threadroom-pi 0.1.0-beta.0

package/node_modules/threadroom-service/dist/src/main.js

@@ -0,0 +1,33 @@
+import { resolve } from 'node:path';
+import { createHash } from 'node:crypto';
+import { ThreadStore } from './store.js';
+import { createThreadroomServer } from './server.js';
+import { createWebsiteHandler } from './site.js';
+
+const port = Number(process.env.PORT || 4310);
+const host = process.env.HOST || '127.0.0.1';
+const database = resolve(process.env.THREADROOM_DB || 'data/threadroom.sqlite');
+const store = new ThreadStore(database);
+if (process.env.THREADROOM_SEED_DEMO !== '0') store.seedDemo();
+
+const allowedOrigins = (process.env.THREADROOM_UI_ORIGINS || 'http://127.0.0.1:4311,http://localhost:4311').split(',').map((origin) => origin.trim()).filter(Boolean);
+const websiteHandler = process.env.THREADROOM_SERVE_UI === '0' ? null : createWebsiteHandler();
+const server = createThreadroomServer(store, {
+  allowedOrigins, websiteHandler,
+  runtimeIdentity: { storageId: createHash('sha256').update(database).digest('hex').slice(0, 24) }
+});
+server.listen(port, host, () => {
+  console.log(`Threadroom ${process.env.THREADROOM_SERVE_UI === '0' ? 'API' : 'API + optional website'} is ready at http://${host}:${server.address().port}`);
+  console.log(`Durable records: ${database}`);
+});
+
+function shutdown() {
+  server.close(() => {
+    store.close();
+    process.exit(0);
+  });
+  // Live subscribers/waiters do not own service lifetime or the durable question.
+  server.closeAllConnections();
+}
+process.on('SIGINT', shutdown);
+process.on('SIGTERM', shutdown);

