paneltir 0.6.0 → 0.7.0

package/INSTALL.md

@@ -19,7 +19,7 @@ identity** — never another project's.
    npm install paneltir
 
    # or, without npm access, straight from the repository:
-   # npm install github:daifukus/paneltir#v0.6.0
+   # npm install github:daifukus/paneltir#v0.7.0
    ```
 
    (Use the tag you were given; never install without pinning a version.)
@@ -181,7 +181,7 @@ identity** — never another project's.
 
    ```bash
    npx paneltir version          # version, fingerprint, where it came from
-   npx paneltir check 0.6.0      # exits non-zero if that is not what is installed
+   npx paneltir check 0.7.0      # exits non-zero if that is not what is installed
    npx paneltir board            # read the board and say what is wrong with it
    ```
 

package/README.md

@@ -54,7 +54,7 @@ tag rather than a branch, so an unfinished push cannot reach a project:
 npm install paneltir
 
 # or, without npm access, straight from the repository:
-# npm install github:daifukus/paneltir#v0.6.0
+# npm install github:daifukus/paneltir#v0.7.0
 ```
 
 Installing from Git runs the `prepare` script, which builds `dist/`, so the

package/bin/paneltir.mjs

@@ -239,7 +239,12 @@ function version() {
   console.log(`paneltir v${pkg.version}`)
   console.log(`fingerprint ${fingerprint.hash}`)
   console.log(`${fingerprint.fileCount} tracked files`)
-  console.log(`installed from github:daifukus/paneltir#v${pkg.version}`)
+  // It used to print "installed from github:daifukus/paneltir#vX.Y.Z", which
+  // was true while that was the only way in and became a guess the moment the
+  // package went to npm. A copy on disk does not carry where it was fetched
+  // from — npm records that in the consumer's lockfile, not here — so the
+  // line is gone rather than wrong. The version and the fingerprint are facts;
+  // that was not one.
 }
 
 /**

package/dist/index.d.ts

@@ -1115,6 +1115,8 @@ interface UiStrings {
     all: string;
     board: string;
     analysis: string;
+    /** The Revisions tab. Short, because it sits beside Board and Analysis. */
+    history: string;
     cardDetail: string;
     panelSettings: string;
     title: string;

package/dist/index.js

@@ -1,6 +1,6 @@
 // src/version.ts
-var PANELTIR_VERSION = "0.6.0";
-var PANELTIR_FINGERPRINT = "sha256:cb1a1df3cac0d3cc775fbaa7b9f385d6d35e22cecbe86cc0a1da4338cf43de37";
+var PANELTIR_VERSION = "0.7.0";
+var PANELTIR_FINGERPRINT = "sha256:406af8c690cfa9b2452360712afff3f3fe9605a7bb0aa834238e5187acfc37c0";
 var PANELTIR_FILE_COUNT = 151;
 var paneltirBuild = {
   version: PANELTIR_VERSION,
@@ -1355,6 +1355,7 @@ var UI = {
     all: "All",
     board: "Board",
     analysis: "Analysis",
+    history: "Revisions",
     cardDetail: "Card",
     panelSettings: "Panel settings",
     title: "Title",
@@ -1615,6 +1616,7 @@ var UI = {
     all: "Todo",
     board: "Tablero",
     analysis: "An\xE1lisis",
+    history: "Revisiones",
     cardDetail: "Tarjeta",
     panelSettings: "Ajustes del panel",
     title: "T\xEDtulo",
@@ -2651,6 +2653,20 @@ function applyMove(cards, move, visible) {
 // src/panel/PanelApp.tsx
 import { Fragment as Fragment5, jsx as jsx19, jsxs as jsxs17 } from "react/jsx-runtime";
 var IMPORTED = "imported";
+function parseJson(body) {
+  try {
+    const parsed = JSON.parse(body);
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function saveError(status, data, body) {
+  if (typeof data.error === "string" && data.error) return data.error;
+  const code = body.match(/\b[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+\b/)?.[0];
+  const id = body.match(/\bID:\s*([\w:.-]+)/i)?.[1];
+  return [`HTTP ${status}`, code, id && `id ${id}`].filter(Boolean).join(" \u2014 ");
+}
 var PRIORITY_TONE = {
   high: "danger",
   medium: "warning",
@@ -3025,10 +3041,11 @@ function PanelApp({
         credentials: "same-origin",
         body: JSON.stringify({ state: next, message: "chore(panel): update the board from the panel" })
       });
-      const data = await response.json().catch(() => ({}));
+      const body = await response.text().catch(() => "");
+      const data = parseJson(body);
       if (!response.ok) {
         const conflict = response.status === 409;
-        throw Object.assign(new Error(data.error || `HTTP ${response.status}`), { conflict });
