ryugi-artifacts 1.47.0 → 1.48.1

package/dist/server.cjs

@@ -8798,7 +8798,7 @@ var import_node_os2 = __toESM(require("node:os"), 1);
 var import_node_path25 = __toESM(require("node:path"), 1);
 
 // package.json
-var version = "1.47.0";
+var version = "1.48.1";
 
 // src/server/app.ts
 var import_node_fs26 = __toESM(require("node:fs"), 1);
@@ -8825,6 +8825,24 @@ var ADDRESS_SOURCE = "(?:[\\w-]{21}|[a-f0-9]{32})";
 var ARTIFACT_LOCATOR_SOURCE = `(?:${SLUG_SOURCE}|${ADDRESS_SOURCE})`;
 var ID_PATTERN = new RegExp(`^${SLUG_SOURCE}$`);
 var ADDRESS_PATTERN = new RegExp(`^${ADDRESS_SOURCE}$`);
+var MINT_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+var MINT_LENGTH = 21;
+var MINTED_PATTERN = new RegExp(`^[a-z0-9]{${MINT_LENGTH}}$`, "i");
+var MINT_BYTE_LIMIT = 248;
+function mintArtifactId() {
+  let id2 = "";
+  const bytes = new Uint8Array(MINT_LENGTH * 2);
+  while (id2.length < MINT_LENGTH) {
+    crypto.getRandomValues(bytes);
+    for (const byte of bytes) {
+      if (byte >= MINT_BYTE_LIMIT) continue;
+      id2 += MINT_ALPHABET[byte % MINT_ALPHABET.length];
+      if (id2.length === MINT_LENGTH) break;
+    }
+  }
+  return id2;
+}
+var isMintedArtifactId = (id2) => MINTED_PATTERN.test(id2);
 var isArtifactId = (id2) => ID_PATTERN.test(id2);
 var isArtifactAddress = (id2) => ADDRESS_PATTERN.test(id2);
 var isArtifactLocator = (id2) => ID_PATTERN.test(id2) || ADDRESS_PATTERN.test(id2);
@@ -9120,88 +9138,36 @@ function typeFaviconHref(type) {
   return `data:image/svg+xml,${encodeURIComponent(svg)}`;
 }
 
+// src/server/access.ts
+var LOOPBACK = /* @__PURE__ */ new Set(["localhost", "::1", "[::1]"]);
+var isLoopbackHost = (host) => LOOPBACK.has(host) || /^127\.\d+\.\d+\.\d+$/.test(host);
+var bracket = (host) => host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+function accessPolicy({
+  host,
+  urlHost,
+  ports,
+  cloudOrigin
+}) {
+  const names = [
+    ...new Set(
+      ["localhost", "127.0.0.1", bracket(host), bracket(urlHost)].map((name) => name.toLowerCase())
+    )
+  ];
+  const hosts = new Set(ports.flatMap((port) => names.map((name) => `${name}:${port}`)));
+  const viewerPort = ports[0];
+  const origins = new Set(names.map((name) => `http://${name}:${viewerPort}`));
+  return { loopback: isLoopbackHost(host), hosts, origins, cloudOrigin };
+}
+var hostAllowed = (policy, host) => !policy.loopback || host !== void 0 && policy.hosts.has(host.toLowerCase());
+var originAllowed = (policy, origin, { cloud = false } = {}) => origin === void 0 || policy.origins.has(origin) || cloud && policy.cloudOrigin !== void 0 && origin === policy.cloudOrigin;
+var navigationAllowed = (secFetchSite) => secFetchSite === void 0 || secFetchSite === "none" || secFetchSite === "same-origin";
+
 // src/server/artifact-address.ts
 var import_node_fs2 = __toESM(require("node:fs"), 1);
 var import_node_path2 = __toESM(require("node:path"), 1);
 
