unspaghettit 0.2.0 → 0.3.0

package/build/server/chunks/featureStore.svelte-DIYgPBVm.js

@@ -0,0 +1,161 @@
+import { q as derived } from './index-server-7H0jzj0M.js';
+import { h as getBrowserContainer, F as FeatureValidationError } from './browserContainer-CNX7ANld.js';
+import { e as emit } from './eventBus-B9k-Vzso.js';
+import { d as deepClonePlain, g as getRoomClient, r as reconcileInPlace } from './reconcile-B5xqb6-s.js';
+
+//#region src/features/behavior-model/presentation/stores/featureStore.svelte.ts
+var FeatureStore = class {
+	loading = true;
+	feature = null;
+	error = null;
+	saveError = null;
+	saving = false;
+	historyEntries = [];
+	historyCursor = -1;
+	#canUndo = derived(() => this.historyCursor > 0);
+	get canUndo() {
+		return this.#canUndo();
+	}
+	set canUndo($$value) {
+		return this.#canUndo($$value);
+	}
+	#canRedo = derived(() => this.historyCursor >= 0 && this.historyCursor < this.historyEntries.length - 1);
+	get canRedo() {
+		return this.#canRedo();
+	}
+	set canRedo($$value) {
+		return this.#canRedo($$value);
+	}
+	currentId = null;
+	client = null;
+	clientUnsubscribe = null;
+	historyUnsubscribe = null;
+	async load(id) {
+		try {
+			this.loading = true;
+			this.error = null;
+			this.currentId = id;
+			const fresh = await (await getBrowserContainer()).useCases.getFeature(id);
+			this.feature = fresh;
+			this.subscribeRoom(id);
+		} catch (e) {
+			this.error = e.message;
+		} finally {
+			this.loading = false;
+		}
+	}
+	async mutate(mutator) {
+		if (!this.feature || !this.currentId) return;
+		const currentSnapshot = this.feature;
+		const next = mutator(currentSnapshot);
+		const cleanNext = next === currentSnapshot ? currentSnapshot : deepClonePlain(next);
+		this.applyNext(cleanNext);
+		if (!this.client) return;
+		this.saving = true;
+		this.saveError = null;
+		try {
+			this.client.setSnapshot(cleanNext);
+			emit("feature.saved", {
+				id: String(cleanNext.id),
+				name: cleanNext.name
+			});
+		} catch (e) {
+			if (e instanceof FeatureValidationError && e.errors.length > 0) this.saveError = `${e.message}\n• ${e.errors.join("\n• ")}`;
+			else this.saveError = e.message;
+		} finally {
+			this.saving = false;
+		}
+	}
+	dismissSaveError() {
+		this.saveError = null;
+	}
+	reset() {
+		if (this.clientUnsubscribe) {
+			this.clientUnsubscribe();
+			this.clientUnsubscribe = null;
+		}
+		if (this.historyUnsubscribe) {
+			this.historyUnsubscribe();
+			this.historyUnsubscribe = null;
+		}
+		this.client = null;
+		this.currentId = null;
+		this.feature = null;
+		this.error = null;
+		this.saveError = null;
+		this.loading = true;
+		this.saving = false;
+		this.historyEntries = [];
+		this.historyCursor = -1;
+	}
+	/**
+	* Step the shared history cursor backward by one. The server applies the
+	* previous snapshot to the Y.Doc and broadcasts a fresh history_snapshot;
+	* the room observer below picks up the resulting remote map write and
+	* reconciles the live feature into the new state. No local replay, no
+	* new history entry.
+	*/
+	undo() {
+		this.client?.undo();
+	}
+	redo() {
+		this.client?.redo();
+	}
+	/** Time-travel directly to a specific history entry. */
+	jumpToHistory(entryId) {
+		this.client?.jumpTo(entryId);
+	}
+	/**
+	* Wipe the feature's shared history. The server replies with a fresh
+	* snapshot containing a single "Cleared history" anchor — every peer
+	* sees the same wipe via the room's broadcast. The current state of
+	* the feature itself is untouched.