package/node_modules/threadroom-service/dist/src/presentations.js

@@ -0,0 +1,116 @@
+// Authored documents are deliberately separate from the host UI and response controls.
+// Serve this policy as an HTTP header: sandbox/frame-ancestors do not work in a meta tag.
+// CSP is not CPU isolation. Own-frame navigation is constrained by the embedding UI's frame-src.
+export const PRESENTATION_CSP = [
+  "default-src 'none'",
+  "script-src 'unsafe-inline'",
+  "style-src 'unsafe-inline'",
+  'img-src data:',
+  'font-src data:',
+  'media-src data:',
+  "connect-src 'none'",
+  "frame-src 'none'",
+  "worker-src 'none'",
+  "object-src 'none'",
+  "base-uri 'none'",
+  "form-action 'none'", 
+  "frame-ancestors 'self' http://127.0.0.1:* http://localhost:*",
+  'sandbox allow-scripts'
+].join('; ');
+
+// No host identity or response API is available to this bridge. A proposal is a
+// draft; only the host's controls can decide whether to persist an answer.
+const bridge = `<script>
+(() => {
+  const send = window.parent.postMessage.bind(window.parent);
+  const stringify = JSON.stringify;
+  const parse = JSON.parse;
+  const encoder = new TextEncoder();
+  const encode = Function.call.bind(TextEncoder.prototype.encode);
+  const arrayIsArray = Array.isArray;
+  const Seen = WeakSet;
+  const weakSetHas = Function.call.bind(Seen.prototype.has);
+  const weakSetAdd = Function.call.bind(Seen.prototype.add);
+  const weakSetDelete = Function.call.bind(Seen.prototype.delete);
+  const objectKeys = Object.keys;
+  const objectPrototype = Object.prototype;
+  const getPrototypeOf = Object.getPrototypeOf;
+  const getOwnPropertyDescriptors = Object.getOwnPropertyDescriptors;
+  const ownKeys = Reflect.ownKeys;
+  const createObject = Object.create;
+  const defineProperty = Object.defineProperty;
+  const isFiniteNumber = Number.isFinite;
+  const hasOwn = Function.call.bind(objectPrototype.hasOwnProperty);
+  const validateJson = (value, seen = new Seen()) => {
+    if (value === null || typeof value === 'string' || typeof value === 'boolean') return value;
+    if (typeof value === 'number') {
+      if (!isFiniteNumber(value)) throw new TypeError('Proposal values must contain only finite JSON numbers');
+      return value;
+    }
+    if (typeof value !== 'object') throw new TypeError('Proposal values must be JSON-compatible');
+    if (weakSetHas(seen, value)) throw new TypeError('Proposal values must not contain cycles');
+    const array = arrayIsArray(value);
+    const prototype = getPrototypeOf(value);
+    if (!array && prototype !== objectPrototype && prototype !== null) {
+      throw new TypeError('Proposal values must contain only JSON objects and arrays');
+    }
+    const descriptors = getOwnPropertyDescriptors(value);
+    for (const key of ownKeys(descriptors)) {
+      const descriptor = descriptors[key];
+      if (descriptor.get || descriptor.set) throw new TypeError('Proposal values must not define accessors');
+    }
+    if (typeof descriptors.toJSON?.value === 'function') {
+      throw new TypeError('Proposal values must not define custom toJSON behavior');
+    }
+    weakSetAdd(seen, value);
+    let copy;
+    if (array) {
+      copy = [];
+      // Never allow an authored Array.prototype.toJSON to transform the copy.
+      defineProperty(copy, 'toJSON', { value: undefined });
+      for (let index = 0; index < descriptors.length.value; index += 1) {
+        if (!hasOwn(descriptors, index)) throw new TypeError('Proposal arrays must not be sparse');
+        defineProperty(copy, index, { value: validateJson(descriptors[index].value, seen), enumerable: true, writable: true, configurable: true });
+      }
+    } else {
+      copy = createObject(null);
+      for (const key of objectKeys(descriptors)) {
+        if (!descriptors[key].enumerable) continue;
+        defineProperty(copy, key, { value: validateJson(descriptors[key].value, seen), enumerable: true, writable: true, configurable: true });
+      }
+    }
+    weakSetDelete(seen, value);
+    return copy;
+  };
+  const propose = (values, summary) => {
+    if (summary !== undefined && (typeof summary !== 'string' || summary.length > 4096)) {
+      throw new TypeError('Proposal summary must be a string of at most 4096 characters');
+    }
+    const valuesSnapshot = validateJson(values);
+    const message = createObject(null);
+    message.type = 'threadroom:proposal';
+    message.values = valuesSnapshot;
+    if (summary !== undefined) message.summary = summary;
+    const json = stringify(message);
+    if (encode(encoder, json).length > 65536) throw new RangeError('Proposal exceeds 64 KiB');
+    const copy = parse(json);
+    if (!hasOwn(copy, 'values')) throw new TypeError('Proposal needs JSON values');
+    send(copy, '*');
+  };
+  Object.defineProperty(window, 'Threadroom', {
+    value: Object.freeze({propose}), writable: false, configurable: false
+  });
+})();
+</script>`;
+
+export function renderPresentationDocument(presentation) {
+  if (presentation?.kind !== 'html-v1' || typeof presentation.html !== 'string') {
+    throw new TypeError('Expected an html-v1 presentation with an HTML document');
+  }
+  const html = presentation.html;
+  // Start the bridge before any authored scripts, preserving the document's
+  // doctype (and therefore standards mode). The parser merges the authored head.
+  const doctype = html.match(/^\s*<!doctype\s+html\b[^>]*>/i);
+  if (doctype) return `${doctype[0]}\n${bridge}\n${html.slice(doctype[0].length)}`;
+  return `<!doctype html>\n${bridge}\n${html}`;
+}