-// node_modules/.pnpm/nanoid@5.1.16/node_modules/nanoid/index.js
-var import_node_crypto = require("node:crypto");
-
-// node_modules/.pnpm/nanoid@5.1.16/node_modules/nanoid/url-alphabet/index.js
-var urlAlphabet = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict";
-
-// node_modules/.pnpm/nanoid@5.1.16/node_modules/nanoid/index.js
-var POOL_SIZE_MULTIPLIER = 128;
-var pool;
-var poolOffset;
-function fillPool(bytes) {
-  if (bytes < 0) throw new RangeError("Wrong ID size");
-  try {
-    if (!pool || pool.length < bytes) {
-      pool = Buffer.allocUnsafe(bytes * POOL_SIZE_MULTIPLIER);
-      import_node_crypto.webcrypto.getRandomValues(pool);
-      poolOffset = 0;
-    } else if (poolOffset + bytes > pool.length) {
-      import_node_crypto.webcrypto.getRandomValues(pool);
-      poolOffset = 0;
-    }
-  } catch (e5) {
-    pool = void 0;
-    throw e5;
-  }
-  poolOffset += bytes;
-}
-function random(bytes) {
-  fillPool(bytes |= 0);
-  return pool.subarray(poolOffset - bytes, poolOffset);
-}
-function customRandom(alphabet, defaultSize, getRandom) {
-  let safeByteCutoff = 256 - 256 % alphabet.length;
-  if (safeByteCutoff === 256) {
-    let mask = alphabet.length - 1;
-    return (size = defaultSize) => {
-      if (!size) return "";
-      let id2 = "";
-      while (true) {
-        let bytes = getRandom(size);
-        let i6 = size;
-        while (i6--) {
-          id2 += alphabet[bytes[i6] & mask];
-          if (id2.length >= size) return id2;
-        }
-      }
-    };
-  }
-  let step = Math.ceil(1.6 * 256 * defaultSize / safeByteCutoff);
-  return (size = defaultSize) => {
-    if (!size) return "";
-    let id2 = "";
-    while (true) {
-      let bytes = getRandom(step);
-      let i6 = step;
-      while (i6--) {
-        if (bytes[i6] < safeByteCutoff) {
-          id2 += alphabet[bytes[i6] % alphabet.length];
-          if (id2.length >= size) return id2;
-        }
-      }
-    }
-  };
-}
-function customAlphabet(alphabet, size = 21) {
-  return customRandom(alphabet, size, random);
-}
-function nanoid(size = 21) {
-  fillPool(size |= 0);
-  let id2 = "";
-  for (let i6 = poolOffset - size; i6 < poolOffset; i6++) {
-    id2 += urlAlphabet[pool[i6] & 63];
-  }
-  return id2;
-}
-
 // src/server/artifacts.ts
-var import_node_crypto2 = __toESM(require("node:crypto"), 1);
+var import_node_crypto = __toESM(require("node:crypto"), 1);
 var import_node_fs = __toESM(require("node:fs"), 1);
 var import_node_path = __toESM(require("node:path"), 1);
 function subdirectories(dir) {
@@ -9273,15 +9239,11 @@ function artifactSignature(dir, type) {
     }
   };
   walk(dir);
-  const hash = import_node_crypto2.default.createHash("sha1").update(names.sort().join("\0")).digest("hex").slice(0, 12);
+  const hash = import_node_crypto.default.createHash("sha1").update(names.sort().join("\0")).digest("hex").slice(0, 12);
   return `${names.length}:${size}:${latest}:${hash}`;
 }
 
 // src/server/artifact-address.ts
-var newArtifactId = customAlphabet(
-  "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",
-  21
-);
 function artifactId(dir) {
   const file = import_node_path2.default.join(dir, ".artifact-id");
   let id2;
@@ -9289,7 +9251,7 @@ function artifactId(dir) {
     id2 = import_node_fs2.default.readFileSync(file, "utf8").trim();
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
-    id2 = newArtifactId();
+    id2 = mintArtifactId();
     try {
       import_node_fs2.default.writeFileSync(file, `${id2}
 `, { flag: "wx" });
@@ -9322,7 +9284,7 @@ function resolveArtifactAddress(root, type, address) {
 var import_node_fs5 = __toESM(require("node:fs"), 1);
 
 // src/server/http.ts
-var import_node_crypto3 = __toESM(require("node:crypto"), 1);
+var import_node_crypto2 = __toESM(require("node:crypto"), 1);
 var import_node_fs3 = __toESM(require("node:fs"), 1);
 var import_node_path3 = __toESM(require("node:path"), 1);
 var MIME = {
@@ -9348,11 +9310,11 @@ var MIME = {
   ".webm": "video/webm"
 };
 var mimeOf = (file) => MIME[import_node_path3.default.extname(file).toLowerCase()] ?? "application/octet-stream";
-var randomToken = () => import_node_crypto3.default.randomBytes(24).toString("base64url");
+var randomToken = () => import_node_crypto2.default.randomBytes(24).toString("base64url");
 function safeEqual(a5, b6) {
   const ab = Buffer.from(a5);
   const bb = Buffer.from(b6);
-  return ab.length === bb.length && import_node_crypto3.default.timingSafeEqual(ab, bb);
+  return ab.length === bb.length && import_node_crypto2.default.timingSafeEqual(ab, bb);
 }
 function parseCookies(header) {
   const cookies = {};
@@ -10559,7 +10521,7 @@ function readArtifactFile(dir, type, relative, uiRuntimeUrl, maxBytes = Infinity
 }
 
 // src/server/auto-publish.ts
-var import_node_crypto4 = __toESM(require("node:crypto"), 1);
+var import_node_crypto3 = __toESM(require("node:crypto"), 1);
 var import_node_fs7 = __toESM(require("node:fs"), 1);
 
 // src/server/state.ts
@@ -10979,7 +10941,7 @@ function createAutoPublisher(options) {
   });
   const raise = (kind, message, upgradeUrl) => {
     if (notice?.kind !== kind)
-      notice = { id: import_node_crypto4.default.randomUUID(), kind, message, ...upgradeUrl ? { upgradeUrl } : {} };
+      notice = { id: import_node_crypto3.default.randomUUID(), kind, message, ...upgradeUrl ? { upgradeUrl } : {} };
   };
   let idleTimer = null;
   let maxTimer = null;
@@ -11082,7 +11044,7 @@ function createAutoPublisher(options) {
 }
 
