sh3-core 0.22.5 → 0.24.0

package/dist/shell-shard/verbs/xfer.js

@@ -11,11 +11,11 @@ export const xferVerb = {
     programmatic: true,
     async run(ctx, args) {
         const ts = Date.now();
-        if (!ctx.docs) {
+        if (!ctx.sh3.docs) {
             ctx.scrollback.push({ kind: 'status', text: 'xfer: document capability not available', level: 'error', ts });
             return;
         }
-        if (!ctx.docs.transferBetweenScopes) {
+        if (!ctx.sh3.docs.transferBetweenScopes) {
             ctx.scrollback.push({ kind: 'status', text: 'xfer: write permission not granted', level: 'error', ts });
             return;
         }
@@ -64,13 +64,13 @@ export const xferVerb = {
                 ctx.scrollback.push({ kind: 'status', text: 'xfer: source and destination are the same', level: 'error', ts });
                 return;
             }
-            await ctx.docs.transferBetweenScopes(srcTenant, srcParsed.shardId, srcParsed.path, dstTenant, dstParsed.shardId, dstParsed.path, moveOpts);
+            await ctx.sh3.docs.transferBetweenScopes(srcTenant, srcParsed.shardId, srcParsed.path, dstTenant, dstParsed.shardId, dstParsed.path, moveOpts);
             const verb = copy ? 'copied' : 'moved';
             ctx.scrollback.push({ kind: 'status', text: `xfer: ${verb} ${positional[0]} → ${positional[1]}`, level: 'info', ts });
             return;
         }
         const prefix = srcParsed.path;
-        const allDocs = await ctx.docs.listDocumentsIn(srcTenant);
+        const allDocs = await ctx.sh3.docs.listDocumentsIn(srcTenant);
         const matching = allDocs.filter((d) => d.shardId === srcParsed.shardId && (!prefix || d.path.startsWith(prefix)));
         if (matching.length === 0) {
             ctx.scrollback.push({ kind: 'status', text: `xfer: no documents found under ${positional[0]}`, level: 'info', ts });
@@ -78,7 +78,7 @@ export const xferVerb = {
         }
         let count = 0;
         for (const doc of matching) {
-            await ctx.docs.transferBetweenScopes(srcTenant, doc.shardId, doc.path, dstTenant, dstParsed.shardId, doc.path, moveOpts);
+            await ctx.sh3.docs.transferBetweenScopes(srcTenant, doc.shardId, doc.path, dstTenant, dstParsed.shardId, doc.path, moveOpts);
             count++;
         }
         const verb = copy ? 'copied' : 'moved';

package/dist/shell-shard/verbs/xfer.test.js

@@ -11,13 +11,13 @@ function makeSh3(scope) {
 }
 function makeCtx(docs, sh3) {
     const pushed = [];
+    const composedSh3 = Object.assign(Object.assign({}, (sh3 !== null && sh3 !== void 0 ? sh3 : {})), { docs });
     const ctx = {
-        sh3: sh3 !== null && sh3 !== void 0 ? sh3 : {},
+        sh3: composedSh3,
         scrollback: { push: (e) => pushed.push(e) },
         session: {},
         cwd: '/',
         fs: {},
-        docs,
         dispatch: async () => { },
     };
     return { ctx, pushed };

package/dist/transport/apiFetch.js

@@ -14,6 +14,7 @@
  * defensive pattern as `platform/index.ts`. Vite code-splits it
  * into a Tauri-only chunk that never loads in web builds.
  */
+import { getEnvServerUrl } from '../env/serverUrl';
 import { getAuthToken } from './authToken';
 let tauriFetch = null;
 let tauriProbed = false;
@@ -43,8 +44,25 @@ async function getTauriFetch() {
     }
     return tauriFetch;
 }
+// Resolve relative paths against the configured server URL so callers can
+// use bare `/api/...` paths and have them hit the configured sh3-server
+// regardless of the webview's origin. Mirrors ctx.fetch's resolveUrl —
+// absolute URLs pass through, relatives get prefixed when a serverUrl is
+// set. When no serverUrl is configured (e.g. early bootstrap, web builds
+// hosted same-origin), the path is left untouched so `fetch` falls back
+// to `window.location.origin` as before.
+function resolveApiUrl(url) {
+    if (url.startsWith('http://') || url.startsWith('https://'))
+        return url;
+    const base = getEnvServerUrl();
+    if (!base)
+        return url;
+    const sep = url.startsWith('/') ? '' : '/';
+    return `${base}${sep}${url}`;
+}
 export function apiFetch(url, init) {
     var _a;
+    const resolved = resolveApiUrl(url);
     // Inject Authorization: Bearer <session-token> if a session is active
     // and the caller didn't already supply one. Cookies don't survive the
     // cross-origin hop (SameSite=Lax + plugin-http has no cookie store),
@@ -62,11 +80,11 @@ export function apiFetch(url, init) {
     // call-timing assertions in tests still hold and web builds skip the
     // dynamic-import probe entirely.
     if (!inTauriRuntime()) {
-        return fetch(url, Object.assign({ credentials: 'include' }, finalInit));
+        return fetch(resolved, Object.assign({ credentials: 'include' }, finalInit));
     }
     return getTauriFetch().then((tf) => {
         if (tf)
-            return tf(url, finalInit);
-        return fetch(url, Object.assign({ credentials: 'include' }, finalInit));
+            return tf(resolved, finalInit);
+        return fetch(resolved, Object.assign({ credentials: 'include' }, finalInit));
     });
 }

