sh3-core 0.5.4 → 0.5.6

package/dist/build.js

@@ -112,7 +112,7 @@ export function sh3Artifact(options = {}) {
             }
         },
         async closeBundle() {
-            var _a, _b, _c, _d;
+            var _a, _b, _c, _d, _e;
             if (!entryFileName)
                 return;
             const clientSrc = join(outDir, entryFileName);
@@ -122,7 +122,7 @@ export function sh3Artifact(options = {}) {
             try {
                 source = readFileSync(clientSrc, 'utf-8');
             }
-            catch (_e) {
+            catch (_f) {
                 console.warn('[sh3-artifact] Could not read entry chunk:', clientSrc);
                 return;
             }
@@ -131,17 +131,71 @@ export function sh3Artifact(options = {}) {
                 writeFileSync(clientDest, source);
                 unlinkSync(clientSrc);
             }
-            // --- Extract manifest fields via regex ---
-            const extract = (pattern) => {
-                const m = source.match(pattern);
-                return m ? m[1] : '';
-            };
-            const id = extract(/\bid\s*:\s*["']([^"']+)["']/);
-            const label = extract(/\blabel\s*:\s*["']([^"']+)["']/);
-            const version = extract(/\bversion\s*:\s*["']([^"']+)["']/);
-            const hasShard = /\bviews\s*:\s*\[/.test(source);
+            // --- Extract manifest fields from App or Shard block ---
+            //
+            // The bundle may contain both an App manifest (has `requiredShards`)
+            // and a Shard manifest (has `views: [`). We extract id/label/version
+            // from the App block first, then fall back to the Shard block.
+            // If neither block exists, the build fails with a clear error.
             const hasApp = /\brequiredShards\s*:\s*\[/.test(source);
+            const hasShard = /\bviews\s*:\s*\[/.test(source);
+            if (!hasApp && !hasShard) {
+                throw new Error('[sh3-artifact] Could not find an App manifest (requiredShards) or Shard manifest (views) in the entry chunk. '
+                    + 'Ensure the entry exports an App or Shard object.');
+            }
             const type = hasShard && hasApp ? 'combo' : hasApp ? 'app' : 'shard';
+            /**
+             * Extract id, label, and version from the manifest object block that
+             * contains `anchor`. Walks backwards from the anchor to find the
+             * opening `{`, then forward to find the matching `}`, and extracts
+             * fields from within that slice.
+             */
+            function extractFromBlock(anchor) {
+                const anchorMatch = anchor.exec(source);
+                if (!anchorMatch)
+                    return null;
+                // Walk backwards from the anchor to find the enclosing `{`.
+                let depth = 0;
+                let blockStart = anchorMatch.index;
+                for (let i = anchorMatch.index - 1; i >= 0; i--) {
+                    if (source[i] === '}')
+                        depth++;
+                    if (source[i] === '{') {
+                        if (depth === 0) {
+                            blockStart = i;
+                            break;
+                        }
+                        depth--;
+                    }
+                }
+                // Walk forwards from the anchor to find the matching `}`.
+                depth = 0;
+                let blockEnd = source.length;
+                for (let i = blockStart; i < source.length; i++) {
+                    if (source[i] === '{')
+                        depth++;
+                    if (source[i] === '}') {
+                        depth--;
+                        if (depth === 0) {
+                            blockEnd = i + 1;
+                            break;
+                        }
+                    }
+                }
+                const block = source.slice(blockStart, blockEnd);
+                const get = (pattern) => {
+                    const m = block.match(pattern);
+                    return m ? m[1] : '';
+                };
+                return {
+                    id: get(/\bid\s*:\s*["']([^"']+)["']/),
+                    label: get(/\blabel\s*:\s*["']([^"']+)["']/),
+                    version: get(/\bversion\s*:\s*["']([^"']+)["']/),
+                };
+            }
+            // App first, then Shard.
+            const extracted = (_a = extractFromBlock(/\brequiredShards\s*:\s*\[/)) !== null && _a !== void 0 ? _a : extractFromBlock(/\bviews\s*:\s*\[/);
+            const { id, label, version } = extracted;
             // --- Optional server bundle ---
             let hasServer = false;
             if (options.serverEntry && existsSync(options.serverEntry)) {
@@ -156,13 +210,13 @@ export function sh3Artifact(options = {}) {
                 pkgDescription = typeof pkg.description === 'string' ? pkg.description : undefined;
                 pkgAuthor = typeof pkg.author === 'string'
                     ? pkg.author
-                    : typeof ((_a = pkg.author) === null || _a === void 0 ? void 0 : _a.name) === 'string' ? pkg.author.name : undefined;
+                    : typeof ((_b = pkg.author) === null || _b === void 0 ? void 0 : _b.name) === 'string' ? pkg.author.name : undefined;
             }
-            catch ( /* no package.json or unreadable */_f) { /* no package.json or unreadable */ }
+            catch ( /* no package.json or unreadable */_g) { /* no package.json or unreadable */ }
             // --- Write manifest.json ---
-            const overrides = (_b = options.manifest) !== null && _b !== void 0 ? _b : {};
-            const finalDescription = (_c = overrides.description) !== null && _c !== void 0 ? _c : pkgDescription;
-            const finalAuthor = (_d = overrides.author) !== null && _d !== void 0 ? _d : pkgAuthor;
+            const overrides = (_c = options.manifest) !== null && _c !== void 0 ? _c : {};
+            const finalDescription = (_d = overrides.description) !== null && _d !== void 0 ? _d : pkgDescription;
+            const finalAuthor = (_e = overrides.author) !== null && _e !== void 0 ? _e : pkgAuthor;
             if (!finalDescription) {
                 throw new Error('[sh3-artifact] Missing "description". Add it to package.json or pass it via sh3Artifact({ manifest: { description } }).');
             }