+	*/
+	clearHistory() {
+		this.client?.clearHistory();
+	}
+	subscribeRoom(id) {
+		if (this.clientUnsubscribe) {
+			this.clientUnsubscribe();
+			this.clientUnsubscribe = null;
+		}
+		if (this.historyUnsubscribe) {
+			this.historyUnsubscribe();
+			this.historyUnsubscribe = null;
+		}
+		const client = getRoomClient("feature", id);
+		this.client = client;
+		this.clientUnsubscribe = client.observe((next, origin) => {
+			if (origin === "local") return;
+			if (!next) return;
+			if (this.currentId !== id) return;
+			this.applyNext(next);
+		});
+		this.historyEntries = client.history.entries;
+		this.historyCursor = client.history.cursor;
+		this.historyUnsubscribe = client.observeHistory((view) => {
+			if (this.currentId !== id) return;
+			this.historyEntries = view.entries;
+			this.historyCursor = view.cursor;
+		});
+	}
+	/**
+	* Bring the live $state proxy in step with `next` while preserving the
+	* identity of every unchanged sub-tree. Critical for reorders: a naive
+	* field-by-field replace (what fast-json-patch generates) creates a
+	* transient duplicate-id state that Svelte's keyed `{#each}` rejects with
+	* `each_key_duplicate`. The reconciler moves items via array splice so the
+	* each block sees a clean rearrangement.
+	*/
+	applyNext(next) {
+		if (!this.feature) {
+			this.feature = next;
+			return;
+		}
+		reconcileInPlace(this.feature, next);
+	}
+};
+var featureStore = new FeatureStore();
+
+export { featureStore as f };
+//# sourceMappingURL=featureStore.svelte-DIYgPBVm.js.map

package/build/server/chunks/featureStore.svelte-DIYgPBVm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"featureStore.svelte-DIYgPBVm.js","sources":["../../../.svelte-kit/adapter-node/chunks/featureStore.svelte.js"],"sourcesContent":["import { l as derived } from \"./index-server.js\";\nimport { t as getBrowserContainer, u as FeatureValidationError } from \"./browserContainer.js\";\nimport { t as emit } from \"./eventBus.js\";\nimport { n as reconcileInPlace, r as getRoomClient, t as deepClonePlain } from \"./reconcile.js\";\n//#region src/features/behavior-model/presentation/stores/featureStore.svelte.ts\nvar FeatureStore = class {\n\tloading = true;\n\tfeature = null;\n\terror = null;\n\tsaveError = null;\n\tsaving = false;\n\thistoryEntries = [];\n\thistoryCursor = -1;\n\t#canUndo = derived(() => this.historyCursor > 0);\n\tget canUndo() {\n\t\treturn this.#canUndo();\n\t}\n\tset canUndo($$value) {\n\t\treturn this.#canUndo($$value);\n\t}\n\t#canRedo = derived(() => this.historyCursor >= 0 && this.historyCursor < this.historyEntries.length - 1);\n\tget canRedo() {\n\t\treturn this.#canRedo();\n\t}\n\tset canRedo($$value) {\n\t\treturn this.#canRedo($$value);\n\t}\n\tcurrentId = null;\n\tclient = null;\n\tclientUnsubscribe = null;\n\thistoryUnsubscribe = null;\n\tasync load(id) {\n\t\ttry {\n\t\t\tthis.loading = true;\n\t\t\tthis.error = null;\n\t\t\tthis.currentId = id;\n\t\t\tconst fresh = await (await getBrowserContainer()).useCases.getFeature(id);\n\t\t\tthis.feature = fresh;\n\t\t\tthis.subscribeRoom(id);\n\t\t} catch (e) {\n\t\t\tthis.error = e.message;\n\t\t} finally {\n\t\t\tthis.loading = false;\n\t\t}\n\t}\n\tasync mutate(mutator) {\n\t\tif (!this.feature || !this.currentId) return;\n\t\tconst currentSnapshot = this.feature;\n\t\tconst next = mutator(currentSnapshot);\n\t\tconst cleanNext = next === currentSnapshot ? currentSnapshot : deepClonePlain(next);\n\t\tthis.applyNext(cleanNext);\n\t\tif (!this.client) return;\n\t\tthis.saving = true;\n\t\tthis.saveError = null;\n\t\ttry {\n\t\t\tthis.client.setSnapshot(cleanNext);\n\t\t\temit(\"feature.saved\", {\n\t\t\t\tid: String(cleanNext.id),\n\t\t\t\tname: cleanNext.name\n\t\t\t});\n\t\t} catch (e) {\n\t\t\tif (e instanceof FeatureValidationError && e.errors.length > 0) this.saveError = `${e.message}\\n• ${e.errors.join(\"\\n• \")}`;\n\t\t\telse this.saveError = e.message;\n\t\t} finally {\n\t\t\tthis.saving = false;\n\t\t}\n\t}\n\tdismissSaveError() {\n\t\tthis.saveError = null;\n\t}\n\treset() {\n\t\tif (this.clientUnsubscribe) {\n\t\t\tthis.clientUnsubscribe();\n\t\t\tthis.clientUnsubscribe = null;\n\t\t}\n\t\tif (this.historyUnsubscribe) {\n\t\t\tthis.historyUnsubscribe();\n\t\t\tthis.historyUnsubscribe = null;\n\t\t}\n\t\tthis.client = null;\n\t\tthis.currentId = null;\n\t\tthis.feature = null;\n\t\tthis.error = null;\n\t\tthis.saveError = null;\n\t\tthis.loading = true;\n\t\tthis.saving = false;\n\t\tthis.historyEntries = [];\n\t\tthis.historyCursor = -1;\n\t}\n\t/**\n\t* Step the shared history cursor backward by one. The server applies the\n\t* previous snapshot to the Y.Doc and broadcasts a fresh history_snapshot;\n\t* the room observer below picks up the resulting remote map write and\n\t* reconciles the live feature into the new state. No local replay, no\n\t* new history entry.\n\t*/\n\tundo() {\n\t\tthis.client?.undo();\n\t}\n\tredo() {\n\t\tthis.client?.redo();\n\t}\n\t/** Time-travel directly to a specific history entry. */\n\tjumpToHistory(entryId) {\n\t\tthis.client?.jumpTo(entryId);\n\t}\n\t/**\n\t* Wipe the feature's shared history. The server replies with a fresh\n\t* snapshot containing a single \"Cleared history\" anchor — every peer\n\t* sees the same wipe via the room's broadcast. The current state of\n\t* the feature itself is untouched.\n\t*/\n\tclearHistory() {\n\t\tthis.client?.clearHistory();\n\t}\n\tsubscribeRoom(id) {\n\t\tif (this.clientUnsubscribe) {\n\t\t\tthis.clientUnsubscribe();\n\t\t\tthis.clientUnsubscribe = null;\n\t\t}\n\t\tif (this.historyUnsubscribe) {\n\t\t\tthis.historyUnsubscribe();\n\t\t\tthis.historyUnsubscribe = null;\n\t\t}\n\t\tconst client = getRoomClient(\"feature\", id);\n\t\tthis.client = client;\n\t\tthis.clientUnsubscribe = client.observe((next, origin) => {\n\t\t\tif (origin === \"local\") return;\n\t\t\tif (!next) return;\n\t\t\tif (this.currentId !== id) return;\n\t\t\tthis.applyNext(next);\n\t\t});\n\t\tthis.historyEntries = client.history.entries;\n\t\tthis.historyCursor = client.history.cursor;\n\t\tthis.historyUnsubscribe = client.observeHistory((view) => {\n\t\t\tif (this.currentId !== id) return;\n\t\t\tthis.historyEntries = view.entries;\n\t\t\tthis.historyCursor = view.cursor;\n\t\t});\n\t}\n\t/**\n\t* Bring the live $state proxy in step with `next` while preserving the\n\t* identity of every unchanged sub-tree. Critical for reorders: a naive\n\t* field-by-field replace (what fast-json-patch generates) creates a\n\t* transient duplicate-id state that Svelte's keyed `{#each}` rejects with\n\t* `each_key_duplicate`. The reconciler moves items via array splice so the\n\t* each block sees a clean rearrangement.