+        throw Object.assign(new Error(saveError(response.status, data, body)), { conflict });
       }
       setSavedSnapshot(JSON.stringify(state));
       setSave({
@@ -3078,7 +3095,7 @@ function PanelApp({
         ),
         status,
         controls: /* @__PURE__ */ jsxs17(Fragment5, { children: [
-          (initialState.analysis || hasMarketplace) && /* @__PURE__ */ jsxs17("span", { className: "pt-views", children: [
+          (initialState.analysis || hasMarketplace || showHistory) && /* @__PURE__ */ jsxs17("span", { className: "pt-views", children: [
             /* @__PURE__ */ jsx19(
               "button",
               {
@@ -3108,6 +3125,16 @@ function PanelApp({
                 onClick: () => setView("marketplace"),
                 children: ui.marketplace
               }
+            ),
+            showHistory && /* @__PURE__ */ jsx19(
+              "button",
+              {
+                type: "button",
+                className: `pt-lang${view === "history" ? " is-on" : ""}`,
+                "aria-pressed": view === "history",
+                onClick: () => setView("history"),
+                children: ui.history
+              }
             )
           ] }),
           showLanguage && LANGS.map((code) => /* @__PURE__ */ jsx19(
@@ -3335,33 +3362,6 @@ function PanelApp({
           )
         }
       ),
-      showHistory && /* @__PURE__ */ jsxs17("section", { className: "pt-panel-page pt-panel-section", id: "revisions", children: [
-        /* @__PURE__ */ jsxs17("div", { children: [
-          /* @__PURE__ */ jsx19("p", { className: "pt-eyebrow", children: ui.historyEyebrow }),
-          /* @__PURE__ */ jsx19("h2", { className: "pt-h2", children: ui.historyTitle }),
-          /* @__PURE__ */ jsx19("p", { className: "pt-sub", children: ui.historyIntro })
-        ] }),
-        state.runs.length === 0 ? /* @__PURE__ */ jsx19("p", { className: "pt-panel-text", children: ui.historyEmpty }) : /* @__PURE__ */ jsx19("ol", { className: "pt-runs", children: [...state.runs].reverse().map((run) => /* @__PURE__ */ jsxs17("li", { className: "pt-run pt-hud", children: [
-          /* @__PURE__ */ jsxs17("p", { className: "pt-run__meta", children: [
-            run.date,
-            " \xB7 ",
-            run.by === "claude" ? "Claude" : ui.ownerYou,
-            run.fingerprint ? ` \xB7 ${run.fingerprint.replace("sha256:", "").slice(0, 12)}` : ""
-          ] }),
-          /* @__PURE__ */ jsx19("p", { className: "pt-panel-text", children: t(run.summary) }),
-          run.cards.length > 0 && /* @__PURE__ */ jsxs17("p", { className: "pt-run__cards", children: [
-            /* @__PURE__ */ jsxs17("span", { children: [
-              ui.historyTouched,
-              ":"
-            ] }),
-            " ",
-            run.cards.map((id) => {
-              const card = state.cards.find((candidate) => candidate.id === id);
-              return card ? t(card.title) || ui.untitled : id;
-            }).join(" \xB7 ")
-          ] })
-        ] }, run.id)) })
-      ] }),
       extras,
       capabilities && capabilities.length > 0 && /* @__PURE__ */ jsxs17("section", { className: "pt-panel-page pt-panel-section", id: "functions", children: [
         /* @__PURE__ */ jsxs17("div", { children: [
@@ -3380,6 +3380,33 @@ function PanelApp({
         ] }, capability.id)) })
       ] })
     ] }),
+    view === "history" && showHistory && /* @__PURE__ */ jsxs17("section", { className: "pt-panel-page pt-panel-section", id: "revisions", children: [
+      /* @__PURE__ */ jsxs17("div", { children: [
+        /* @__PURE__ */ jsx19("p", { className: "pt-eyebrow", children: ui.historyEyebrow }),
+        /* @__PURE__ */ jsx19("h2", { className: "pt-h2", children: ui.historyTitle }),
+        /* @__PURE__ */ jsx19("p", { className: "pt-sub", children: ui.historyIntro })
+      ] }),
+      state.runs.length === 0 ? /* @__PURE__ */ jsx19("p", { className: "pt-panel-text", children: ui.historyEmpty }) : /* @__PURE__ */ jsx19("ol", { className: "pt-runs", children: [...state.runs].reverse().map((run) => /* @__PURE__ */ jsxs17("li", { className: "pt-run pt-hud", children: [
+        /* @__PURE__ */ jsxs17("p", { className: "pt-run__meta", children: [
+          run.date,
+          " \xB7 ",
