ryugi-artifacts 1.46.4 → 1.48.0

package/dist/server.cjs

@@ -8798,7 +8798,7 @@ var import_node_os2 = __toESM(require("node:os"), 1);
 var import_node_path25 = __toESM(require("node:path"), 1);
 
 // package.json
-var version = "1.46.4";
+var version = "1.48.0";
 
 // src/server/app.ts
 var import_node_fs26 = __toESM(require("node:fs"), 1);
@@ -8825,6 +8825,24 @@ var ADDRESS_SOURCE = "(?:[\\w-]{21}|[a-f0-9]{32})";
 var ARTIFACT_LOCATOR_SOURCE = `(?:${SLUG_SOURCE}|${ADDRESS_SOURCE})`;
 var ID_PATTERN = new RegExp(`^${SLUG_SOURCE}$`);
 var ADDRESS_PATTERN = new RegExp(`^${ADDRESS_SOURCE}$`);
+var MINT_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+var MINT_LENGTH = 21;
+var MINTED_PATTERN = new RegExp(`^[a-z0-9]{${MINT_LENGTH}}$`, "i");
+var MINT_BYTE_LIMIT = 248;
+function mintArtifactId() {
+  let id2 = "";
+  const bytes = new Uint8Array(MINT_LENGTH * 2);
+  while (id2.length < MINT_LENGTH) {
+    crypto.getRandomValues(bytes);
+    for (const byte of bytes) {
+      if (byte >= MINT_BYTE_LIMIT) continue;
+      id2 += MINT_ALPHABET[byte % MINT_ALPHABET.length];
+      if (id2.length === MINT_LENGTH) break;
+    }
+  }
+  return id2;
+}
+var isMintedArtifactId = (id2) => MINTED_PATTERN.test(id2);
 var isArtifactId = (id2) => ID_PATTERN.test(id2);
 var isArtifactAddress = (id2) => ADDRESS_PATTERN.test(id2);
 var isArtifactLocator = (id2) => ID_PATTERN.test(id2) || ADDRESS_PATTERN.test(id2);
@@ -9120,88 +9138,36 @@ function typeFaviconHref(type) {
   return `data:image/svg+xml,${encodeURIComponent(svg)}`;
 }
 
+// src/server/access.ts
+var LOOPBACK = /* @__PURE__ */ new Set(["localhost", "::1", "[::1]"]);
+var isLoopbackHost = (host) => LOOPBACK.has(host) || /^127\.\d+\.\d+\.\d+$/.test(host);
+var bracket = (host) => host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+function accessPolicy({
+  host,
+  urlHost,
+  ports,
+  cloudOrigin
+}) {
+  const names = [
+    ...new Set(
+      ["localhost", "127.0.0.1", bracket(host), bracket(urlHost)].map((name) => name.toLowerCase())
+    )
+  ];
+  const hosts = new Set(ports.flatMap((port) => names.map((name) => `${name}:${port}`)));
+  const viewerPort = ports[0];
+  const origins = new Set(names.map((name) => `http://${name}:${viewerPort}`));
+  return { loopback: isLoopbackHost(host), hosts, origins, cloudOrigin };
+}
+var hostAllowed = (policy, host) => !policy.loopback || host !== void 0 && policy.hosts.has(host.toLowerCase());
+var originAllowed = (policy, origin, { cloud = false } = {}) => origin === void 0 || policy.origins.has(origin) || cloud && policy.cloudOrigin !== void 0 && origin === policy.cloudOrigin;
+var navigationAllowed = (secFetchSite) => secFetchSite === void 0 || secFetchSite === "none" || secFetchSite === "same-origin";
+
 // src/server/artifact-address.ts
 var import_node_fs2 = __toESM(require("node:fs"), 1);
 var import_node_path2 = __toESM(require("node:path"), 1);
 
-// node_modules/.pnpm/nanoid@5.1.16/node_modules/nanoid/index.js
-var import_node_crypto = require("node:crypto");
-
-// node_modules/.pnpm/nanoid@5.1.16/node_modules/nanoid/url-alphabet/index.js
-var urlAlphabet = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict";
-
-// node_modules/.pnpm/nanoid@5.1.16/node_modules/nanoid/index.js
-var POOL_SIZE_MULTIPLIER = 128;
-var pool;
-var poolOffset;
-function fillPool(bytes) {
-  if (bytes < 0) throw new RangeError("Wrong ID size");
-  try {
-    if (!pool || pool.length < bytes) {
-      pool = Buffer.allocUnsafe(bytes * POOL_SIZE_MULTIPLIER);
-      import_node_crypto.webcrypto.getRandomValues(pool);
-      poolOffset = 0;
-    } else if (poolOffset + bytes > pool.length) {
-      import_node_crypto.webcrypto.getRandomValues(pool);
-      poolOffset = 0;
-    }
-  } catch (e5) {
-    pool = void 0;
-    throw e5;
-  }
-  poolOffset += bytes;
-}
-function random(bytes) {
-  fillPool(bytes |= 0);
-  return pool.subarray(poolOffset - bytes, poolOffset);
-}
-function customRandom(alphabet, defaultSize, getRandom) {
-  let safeByteCutoff = 256 - 256 % alphabet.length;
-  if (safeByteCutoff === 256) {
-    let mask = alphabet.length - 1;
-    return (size = defaultSize) => {
-      if (!size) return "";
-      let id2 = "";
-      while (true) {
-        let bytes = getRandom(size);
-        let i6 = size;
-        while (i6--) {
-          id2 += alphabet[bytes[i6] & mask];
-          if (id2.length >= size) return id2;
-        }
-      }
-    };
-  }
-  let step = Math.ceil(1.6 * 256 * defaultSize / safeByteCutoff);
-  return (size = defaultSize) => {
-    if (!size) return "";
-    let id2 = "";
-    while (true) {
-      let bytes = getRandom(step);
-      let i6 = step;
-      while (i6--) {
-        if (bytes[i6] < safeByteCutoff) {
-          id2 += alphabet[bytes[i6] % alphabet.length];
-          if (id2.length >= size) return id2;
-        }
-      }
-    }
-  };
-}
-function customAlphabet(alphabet, size = 21) {
-  return customRandom(alphabet, size, random);
-}
-function nanoid(size = 21) {
-  fillPool(size |= 0);
-  let id2 = "";
-  for (let i6 = poolOffset - size; i6 < poolOffset; i6++) {
-    id2 += urlAlphabet[pool[i6] & 63];
-  }
-  return id2;
-}
-
 // src/server/artifacts.ts
-var import_node_crypto2 = __toESM(require("node:crypto"), 1);
+var import_node_crypto = __toESM(require("node:crypto"), 1);
 var import_node_fs = __toESM(require("node:fs"), 1);
 var import_node_path = __toESM(require("node:path"), 1);
 function subdirectories(dir) {
@@ -9273,15 +9239,11 @@ function artifactSignature(dir, type) {
     }
   };
   walk(dir);
-  const hash = import_node_crypto2.default.createHash("sha1").update(names.sort().join("\0")).digest("hex").slice(0, 12);
+  const hash = import_node_crypto.default.createHash("sha1").update(names.sort().join("\0")).digest("hex").slice(0, 12);
   return `${names.length}:${size}:${latest}:${hash}`;
 }
 