package/dist/transport/apiFetch.test.js

@@ -34,4 +34,67 @@ describe('apiFetch', () => {
         const [, init] = calls[0];
         expect(init.credentials).toBe('omit');
     });
+    it('resolves relative paths against the configured serverUrl', async () => {
+        const calls = [];
+        globalThis.fetch = vi.fn(async (input) => {
+            calls.push(String(input));
+            return new Response('ok');
+        });
+        const { __setEnvServerUrl } = await import('../env/serverUrl');
+        __setEnvServerUrl('https://remote.example.com');
+        try {
+            const { apiFetch } = await import('./apiFetch');
+            await apiFetch('/api/admin/users');
+            expect(calls[0]).toBe('https://remote.example.com/api/admin/users');
+        }
+        finally {
+            __setEnvServerUrl('');
+        }
+    });
+    it('prepends a slash to bare relative paths when serverUrl is set', async () => {
+        const calls = [];
+        globalThis.fetch = vi.fn(async (input) => {
+            calls.push(String(input));
+            return new Response('ok');
+        });
+        const { __setEnvServerUrl } = await import('../env/serverUrl');
+        __setEnvServerUrl('https://remote.example.com');
+        try {
+            const { apiFetch } = await import('./apiFetch');
+            await apiFetch('api/admin/users');
+            expect(calls[0]).toBe('https://remote.example.com/api/admin/users');
+        }
+        finally {
+            __setEnvServerUrl('');
+        }
+    });
+    it('passes absolute URLs through unchanged regardless of serverUrl', async () => {
+        const calls = [];
+        globalThis.fetch = vi.fn(async (input) => {
+            calls.push(String(input));
+            return new Response('ok');
+        });
+        const { __setEnvServerUrl } = await import('../env/serverUrl');
+        __setEnvServerUrl('https://remote.example.com');
+        try {
+            const { apiFetch } = await import('./apiFetch');
+            await apiFetch('https://other.example.com/api/bar');
+            expect(calls[0]).toBe('https://other.example.com/api/bar');
+        }
+        finally {
+            __setEnvServerUrl('');
+        }
+    });
+    it('leaves relative paths alone when no serverUrl is configured', async () => {
+        const calls = [];
+        globalThis.fetch = vi.fn(async (input) => {
+            calls.push(String(input));
+            return new Response('ok');
+        });
+        const { __setEnvServerUrl } = await import('../env/serverUrl');
+        __setEnvServerUrl('');
+        const { apiFetch } = await import('./apiFetch');
+        await apiFetch('/api/admin/users');
+        expect(calls[0]).toBe('/api/admin/users');
+    });
 });

package/dist/verbs/types.d.ts

@@ -174,6 +174,16 @@ export interface Sh3Api {
         id: string;
         name: string;
     }>;
+    /**
+     * Tenant-wide document observation surface for the caller. Present iff
+     * the caller's manifest declares `documents:browse`. Read methods
+     * (`readFrom`, …) require `documents:read`; write methods (`writeTo`,
+     * `transferBetweenScopes`, …) require `documents:write`. Verbs that need
+     * documents — `xfer`, `cat`, `ls`, `mv`, `mkdir`, `rm` — read it from
+     * here so programmatic dispatch (runVerb / pipelines) inherits the
+     * caller's gating.
+     */
+    docs?: BrowseCapability;
 }
 export type { DispatchToTerminalResult } from '../shell-shard/dispatch-to-terminal';
 export interface VerbContext {
@@ -182,8 +192,6 @@ export interface VerbContext {
     session: SessionClient;
     cwd: string;
     fs: TenantFsClient;
-    /** Document zone browse capability. Present when shell-shard has documents:browse permission. */
-    docs?: BrowseCapability;
     /** Invoke another registered verb programmatically (used by rich-entry clicks). */
     dispatch(line: string): Promise<void>;
     /**

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** Auto-generated from package.json — do not edit manually. */
-export declare const VERSION = "0.22.5";
+export declare const VERSION = "0.24.0";

package/dist/version.js

@@ -1,2 +1,2 @@
 /** Auto-generated from package.json — do not edit manually. */
-export const VERSION = '0.22.5';
+export const VERSION = '0.24.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sh3-core",
-  "version": "0.22.5",
+  "version": "0.24.0",
   "type": "module",
   "files": [
     "dist"