package/dist/createShell.d.ts

@@ -2,8 +2,6 @@ import type { Shard, App } from './index';
 export interface ShellConfig {
     /** Framework shard IDs to exclude (all included by default) */
     excludeShards?: string[];
-    /** Framework app IDs to exclude (all included by default) */
-    excludeApps?: string[];
     /** Additional shards to register */
     shards?: Shard[];
     /** Additional apps to register */
@@ -20,5 +18,7 @@ export interface ShellConfig {
     }>;
     /** Mount target — CSS selector or element (defaults to '#app') */
     target?: string | HTMLElement;
+    /** Server base URL ('' for same-origin) */
+    serverUrl?: string;
 }
 export declare function createShell(config?: ShellConfig): Promise<void>;

package/dist/createShell.js

@@ -3,20 +3,22 @@
  *
  * Consumers call this from their own main.ts instead of manually
  * importing registerShard / registerApp / bootstrap / Shell. The
- * factory handles platform detection, registration, bootstrap, and
- * mounting in the correct order.
+ * factory handles platform detection, boot config, auth gating,
+ * registration, bootstrap, and mounting in the correct order.
  */
-import { mount } from 'svelte';
+import { mount, unmount } from 'svelte';
 import { Shell } from './index';
 import { registerShard, registerApp, bootstrap, __setBackend, setLocalOwner, } from './host';
 import { resolvePlatform } from './platform/index';
 import { hydrateTokenOverrides } from './theme';
 import { __setEnvServerUrl } from './env/index';
+import { __setTenantId } from './documents/config';
+import { initFromBoot } from './auth/index';
+import SignInWall from './auth/SignInWall.svelte';
 export async function createShell(config) {
-    var _a, _b;
-    // 1. Platform detection — must run before bootstrap so state zones
-    //    hydrate from the right backend, and local-owner environments
-    //    auto-elevate to admin.
+    var _a, _b, _c;
+    const sUrl = (_a = config === null || config === void 0 ? void 0 : config.serverUrl) !== null && _a !== void 0 ? _a : '';
+    // 1. Platform detection
     const platform = await resolvePlatform();
     if (platform.backends) {
         __setBackend('workspace', platform.backends.workspace);
@@ -25,15 +27,52 @@ export async function createShell(config) {
     if (platform.localOwner) {
         setLocalOwner();
     }
-    // 1d. Default env state to same-origin. The server frontend overrides
-    //     this if it knows a specific URL, but this ensures env() works for
-    //     same-origin deployments without explicit configuration.
-    __setEnvServerUrl('');
-    // 1c. Apply persisted theme token overrides before any component mounts,
-    //     so the first frame renders with the user's chosen theme.
+    __setEnvServerUrl(sUrl);
     hydrateTokenOverrides();
-    // 1b. Load server-discovered packages (fetched by frontend from /api/packages).
-    if ((_a = config === null || config === void 0 ? void 0 : config.discoveredPackages) === null || _a === void 0 ? void 0 : _a.length) {
+    // 2. Resolve mount target early (needed for both sign-in wall and shell)
+    const target = typeof (config === null || config === void 0 ? void 0 : config.target) === 'string'
+        ? document.querySelector(config.target)
+        : (_b = config === null || config === void 0 ? void 0 : config.target) !== null && _b !== void 0 ? _b : document.getElementById('app');
+    if (!target) {
+        throw new Error('SH3: mount target not found');
+    }
+    // 3. Fetch boot config (skip for local-owner platforms like Tauri/dev)
+    let bootConfig = null;
+    if (!platform.localOwner) {
+        try {
+            const res = await fetch(`${sUrl}/api/boot`, { credentials: 'include' });
+            if (res.ok) {
+                bootConfig = await res.json();