 // src/server/avatars.ts
-var import_node_crypto5 = require("node:crypto");
+var import_node_crypto4 = require("node:crypto");
 var AVATAR_ROUTE = /^\/api\/avatar\/([a-z]+)\/([^/]+)$/;
 var MAX_BYTES = 512 * 1024;
 var TIMEOUT_MS = 5e3;
@@ -11097,7 +11059,7 @@ var SOURCES = {
   }
 };
 var githubAvatar = (login) => `/api/avatar/github/${login}`;
-var gravatarAvatar = (email) => `/api/avatar/gravatar/${(0, import_node_crypto5.createHash)("sha256").update(email.trim().toLowerCase()).digest("hex")}`;
+var gravatarAvatar = (email) => `/api/avatar/gravatar/${(0, import_node_crypto4.createHash)("sha256").update(email.trim().toLowerCase()).digest("hex")}`;
 function createAvatars(fetchImpl = fetch) {
   const cache = /* @__PURE__ */ new Map();
   const fetchAvatar = async (url) => {
@@ -11608,6 +11570,44 @@ function createCommentCursors(stateDir, type = "document") {
 
 // src/server/document-comments.ts
 var import_node_fs9 = __toESM(require("node:fs"), 1);
+
+// node_modules/.pnpm/nanoid@5.1.16/node_modules/nanoid/index.js
+var import_node_crypto5 = require("node:crypto");
+
+// node_modules/.pnpm/nanoid@5.1.16/node_modules/nanoid/url-alphabet/index.js
+var urlAlphabet = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict";
+
+// node_modules/.pnpm/nanoid@5.1.16/node_modules/nanoid/index.js
+var POOL_SIZE_MULTIPLIER = 128;
+var pool;
+var poolOffset;
+function fillPool(bytes) {
+  if (bytes < 0) throw new RangeError("Wrong ID size");
+  try {
+    if (!pool || pool.length < bytes) {
+      pool = Buffer.allocUnsafe(bytes * POOL_SIZE_MULTIPLIER);
+      import_node_crypto5.webcrypto.getRandomValues(pool);
+      poolOffset = 0;
+    } else if (poolOffset + bytes > pool.length) {
+      import_node_crypto5.webcrypto.getRandomValues(pool);
+      poolOffset = 0;
+    }
+  } catch (e5) {
+    pool = void 0;
+    throw e5;
+  }
+  poolOffset += bytes;
+}
+function nanoid(size = 21) {
+  fillPool(size |= 0);
+  let id2 = "";
+  for (let i6 = poolOffset - size; i6 < poolOffset; i6++) {
+    id2 += urlAlphabet[pool[i6] & 63];
+  }
+  return id2;
+}
+
+// src/server/document-comments.ts
 var MAX_TEXT = 2e4;
 var isText = (value, max = MAX_TEXT) => typeof value === "string" && value.length <= max;
 var isId = (value) => isText(value, 100) && value.length > 0;
@@ -11982,6 +11982,29 @@ function createBoardCommentRegistry(options) {
   };
 }
 
+// src/server/board-port.ts
+var BOARD_PORT_FILE = ".last-board-port";
+var BOARD_ROUTE = /^\/c\/artboard\/([^/]+)\/(.+)$/;
+var RUNTIME_ROUTE = /^\/c\/runtime\/(.+)$/;
+var loopbackHosts = (urlHost) => [
+  .../* @__PURE__ */ new Set(["localhost", "127.0.0.1", urlHost.includes(":") ? `[${urlHost}]` : urlHost])
+];
+var originsFor = (urlHost, port) => loopbackHosts(urlHost).map((host) => `http://${host}:${port}`);
+function boardCsp(urlHost, viewerPort, cloudOrigin) {
+  const ancestors = [...originsFor(urlHost, viewerPort), ...cloudOrigin ? [cloudOrigin] : []];
+  return `worker-src 'none'; frame-ancestors ${ancestors.join(" ")}`;
+}
+function routeBoardRequest(req, pathname) {
+  if (req.method !== "GET" && req.method !== "HEAD") return { kind: "none" };
+  if (pathname === "/robots.txt") return { kind: "robots" };
+  const runtime = RUNTIME_ROUTE.exec(pathname);
+  if (runtime) return { kind: "runtime", rest: `runtime/${runtime[1]}` };
+  const board = BOARD_ROUTE.exec(pathname);
+  if (board && isArtifactAddress(board[1]))
+    return { kind: "board", address: board[1], rest: board[2] };
+  return { kind: "none" };
+}
+
 // src/server/cloud.ts
 var import_node_crypto7 = __toESM(require("node:crypto"), 1);
 