+          run.by === "claude" ? "Claude" : ui.ownerYou,
+          run.fingerprint ? ` \xB7 ${run.fingerprint.replace("sha256:", "").slice(0, 12)}` : ""
+        ] }),
+        /* @__PURE__ */ jsx19("p", { className: "pt-panel-text", children: t(run.summary) }),
+        run.cards.length > 0 && /* @__PURE__ */ jsxs17("p", { className: "pt-run__cards", children: [
+          /* @__PURE__ */ jsxs17("span", { children: [
+            ui.historyTouched,
+            ":"
+          ] }),
+          " ",
+          run.cards.map((id) => {
+            const card = state.cards.find((candidate) => candidate.id === id);
+            return card ? t(card.title) || ui.untitled : id;
+          }).join(" \xB7 ")
+        ] })
+      ] }, run.id)) })
+    ] }),
     /* @__PURE__ */ jsx19(
       CardSheet,
       {

package/fingerprint.json

@@ -1,7 +1,7 @@
 {
   "name": "paneltir",
-  "version": "0.6.0",
-  "hash": "sha256:cb1a1df3cac0d3cc775fbaa7b9f385d6d35e22cecbe86cc0a1da4338cf43de37",
+  "version": "0.7.0",
+  "hash": "sha256:406af8c690cfa9b2452360712afff3f3fe9605a7bb0aa834238e5187acfc37c0",
   "fileCount": 151,
-  "generatedAt": "2026-09-06T10:08:28.981Z"
+  "generatedAt": "2026-09-07T12:33:30.026Z"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "paneltir",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "A React UI kit for admin panels: page frame, a board with touch-ready drag and drop, detail sheets, and a whole panel in one component. Structure and behaviour are fixed; colour and brand belong to each project.",
   "license": "SEE LICENSE IN LICENSE",
   "author": "DFKlabs (https://DFKlabs.com)",

package/template/api/panel-state.ts

@@ -24,7 +24,98 @@
  *   PANEL_FILE      optional path to the board within it.
  *   PANEL_BRANCH    optional, defaults to main.
  */
-import { SESSION_COOKIE, readCookie, verifyToken } from '../lib/session'
+/**
+ * The session check, carried here rather than imported.
+ *
+ * This is the rule `middleware.ts` lives by, and it reached the functions the
+ * hard way: every function under `api/` that imported anything answered
+ * FUNCTION_INVOCATION_FAILED on every request, while the middleware, which
+ * imports nothing, never failed once. A wrapper added to catch and name the
+ * fault changed nothing, which is the answer — the module never runs, so there
+ * is no handler for a `try` to protect.
+ *
+ * It is a copy of `lib/session.ts`, and `npm run test:auth` holds every copy to
+ * the same answer over the same tokens. Edit this file freely; if you change
+ * the check, change it everywhere the test names.
+ */
+const SESSION_COOKIE = 'pt_session'
+const VERSION = 'v1'
+
+/**
+ * Reads one variable, surviving a runtime with no `process` at all.
+ *
+ * Written out as literal `process.env.X` accesses because that is the form
+ * build tools substitute at build time; a computed key would leave nothing to
+ * substitute. A bare access is a ReferenceError where `process` is undefined,
+ * which in middleware reads as the whole route crashing rather than as a
+ * missing variable — hence the catch.
+ */
+function env(name: 'ADMIN_PASSWORD' | 'SESSION_SECRET'): string | undefined {
+  try {
+    if (name === 'ADMIN_PASSWORD') return process.env.ADMIN_PASSWORD || undefined
+    return process.env.SESSION_SECRET || undefined
+  } catch {
+    return undefined
+  }
+}
+
+/** Kept identical to lib/session.ts; test:auth asserts they agree. */
+function signingSecret(): string | null {
+  const password = env('ADMIN_PASSWORD')
+  if (!password) return null
+  return env('SESSION_SECRET') || password
+}
+
+function safeEqual(a: string, b: string): boolean {
+  const encoder = new TextEncoder()
+  const left = encoder.encode(a)
+  const right = encoder.encode(b)
+  let diff = left.length ^ right.length
+  const max = Math.max(left.length, right.length)
+  for (let i = 0; i < max; i += 1) diff |= (left[i] ?? 0) ^ (right[i] ?? 0)
+  return diff === 0
+}
+
+async function hmac(secret: string, message: string): Promise<string> {
+  const encoder = new TextEncoder()
+  const key = await crypto.subtle.importKey(
+    'raw',
+    encoder.encode(secret),
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign']
+  )
+  const signature = await crypto.subtle.sign('HMAC', key, encoder.encode(message))
