pixelkiln 0.70.0 → 0.71.0

package/dist/index.cjs

@@ -164,6 +164,7 @@ __export(index_exports, {
   fontOutputPaths: () => fontOutputPaths,
   formatCost: () => formatCost,
   frameSetFps: () => frameSetFps,
+  galleryContentSecurityPolicy: () => galleryContentSecurityPolicy,
   galleryMediaId: () => galleryMediaId,
   galleryMediaRoute: () => galleryMediaRoute,
   generateFont: () => generateFont,
@@ -15946,6 +15947,15 @@ var SkeletonAnimationRequestSchema = import_zod10.z.object({
   /** Replace an existing `keypointsFile` with `set`. */
   overwrite: import_zod10.z.boolean().optional()
 }).strict();
+var SkeletonKeypointsUpdateSchema = import_zod10.z.object({
+  action: import_zod10.z.literal("update-skeleton-keypoints"),
+  project: import_zod10.z.string().min(1).optional(),
+  styleId: import_zod10.z.string().min(1),
+  assetId: import_zod10.z.string().min(1),
+  /** The file's SHA-256 when the page loaded it; anything else on disk is a concurrent edit. */
+  expectedSha256: import_zod10.z.string().regex(/^[0-9a-f]{64}$/),
+  set: SkeletonSetSchema
+}).strict();
 async function createSkeletonAnimation(manifestPath, request) {
   const root = import_node_path29.default.dirname(import_node_path29.default.resolve(manifestPath));
   const file = import_node_path29.default.resolve(root, request.keypointsFile);
@@ -15991,6 +16001,26 @@ async function createSkeletonAnimation(manifestPath, request) {
     throw error;
   }
 }
+async function updateSkeletonKeypoints(ctx, request) {
+  const key = lockKey(request.styleId, request.assetId);
+  const spec = ctx.specs.find((candidate) => lockKey(candidate.styleId, candidate.assetId) === key);
+  if (!spec) throw new ManifestEditError(`"${key}" is not declared by the manifest`);
+  const file = spec.revision?.mode === "animate-skeleton" ? spec.revision.keypointsFile : void 0;
+  if (!file) throw new ManifestEditError(`${key} is not an animate-skeleton revision`);
+  const relative = import_node_path29.default.relative(ctx.loaded.root, file);
+  if (relative.startsWith("..") || import_node_path29.default.isAbsolute(relative)) {
+    throw new ManifestEditError(`${key}'s keypoints file is outside the project; edit it by hand`);
+  }
+  const current = (0, import_node_fs25.existsSync)(file) ? sha256(await (0, import_promises22.readFile)(file)) : null;
+  if (current !== request.expectedSha256) {
+    throw Object.assign(
+      new Error(`${relative.split(import_node_path29.default.sep).join("/")} changed on disk since this page loaded it; press Refresh and edit again`),
+      { status: 409 }
+    );
+  }
+  await (0, import_promises22.writeFile)(file, JSON.stringify(request.set, null, 2) + "\n");
+  return relative.split(import_node_path29.default.sep).join("/");
+}
 
 // src/gallery/edit.ts
 var Base64 = import_zod11.z.string().regex(/^[A-Za-z0-9+/]*={0,2}$/).max(Math.ceil(MAX_HAND_EDIT_BYTES / 3) * 4);
@@ -16067,6 +16097,18 @@ function createGalleryEditHandler(opts) {
       }
       return opts.reload();
     }
+    const poses = SkeletonKeypointsUpdateSchema.safeParse(body);
+    if (poses.success) {
+      if (!opts.loadProject) throw new ManifestEditError("pose edits are not available in this gallery");
+      const written = await updateSkeletonKeypoints(await opts.loadProject(poses.data.project), poses.data);
+      log(`  poses saved: ${written} (${poses.data.styleId}/${poses.data.assetId} is stale until generated again)`);
+      return opts.reload();
+    }
+    if (body?.action === "update-skeleton-keypoints") {
+      throw new ManifestEditError(
+        "invalid pose edit: " + poses.error.issues.slice(0, 3).map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ")
+      );
+    }
     const skeleton = SkeletonAnimationRequestSchema.safeParse(body);
     if (skeleton.success) {
       let manifestPath2;
@@ -16440,7 +16482,8 @@ async function buildGallerySnapshot(opts) {
       mirrorOfKey: spec.mirror ? lockKey(spec.styleId, spec.mirror.sourceAssetId) : entry?.mirror ? lockKey(spec.styleId, entry.mirror.sourceAssetId) : null,
       skeleton: spec.revision?.mode === "animate-skeleton" && spec.revision.keypointsFile ? {
         keypointsFile: portableOutputPath(spec.revision.keypointsFile, root),
-        set: spec.revision.skeleton ?? null
+        set: spec.revision.skeleton ?? null,
+        sha256: spec.revision.keypointsSha256 ?? null
       } : null,
       character: describeCharacter(spec, entry),
       outputs,
@@ -16728,12 +16771,47 @@ async function buildWorkspaceGallerySnapshot(opts) {
 