 // src/server/artifact-address.ts
-var newArtifactId = customAlphabet(
-  "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",
-  21
-);
 function artifactId(dir) {
   const file = import_node_path2.default.join(dir, ".artifact-id");
   let id2;
@@ -9289,7 +9251,7 @@ function artifactId(dir) {
     id2 = import_node_fs2.default.readFileSync(file, "utf8").trim();
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
-    id2 = newArtifactId();
+    id2 = mintArtifactId();
     try {
       import_node_fs2.default.writeFileSync(file, `${id2}
 `, { flag: "wx" });
@@ -9322,7 +9284,7 @@ function resolveArtifactAddress(root, type, address) {
 var import_node_fs5 = __toESM(require("node:fs"), 1);
 
 // src/server/http.ts
-var import_node_crypto3 = __toESM(require("node:crypto"), 1);
+var import_node_crypto2 = __toESM(require("node:crypto"), 1);
 var import_node_fs3 = __toESM(require("node:fs"), 1);
 var import_node_path3 = __toESM(require("node:path"), 1);
 var MIME = {
@@ -9348,11 +9310,11 @@ var MIME = {
   ".webm": "video/webm"
 };
 var mimeOf = (file) => MIME[import_node_path3.default.extname(file).toLowerCase()] ?? "application/octet-stream";
-var randomToken = () => import_node_crypto3.default.randomBytes(24).toString("base64url");
+var randomToken = () => import_node_crypto2.default.randomBytes(24).toString("base64url");
 function safeEqual(a5, b6) {
   const ab = Buffer.from(a5);
   const bb = Buffer.from(b6);
-  return ab.length === bb.length && import_node_crypto3.default.timingSafeEqual(ab, bb);
+  return ab.length === bb.length && import_node_crypto2.default.timingSafeEqual(ab, bb);
 }
 function parseCookies(header) {
   const cookies = {};
@@ -10559,7 +10521,7 @@ function readArtifactFile(dir, type, relative, uiRuntimeUrl, maxBytes = Infinity
 }
 
 // src/server/auto-publish.ts
-var import_node_crypto4 = __toESM(require("node:crypto"), 1);
+var import_node_crypto3 = __toESM(require("node:crypto"), 1);
 var import_node_fs7 = __toESM(require("node:fs"), 1);
 
 // src/server/state.ts
@@ -10979,7 +10941,7 @@ function createAutoPublisher(options) {
   });
   const raise = (kind, message, upgradeUrl) => {
     if (notice?.kind !== kind)
-      notice = { id: import_node_crypto4.default.randomUUID(), kind, message, ...upgradeUrl ? { upgradeUrl } : {} };
+      notice = { id: import_node_crypto3.default.randomUUID(), kind, message, ...upgradeUrl ? { upgradeUrl } : {} };
   };
   let idleTimer = null;
   let maxTimer = null;
@@ -11082,7 +11044,7 @@ function createAutoPublisher(options) {
 }
 
 // src/server/avatars.ts
-var import_node_crypto5 = require("node:crypto");
+var import_node_crypto4 = require("node:crypto");
 var AVATAR_ROUTE = /^\/api\/avatar\/([a-z]+)\/([^/]+)$/;
 var MAX_BYTES = 512 * 1024;
 var TIMEOUT_MS = 5e3;
@@ -11097,7 +11059,7 @@ var SOURCES = {
   }
 };
 var githubAvatar = (login) => `/api/avatar/github/${login}`;
-var gravatarAvatar = (email) => `/api/avatar/gravatar/${(0, import_node_crypto5.createHash)("sha256").update(email.trim().toLowerCase()).digest("hex")}`;
+var gravatarAvatar = (email) => `/api/avatar/gravatar/${(0, import_node_crypto4.createHash)("sha256").update(email.trim().toLowerCase()).digest("hex")}`;
 function createAvatars(fetchImpl = fetch) {
   const cache = /* @__PURE__ */ new Map();
   const fetchAvatar = async (url) => {
@@ -11608,6 +11570,44 @@ function createCommentCursors(stateDir, type = "document") {
 
 // src/server/document-comments.ts
 var import_node_fs9 = __toESM(require("node:fs"), 1);
+
+// node_modules/.pnpm/nanoid@5.1.16/node_modules/nanoid/index.js
+var import_node_crypto5 = require("node:crypto");
+
+// node_modules/.pnpm/nanoid@5.1.16/node_modules/nanoid/url-alphabet/index.js
+var urlAlphabet = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict";
+
+// node_modules/.pnpm/nanoid@5.1.16/node_modules/nanoid/index.js
+var POOL_SIZE_MULTIPLIER = 128;
+var pool;
+var poolOffset;
+function fillPool(bytes) {
+  if (bytes < 0) throw new RangeError("Wrong ID size");
+  try {
+    if (!pool || pool.length < bytes) {
+      pool = Buffer.allocUnsafe(bytes * POOL_SIZE_MULTIPLIER);
+      import_node_crypto5.webcrypto.getRandomValues(pool);
+      poolOffset = 0;
+    } else if (poolOffset + bytes > pool.length) {
+      import_node_crypto5.webcrypto.getRandomValues(pool);
+      poolOffset = 0;
+    }
+  } catch (e5) {
+    pool = void 0;
+    throw e5;
+  }
+  poolOffset += bytes;
+}
+function nanoid(size = 21) {
+  fillPool(size |= 0);
+  let id2 = "";
+  for (let i6 = poolOffset - size; i6 < poolOffset; i6++) {
+    id2 += urlAlphabet[pool[i6] & 63];
+  }
+  return id2;
+}
+
+// src/server/document-comments.ts
 var MAX_TEXT = 2e4;
 var isText = (value, max = MAX_TEXT) => typeof value === "string" && value.length <= max;
 var isId = (value) => isText(value, 100) && value.length > 0;
@@ -11982,6 +11982,29 @@ function createBoardCommentRegistry(options) {
   };
 }
 