@@ -12448,14 +12471,14 @@ function fillRandom(buffer) {
     from = to3;
   }
 }
-function random2(bytes) {
+function random(bytes) {
   bytes |= 0;
   if (bytes < 0) throw new RangeError("Wrong ID size");
   let buffer = Buffer.allocUnsafe(bytes);
   fillRandom(buffer);
   return buffer;
 }
-function customRandom2(alphabet, defaultSize, getRandom) {
+function customRandom(alphabet, defaultSize, getRandom) {
   let safeByteCutoff = 256 - 256 % alphabet.length;
   if (safeByteCutoff === 256) {
     let mask = alphabet.length - 1;
@@ -12489,13 +12512,13 @@ function customRandom2(alphabet, defaultSize, getRandom) {
   };
 }
 var POOL_MAX = GET_RANDOM_LIMIT / 2;
-function customAlphabet2(alphabet, defaultSize = 21) {
+function customAlphabet(alphabet, defaultSize = 21) {
   if (typeof alphabet !== "string" || !alphabet || alphabet.length > 256) {
-    return customRandom2(alphabet, defaultSize, random2);
+    return customRandom(alphabet, defaultSize, random);
   }
   for (let i6 = 0; i6 < alphabet.length; i6++) {
     if (alphabet.charCodeAt(i6) > 255) {
-      return customRandom2(alphabet, defaultSize, random2);
+      return customRandom(alphabet, defaultSize, random);
     }
   }
   let charCodes = Uint8Array.from(alphabet, (str) => {
@@ -12542,7 +12565,7 @@ function customAlphabet2(alphabet, defaultSize = 21) {
     return pool2.substring(poolOffset2 - size, poolOffset2);
   };
 }
-var nanoid2 = customAlphabet2(urlAlphabet2);
+var nanoid2 = customAlphabet(urlAlphabet2);
 
 // node_modules/.pnpm/@haklex+rich-litexml@0.61.1_typescript@5.9.3/node_modules/@haklex/rich-litexml/dist/src-CwO17cE7.js
 var impl = null;
@@ -12688,11 +12711,11 @@ function registerBuiltinReaders(registry2) {
   }));
 }
 var idAlphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
-var makePollIdSuffix = customAlphabet2(idAlphabet, 10);
-var makeOptionIdSuffix = customAlphabet2(idAlphabet, 6);
-var makeChatParticipantId = customAlphabet2(idAlphabet, 6);
-var makeChatMessageId = customAlphabet2(idAlphabet, 8);
-var makeStepId = customAlphabet2(idAlphabet, 8);
+var makePollIdSuffix = customAlphabet(idAlphabet, 10);
+var makeOptionIdSuffix = customAlphabet(idAlphabet, 6);
+var makeChatParticipantId = customAlphabet(idAlphabet, 6);
+var makeChatMessageId = customAlphabet(idAlphabet, 8);
+var makeStepId = customAlphabet(idAlphabet, 8);
 function extractBlockId(el2) {
   const id2 = el2.getAttribute("id");
   return id2 ? { $: { blockId: id2 } } : {};
@@ -24929,7 +24952,7 @@ function sharedComments(file) {
 function publishPayload(ref, dir, title, payload, comments = emptyComments()) {
   if (ref.type === "artboard") {
     const { canvas, layout, versions } = payload;
-    return { canvas, layout, versions, snapshots: true };
+    return { canvas, layout, versions };
   }
   if (ref.type === "document")
     return {
@@ -25170,7 +25193,14 @@ function createCloudRoutes(options) {
     ([, entry]) => entry.cloud?.id === cloudId
   )?.[0] ?? `cloud:${cloudId}`;
   const createRecord2 = async (ref, visibility) => {
-    const res = await cloudFetch("POST", "/api/artifacts", { type: ref.type, visibility, project });
+    const body = { type: ref.type, visibility, project };
+    const id2 = options.address?.(ref);
+    let res = await cloudFetch(
+      "POST",
+      "/api/artifacts",
+      id2 && isMintedArtifactId(id2) ? { ...body, id: id2 } : body
+    );
+    if (res.status === 409) res = await cloudFetch("POST", "/api/artifacts", body);
     if (res.status === 403) throw new CreateRefused(await errorMessage(res));
     const created = await (await expectOk(res)).json();
     updateArtifactConfig(configFile, `${ref.type}/${ref.id}`, {
@@ -95268,11 +95298,11 @@ function $assignBlockIds(editor, runtime, candidates) {
       }
     }
   }
-  let random3 = needFresh;
+  let random2 = needFresh;
   if (isLoad && needFresh.length > 0) {
     const fresh = new Set(needFresh.map((node) => node.getKey()));
     const placed = $placeBlocks(runtime, (node) => fresh.has(node.getKey()));
-    random3 = [];
+    random2 = [];
     for (const node of needFresh) {
       const key2 = node.getKey();
       const id2 = placed.get(key2);
@@ -95280,11 +95310,11 @@ function $assignBlockIds(editor, runtime, candidates) {
         used.add(id2);
         $setState2(node, blockIdState, id2);
       } else {
-        random3.push(node);
+        random2.push(node);
       }
     }
   }
-  for (const node of random3.sort(compareKeys)) {
+  for (const node of random2.sort(compareKeys)) {
     const id2 = $makeFreshId(runtime, used);
     $setState2(node, blockIdState, id2);
     if (!prevNodeMap.has(node.getKey())) {
@@ -100170,7 +100200,7 @@ function viewerPage(template, page) {
   };
   return template.replace(
     /<html\b([^>]*)>/i,
-    (_tag, attributes) => `<html${attributes.replace(/\slang="[^"]*"/i, "")} lang="${HTML_LANG[locale]}"${page.artifactId ? ` data-ryugi-artifact-id="${escapeHtml2(page.artifactId)}"` : ""}>`
+    (_tag, attributes) => `<html${attributes.replace(/\slang="[^"]*"/i, "")} lang="${HTML_LANG[locale]}"${page.artifactId ? ` data-ryugi-artifact-id="${escapeHtml2(page.artifactId)}"` : ""}${page.embedParent ? ` data-ryugi-embed-parent="${escapeHtml2(page.embedParent)}"` : ""}>`
   ).replace(/<title\b[^>]*>[\s\S]*?<\/title>/i, () => `<title>${escapeHtml2(page.title)}</title>`).replace(
     /(<link\b[^>]+\brel="icon"[^>]*\bhref=")[^"]*(")/i,
     (tag, prefix, suffix) => page.icon ? `${prefix}${escapeHtml2(page.icon)}${suffix}` : tag
@@ -100272,14 +100302,14 @@ function watchTree(root, onChange, debounceMs = 120, backupPollMs = 1e3) {
 }
 