+  let binary = ''
+  for (const byte of new Uint8Array(signature)) binary += String.fromCharCode(byte)
+  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
+}
+
+async function verifyToken(token: string | undefined, now = Date.now()): Promise<boolean> {
+  const secret = signingSecret()
+  if (!secret || !token) return false
+
+  const parts = token.split('.')
+  if (parts.length !== 3) return false
+  const [version, expires, signature] = parts
+  if (version !== VERSION) return false
+
+  const expiry = Number(expires)
+  if (!Number.isSafeInteger(expiry) || expiry * 1000 <= now) return false
+
+  return safeEqual(signature, await hmac(secret, `${version}.${expires}`))
+}
+
+function readCookie(header: string | null | undefined, name: string): string | undefined {
+  if (!header) return undefined
+  for (const pair of header.split(';')) {
+    const eq = pair.indexOf('=')
+    if (eq === -1) continue
+    if (pair.slice(0, eq).trim() === name) return pair.slice(eq + 1).trim()
+  }
+  return undefined
+}
+
 
 /**
  * Where the board lives in this repository. Set PANEL_FILE to override; the
@@ -215,7 +306,31 @@ function configuration() {
   }
 }
 
+/**
+ * Nothing here may reach the platform as an uncaught throw.
+ *
+ * `authorized()` runs before the try that wraps the network calls, so anything
+ * it raised left the platform to answer with its own generic 500 and the
+ * SHOUTING_CODE FUNCTION_INVOCATION_FAILED — a code that names the shape of
+ * the fault and never the fault, which is how three separate fixes were aimed
+ * at a cause nobody had seen. It is the rule `middleware.ts` already lives by:
+ * it never throws, because a throw is answered by a page that names nothing.
+ *
+ * The detail is safe to return: this endpoint is behind the session, and the
+ * GitHub branch below already answers with `detail` for the same reason.
+ */
 export default async function handler(request: VercelRequest, response: VercelResponse) {
+  try {
+    return await handleRequest(request, response)
+  } catch (error) {
+    return response.status(500).json({
+      error: 'The panel API failed before it could answer.',
+      detail: error instanceof Error ? `${error.name}: ${error.message}` : String(error),
+    })
+  }
+}
+
+async function handleRequest(request: VercelRequest, response: VercelResponse) {
   response.setHeader('Cache-Control', 'no-store')
 
   if (request.method !== 'POST' && request.method !== 'GET') {
@@ -248,7 +363,8 @@ export default async function handler(request: VercelRequest, response: VercelRe
   if (problem) return response.status(400).json({ error: problem })
 
   const content = `${JSON.stringify(payload.state, null, 2)}\n`
-  if (Buffer.byteLength(content, 'utf8') > MAX_BODY_BYTES) {
+  const bytes = new TextEncoder().encode(content)
+  if (bytes.length > MAX_BODY_BYTES) {
     return response.status(413).json({ error: 'The state is too large.' })
   }
 
@@ -280,7 +396,7 @@ export default async function handler(request: VercelRequest, response: VercelRe
       headers: { ...githubHeaders, 'content-type': 'application/json' },
       body: JSON.stringify({
         message,
-        content: Buffer.from(content, 'utf8').toString('base64'),
+        content: base64(bytes),
         branch,
         ...(sha ? { sha } : {}),
       }),
@@ -308,6 +424,26 @@ export default async function handler(request: VercelRequest, response: VercelRe
   }
 }
 
+/**
+ * Base64 without `Buffer`.
+ *
+ * `Buffer` was the only runtime-specific global left on this path, and it sat
+ * on the POST side alone — so a function running anywhere but Node answered a
+ * save with a platform 500 while every GET on the same file kept working, and
+ * the panel could only report the number. `TextEncoder` and `btoa` exist in
+ * every runtime this can land in.
+ *
+ * Chunked because `String.fromCharCode(...bytes)` spreads one argument per
+ * byte: a board is far past the call-argument limit and it would throw.
+ */
+function base64(bytes: Uint8Array): string {
+  let binary = ''
+  for (let i = 0; i < bytes.length; i += 0x8000) {
+    binary += String.fromCharCode(...bytes.subarray(i, i + 0x8000))
+  }
+  return btoa(binary)
+}
+
 function safeParse(value: string): unknown {
   try {
     return JSON.parse(value)