+// src/server/board-port.ts
+var BOARD_PORT_FILE = ".last-board-port";
+var BOARD_ROUTE = /^\/c\/artboard\/([^/]+)\/(.+)$/;
+var RUNTIME_ROUTE = /^\/c\/runtime\/(.+)$/;
+var loopbackHosts = (urlHost) => [
+  .../* @__PURE__ */ new Set(["localhost", "127.0.0.1", urlHost.includes(":") ? `[${urlHost}]` : urlHost])
+];
+var originsFor = (urlHost, port) => loopbackHosts(urlHost).map((host) => `http://${host}:${port}`);
+function boardCsp(urlHost, viewerPort, cloudOrigin) {
+  const ancestors = [...originsFor(urlHost, viewerPort), ...cloudOrigin ? [cloudOrigin] : []];
+  return `worker-src 'none'; frame-ancestors ${ancestors.join(" ")}`;
+}
+function routeBoardRequest(req, pathname) {
+  if (req.method !== "GET" && req.method !== "HEAD") return { kind: "none" };
+  if (pathname === "/robots.txt") return { kind: "robots" };
+  const runtime = RUNTIME_ROUTE.exec(pathname);
+  if (runtime) return { kind: "runtime", rest: `runtime/${runtime[1]}` };
+  const board = BOARD_ROUTE.exec(pathname);
+  if (board && isArtifactAddress(board[1]))
+    return { kind: "board", address: board[1], rest: board[2] };
+  return { kind: "none" };
+}
+
 // src/server/cloud.ts
 var import_node_crypto7 = __toESM(require("node:crypto"), 1);
 
@@ -12043,8 +12066,12 @@ var en_default = {
     fromPageDetail: "Go back to Ryugi; the share panel refreshes on its own.",
     fromAgent: "Asked the agent to publish?",
     fromAgentDetail: "Have it run the publish command again.",
-    autoPublish: "Auto-publish is on",
-    autoPublishDetail: "After each agent turn, changed artifacts sync privately to Ryugi Cloud. To turn it off, run <code>ryugi-artifacts config --auto-publish off</code>.",
+    autoPublishOn: "Auto-publish is on",
+    autoPublishOff: "Auto-publish is off",
+    autoPublishDetail: "After each agent turn, changed artifacts sync privately to Ryugi Cloud, so you can open them on another device. Only you can see them.",
+    autoPublishTurnOn: "Turn on auto-publish",
+    autoPublishTurnOff: "Turn off auto-publish",
+    autoPublishWhere: "Change it any time in Settings, from your avatar at the top right of the artifact list.",
     notConnected: "Not connected",
     retry: "Sign in again",
     retryDetail: "Go back to Ryugi and click Sign in in the share panel again.",
@@ -12075,8 +12102,12 @@ var zh_default = {
     fromPageDetail: "\u56DE\u5230 Ryugi\uFF0C\u5206\u4EAB\u9762\u677F\u4F1A\u81EA\u52A8\u5237\u65B0\u3002",
     fromAgent: "\u8BA9 agent \u53D1\u5E03\u7684\uFF1F",
     fromAgentDetail: "\u8BA9\u5B83\u518D\u8FD0\u884C\u4E00\u6B21\u53D1\u5E03\u547D\u4EE4\u3002",
-    autoPublish: "\u81EA\u52A8\u53D1\u5E03\u5DF2\u6253\u5F00",
-    autoPublishDetail: "agent \u6BCF\u8F6E\u7ED3\u675F\u540E\uFF0C\u6539\u8FC7\u7684 artifact \u4F1A\u4EE5\u79C1\u5BC6\u65B9\u5F0F\u540C\u6B65\u5230 Ryugi Cloud\u3002\u5173\u95ED\uFF1A\u8FD0\u884C <code>ryugi-artifacts config --auto-publish off</code>\u3002",
+    autoPublishOn: "\u81EA\u52A8\u53D1\u5E03\u5DF2\u6253\u5F00",
+    autoPublishOff: "\u81EA\u52A8\u53D1\u5E03\u5DF2\u5173\u95ED",
+    autoPublishDetail: "agent \u6BCF\u8F6E\u7ED3\u675F\u540E\uFF0C\u6539\u8FC7\u7684 artifact \u4F1A\u4EE5\u79C1\u5BC6\u65B9\u5F0F\u540C\u6B65\u5230 Ryugi Cloud\uFF0C\u6362\u53F0\u8BBE\u5907\u4E5F\u80FD\u6253\u5F00\u3002\u53EA\u6709\u4F60\u80FD\u770B\u5230\u3002",
+    autoPublishTurnOn: "\u6253\u5F00\u81EA\u52A8\u53D1\u5E03",
+    autoPublishTurnOff: "\u5173\u95ED\u81EA\u52A8\u53D1\u5E03",
+    autoPublishWhere: "\u4EE5\u540E\u5728 Artifacts \u5217\u8868\u53F3\u4E0A\u89D2\u5934\u50CF \u203A \u8BBE\u7F6E \u91CC\u968F\u65F6\u4FEE\u6539\u3002",
     notConnected: "\u672A\u8FDE\u63A5",
     retry: "\u91CD\u65B0\u767B\u5F55",
     retryDetail: "\u56DE\u5230 Ryugi\uFF0C\u5728\u5206\u4EAB\u9762\u677F\u91CC\u518D\u70B9\u4E00\u6B21\u300C\u767B\u5F55\u300D\u3002",
@@ -12099,7 +12130,7 @@ var zh_default = {
 var serverText = (locale) => translator({ en: en_default, zh: zh_default }, locale);
 