 // src/server/app.ts
-var VIEWER_CSP = [
+var viewerCsp = (boardOrigins) => [
   "default-src 'self'",
   "script-src 'self' 'wasm-unsafe-eval'",
   "style-src 'self' 'unsafe-inline'",
   "img-src 'self' data: blob:",
   "font-src 'self' data:",
-  "connect-src 'self'",
-  "frame-src 'self'",
+  `connect-src 'self' ${boardOrigins.join(" ")}`,
+  `frame-src 'self' ${boardOrigins.join(" ")}`,
   "base-uri 'self'",
   "form-action 'none'",
   "frame-ancestors 'none'"
@@ -100297,6 +100327,7 @@ var PREVIEW_ROUTE = new RegExp(
   `^/preview/(artboard|document|html)/${ARTIFACT_LOCATOR_SOURCE}/?$`
 );
 var API_PREVIEW_ROUTE = /^\/api\/preview\/([^/]+)\/([^/]+)$/;
+var EMBED_ROUTE = /^\/embed\/artboard\/([\w-]{1,64})\/?$/;
 var API_THUMBNAIL_ROUTE = /^\/api\/thumbnail\/([^/]+)\/([^/]+)\.svg$/;
 var API_DOCUMENT_ROUTE = /^\/api\/document\/([^/]+)\/(state|update|comments)$/;
 var MAX_COMMENT_OP = 64 * 1024;
@@ -100345,6 +100376,15 @@ async function startArtifactsServer(options) {
   import_node_fs26.default.writeFileSync(tokenFile, `${token}
 `, { mode: 384 });
   const contentToken = randomToken();
+  const loopback = isLoopbackHost(options.host);
+  const keyOk = (key2) => loopback || key2 !== null && safeEqual(key2, token);
+  const agentOk = (req, key2) => loopback ? req.headers.origin === void 0 : key2 !== null && safeEqual(key2, token);
+  let policy = accessPolicy({
+    host: options.host,
+    urlHost: options.urlHost,
+    ports: [],
+    cloudOrigin: options.cloud?.origin
+  });
   const runtimeWarnings = /* @__PURE__ */ new Map();
   const ranVersions = /* @__PURE__ */ new Map();
   const dynamicBlocks = createDynamicBlocks({ maxErrors: MAX_RUNTIME_WARNINGS });
@@ -100365,6 +100405,8 @@ async function startArtifactsServer(options) {
     activityListeners.forEach((listener) => listener());
   };
   let port = 0;
+  let boardPort = 0;
+  const boardOrigins = () => boardPort ? originsFor(options.urlHost, boardPort) : [];
   let cookieName = "";
   let relay = null;
   const direct = createDirectRelay({
@@ -100465,6 +100507,7 @@ async function startArtifactsServer(options) {
     ...options.cloud,
     configFile: options.configFile,
     project: import_node_path23.default.basename(import_node_path23.default.resolve(root, "../..")),
+    address: (ref) => artifactPath(root, ref.type, ref.id).split("/").pop(),
     port: () => port,
     inspect,
     onPublication: (key2, publication) => {
@@ -100692,8 +100735,8 @@ async function startArtifactsServer(options) {
       sendJson(res, 400, { error: err.message });
     }
   };
-  const isAuthorized = (req, keyFromQuery) => keyFromQuery !== null && safeEqual(keyFromQuery, token) || safeEqual(parseCookies(req.headers.cookie)[cookieName] ?? "", token);
-  const serveContent = (res, rest, range) => {
+  const isAuthorized = (req, keyFromQuery) => loopback || keyFromQuery !== null && safeEqual(keyFromQuery, token) || safeEqual(parseCookies(req.headers.cookie)[cookieName] ?? "", token);
+  const serveContent = (res, rest, range, mode = "main") => {
     if (rest.startsWith("runtime/")) {
       if (!runtimeDir) {
         send(res, 404, "Not found");
@@ -100735,8 +100778,8 @@ async function startArtifactsServer(options) {
     }
     const page = ref.type === "html" ? relative === "index.html" : relative.endsWith(".html");
     const headers = {
-      "Content-Security-Policy": CONTENT_CSP[page && ref.type === "document" ? "html" : ref.type],
-      "Access-Control-Allow-Origin": "*"
+      "Content-Security-Policy": mode === "board" ? boardCsp(options.urlHost, port, options.cloud?.origin) : CONTENT_CSP[page && ref.type === "document" ? "html" : ref.type],
+      ...mode === "board" ? {} : { "Access-Control-Allow-Origin": "*" }
     };
     if (!page) {
       sendFile(res, target, headers, range);
@@ -100745,7 +100788,7 @@ async function startArtifactsServer(options) {
     import_node_fs26.default.readFile(target, "utf8", (err, source) => {
       if (err) send(res, 404, "Not found");
       else {
-        const uiRuntimeUrl = runtimeDir ? `${contentPrefix}runtime/ryugi-ui.js` : void 0;