+            }
+        }
+        catch (_d) {
+            // Server unreachable — boot without auth (offline mode)
+        }
+    }
+    // 4. Auth decision point
+    if (platform.localOwner) {
+        // Local-owner (Tauri/dev): no auth, no sign-in, tenant is 'local'.
+        // setLocalOwner() already called above — admin is assumed.
+        __setTenantId('local');
+    }
+    else if (bootConfig) {
+        initFromBoot(sUrl, bootConfig);
+        __setTenantId(bootConfig.tenantId);
+        const { auth, session } = bootConfig;
+        // Hard gate: no session, auth required, no guest allowed → sign-in wall
+        if (!session && auth.required && !auth.guestAllowed) {
+            await showSignInWall(target, sUrl, bootConfig);
+            // After successful sign-in, re-fetch boot config
+            const res = await fetch(`${sUrl}/api/boot`, { credentials: 'include' });
+            if (res.ok) {
+                bootConfig = await res.json();
+                initFromBoot(sUrl, bootConfig);
+                __setTenantId(bootConfig.tenantId);
+            }
+        }
+    }
+    // 5. Load server-discovered packages
+    if ((_c = config === null || config === void 0 ? void 0 : config.discoveredPackages) === null || _c === void 0 ? void 0 : _c.length) {
         const { loadBundleModule } = await import('./registry/loader');
         for (const pkg of config.discoveredPackages) {
             try {
@@ -55,33 +94,39 @@ export async function createShell(config) {
             }
         }
     }
-    // 2. Register consumer-provided shards and apps. These go in before
-    //    bootstrap() so they appear in registeredShards, but framework
-    //    shards activate first (insertion-order guarantee in bootstrap).
+    // 6. Register consumer-provided shards and apps
     if (config === null || config === void 0 ? void 0 : config.shards) {
-        for (const shard of config.shards) {
+        for (const shard of config.shards)
             registerShard(shard);
-        }
     }
     if (config === null || config === void 0 ? void 0 : config.apps) {
-        for (const app of config.apps) {
+        for (const app of config.apps)
             registerApp(app);
-        }
     }
-    // 3. Bootstrap — framework shards/apps registered internally,
-    //    filtered by the exclude lists.
+    // 7. Bootstrap
     const bootstrapConfig = {};
     if (config === null || config === void 0 ? void 0 : config.excludeShards)
         bootstrapConfig.excludeShards = config.excludeShards;
-    if (config === null || config === void 0 ? void 0 : config.excludeApps)
-        bootstrapConfig.excludeApps = config.excludeApps;
     await bootstrap(bootstrapConfig);
-    // 4. Mount the shell.
-    const target = typeof (config === null || config === void 0 ? void 0 : config.target) === 'string'
-        ? document.querySelector(config.target)
-        : (_b = config === null || config === void 0 ? void 0 : config.target) !== null && _b !== void 0 ? _b : document.getElementById('app');
-    if (!target) {
-        throw new Error('SH3: mount target not found');
-    }
+    // 8. Mount the shell
     mount(Shell, { target });
 }
+/**
+ * Show the sign-in wall and wait until the user authenticates.
+ * Returns a promise that resolves after successful login.
+ */
+function showSignInWall(target, serverUrl, bootConfig) {
+    return new Promise((resolve) => {
+        const instance = mount(SignInWall, {
+            target,
+            props: {
+                serverUrl,
+                selfRegistration: bootConfig.auth.selfRegistration,
+                onSuccess: () => {
+                    unmount(instance);
+                    resolve();
+                },
+            },
+        });
+    });
+}