 // src/server/callback-page.ts
-var CALLBACK_PAGE_CSP = "default-src 'none'; style-src 'unsafe-inline'; img-src data:; script-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'";
+var CALLBACK_PAGE_CSP = "default-src 'none'; style-src 'unsafe-inline'; img-src data:; script-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'";
 var escapeHtml = (value) => value.replaceAll(
   /[&<>"']/g,
   (ch2) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[ch2]
@@ -12170,10 +12201,25 @@ h1 em { margin-left: 8px; font-style: normal; color: var(--name); }
 .rows li { padding: 16px 0; border-bottom: 1px solid var(--rule); font-size: 14px; }
 .rows b { display: block; margin-bottom: 3px; font-weight: 600; }
 .rows span { color: var(--soft); font-size: 13px; }
+.auto { margin-top: 28px; padding: 16px 18px; border: 1px solid var(--rule); border-radius: 12px; }
+.auto form { display: flex; align-items: center; gap: 16px; margin: 0; }
+.auto .text { flex: 1; }
+.auto b { display: block; margin-bottom: 4px; font-size: 15px; font-weight: 600; }
+.auto .text span { color: var(--soft); font-size: 13px; line-height: 1.7; }
+.switch { flex-shrink: 0; width: 44px; height: 24px; padding: 2px; border: 0; border-radius: 12px; background: var(--rule); cursor: pointer; display: flex; }
+.switch[aria-checked="true"] { justify-content: flex-end; background: var(--ink); }
+.switch i { width: 20px; height: 20px; border-radius: 50%; background: var(--bg); }
+.switch:focus-visible { outline: 2px solid var(--name); outline-offset: 2px; }
+.auto .where { display: block; margin-top: 12px; padding-top: 12px; border-top: 1px solid var(--rule); color: var(--soft); font-size: 12px; }
 footer { display: flex; justify-content: space-between; gap: 16px; margin-top: 20px; font-size: 12px; color: var(--faint); }
 footer code { font: 12px var(--mono); }
 `;
 var row = (title, detail) => `<li><b>${title}</b><span>${detail}</span></li>`;
+var autoPublishCard = (t7, on5, ticket) => `<section class="auto"><form method="post" action="/api/cloud/callback/auto-publish">
+        <input type="hidden" name="ticket" value="${escapeHtml(ticket)}">
+        <span class="text"><b>${on5 ? t7("callback.autoPublishOn") : t7("callback.autoPublishOff")}</b><span>${t7("callback.autoPublishDetail")}</span></span>
+        <button class="switch" type="submit" name="value" value="${on5 ? "off" : "on"}" role="switch" aria-checked="${on5}" aria-label="${on5 ? t7("callback.autoPublishTurnOff") : t7("callback.autoPublishTurnOn")}"><i></i></button>
+      </form><span class="where">${t7("callback.autoPublishWhere")}</span></section>`;
 function callbackPage(result, locale = "en") {
   const t7 = serverText(locale);
   const host = escapeHtml(new URL(result.origin).host);
@@ -12181,7 +12227,8 @@ function callbackPage(result, locale = "en") {
   const body = result.ok ? `<p class="status">${CIRCLE_CHECK}${t7("callback.connected")}</p>
       <h1>${t7("callback.signedIn")}<em>${escapeHtml(result.login)}</em></h1>
       <p class="lead">${t7("callback.lead")}</p>
-      <ul class="rows">${row(t7("callback.fromPage"), t7("callback.fromPageDetail"))}${row(t7("callback.fromAgent"), t7("callback.fromAgentDetail"))}${result.autoPublish ? row(t7("callback.autoPublish"), t7("callback.autoPublishDetail")) : ""}</ul>` : `<p class="status">${CIRCLE_ALERT}${t7("callback.notConnected")}</p>
+      ${autoPublishCard(t7, result.autoPublish, result.ticket)}
+      <ul class="rows">${row(t7("callback.fromPage"), t7("callback.fromPageDetail"))}${row(t7("callback.fromAgent"), t7("callback.fromAgentDetail"))}</ul>` : `<p class="status">${CIRCLE_ALERT}${t7("callback.notConnected")}</p>
       <h1>${t7("callback.titleFailed")}</h1>
       <p class="lead">${escapeHtml(result.detail)}</p>
       <ul class="rows">${row(t7("callback.retry"), t7("callback.retryDetail"))}</ul>`;
@@ -12424,14 +12471,14 @@ function fillRandom(buffer) {
     from = to3;
   }
 }
-function random2(bytes) {
+function random(bytes) {
   bytes |= 0;
   if (bytes < 0) throw new RangeError("Wrong ID size");
   let buffer = Buffer.allocUnsafe(bytes);
   fillRandom(buffer);
   return buffer;
 }
-function customRandom2(alphabet, defaultSize, getRandom) {
+function customRandom(alphabet, defaultSize, getRandom) {
   let safeByteCutoff = 256 - 256 % alphabet.length;
   if (safeByteCutoff === 256) {
     let mask = alphabet.length - 1;
@@ -12465,13 +12512,13 @@ function customRandom2(alphabet, defaultSize, getRandom) {
   };
 }
 var POOL_MAX = GET_RANDOM_LIMIT / 2;
-function customAlphabet2(alphabet, defaultSize = 21) {
+function customAlphabet(alphabet, defaultSize = 21) {
   if (typeof alphabet !== "string" || !alphabet || alphabet.length > 256) {
-    return customRandom2(alphabet, defaultSize, random2);
+    return customRandom(alphabet, defaultSize, random);
   }
   for (let i6 = 0; i6 < alphabet.length; i6++) {
     if (alphabet.charCodeAt(i6) > 255) {
-      return customRandom2(alphabet, defaultSize, random2);
+      return customRandom(alphabet, defaultSize, random);
     }
   }
   let charCodes = Uint8Array.from(alphabet, (str) => {
@@ -12518,7 +12565,7 @@ function customAlphabet2(alphabet, defaultSize = 21) {
     return pool2.substring(poolOffset2 - size, poolOffset2);
   };
 }
-var nanoid2 = customAlphabet2(urlAlphabet2);
+var nanoid2 = customAlphabet(urlAlphabet2);
 
 // node_modules/.pnpm/@haklex+rich-litexml@0.61.1_typescript@5.9.3/node_modules/@haklex/rich-litexml/dist/src-CwO17cE7.js
 var impl = null;
@@ -12664,11 +12711,11 @@ function registerBuiltinReaders(registry2) {
   }));
 }
 var idAlphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
-var makePollIdSuffix = customAlphabet2(idAlphabet, 10);
-var makeOptionIdSuffix = customAlphabet2(idAlphabet, 6);
-var makeChatParticipantId = customAlphabet2(idAlphabet, 6);
-var makeChatMessageId = customAlphabet2(idAlphabet, 8);
-var makeStepId = customAlphabet2(idAlphabet, 8);
+var makePollIdSuffix = customAlphabet(idAlphabet, 10);
+var makeOptionIdSuffix = customAlphabet(idAlphabet, 6);
+var makeChatParticipantId = customAlphabet(idAlphabet, 6);
+var makeChatMessageId = customAlphabet(idAlphabet, 8);
+var makeStepId = customAlphabet(idAlphabet, 8);
 function extractBlockId(el2) {
   const id2 = el2.getAttribute("id");
   return id2 ? { $: { blockId: id2 } } : {};
@@ -24905,7 +24952,7 @@ function sharedComments(file) {
 function publishPayload(ref, dir, title, payload, comments = emptyComments()) {
   if (ref.type === "artboard") {
     const { canvas, layout, versions } = payload;
-    return { canvas, layout, versions, snapshots: true };
+    return { canvas, layout, versions };
   }
   if (ref.type === "document")
     return {
@@ -24951,6 +24998,16 @@ function writeGlobalAutoPublish(file, value) {
   import_node_fs16.default.mkdirSync(import_node_path13.default.dirname(file), { recursive: true, mode: 448 });
   writeJsonAtomic(file, { ...readSettings(file), autoPublish: value });
 }
+function postponeGlobalAutoPublish(file) {
+  const settings = readSettings(file);
+  if (settings.autoPublishPostponed === true) {
+    writeGlobalAutoPublish(file, false);
+    return "off";
+  }
+  import_node_fs16.default.mkdirSync(import_node_path13.default.dirname(file), { recursive: true, mode: 448 });
+  writeJsonAtomic(file, { ...settings, autoPublishPostponed: true });
+  return "postponed";
+}
 function defaultGlobalAutoPublish(file) {
   if (readGlobalAutoPublish(file) === void 0) writeGlobalAutoPublish(file, true);
 }
@@ -24963,6 +25020,7 @@ function autoPublishEnabled({
 
