typebulb 0.34.0 → 0.35.0

package/dist/agents/pi/matchu-patchu.ts

@@ -2280,7 +2280,7 @@ var Patcher = class {
 
 // cli/agents/pi/server/piPatcherExtension.ts
 var DESCRIPTION = true ? "Apply unified diffs to files \u2014 tolerant of form, strict about intent. Repairs sloppy AI-generated diffs (mangled headers, whitespace drift, missing prefixes; line numbers can be wrong or absent \u2014 hunks anchor by fuzzy-matched context lines) and applies all hunks atomically when the intent is unambiguous; fails with a precise, typed error when it isn't. Use for multi-hunk edits in one step, or when exact string-replacement editing fails on whitespace or invisible characters." : "Apply unified diffs to files.";
-var BUILD_TAG = true ? "matchu-patchu-pi 0.3.1, built 2026-07-20 10:45:53" : "matchu-patchu-pi dev";
+var BUILD_TAG = true ? "matchu-patchu-pi 0.3.1, built 2026-07-20 11:47:59" : "matchu-patchu-pi dev";
 var errorBlocks = (errors) => {
   const parts = [`Patch failed with ${errors.length} error(s):`];
   for (const e of errors) parts.push("", e.toString());

package/dist/format/config.d.ts

@@ -19,6 +19,22 @@ export declare const HOSTED_ASSETS_ORIGIN = "https://assets.typebulb.com";
 /** The hosted-assets base derived from a bulb's identity (TB-Assets-Push.md Invariant 2:
  *  derived, never stored). An identity-less bulb has no remote base — it can't push either. */
 export declare const hostedAssetsBase: (userSlug: string, slug: string) => string;
+/**
+ * Content type for a served file, from its extension. `.wasm` must be `application/wasm`
+ * for `WebAssembly.instantiateStreaming`; `.svg` must be `image/svg+xml` or an `<img>`
+ * won't render it (no sniffing for SVG). Unknown extensions are `application/octet-stream`
+ * — browsers download those, never render. Shared by the CLI's static routes (which serve
+ * real `.js`: the mirror's bundled client, `--replace` dirs) and the API worker's asset PUT
+ * — which derives the stored type from this table, never the upload header, and refuses
+ * document/script extensions before consulting it, so the `.js`/`.css` rows are unreachable
+ * on the hosted-asset path (TB-Assets-Push.md Invariant 9).
+ */
+export declare function contentTypeFor(filePath: string): string;
+/** The offending extension when a path names browser code/markup — refused as an asset
+ *  everywhere (the hosted PUT and the local `/assets/` route alike): a bulb's code and
+ *  markup live in the bulb; assets are media and data (TB-Assets-Push.md Invariant 9).
+ *  `undefined` for everything else — media, data, and unknown extensions all serve. */
+export declare function forbiddenAssetExt(relpath: string): string | undefined;
 /** Strip inline markdown (links, emphasis, code, headings) for plain-text contexts like meta descriptions. */
 export declare function stripMarkdown(text: string): string;
 /** Plain-text description from a `config.json` string: markdown stripped, single line, ≤200 chars.

package/dist/format/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../format/src/config.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAE/F,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B,EAAE,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAClC;AAED,+EAA+E;AAC/E,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAOtD;AAED,wFAAwF;AACxF,eAAO,MAAM,oBAAoB,gCAAgC,CAAA;AAEjE;+FAC+F;AAC/F,eAAO,MAAM,gBAAgB,GAAI,UAAU,MAAM,EAAE,MAAM,MAAM,WAC2B,CAAA;AAI1F,8GAA8G;AAC9G,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOlD;AAED;0EAC0E;AAC1E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMrE"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../format/src/config.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAE/F,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B,EAAE,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAClC;AAED,+EAA+E;AAC/E,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAOtD;AAED,wFAAwF;AACxF,eAAO,MAAM,oBAAoB,gCAAgC,CAAA;AAEjE;+FAC+F;AAC/F,eAAO,MAAM,gBAAgB,GAAI,UAAU,MAAM,EAAE,MAAM,MAAM,WAC2B,CAAA;AAK1F;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CA2BvD;AAID;;;uFAGuF;AACvF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGrE;AAID,8GAA8G;AAC9G,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOlD;AAED;0EAC0E;AAC1E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMrE"}