+        const uiRuntimeUrl = runtimeDir ? `${mode === "board" ? "/c/" : contentPrefix}runtime/ryugi-ui.js` : void 0;
         send(
           res,
           200,
@@ -100771,7 +100814,11 @@ async function startArtifactsServer(options) {
       sendJson(res, 404, { warnings: [`artifact ${type}/${id2} not found`] });
       return;
     }
-    sendJson(res, 200, artifactMeta(artifactKeyOf(`${type}/${id2}`), dir));
+    const ref = artifactKeyOf(`${type}/${id2}`);
+    sendJson(res, 200, {
+      ...artifactMeta(ref, dir),
+      ...ref.type === "artboard" && boardPort ? { boardPort, boardPath: `/c${artifactPath(root, "artboard", ref.id)}/` } : {}
+    });
   };
   const serveList = (res) => {
     const { artifacts, warnings } = listArtifacts(root);
@@ -100846,6 +100893,10 @@ async function startArtifactsServer(options) {
   }
   const handleRequest = (req, res) => {
     res.setHeader("X-Robots-Tag", "noindex, nofollow");
+    if (!hostAllowed(policy, req.headers.host)) {
+      send(res, 403, "Forbidden host");
+      return;
+    }
     const url2 = new URL(req.url ?? "/", "http://artifacts.local");
     if (url2.pathname === "/api/status") {
       if (!isAuthorized(req, url2.searchParams.get("key")))
@@ -100890,6 +100941,10 @@ async function startArtifactsServer(options) {
       });
       return;
     }
+    if (loopback && !originAllowed(policy, req.headers.origin)) {
+      send(res, 403, "Forbidden origin");
+      return;
+    }
     const key2 = url2.searchParams.get("key");
     if (!isAuthorized(req, key2)) {
       send(res, 403, "Forbidden: open the full artifact link including ?key=");
@@ -100971,7 +101026,7 @@ async function startArtifactsServer(options) {
       return;
     }
     if (pathname === "/api/cloud/flush") {
-      if (req.method !== "POST" || key2 === null || !safeEqual(key2, token)) {
+      if (req.method !== "POST" || !agentOk(req, key2)) {
         send(res, 403, "Forbidden: agent calls need ?key=");
         return;
       }
@@ -100986,7 +101041,7 @@ async function startArtifactsServer(options) {
     }
     const cloudMatch = cloud?.match(pathname);
     if (cloud && cloudMatch) {
-      if (req.method !== "GET" && !(key2 !== null && safeEqual(key2, token)) && !sameOrigin(req)) {
+      if (req.method !== "GET" && !keyOk(key2) && !sameOrigin(req)) {
         send(res, 403, "Forbidden");
         return;
       }
@@ -100995,7 +101050,7 @@ async function startArtifactsServer(options) {
     }
     const agentCommentsMatch = API_AGENT_COMMENTS_ROUTE.exec(pathname);
     if (agentCommentsMatch) {
-      if (req.method !== "POST" || key2 === null || !safeEqual(key2, token)) {
+      if (req.method !== "POST" || !agentOk(req, key2)) {
         send(res, 403, "Forbidden: agent calls need ?key=");
         return;
       }
@@ -101006,7 +101061,7 @@ async function startArtifactsServer(options) {
     }
     const agentBoardMatch = API_AGENT_BOARD_COMMENTS_ROUTE.exec(pathname);
     if (agentBoardMatch) {
-      if (req.method !== "POST" || key2 === null || !safeEqual(key2, token)) {
+      if (req.method !== "POST" || !agentOk(req, key2)) {
         send(res, 403, "Forbidden: agent calls need ?key=");
         return;
       }
@@ -101017,7 +101072,7 @@ async function startArtifactsServer(options) {
     }
     const agentCheckMatch = API_AGENT_CHECK_ROUTE.exec(pathname);
     if (agentCheckMatch) {
-      if (req.method !== "POST" || key2 === null || !safeEqual(key2, token)) {
+      if (req.method !== "POST" || !agentOk(req, key2)) {
         send(res, 403, "Forbidden: agent calls need ?key=");
         return;
       }
@@ -101045,8 +101100,19 @@ async function startArtifactsServer(options) {
       serveArtifactApi(res, apiMatch[1], apiMatch[2]);
       return;
     }
-    if (SHELL_ROUTE.test(pathname) || PREVIEW_ROUTE.test(pathname) || pathname === "/index.html") {
-      const requested = artifactKeyOf(
+    const embedMatch = EMBED_ROUTE.exec(pathname);
+    const embed = !!embedMatch;
+    const embedded = embedMatch && embedTarget(embedMatch[1]);