 // src/server/cloud.ts
 var LOGIN_STATE_TTL_MS = 10 * 60 * 1e3;
+var CALLBACK_TICKET_TTL_MS = 30 * 60 * 1e3;
 var UPLOAD_CONCURRENCY = 6;
 var MAX_JSON_BODY = 4096;
 var CLOUD_ID = /^[\w-]{1,64}$/;
@@ -24994,7 +25052,7 @@ var CreateRefused = class extends CloudRefused {
   }
   detail;
 };
-async function readJsonBody(req) {
+async function readBodyText(req) {
   const chunks = [];
   let size = 0;
   for await (const chunk of req) {
@@ -25002,8 +25060,11 @@ async function readJsonBody(req) {
     if (size > MAX_JSON_BODY) throw new CloudRefused(413, "request body too large");
     chunks.push(chunk);
   }
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function readJsonBody(req) {
   try {
-    return JSON.parse(Buffer.concat(chunks).toString("utf8") || "null");
+    return JSON.parse(await readBodyText(req) || "null");
   } catch {
     return null;
   }
@@ -25049,7 +25110,27 @@ function createCloudRoutes(options) {
     project: readConfig(configFile).config.autoPublish ?? null,
     enabled: !!readCredentials(credentialsFile2, origin) && autoPublishEnabled({ globalFile: settingsFile, projectFile: configFile })
   });
+  let postponed = false;
   const pendingStates = /* @__PURE__ */ new Map();
+  const callbackTickets = /* @__PURE__ */ new Map();
+  const issueTicket = (login) => {
+    const now = Date.now();
+    for (const [ticket2, issued] of callbackTickets)
+      if (issued.expires < now) callbackTickets.delete(ticket2);
+    const ticket = randomToken();
+    callbackTickets.set(ticket, { expires: now + CALLBACK_TICKET_TTL_MS, login });
+    return ticket;
+  };
+  const sendCallbackPage = (res, status, result, locale) => send(res, status, callbackPage({ ...result, origin }, locale), {
+    "Content-Type": "text/html; charset=utf-8",
+    "Content-Security-Policy": CALLBACK_PAGE_CSP
+  });
+  const signedInPage = (res, ticket, login, locale) => sendCallbackPage(
+    res,
+    200,
+    { ok: true, login, ticket, autoPublish: readGlobalAutoPublish(settingsFile) ?? false },
+    locale
+  );
   const loginUrl = () => {
     const now = Date.now();
     for (const [state2, pending] of pendingStates)
@@ -25112,7 +25193,14 @@ function createCloudRoutes(options) {
     ([, entry]) => entry.cloud?.id === cloudId
   )?.[0] ?? `cloud:${cloudId}`;
   const createRecord2 = async (ref, visibility) => {
-    const res = await cloudFetch("POST", "/api/artifacts", { type: ref.type, visibility, project });
+    const body = { type: ref.type, visibility, project };
+    const id2 = options.address?.(ref);
+    let res = await cloudFetch(
+      "POST",
+      "/api/artifacts",
+      id2 && isMintedArtifactId(id2) ? { ...body, id: id2 } : body
+    );
+    if (res.status === 409) res = await cloudFetch("POST", "/api/artifacts", body);
     if (res.status === 403) throw new CreateRefused(await errorMessage(res));
     const created = await (await expectOk(res)).json();
     updateArtifactConfig(configFile, `${ref.type}/${ref.id}`, {
@@ -25381,7 +25469,7 @@ function createCloudRoutes(options) {
         origin,
         hostId: hostIdFor(credentialsFile2),
         artifacts: config.artifacts,
-        autoPublish: autoPublishState(),
+        autoPublish: { ...autoPublishState(), postponed },
         warning: warning ?? null
       });
       return;
@@ -25460,6 +25548,11 @@ function createCloudRoutes(options) {
       sendJson(res, 200, await setVisibility(ref, visibility));
       return;
     }
+    if (action === "auto-publish" && method === "POST" && first === "later" && !second) {
+      postponed = postponeGlobalAutoPublish(settingsFile) === "postponed";
+      sendJson(res, 200, { ...autoPublishState(), postponed });
+      return;
+    }
     if (action === "auto-publish" && method === "POST" && !first) {
       const body = await readJsonBody(req);
       const value = body?.value;
@@ -25480,10 +25573,7 @@ function createCloudRoutes(options) {
   return {
     async handleCallback(url, res, locale = "en") {
       const t7 = serverText(locale);
-      const page = (status, result) => send(res, status, callbackPage({ ...result, origin }, locale), {
-        "Content-Type": "text/html; charset=utf-8",
-        "Content-Security-Policy": CALLBACK_PAGE_CSP
-      });
+      const page = (status, result) => sendCallbackPage(res, status, result, locale);
       const state = url.searchParams.get("state") ?? "";
       const pending = pendingStates.get(state);
       pendingStates.delete(state);
@@ -25514,7 +25604,27 @@ function createCloudRoutes(options) {
       }
       writeCredentials(credentialsFile2, { origin, token: issued.token, login: issued.login });
       defaultGlobalAutoPublish(settingsFile);
-      page(200, { ok: true, login: issued.login, autoPublish: autoPublishState().enabled });
+      signedInPage(res, issueTicket(issued.login), issued.login, locale);
+    },
+    async handleCallbackAutoPublish(req, res, locale = "en") {
+      if (req.method !== "POST") {
+        send(res, 405, "Method not allowed");
+        return;
+      }
+      const form = new URLSearchParams(await readBodyText(req));
+      const ticket = form.get("ticket") ?? "";
+      const issued = callbackTickets.get(ticket);
+      const value = form.get("value");
+      if (!issued || issued.expires < Date.now()) {
+        send(res, 403, "Forbidden");
+        return;
+      }
+      if (value !== "on" && value !== "off") {
+        send(res, 400, "value must be on or off");
+        return;
+      }
+      writeGlobalAutoPublish(settingsFile, value === "on");
+      signedInPage(res, ticket, issued.login, locale);
     },
     match: (pathname) => ROUTE.exec(pathname),
     autoPublish,
@@ -95188,11 +95298,11 @@ function $assignBlockIds(editor, runtime, candidates) {
       }
     }
   }
-  let random3 = needFresh;
+  let random2 = needFresh;
   if (isLoad && needFresh.length > 0) {
     const fresh = new Set(needFresh.map((node) => node.getKey()));
     const placed = $placeBlocks(runtime, (node) => fresh.has(node.getKey()));
-    random3 = [];
+    random2 = [];
     for (const node of needFresh) {
       const key2 = node.getKey();
       const id2 = placed.get(key2);
@@ -95200,11 +95310,11 @@ function $assignBlockIds(editor, runtime, candidates) {
         used.add(id2);
         $setState2(node, blockIdState, id2);
       } else {
-        random3.push(node);
+        random2.push(node);
       }
     }
   }
-  for (const node of random3.sort(compareKeys)) {
+  for (const node of random2.sort(compareKeys)) {
     const id2 = $makeFreshId(runtime, used);
     $setState2(node, blockIdState, id2);
     if (!prevNodeMap.has(node.getKey())) {
@@ -100090,7 +100200,7 @@ function viewerPage(template, page) {
   };
   return template.replace(
     /<html\b([^>]*)>/i,
-    (_tag, attributes) => `<html${attributes.replace(/\slang="[^"]*"/i, "")} lang="${HTML_LANG[locale]}"${page.artifactId ? ` data-ryugi-artifact-id="${escapeHtml2(page.artifactId)}"` : ""}>`
+    (_tag, attributes) => `<html${attributes.replace(/\slang="[^"]*"/i, "")} lang="${HTML_LANG[locale]}"${page.artifactId ? ` data-ryugi-artifact-id="${escapeHtml2(page.artifactId)}"` : ""}${page.embedParent ? ` data-ryugi-embed-parent="${escapeHtml2(page.embedParent)}"` : ""}>`
   ).replace(/<title\b[^>]*>[\s\S]*?<\/title>/i, () => `<title>${escapeHtml2(page.title)}</title>`).replace(
     /(<link\b[^>]+\brel="icon"[^>]*\bhref=")[^"]*(")/i,
     (tag, prefix, suffix) => page.icon ? `${prefix}${escapeHtml2(page.icon)}${suffix}` : tag
@@ -100192,14 +100302,14 @@ function watchTree(root, onChange, debounceMs = 120, backupPollMs = 1e3) {
 }
 