package/node_modules/threadroom-service/dist/src/server.js

@@ -0,0 +1,143 @@
+import { createServer } from 'node:http';
+import { streamEvents, waitForResponse } from './live.js';
+import { renderPresentationDocument, PRESENTATION_CSP } from './presentations.js';
+
+// The service has no website dependency. A static website handler can be injected for convenience.
+export function createThreadroomServer(store, { websiteHandler = null, allowedOrigins = [], runtimeIdentity = {} } = {}) {
+  const origins = new Set(allowedOrigins);
+  return createServer(async (request, response) => {
+    try {
+      const url = new URL(request.url, 'http://threadroom.local');
+      const hostname = new URL(`http://${request.headers.host || 'unknown'}`).hostname;
+      if (!['localhost', '127.0.0.1', '[::1]'].includes(hostname)) return json(response, 403, { error: 'This local spike accepts loopback hostnames only' });
+      response.setHeader('X-Content-Type-Options', 'nosniff');
+      response.setHeader('Referrer-Policy', 'no-referrer');
+      const origin = request.headers.origin;
+      const sameOrigin = origin === `http://${request.headers.host}`;
+      const allowed = !origin || sameOrigin || origins.has(origin);
+      if (origin && origins.has(origin)) {
+        response.setHeader('Access-Control-Allow-Origin', origin);
+        response.setHeader('Vary', 'Origin');
+      }
+      if (request.method === 'OPTIONS') {
+        if (!allowed) return json(response, 403, { error: 'Browser origin is not allowed' });
+        response.writeHead(204, {
+          'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+          'Access-Control-Allow-Headers': 'Content-Type, Idempotency-Key',
+          'Access-Control-Max-Age': '60'
+        });
+        return response.end();
+      }
+      if (request.method === 'POST' && (!allowed || (request.headers['sec-fetch-site'] === 'cross-site' && !origins.has(origin)))) {
+        return json(response, 403, { error: 'Cross-origin browser writes are not permitted' });
+      }
+
+      if (url.pathname === '/api/health' && request.method === 'GET') return json(response, 200, {
+        ok: true, service: 'threadroom', apiVersion: 2, website: !!websiteHandler, ...runtimeIdentity
+      });
+      if (url.pathname === '/api/tree' && request.method === 'GET') {
+        const nodes = store.listNodes().map(({ presentation, response: savedResponse, body: savedBody, ...summary }) => ({
+          ...summary, responseKind: savedResponse?.kind || null, hasPresentation: !!presentation
+        }));
+        return json(response, 200, { nodes });
+      }
+      if ((url.pathname === '/api/nodes' || url.pathname === '/api/ask') && request.method === 'POST') {
+        const input = await body(request);
+        // A blocking ask is still publication first, but malformed transport
+        // options must not turn a rejected request into a durable question.
+        const wait = url.pathname === '/api/ask' ? waitOptions(input) : null;
+        const published = store.createNode(input, request.headers['idempotency-key']);
+        if (wait) {
+          waitForResponse(request, response, store, published.node.id, { published, timeoutMs: wait.timeoutMs });
+          return;
+        }
+        return json(response, published.deduplicated ? 200 : 201, published);
+      }
+      const nodeMatch = url.pathname.match(/^\/api\/nodes\/([^/]+)$/);
+      if (nodeMatch && request.method === 'GET') return json(response, 200, store.getNode(decodeURIComponent(nodeMatch[1])));
+      const respondMatch = url.pathname.match(/^\/api\/nodes\/([^/]+)\/respond$/);
+      if (respondMatch && request.method === 'POST') {
+        const result = store.respond(decodeURIComponent(respondMatch[1]), await body(request), request.headers['idempotency-key']);
+        return json(response, result.deduplicated ? 200 : 201, result);
+      }
+      const presentationMatch = url.pathname.match(/^\/api\/nodes\/([^/]+)\/presentation$/);
+      if (presentationMatch && request.method === 'GET') {
+        const { node } = store.getNode(decodeURIComponent(presentationMatch[1]));
+        if (node.presentation?.kind !== 'html-v1') return json(response, 404, { error: 'No authored HTML presentation on this thread' });
+        response.writeHead(200, {
+          'Content-Type': 'text/html; charset=utf-8',
+          'Content-Security-Policy': PRESENTATION_CSP,
+          'Permissions-Policy': 'camera=(), microphone=(), geolocation=(), payment=(), usb=()',
+          'Cache-Control': 'no-store'
+        });
+        response.end(renderPresentationDocument(node.presentation));
+        return;
+      }
+      if (url.pathname === '/api/stream' && request.method === 'GET') {
+        streamEvents(request, response, store, { after: Number(url.searchParams.get('after') || 0) });
+        return;
+      }
+      if (url.pathname === '/api/events' && request.method === 'GET') return json(response, 200, {
+        events: store.listEvents(Number(url.searchParams.get('after') || 0), url.searchParams.get('threadId'))
+      });
+
+      // First-spike compatibility endpoints. All adapters use the same recursive records.
+      if (url.pathname === '/api/threads' && request.method === 'GET') return json(response, 200, { threads: store.listThreads(url.searchParams.get('view') || 'history') });
+      if (url.pathname === '/api/threads' && request.method === 'POST') return json(response, 201, { thread: store.createThread(await body(request)) });
+      const threadMatch = url.pathname.match(/^\/api\/threads\/([^/]+)$/);
+      if (threadMatch && request.method === 'GET') return json(response, 200, { thread: store.getThread(decodeURIComponent(threadMatch[1])) });
+      const questionMatch = url.pathname.match(/^\/api\/threads\/([^/]+)\/questions$/);
+      if (questionMatch && request.method === 'POST') return json(response, 201, { thread: store.addQuestion(decodeURIComponent(questionMatch[1]), await body(request)) });
+      const responseMatch = url.pathname.match(/^\/api\/questions\/([^/]+)\/responses$/);
+      if (responseMatch && request.method === 'POST') {
+        const result = store.addResponse(decodeURIComponent(responseMatch[1]), await body(request), request.headers['idempotency-key']);
+        return json(response, result.deduplicated ? 200 : 201, result);
+      }
+      if (url.pathname.startsWith('/api/')) return json(response, 404, { error: 'API route not found' });
+      if (websiteHandler) return await websiteHandler(request, response);
+      return json(response, 404, { error: 'API-only service; this host does not serve a website' });
+    } catch (error) {
+      const status = error.statusCode || (error.name === 'SyntaxError' ? 400 : 500);
+      if (status === 500) console.error(error);
+      return json(response, status, { error: status === 500 ? 'Internal server error' : error.message });
+    }
+  });
+}
+
+async function body(request) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of request) {
+    size += chunk.length;
+    if (size > 5_000_000) {
+      const error = new Error('Request body is too large'); error.statusCode = 413; throw error;
+    }
+    chunks.push(chunk);
+  }
+  const value = chunks.length ? JSON.parse(Buffer.concat(chunks).toString('utf8')) : {};
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw clientError('Request body must be a JSON object');
+  return value;
+}
+
+function waitOptions(input) {
+  if (!Object.hasOwn(input, 'wait') || input.wait === undefined) return null;
+  const wait = input.wait;
+  if (!wait || typeof wait !== 'object' || Array.isArray(wait)) throw clientError('wait must be an object');
+  const timeoutMs = wait.timeoutMs ?? 60_000;
+  if (typeof timeoutMs !== 'number' || !Number.isFinite(timeoutMs) || timeoutMs < 0) {
+    throw clientError('timeoutMs must be a non-negative number');
+  }
+  return { timeoutMs: Math.min(timeoutMs, 120_000) };
+}
+
+function clientError(message) {
+  const error = new Error(message);
+  error.statusCode = 400;
+  return error;
+}
+
+function json(response, status, value) {
+  if (response.headersSent || response.destroyed) return;
+  response.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store' });
+  response.end(JSON.stringify(value));
+}