+    if (pathname.startsWith("/embed/") && (!embedded || !options.cloud)) {
+      send(res, 404, "Not found");
+      return;
+    }
+    if (SHELL_ROUTE.test(pathname) || PREVIEW_ROUTE.test(pathname) || embed || pathname === "/index.html") {
+      if (loopback && (pathname === "/" || pathname === "/index.html") && !navigationAllowed(req.headers["sec-fetch-site"])) {
+        send(res, 403, "Forbidden");
+        return;
+      }
+      const requested = embedded || artifactKeyOf(
         pathname.replace(/^\/(?:preview\/)?/, "").replace(/\/$/, ""),
         isArtifactLocator
       );
@@ -101065,9 +101131,12 @@ async function startArtifactsServer(options) {
       const preview = PREVIEW_ROUTE.test(pathname);
       const canonicalPath = ref ? dir ? artifactPath(root, ref.type, ref.id) : `/${ref.type}/${ref.id}` : "/";
       const canonical = `http://${urlHostForHttp(options.urlHost)}:${port}${preview ? "/preview" : ""}${canonicalPath}`;
-      const csp = preview ? VIEWER_CSP.replace("frame-ancestors 'none'", "frame-ancestors 'self'") : VIEWER_CSP;
+      const csp = embed ? viewerCsp(boardOrigins()).replace(
+        "frame-ancestors 'none'",
+        `frame-ancestors ${options.cloud.origin}`
+      ) : preview ? viewerCsp(boardOrigins()).replace("frame-ancestors 'none'", "frame-ancestors 'self'") : viewerCsp(boardOrigins());
       const headers = { "Content-Type": "text/html; charset=utf-8" };
-      if (key2 !== null)
+      if (key2 !== null && !loopback)
         headers["Set-Cookie"] = `${cookieName}=${token}; HttpOnly; SameSite=Strict; Path=/`;
       const entry = preview && import_node_fs26.default.existsSync(import_node_path23.default.join(viewerDir, "preview.html")) ? "preview.html" : "index.html";
       void import_node_fs26.default.promises.readFile(import_node_path23.default.join(viewerDir, entry), "utf8").then((template) => {
@@ -101077,7 +101146,8 @@ async function startArtifactsServer(options) {
           locale,
           url: canonical,
           icon: ref ? typeFaviconHref(ref.type) : void 0,
-          artifactId: resolved?.id
+          artifactId: resolved?.id,
+          embedParent: embed ? options.cloud.origin : void 0
         });
         send(res, 200, html, {
           ...headers,
@@ -101090,7 +101160,10 @@ async function startArtifactsServer(options) {
     }
     const target = resolveInside(viewerDir, pathname.slice(1));
     if (!target) send(res, 404, "Not found");
-    else sendFile(res, target, { "Content-Security-Policy": VIEWER_CSP });
+    else
+      sendFile(res, target, {
+        "Content-Security-Policy": viewerCsp(boardOrigins())
+      });
   };
   const server = import_node_http.default.createServer((req, res) => {
     try {
@@ -101100,12 +101173,16 @@ async function startArtifactsServer(options) {
     }
   });
   server.on("upgrade", (req, socket) => {
+    if (!hostAllowed(policy, req.headers.host)) {
+      rejectUpgrade(socket, 403, "Forbidden");
+      return;
+    }
     const url2 = new URL(req.url ?? "/", "http://artifacts.local");
     const clientKey = req.headers["sec-websocket-key"];
     const directMatch = DIRECT_RELAY_ROUTE.exec(url2.pathname);
     if (directMatch && typeof clientKey === "string") {
       const fromCloud = options.cloud !== void 0 && req.headers.origin === options.cloud.origin;
-      if (!safeEqual(url2.searchParams.get("key") ?? "", token) || !(fromCloud || sameOrigin(req))) {
+      if (!keyOk(url2.searchParams.get("key")) || !(fromCloud || sameOrigin(req))) {
         rejectUpgrade(socket, 403, "Forbidden");
         return;
       }
@@ -101150,9 +101227,56 @@ async function startArtifactsServer(options) {
   cookieName = `ryugi_artifacts_${port}`;
   import_node_fs26.default.writeFileSync(portFile, `${port}
 `, { mode: 384 });
+  const boardServer = import_node_http.default.createServer((req, res) => {
+    if (!hostAllowed(policy, req.headers.host)) {
+      send(res, 403, "Forbidden host");
+      return;
+    }
+    let pathname;
+    try {
+      pathname = decodeURIComponent(new URL(req.url ?? "/", "http://board.local").pathname);
+    } catch {