package/dist/host-entry.d.ts

@@ -7,6 +7,7 @@ export { HttpDocumentBackend } from './documents/http-backend';
 export { __setEnvServerUrl } from './env/index';
 export { installPackage, uninstallPackage, listInstalledPackages, loadInstalledPackages, } from './registry/index';
 export type { InstalledPackage, InstallResult, PackageMeta } from './registry/types';
-export { initAuth, elevate, deescalate } from './auth/index';
+export { initFromBoot, login, logout, register, setLocalOwner as setLocalOwnerAuth } from './auth/index';
+export type { AuthUser, AuthSession, BootConfig, GlobalSettings } from './auth/types';
 export { createShell } from './createShell';
 export type { ShellConfig } from './createShell';

package/dist/host-entry.js

@@ -11,7 +11,7 @@ export { HttpDocumentBackend } from './documents/http-backend';
 export { __setEnvServerUrl } from './env/index';
 // Install API (host-only).
 export { installPackage, uninstallPackage, listInstalledPackages, loadInstalledPackages, } from './registry/index';
-// Admin mode (host-only — elevate/deescalate drive the shell UI, initAuth runs at boot).
-export { initAuth, elevate, deescalate } from './auth/index';
+// Auth (host-only — session lifecycle, boot initialization).
+export { initFromBoot, login, logout, register, setLocalOwner as setLocalOwnerAuth } from './auth/index';
 // Shell boot factory.
 export { createShell } from './createShell';

package/dist/host.d.ts

@@ -10,8 +10,6 @@ export { registerApp };
 export interface BootstrapConfig {
     /** Framework shard IDs to skip registration for */
     excludeShards?: string[];
-    /** Framework app IDs to skip registration for */
-    excludeApps?: string[];
 }
 export declare function bootstrap(config?: BootstrapConfig): Promise<void>;
 export { installPackage, listInstalledPackages } from './registry/installer';

package/dist/host.js

@@ -22,10 +22,12 @@ import { shellShard } from './shell-shard/shellShard.svelte';
 import { storeShard } from './store/storeShard.svelte';
 import { __setBackend } from './state/zones.svelte';
 import { loadInstalledPackages } from './registry/installer';
-import { initAuth, isAdmin, setLocalOwner } from './auth/index';
+import { setLocalOwner } from './auth/index';
 import { storeApp } from './store/storeApp';
 import { diagnosticShard } from './diagnostic/diagnosticShard.svelte';
 import { diagnosticApp } from './diagnostic/diagnosticApp';
+import { adminShard } from './admin/adminShard.svelte';
+import { adminApp } from './admin/adminApp';
 export { __setBackend };
 export { setLocalOwner };
 export { __setTenantId, __setDocumentBackend } from './documents/config';
@@ -35,43 +37,27 @@ export function registerShard(shard) {
 export { registerApp };
 export async function bootstrap(config) {
     const exShards = new Set(config === null || config === void 0 ? void 0 : config.excludeShards);
-    const exApps = new Set(config === null || config === void 0 ? void 0 : config.excludeApps);
-    // 1. Framework-owned shards — registered first so installed packages
-    //    cannot claim reserved IDs like __shell__ or sh3-store.
-    const frameworkShards = [shellShard, storeShard, diagnosticShard];
+    // 1. Framework-owned shards
+    const frameworkShards = [shellShard, storeShard, diagnosticShard, adminShard];
     for (const shard of frameworkShards) {
         if (!exShards.has(shard.manifest.id)) {
             registerShardInternal(shard);
         }
     }
-    // 2. Framework-shipped admin apps.
-    const frameworkApps = [storeApp, diagnosticApp];
+    // 2. Framework-shipped apps
+    const frameworkApps = [storeApp, diagnosticApp, adminApp];
     for (const app of frameworkApps) {
-        if (!exApps.has(app.manifest.id)) {
-            registerApp(app);
-        }
-    }
-    // 3. Auth — if the host already called setLocalOwner() (Tauri / dev),
-    //    skip server verification. Otherwise verify the stored admin key
-    //    against the server (3s timeout, fails open).
-    if (!isAdmin()) {
-        await initAuth();
+        registerApp(app);
     }
-    // 4. Load any packages that were hot-installed in a previous session
-    //    from IndexedDB. Runs after framework shards but before activation
-    //    so installed packages participate in the self-starting pass.
+    // 3. Load any packages installed in a previous session from IndexedDB
     await loadInstalledPackages();
-    // 5. Activate every self-starting shard (any shard whose `autostart`
-    //    field is defined). Iteration order is insertion order, which
-    //    puts __shell__ first and glob-discovered shards after — exactly
-    //    what we need.
+    // 4. Activate every self-starting shard
     for (const [id, shard] of registeredShards) {
         if (shard.autostart) {
             await activateShard(id);
         }
     }
-    // 6. Read the last-active app from the user zone. If it names a still-
-    //    registered app, launch it; otherwise leave the shell on home.
+    // 5. Read the last-active app from the user zone
     const lastId = readLastApp();
     if (lastId && registeredApps.has(lastId)) {
         await launchApp(lastId);