 // src/gallery/page.ts
 var import_node_fs27 = require("fs");
+
+// src/gallery/client-bundle.ts
+var import_node_module = require("module");
+var import_node_url2 = require("url");
+function bundleGalleryClient(entry = (0, import_node_url2.fileURLToPath)(new URL("./client/src/main.ts", importMetaUrl))) {
+  const esbuild = (0, import_node_module.createRequire)(importMetaUrl)("esbuild");
+  const result = esbuild.buildSync({
+    entryPoints: [entry],
+    bundle: true,
+    format: "iife",
+    target: "es2020",
+    platform: "browser",
+    write: false,
+    legalComments: "none",
+    charset: "utf8"
+  });
+  return result.outputFiles[0].text;
+}
+
+// src/gallery/page.ts
+function galleryContentSecurityPolicy(nonce) {
+  return [
+    "default-src 'self'",
+    `script-src 'nonce-${nonce}'`,
+    `style-src 'nonce-${nonce}'`,
+    "img-src 'self' data: blob:",
+    "frame-src 'self'",
+    "connect-src 'self'",
+    "object-src 'none'",
+    "base-uri 'none'",
+    "form-action 'none'",
+    "frame-ancestors 'none'"
+  ].join("; ");
+}
 var CLIENT_DIR = new URL("./client/", importMetaUrl);
 var client;
 function clientAssets() {
+  const prebuilt = new URL("gallery.js", CLIENT_DIR);
   client ??= {
     css: (0, import_node_fs27.readFileSync)(new URL("gallery.css", CLIENT_DIR), "utf8"),
-    js: (0, import_node_fs27.readFileSync)(new URL("gallery.js", CLIENT_DIR), "utf8")
+    js: (0, import_node_fs27.existsSync)(prebuilt) ? (0, import_node_fs27.readFileSync)(prebuilt, "utf8") : bundleGalleryClient()
   };
   return client;
 }
@@ -16745,6 +16823,7 @@ function renderGallery(snapshot, opts = {}) {
   const editor = JSON.stringify(Boolean(opts.editor && opts.session));
   const title = `${snapshot.project?.name ?? "workspace"} | pixelkiln`;
   const { css, js } = clientAssets();
+  const nonce = opts.nonce ? ` nonce="${escapeHtml2(opts.nonce)}"` : "";
   return `<!doctype html>
 <html lang="en">
 <head>
@@ -16752,7 +16831,7 @@ function renderGallery(snapshot, opts = {}) {
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>${escapeHtml2(title)}</title>
 <link rel="icon" href="data:,">
-<style>
+<style${nonce}>
 ${css}</style>
 </head>
 <body>
@@ -16794,7 +16873,7 @@ ${css}</style>
 <div id="drawer-host"></div>
 <div id="dialog-host"></div>
 <datalist id="view-options"><option value="low top-down"><option value="high top-down"><option value="side"><option value="sidescroller"></datalist>
-<script>
+<script${nonce}>
 const INITIAL = ${data};
 const SESSION = ${session};
 const EDITABLE = ${editable};
@@ -17287,6 +17366,10 @@ async function serveGallery(opts) {
       }
     }
     if (req.method !== "GET" && req.method !== "HEAD") return fail(405, "the gallery is read-only");
+    if (url2.pathname === "/api/skeleton") {
+      if (!opts.skeleton) return fail(404, "skeleton estimates need the gallery started with --edit");
+      return json(200, opts.skeleton.status());
+    }
     if (url2.pathname === "/api/jobs") {
       if (!opts.generate) return fail(404, "generation is off");
       return json(200, opts.generate.status());
@@ -17320,12 +17403,15 @@ async function serveGallery(opts) {
     try {
       if (url2.pathname === "/") {
         const { snapshot } = await load();
+        const nonce = (0, import_node_crypto8.randomBytes)(16).toString("base64");
         res.writeHead(200, {
           "Content-Type": "text/html; charset=utf-8",
           "Cache-Control": "no-store",
-          "X-Content-Type-Options": "nosniff"
+          "X-Content-Type-Options": "nosniff",
+          "Content-Security-Policy": galleryContentSecurityPolicy(nonce)
         });
         res.end(renderGallery(snapshot, {
+          nonce,
           ...session ? { session } : {},
           editable: Boolean(opts.edit),
           generation: Boolean(opts.generate),
@@ -18499,6 +18585,7 @@ async function workspaceStatus(ws, dir) {
   fontOutputPaths,
   formatCost,
   frameSetFps,
+  galleryContentSecurityPolicy,
   galleryMediaId,
   galleryMediaRoute,
   generateFont,