 // src/server/app.ts
-var VIEWER_CSP = [
+var viewerCsp = (boardOrigins) => [
   "default-src 'self'",
   "script-src 'self' 'wasm-unsafe-eval'",
   "style-src 'self' 'unsafe-inline'",
   "img-src 'self' data: blob:",
   "font-src 'self' data:",
-  "connect-src 'self'",
-  "frame-src 'self'",
+  `connect-src 'self' ${boardOrigins.join(" ")}`,
+  `frame-src 'self' ${boardOrigins.join(" ")}`,
   "base-uri 'self'",
   "form-action 'none'",
   "frame-ancestors 'none'"
@@ -100217,6 +100327,7 @@ var PREVIEW_ROUTE = new RegExp(
   `^/preview/(artboard|document|html)/${ARTIFACT_LOCATOR_SOURCE}/?$`
 );
 var API_PREVIEW_ROUTE = /^\/api\/preview\/([^/]+)\/([^/]+)$/;
+var EMBED_ROUTE = /^\/embed\/artboard\/([\w-]{1,64})\/?$/;
 var API_THUMBNAIL_ROUTE = /^\/api\/thumbnail\/([^/]+)\/([^/]+)\.svg$/;
 var API_DOCUMENT_ROUTE = /^\/api\/document\/([^/]+)\/(state|update|comments)$/;
 var MAX_COMMENT_OP = 64 * 1024;
@@ -100265,6 +100376,15 @@ async function startArtifactsServer(options) {
   import_node_fs26.default.writeFileSync(tokenFile, `${token}
 `, { mode: 384 });
   const contentToken = randomToken();
+  const loopback = isLoopbackHost(options.host);
+  const keyOk = (key2) => loopback || key2 !== null && safeEqual(key2, token);
+  const agentOk = (req, key2) => loopback ? req.headers.origin === void 0 : key2 !== null && safeEqual(key2, token);
+  let policy = accessPolicy({
+    host: options.host,
+    urlHost: options.urlHost,
+    ports: [],
+    cloudOrigin: options.cloud?.origin
+  });
   const runtimeWarnings = /* @__PURE__ */ new Map();
   const ranVersions = /* @__PURE__ */ new Map();
   const dynamicBlocks = createDynamicBlocks({ maxErrors: MAX_RUNTIME_WARNINGS });
@@ -100285,6 +100405,8 @@ async function startArtifactsServer(options) {
     activityListeners.forEach((listener) => listener());
   };
   let port = 0;
+  let boardPort = 0;
+  const boardOrigins = () => boardPort ? originsFor(options.urlHost, boardPort) : [];
   let cookieName = "";
   let relay = null;
   const direct = createDirectRelay({
@@ -100385,6 +100507,7 @@ async function startArtifactsServer(options) {
     ...options.cloud,
     configFile: options.configFile,
     project: import_node_path23.default.basename(import_node_path23.default.resolve(root, "../..")),
+    address: (ref) => artifactPath(root, ref.type, ref.id).split("/").pop(),
     port: () => port,
     inspect,
     onPublication: (key2, publication) => {
@@ -100612,8 +100735,8 @@ async function startArtifactsServer(options) {
       sendJson(res, 400, { error: err.message });
     }
   };
-  const isAuthorized = (req, keyFromQuery) => keyFromQuery !== null && safeEqual(keyFromQuery, token) || safeEqual(parseCookies(req.headers.cookie)[cookieName] ?? "", token);
-  const serveContent = (res, rest, range) => {
+  const isAuthorized = (req, keyFromQuery) => loopback || keyFromQuery !== null && safeEqual(keyFromQuery, token) || safeEqual(parseCookies(req.headers.cookie)[cookieName] ?? "", token);
+  const serveContent = (res, rest, range, mode = "main") => {
     if (rest.startsWith("runtime/")) {
       if (!runtimeDir) {
         send(res, 404, "Not found");
@@ -100655,8 +100778,8 @@ async function startArtifactsServer(options) {
     }
     const page = ref.type === "html" ? relative === "index.html" : relative.endsWith(".html");
     const headers = {
-      "Content-Security-Policy": CONTENT_CSP[page && ref.type === "document" ? "html" : ref.type],
-      "Access-Control-Allow-Origin": "*"
+      "Content-Security-Policy": mode === "board" ? boardCsp(options.urlHost, port, options.cloud?.origin) : CONTENT_CSP[page && ref.type === "document" ? "html" : ref.type],
+      ...mode === "board" ? {} : { "Access-Control-Allow-Origin": "*" }
     };
     if (!page) {
       sendFile(res, target, headers, range);
@@ -100665,7 +100788,7 @@ async function startArtifactsServer(options) {
     import_node_fs26.default.readFile(target, "utf8", (err, source) => {
       if (err) send(res, 404, "Not found");
       else {
-        const uiRuntimeUrl = runtimeDir ? `${contentPrefix}runtime/ryugi-ui.js` : void 0;
+        const uiRuntimeUrl = runtimeDir ? `${mode === "board" ? "/c/" : contentPrefix}runtime/ryugi-ui.js` : void 0;
         send(
           res,
           200,
@@ -100691,7 +100814,11 @@ async function startArtifactsServer(options) {
       sendJson(res, 404, { warnings: [`artifact ${type}/${id2} not found`] });
       return;
     }
-    sendJson(res, 200, artifactMeta(artifactKeyOf(`${type}/${id2}`), dir));
+    const ref = artifactKeyOf(`${type}/${id2}`);
+    sendJson(res, 200, {
+      ...artifactMeta(ref, dir),
+      ...ref.type === "artboard" && boardPort ? { boardPort, boardPath: `/c${artifactPath(root, "artboard", ref.id)}/` } : {}
+    });
   };
   const serveList = (res) => {
     const { artifacts, warnings } = listArtifacts(root);
@@ -100766,6 +100893,10 @@ async function startArtifactsServer(options) {
   }
   const handleRequest = (req, res) => {
     res.setHeader("X-Robots-Tag", "noindex, nofollow");
+    if (!hostAllowed(policy, req.headers.host)) {
+      send(res, 403, "Forbidden host");
+      return;
+    }
     const url2 = new URL(req.url ?? "/", "http://artifacts.local");
     if (url2.pathname === "/api/status") {
       if (!isAuthorized(req, url2.searchParams.get("key")))
@@ -100800,6 +100931,20 @@ async function startArtifactsServer(options) {
       });
       return;
     }
+    if (cloud && pathname === "/api/cloud/callback/auto-publish") {
+      void cloud.handleCallbackAutoPublish(
+        req,
+        res,