package/dist/shell-shard/ShellHome.svelte

@@ -2,37 +2,18 @@
   /*
    * Shell home — the view shown when no app is active. Sections:
    *   1. User apps — always visible
-   *   2. Admin apps — visible when elevated (admin mode)
-   *   3. Elevate prompt — shown when not elevated
+   *   2. Admin apps — visible when user has admin role
    */
 
   import { listRegisteredApps, launchApp, isAdmin, VERSION } from '../api';
-  import { elevate, deescalate } from '../auth/index';
+  import { logout, isAuthenticated, getUser } from '../auth/index';
 
   const apps = $derived(listRegisteredApps());
   const userApps = $derived(apps.filter(m => !m.admin));
   const adminApps = $derived(apps.filter(m => m.admin));
   const elevated = $derived(isAdmin());
-
-  let keyInput = $state('');
-  let elevateError = $state<string | null>(null);
-  let elevating = $state(false);
-
-  async function handleElevate() {
-    if (!keyInput.trim() || elevating) return;
-    elevating = true;
-    elevateError = null;
-    const ok = await elevate(keyInput.trim());
-    if (!ok) {
-      elevateError = 'Invalid API key';
-    }
-    keyInput = '';
-    elevating = false;
-  }
-
-  function handleDeescalate() {
-    deescalate();
-  }
+  const authenticated = $derived(isAuthenticated());
+  const user = $derived(getUser());
 </script>
 
 <div class="shell-home">
@@ -40,9 +21,10 @@
     <h1>SH3</h1>
     <span class="shell-home-version">v{VERSION}</span>
     <span class="shell-home-alpha">alpha</span>
-    {#if elevated}
-      <button type="button" class="shell-home-deescalate" onclick={handleDeescalate}>
-        Exit admin mode
+    {#if authenticated && user}
+      <span class="shell-home-user">{user.displayName}</span>
+      <button type="button" class="shell-home-deescalate" onclick={() => logout()}>
+        Sign out
       </button>
     {/if}
   </header>
@@ -70,54 +52,26 @@
     </section>
   {/if}
 