package/dist/format/config.js

@@ -15,6 +15,55 @@ export const HOSTED_ASSETS_ORIGIN = 'https://assets.typebulb.com';
 /** The hosted-assets base derived from a bulb's identity (TB-Assets-Push.md Invariant 2:
  *  derived, never stored). An identity-less bulb has no remote base — it can't push either. */
 export const hostedAssetsBase = (userSlug, slug) => `${HOSTED_ASSETS_ORIGIN}/u/${encodeURIComponent(userSlug)}/${encodeURIComponent(slug)}/`;
+/** Lowercased final extension (`sub/née.PNG` → `.png`); undefined when there is none. */
+const extOf = (p) => /\.[^./\\]+$/.exec(p)?.[0]?.toLowerCase();
+/**
+ * Content type for a served file, from its extension. `.wasm` must be `application/wasm`
+ * for `WebAssembly.instantiateStreaming`; `.svg` must be `image/svg+xml` or an `<img>`
+ * won't render it (no sniffing for SVG). Unknown extensions are `application/octet-stream`
+ * — browsers download those, never render. Shared by the CLI's static routes (which serve
+ * real `.js`: the mirror's bundled client, `--replace` dirs) and the API worker's asset PUT
+ * — which derives the stored type from this table, never the upload header, and refuses
+ * document/script extensions before consulting it, so the `.js`/`.css` rows are unreachable
+ * on the hosted-asset path (TB-Assets-Push.md Invariant 9).
+ */
+export function contentTypeFor(filePath) {
+    switch (extOf(filePath)) {
+        case '.js':
+        case '.mjs': return 'text/javascript';
+        case '.wasm': return 'application/wasm';
+        case '.json':
+        case '.map': return 'application/json';
+        case '.svg': return 'image/svg+xml';
+        case '.png': return 'image/png';
+        case '.jpg':
+        case '.jpeg': return 'image/jpeg';
+        case '.gif': return 'image/gif';
+        case '.webp': return 'image/webp';
+        case '.avif': return 'image/avif';
+        case '.ico': return 'image/x-icon';
+        case '.mp3': return 'audio/mpeg';
+        case '.wav': return 'audio/wav';
+        case '.ogg': return 'audio/ogg';
+        case '.m4a': return 'audio/mp4';
+        case '.mp4': return 'video/mp4';
+        case '.webm': return 'video/webm';
+        case '.woff2': return 'font/woff2';
+        case '.ttf': return 'font/ttf';
+        case '.css': return 'text/css';
+        case '.txt': return 'text/plain; charset=utf-8';
+        default: return 'application/octet-stream';
+    }
+}
+const FORBIDDEN_ASSET_EXTENSIONS = new Set(['.html', '.htm', '.xhtml', '.js', '.mjs', '.cjs', '.ts', '.tsx', '.css']);
+/** The offending extension when a path names browser code/markup — refused as an asset
+ *  everywhere (the hosted PUT and the local `/assets/` route alike): a bulb's code and
+ *  markup live in the bulb; assets are media and data (TB-Assets-Push.md Invariant 9).
+ *  `undefined` for everything else — media, data, and unknown extensions all serve. */
+export function forbiddenAssetExt(relpath) {
+    const ext = extOf(relpath);
+    return ext !== undefined && FORBIDDEN_ASSET_EXTENSIONS.has(ext) ? ext : undefined;
+}
 const DEFAULT_DESCRIPTION = 'A Typebulb bulb.';
 /** Strip inline markdown (links, emphasis, code, headings) for plain-text contexts like meta descriptions. */
 export function stripMarkdown(text) {

