function (triggerEl, contentHtml, durationMs, positions) {
         if (!triggerEl) return;