package/node_modules/threadroom-service/dist/src/site.js

@@ -0,0 +1,53 @@
+import { readFile, stat } from 'node:fs/promises';
+import { extname, isAbsolute, relative, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const publicDir = fileURLToPath(new URL('../public/', import.meta.url));
+const types = { '.html': 'text/html; charset=utf-8', '.js': 'text/javascript; charset=utf-8', '.css': 'text/css; charset=utf-8', '.svg': 'image/svg+xml' };
+
+// Website hosting is optional plumbing. This module knows nothing about persistence or thread semantics.
+export function createWebsiteHandler({ apiBaseUrl = '' } = {}) {
+  return async function website(request, response) {
+    const url = new URL(request.url, 'http://threadroom.local');
+    if (url.pathname === '/threadroom-config.json') {
+      response.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+      response.end(JSON.stringify({ apiBaseUrl }));
+      return;
+    }
+    if (request.method !== 'GET' && request.method !== 'HEAD') {
+      response.writeHead(405); response.end('Method not allowed'); return;
+    }
+    // Thread IDs are one encoded URL segment, never filenames. Route them
+    // before decoding so traversal-looking or extension-like IDs cannot expose
+    // static assets or escape the public directory.
+    const threadRoute = /^\/threads\/[^/]+$/.test(url.pathname);
+    let filename;
+    if (threadRoute) {
+      filename = resolve(publicDir, 'index.html');
+    } else {
+      const requestedPath = url.pathname === '/' ? '/index.html' : url.pathname;
+      let decodedPath;
+      try { decodedPath = decodeURIComponent(requestedPath); }
+      catch { decodedPath = requestedPath; }
+      filename = resolve(publicDir, `.${decodedPath}`);
+      const fromPublic = relative(publicDir, filename);
+      if (fromPublic === '..' || fromPublic.startsWith(`..${sep}`) || isAbsolute(fromPublic)) {
+        response.writeHead(403); response.end('Forbidden'); return;
+      }
+      try {
+        if (!(await stat(filename)).isFile()) throw new Error('not a file');
+      } catch {
+        if (extname(url.pathname)) { response.writeHead(404); response.end('Not found'); return; }
+        filename = resolve(publicDir, 'index.html');
+      }
+    }
+    const bytes = await readFile(filename);
+    const apiOrigin = apiBaseUrl ? new URL(apiBaseUrl).origin : `http://${request.headers.host}`;
+    response.writeHead(200, {
+      'Content-Type': types[extname(filename)] || 'application/octet-stream',
+      'Cache-Control': 'no-cache',
+      'Content-Security-Policy': `default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self' ${apiOrigin}; frame-src ${apiOrigin}/api/nodes/; frame-ancestors 'none'; object-src 'none'; base-uri 'none'; form-action 'self'`
+    });
+    response.end(request.method === 'HEAD' ? undefined : bytes);
+  };
+}