package/dist/format/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../format/src/config.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAe/F,+EAA+E;AAC/E,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAA;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,MAAM,oBAAoB,GAAG,6BAA6B,CAAA;AAEjE;+FAC+F;AAC/F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAE,EAAE,CACjE,GAAG,oBAAoB,MAAM,kBAAkB,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAA;AAE1F,MAAM,mBAAmB,GAAG,kBAAkB,CAAA;AAE9C,8GAA8G;AAC9G,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI;SACR,OAAO,CAAC,wBAAwB,EAAE,IAAI,CAAC;SACvC,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAAC;SACjC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC;SAC7B,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC;SAC3B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAA;AAChC,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,kBAAkB,CAAC,MAA0B;IAC3D,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,CAAA;IAC1D,IAAI,CAAC,IAAI;QAAE,OAAO,mBAAmB,CAAA;IACrC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IACpC,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAA;IACnF,OAAO,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;AACtC,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../format/src/config.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAe/F,+EAA+E;AAC/E,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAA;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,MAAM,oBAAoB,GAAG,6BAA6B,CAAA;AAEjE;+FAC+F;AAC/F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAE,EAAE,CACjE,GAAG,oBAAoB,MAAM,kBAAkB,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAA;AAE1F,yFAAyF;AACzF,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAA;AAEtE;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,QAAQ,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxB,KAAK,KAAK,CAAC;QACX,KAAK,MAAM,CAAC,CAAC,OAAO,iBAAiB,CAAA;QACrC,KAAK,OAAO,CAAC,CAAC,OAAO,kBAAkB,CAAA;QACvC,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC,CAAC,OAAO,kBAAkB,CAAA;QACtC,KAAK,MAAM,CAAC,CAAC,OAAO,eAAe,CAAA;QACnC,KAAK,MAAM,CAAC,CAAC,OAAO,WAAW,CAAA;QAC/B,KAAK,MAAM,CAAC;QACZ,KAAK,OAAO,CAAC,CAAC,OAAO,YAAY,CAAA;QACjC,KAAK,MAAM,CAAC,CAAC,OAAO,WAAW,CAAA;QAC/B,KAAK,OAAO,CAAC,CAAC,OAAO,YAAY,CAAA;QACjC,KAAK,OAAO,CAAC,CAAC,OAAO,YAAY,CAAA;QACjC,KAAK,MAAM,CAAC,CAAC,OAAO,cAAc,CAAA;QAClC,KAAK,MAAM,CAAC,CAAC,OAAO,YAAY,CAAA;QAChC,KAAK,MAAM,CAAC,CAAC,OAAO,WAAW,CAAA;QAC/B,KAAK,MAAM,CAAC,CAAC,OAAO,WAAW,CAAA;QAC/B,KAAK,MAAM,CAAC,CAAC,OAAO,WAAW,CAAA;QAC/B,KAAK,MAAM,CAAC,CAAC,OAAO,WAAW,CAAA;QAC/B,KAAK,OAAO,CAAC,CAAC,OAAO,YAAY,CAAA;QACjC,KAAK,QAAQ,CAAC,CAAC,OAAO,YAAY,CAAA;QAClC,KAAK,MAAM,CAAC,CAAC,OAAO,UAAU,CAAA;QAC9B,KAAK,MAAM,CAAC,CAAC,OAAO,UAAU,CAAA;QAC9B,KAAK,MAAM,CAAC,CAAC,OAAO,2BAA2B,CAAA;QAC/C,OAAO,CAAC,CAAC,OAAO,0BAA0B,CAAA;IAC5C,CAAC;AACH,CAAC;AAED,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAErH;;;uFAGuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAA;IAC1B,OAAO,GAAG,KAAK,SAAS,IAAI,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AACnF,CAAC;AAED,MAAM,mBAAmB,GAAG,kBAAkB,CAAA;AAE9C,8GAA8G;AAC9G,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI;SACR,OAAO,CAAC,wBAAwB,EAAE,IAAI,CAAC;SACvC,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAAC;SACjC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC;SAC7B,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC;SAC3B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAA;AAChC,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,kBAAkB,CAAC,MAA0B;IAC3D,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,CAAA;IAC1D,IAAI,CAAC,IAAI;QAAE,OAAO,mBAAmB,CAAA;IACrC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IACpC,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAA;IACnF,OAAO,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;AACtC,CAAC"}