+      send(res, 400, "Bad request");
+      return;
+    }
+    try {
+      const route = routeBoardRequest(req, pathname);
+      if (route.kind === "robots") send(res, 200, "User-agent: *\nDisallow: /\n");
+      else if (route.kind === "runtime") serveContent(res, route.rest, req.headers.range, "board");
+      else if (route.kind === "board") {
+        const resolved = resolveArtifactAddress(root, "artboard", route.address);
+        if (!resolved || resolved.id === route.address) send(res, 404, "Not found");
+        else serveContent(res, `artboard/${resolved.id}/${route.rest}`, req.headers.range, "board");
+      } else send(res, 404, "Not found");
+    } catch (err) {
+      if (!res.headersSent) send(res, 500, err.message);
+      else res.destroy();
+    }
+  });
+  if (loopback) {
+    const boardPortFile = import_node_path23.default.join(stateDir, BOARD_PORT_FILE);
+    const previousBoardPort = Number(readPersisted(boardPortFile));
+    try {
+      boardPort = await listen(
+        boardServer,
+        options.host,
+        Number.isInteger(previousBoardPort) && previousBoardPort > 0 && previousBoardPort !== port ? previousBoardPort : 0
+      );
+    } catch {
+      boardPort = await listen(boardServer, options.host, 0);
+    }
+    import_node_fs26.default.writeFileSync(boardPortFile, `${boardPort}
+`, { mode: 384 });
+  }
+  policy = accessPolicy({
+    host: options.host,
+    urlHost: options.urlHost,
+    ports: boardPort ? [port, boardPort] : [port],
+    cloudOrigin: options.cloud?.origin
+  });
   const origin = `http://${urlHostForHttp(options.urlHost)}:${port}`;
-  const url = `${origin}/?key=${token}`;
-  const linkFor = (type, id2) => `${origin}${artifactPath(root, type, id2)}?key=${token}`;
+  const url = loopback ? `${origin}/` : `${origin}/?key=${token}`;
+  const linkFor = (type, id2) => `${origin}${artifactPath(root, type, id2)}${loopback ? "" : `?key=${token}`}`;
   const signatures = /* @__PURE__ */ new Map();
   const writeState = (ref, dir) => {
     const payload = readArtifact(dir, ref, runtimeOf(ref, dir));
@@ -101174,8 +101298,20 @@ async function startArtifactsServer(options) {
     initialChanges.push({ ref: entry, payload, files: [] });
     if (entry.type === "document") void documents.open(entry.id);
   }
-  writeJsonAtomic(import_node_path23.default.join(stateDir, "server-info"), { type: "server-started", url, port, root });
+  writeJsonAtomic(import_node_path23.default.join(stateDir, "server-info"), {
+    type: "server-started",
+    url,
+    port,
+    boardPort,
+    root
+  });
   const relayViewers = /* @__PURE__ */ new Map();
+  const embedTarget = (id2) => {
+    if (isArtifactLocator(id2) && resolveArtifactAddress(root, "artboard", id2))
+      return { type: "artboard", id: id2 };
+    const served = artifactKeyOf(servedArtifacts().get(id2) ?? "");
+    return served?.type === "artboard" ? served : null;
+  };
   const servedArtifacts = () => {
     const served = /* @__PURE__ */ new Map();
     if (!options.configFile) return served;
@@ -101257,7 +101393,11 @@ async function startArtifactsServer(options) {
     ...options.relay,
     token: () => readCredentials(options.cloud.credentialsFile, options.cloud.origin)?.token ?? null,
     served: servedArtifacts,
-    local: () => ({ hostId: hostIdFor(options.cloud.credentialsFile), port, key: token }),
+    local: () => ({
+      hostId: hostIdFor(options.cloud.credentialsFile),
+      port,
+      ...loopback ? { embed: true } : { key: token }
+    }),
     handle: handleRelay,
     onActivity: touch,
     onWatch: (keys2) => {
@@ -101352,6 +101492,7 @@ async function startArtifactsServer(options) {
   );
   return {
     port,
+    boardPort,
     token,
     contentToken,
     url,
@@ -101380,6 +101521,8 @@ async function startArtifactsServer(options) {
         direct.close();
         selections.clearAll();
         for (const socket of clients) socket.destroy();
+        boardServer.close();
+        boardServer.closeAllConnections();
         server.close(() => resolve());
         server.closeAllConnections();
       });