+        resolveLocale(parseAcceptLanguage(req.headers["accept-language"]))
+      ).catch((err) => {
+        if (!res.headersSent) send(res, 500, `Artifacts error: ${err.message}`);
+      });
+      return;
+    }
+    if (loopback && !originAllowed(policy, req.headers.origin)) {
+      send(res, 403, "Forbidden origin");
+      return;
+    }
     const key2 = url2.searchParams.get("key");
     if (!isAuthorized(req, key2)) {
       send(res, 403, "Forbidden: open the full artifact link including ?key=");
@@ -100881,7 +101026,7 @@ async function startArtifactsServer(options) {
       return;
     }
     if (pathname === "/api/cloud/flush") {
-      if (req.method !== "POST" || key2 === null || !safeEqual(key2, token)) {
+      if (req.method !== "POST" || !agentOk(req, key2)) {
         send(res, 403, "Forbidden: agent calls need ?key=");
         return;
       }
@@ -100896,7 +101041,7 @@ async function startArtifactsServer(options) {
     }
     const cloudMatch = cloud?.match(pathname);
     if (cloud && cloudMatch) {
-      if (req.method !== "GET" && !(key2 !== null && safeEqual(key2, token)) && !sameOrigin(req)) {
+      if (req.method !== "GET" && !keyOk(key2) && !sameOrigin(req)) {
         send(res, 403, "Forbidden");
         return;
       }
@@ -100905,7 +101050,7 @@ async function startArtifactsServer(options) {
     }
     const agentCommentsMatch = API_AGENT_COMMENTS_ROUTE.exec(pathname);
     if (agentCommentsMatch) {
-      if (req.method !== "POST" || key2 === null || !safeEqual(key2, token)) {
+      if (req.method !== "POST" || !agentOk(req, key2)) {
         send(res, 403, "Forbidden: agent calls need ?key=");
         return;
       }
@@ -100916,7 +101061,7 @@ async function startArtifactsServer(options) {
     }
     const agentBoardMatch = API_AGENT_BOARD_COMMENTS_ROUTE.exec(pathname);
     if (agentBoardMatch) {
-      if (req.method !== "POST" || key2 === null || !safeEqual(key2, token)) {
+      if (req.method !== "POST" || !agentOk(req, key2)) {
         send(res, 403, "Forbidden: agent calls need ?key=");
         return;
       }
@@ -100927,7 +101072,7 @@ async function startArtifactsServer(options) {
     }
     const agentCheckMatch = API_AGENT_CHECK_ROUTE.exec(pathname);
     if (agentCheckMatch) {
-      if (req.method !== "POST" || key2 === null || !safeEqual(key2, token)) {
+      if (req.method !== "POST" || !agentOk(req, key2)) {
         send(res, 403, "Forbidden: agent calls need ?key=");
         return;
       }
@@ -100955,8 +101100,19 @@ async function startArtifactsServer(options) {
       serveArtifactApi(res, apiMatch[1], apiMatch[2]);
       return;
     }
-    if (SHELL_ROUTE.test(pathname) || PREVIEW_ROUTE.test(pathname) || pathname === "/index.html") {
-      const requested = artifactKeyOf(
+    const embedMatch = EMBED_ROUTE.exec(pathname);
+    const embed = !!embedMatch;
+    const embedded = embedMatch && embedTarget(embedMatch[1]);
+    if (pathname.startsWith("/embed/") && (!embedded || !options.cloud)) {
+      send(res, 404, "Not found");
+      return;
+    }
+    if (SHELL_ROUTE.test(pathname) || PREVIEW_ROUTE.test(pathname) || embed || pathname === "/index.html") {
+      if (loopback && (pathname === "/" || pathname === "/index.html") && !navigationAllowed(req.headers["sec-fetch-site"])) {
+        send(res, 403, "Forbidden");
+        return;
+      }
+      const requested = embedded || artifactKeyOf(
         pathname.replace(/^\/(?:preview\/)?/, "").replace(/\/$/, ""),
         isArtifactLocator
       );
@@ -100975,9 +101131,12 @@ async function startArtifactsServer(options) {
       const preview = PREVIEW_ROUTE.test(pathname);
       const canonicalPath = ref ? dir ? artifactPath(root, ref.type, ref.id) : `/${ref.type}/${ref.id}` : "/";
       const canonical = `http://${urlHostForHttp(options.urlHost)}:${port}${preview ? "/preview" : ""}${canonicalPath}`;
-      const csp = preview ? VIEWER_CSP.replace("frame-ancestors 'none'", "frame-ancestors 'self'") : VIEWER_CSP;
+      const csp = embed ? viewerCsp(boardOrigins()).replace(
+        "frame-ancestors 'none'",
+        `frame-ancestors ${options.cloud.origin}`
+      ) : preview ? viewerCsp(boardOrigins()).replace("frame-ancestors 'none'", "frame-ancestors 'self'") : viewerCsp(boardOrigins());
       const headers = { "Content-Type": "text/html; charset=utf-8" };
-      if (key2 !== null)
+      if (key2 !== null && !loopback)
         headers["Set-Cookie"] = `${cookieName}=${token}; HttpOnly; SameSite=Strict; Path=/`;
       const entry = preview && import_node_fs26.default.existsSync(import_node_path23.default.join(viewerDir, "preview.html")) ? "preview.html" : "index.html";
       void import_node_fs26.default.promises.readFile(import_node_path23.default.join(viewerDir, entry), "utf8").then((template) => {
@@ -100987,7 +101146,8 @@ async function startArtifactsServer(options) {
           locale,
           url: canonical,
           icon: ref ? typeFaviconHref(ref.type) : void 0,
-          artifactId: resolved?.id
+          artifactId: resolved?.id,
+          embedParent: embed ? options.cloud.origin : void 0
         });
         send(res, 200, html, {
           ...headers,
@@ -101000,7 +101160,10 @@ async function startArtifactsServer(options) {
     }
     const target = resolveInside(viewerDir, pathname.slice(1));
     if (!target) send(res, 404, "Not found");
-    else sendFile(res, target, { "Content-Security-Policy": VIEWER_CSP });
+    else
+      sendFile(res, target, {
+        "Content-Security-Policy": viewerCsp(boardOrigins())
+      });
   };