-  {#if elevated}
-    {#if adminApps.length > 0}
-      <section class="shell-home-section">
-        <h2 class="shell-home-section-title">Admin</h2>
-        <ul class="shell-home-list">
-          {#each adminApps as manifest (manifest.id)}
-            <li class="shell-home-entry">
-              <div class="shell-home-entry-label">{manifest.label}</div>
-              <div class="shell-home-entry-meta">
-                {manifest.id} · v{manifest.version}
-              </div>
-              <button
-                type="button"
-                class="shell-home-launch"
-                onclick={() => launchApp(manifest.id)}
-              >
-                Launch
-              </button>
-            </li>
-          {/each}
-        </ul>
-      </section>
-    {/if}
-  {:else}
+  {#if elevated && adminApps.length > 0}
     <section class="shell-home-section">
-      <h2 class="shell-home-section-title">Admin Mode</h2>
-      <p class="shell-home-elevate-hint">
-        Elevate Permissions
-      </p>
-      <form class="shell-home-elevate-form" onsubmit={(e) => { e.preventDefault(); handleElevate(); }}>
-        <input
-          class="shell-home-key-input"
-          type="password"
-          placeholder="API key"
-          bind:value={keyInput}
-          disabled={elevating}
-        />
-        <button
-          type="submit"
-          class="shell-home-elevate-btn"
-          disabled={elevating || !keyInput.trim()}
-        >
-          {elevating ? 'Verifying...' : 'Elevate'}
-        </button>
-      </form>
-      {#if elevateError}
-        <div class="shell-home-elevate-error">{elevateError}</div>
-      {/if}
+      <h2 class="shell-home-section-title">Admin</h2>
+      <ul class="shell-home-list">
+        {#each adminApps as manifest (manifest.id)}
+          <li class="shell-home-entry">
+            <div class="shell-home-entry-label">{manifest.label}</div>
+            <div class="shell-home-entry-meta">
+              {manifest.id} · v{manifest.version}
+            </div>
+            <button
+              type="button"
+              class="shell-home-launch"
+              onclick={() => launchApp(manifest.id)}
+            >
+              Launch
+            </button>
+          </li>
+        {/each}
+      </ul>
     </section>
   {/if}
 
@@ -243,48 +197,8 @@
     color: var(--shell-fg);
     border-color: var(--shell-fg-subtle);
   }
-  .shell-home-elevate-hint {
-    margin: 0 0 12px;
+  .shell-home-user {
     font-size: 13px;
-    color: var(--shell-fg-muted);
-  }
-  .shell-home-elevate-form {
-    display: flex;
-    gap: 8px;
-  }
-  .shell-home-key-input {
-    flex: 1;
-    padding: 8px 12px;
-    background: var(--shell-grad-bg-elevated, var(--shell-bg-elevated));
-    color: var(--shell-fg);
-    border: 1px solid var(--shell-border);
-    border-radius: var(--shell-radius);
-    font-family: monospace;
-    font-size: 13px;
-  }
-  .shell-home-key-input::placeholder {
-    color: var(--shell-fg-muted);
-  }
-  .shell-home-elevate-btn {
-    padding: 8px 16px;
-    background: var(--shell-accent);
-    color: var(--shell-bg);
-    border: none;
-    border-radius: var(--shell-radius);
-    font-weight: 600;
-    cursor: pointer;
-    white-space: nowrap;
-  }
-  .shell-home-elevate-btn:disabled {
-    opacity: 0.6;
-    cursor: not-allowed;
-  }
-  .shell-home-elevate-error {
-    margin-top: 8px;
-    padding: 6px 10px;
-    font-size: 12px;
-    color: var(--shell-error, #d32f2f);
-    background: color-mix(in srgb, var(--shell-error, #d32f2f) 10%, transparent);
-    border-radius: var(--shell-radius);
+    color: var(--shell-fg-subtle);
   }
 </style>

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-/** sh3-core package version. Keep in sync with package.json. */
-export declare const VERSION = "0.5.4";
+/** Auto-generated from package.json — do not edit manually. */
+export declare const VERSION = "0.5.6";

package/dist/version.js

@@ -1,2 +1,2 @@
-/** sh3-core package version. Keep in sync with package.json. */
-export const VERSION = '0.5.4';
+/** Auto-generated from package.json — do not edit manually. */
+export const VERSION = '0.5.6';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sh3-core",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "type": "module",
   "files": [
     "dist"
@@ -29,7 +29,7 @@
     }
   },
   "scripts": {
-    "build": "svelte-package -i src -o dist && node --import tsx scripts/generate-api-docs.ts",
+    "build": "node --import tsx scripts/sync-version.ts && svelte-package -i src -o dist && node --import tsx scripts/generate-api-docs.ts",
     "check": "svelte-check --tsconfig ./tsconfig.json",
     "pack": "npm run build && npm pack"
   },