   const server = import_node_http.default.createServer((req, res) => {
     try {
@@ -101010,12 +101173,16 @@ async function startArtifactsServer(options) {
     }
   });
   server.on("upgrade", (req, socket) => {
+    if (!hostAllowed(policy, req.headers.host)) {
+      rejectUpgrade(socket, 403, "Forbidden");
+      return;
+    }
     const url2 = new URL(req.url ?? "/", "http://artifacts.local");
     const clientKey = req.headers["sec-websocket-key"];
     const directMatch = DIRECT_RELAY_ROUTE.exec(url2.pathname);
     if (directMatch && typeof clientKey === "string") {
       const fromCloud = options.cloud !== void 0 && req.headers.origin === options.cloud.origin;
-      if (!safeEqual(url2.searchParams.get("key") ?? "", token) || !(fromCloud || sameOrigin(req))) {
+      if (!keyOk(url2.searchParams.get("key")) || !(fromCloud || sameOrigin(req))) {
         rejectUpgrade(socket, 403, "Forbidden");
         return;
       }
@@ -101060,9 +101227,56 @@ async function startArtifactsServer(options) {
   cookieName = `ryugi_artifacts_${port}`;
   import_node_fs26.default.writeFileSync(portFile, `${port}
 `, { mode: 384 });
+  const boardServer = import_node_http.default.createServer((req, res) => {
+    if (!hostAllowed(policy, req.headers.host)) {
+      send(res, 403, "Forbidden host");
+      return;
+    }
+    let pathname;
+    try {
+      pathname = decodeURIComponent(new URL(req.url ?? "/", "http://board.local").pathname);
+    } catch {
+      send(res, 400, "Bad request");
+      return;
+    }
+    try {
+      const route = routeBoardRequest(req, pathname);
+      if (route.kind === "robots") send(res, 200, "User-agent: *\nDisallow: /\n");
+      else if (route.kind === "runtime") serveContent(res, route.rest, req.headers.range, "board");
+      else if (route.kind === "board") {
+        const resolved = resolveArtifactAddress(root, "artboard", route.address);
+        if (!resolved || resolved.id === route.address) send(res, 404, "Not found");
+        else serveContent(res, `artboard/${resolved.id}/${route.rest}`, req.headers.range, "board");
+      } else send(res, 404, "Not found");
+    } catch (err) {
+      if (!res.headersSent) send(res, 500, err.message);
+      else res.destroy();
+    }
+  });
+  if (loopback) {
+    const boardPortFile = import_node_path23.default.join(stateDir, BOARD_PORT_FILE);
+    const previousBoardPort = Number(readPersisted(boardPortFile));
+    try {
+      boardPort = await listen(
+        boardServer,
+        options.host,
+        Number.isInteger(previousBoardPort) && previousBoardPort > 0 && previousBoardPort !== port ? previousBoardPort : 0
+      );
+    } catch {
+      boardPort = await listen(boardServer, options.host, 0);
+    }
+    import_node_fs26.default.writeFileSync(boardPortFile, `${boardPort}
+`, { mode: 384 });
+  }
+  policy = accessPolicy({
+    host: options.host,
+    urlHost: options.urlHost,
+    ports: boardPort ? [port, boardPort] : [port],
+    cloudOrigin: options.cloud?.origin
+  });
   const origin = `http://${urlHostForHttp(options.urlHost)}:${port}`;
-  const url = `${origin}/?key=${token}`;
-  const linkFor = (type, id2) => `${origin}${artifactPath(root, type, id2)}?key=${token}`;
+  const url = loopback ? `${origin}/` : `${origin}/?key=${token}`;
+  const linkFor = (type, id2) => `${origin}${artifactPath(root, type, id2)}${loopback ? "" : `?key=${token}`}`;
   const signatures = /* @__PURE__ */ new Map();
   const writeState = (ref, dir) => {
     const payload = readArtifact(dir, ref, runtimeOf(ref, dir));
@@ -101084,8 +101298,20 @@ async function startArtifactsServer(options) {
     initialChanges.push({ ref: entry, payload, files: [] });
     if (entry.type === "document") void documents.open(entry.id);
   }
-  writeJsonAtomic(import_node_path23.default.join(stateDir, "server-info"), { type: "server-started", url, port, root });
+  writeJsonAtomic(import_node_path23.default.join(stateDir, "server-info"), {
+    type: "server-started",
+    url,
+    port,
+    boardPort,
+    root
+  });
   const relayViewers = /* @__PURE__ */ new Map();
+  const embedTarget = (id2) => {
+    if (isArtifactLocator(id2) && resolveArtifactAddress(root, "artboard", id2))
+      return { type: "artboard", id: id2 };
+    const served = artifactKeyOf(servedArtifacts().get(id2) ?? "");
+    return served?.type === "artboard" ? served : null;
+  };
   const servedArtifacts = () => {
     const served = /* @__PURE__ */ new Map();
     if (!options.configFile) return served;
@@ -101167,7 +101393,11 @@ async function startArtifactsServer(options) {
     ...options.relay,
     token: () => readCredentials(options.cloud.credentialsFile, options.cloud.origin)?.token ?? null,
     served: servedArtifacts,
-    local: () => ({ hostId: hostIdFor(options.cloud.credentialsFile), port, key: token }),
+    local: () => ({
+      hostId: hostIdFor(options.cloud.credentialsFile),
+      port,
+      ...loopback ? { embed: true } : { key: token }
+    }),
     handle: handleRelay,
     onActivity: touch,
     onWatch: (keys2) => {
@@ -101262,6 +101492,7 @@ async function startArtifactsServer(options) {
   );
   return {
     port,
+    boardPort,
     token,
     contentToken,
     url,
@@ -101290,6 +101521,8 @@ async function startArtifactsServer(options) {
         direct.close();
         selections.clearAll();
         for (const socket of clients) socket.destroy();
+        boardServer.close();
+        boardServer.closeAllConnections();
         server.close(() => resolve());
         server.closeAllConnections();
       });