\n\t*/\n\tapplyNext(next) {\n\t\tif (!this.feature) {\n\t\t\tthis.feature = next;\n\t\t\treturn;\n\t\t}\n\t\treconcileInPlace(this.feature, next);\n\t}\n};\nvar featureStore = new FeatureStore();\n//#endregion\nexport { featureStore as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA,IAAI,YAAY,GAAG,MAAM;AACzB,CAAC,OAAO,GAAG,IAAI;AACf,CAAC,OAAO,GAAG,IAAI;AACf,CAAC,KAAK,GAAG,IAAI;AACb,CAAC,SAAS,GAAG,IAAI;AACjB,CAAC,MAAM,GAAG,KAAK;AACf,CAAC,cAAc,GAAG,EAAE;AACpB,CAAC,aAAa,GAAG,EAAE;AACnB,CAAC,QAAQ,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;AACjD,CAAC,IAAI,OAAO,GAAG;AACf,EAAE,OAAO,IAAI,CAAC,QAAQ,EAAE;AACxB,CAAC;AACD,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE;AACtB,EAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;AAC/B,CAAC;AACD,CAAC,QAAQ,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;AACzG,CAAC,IAAI,OAAO,GAAG;AACf,EAAE,OAAO,IAAI,CAAC,QAAQ,EAAE;AACxB,CAAC;AACD,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE;AACtB,EAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;AAC/B,CAAC;AACD,CAAC,SAAS,GAAG,IAAI;AACjB,CAAC,MAAM,GAAG,IAAI;AACd,CAAC,iBAAiB,GAAG,IAAI;AACzB,CAAC,kBAAkB,GAAG,IAAI;AAC1B,CAAC,MAAM,IAAI,CAAC,EAAE,EAAE;AAChB,EAAE,IAAI;AACN,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI;AACtB,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI;AACpB,GAAG,IAAI,CAAC,SAAS,GAAG,EAAE;AACtB,GAAG,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,mBAAmB,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;AAC5E,GAAG,IAAI,CAAC,OAAO,GAAG,KAAK;AACvB,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;AACzB,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE;AACd,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,OAAO;AACzB,EAAE,CAAC,SAAS;AACZ,GAAG,IAAI,CAAC,OAAO,GAAG,KAAK;AACvB,EAAE;AACF,CAAC;AACD,CAAC,MAAM,MAAM,CAAC,OAAO,EAAE;AACvB,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;AACxC,EAAE,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO;AACtC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,eAAe,CAAC;AACvC,EAAE,MAAM,SAAS,GAAG,IAAI,KAAK,eAAe,GAAG,eAAe,GAAG,cAAc,CAAC,IAAI,CAAC;AACrF,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;AAC3B,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;AACpB,EAAE,IAAI,CAAC,MAAM,GAAG,IAAI;AACpB,EAAE,IAAI,CAAC,SAAS,GAAG,IAAI;AACvB,EAAE,IAAI;AACN,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC;AACrC,GAAG,IAAI,CAAC,eAAe,EAAE;AACzB,IAAI,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;AAC5B,IAAI,IAAI,EAAE,SAAS,CAAC;AACpB,IAAI,CAAC;AACL,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE;AACd,GAAG,IAAI,CAAC,YAAY,sBAAsB,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9H,QAAQ,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,OAAO;AAClC,EAAE,CAAC,SAAS;AACZ,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK;AACtB,EAAE;AACF,CAAC;AACD,CAAC,gBAAgB,GAAG;AACpB,EAAE,IAAI,CAAC,SAAS,GAAG,IAAI;AACvB,CAAC;AACD,CAAC,KAAK,GAAG;AACT,EAAE,IAAI,IAAI,CAAC,iBAAiB,EAAE;AAC9B,GAAG,IAAI,CAAC,iBAAiB,EAAE;AAC3B,GAAG,IAAI,CAAC,iBAAiB,GAAG,IAAI;AAChC,EAAE;AACF,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE;AAC/B,GAAG,IAAI,CAAC,kBAAkB,EAAE;AAC5B,GAAG,IAAI,CAAC,kBAAkB,GAAG,IAAI;AACjC,EAAE;AACF,EAAE,IAAI,CAAC,MAAM,GAAG,IAAI;AACpB,EAAE,IAAI,CAAC,SAAS,GAAG,IAAI;AACvB,EAAE,IAAI,CAAC,OAAO,GAAG,IAAI;AACrB,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI;AACnB,EAAE,IAAI,CAAC,SAAS,GAAG,IAAI;AACvB,EAAE,IAAI,CAAC,OAAO,GAAG,IAAI;AACrB,EAAE,IAAI,CAAC,MAAM,GAAG,KAAK;AACrB,EAAE,IAAI,CAAC,cAAc,GAAG,EAAE;AAC1B,EAAE,IAAI,CAAC,aAAa,GAAG,EAAE;AACzB,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,IAAI,GAAG;AACR,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE;AACrB,CAAC;AACD,CAAC,IAAI,GAAG;AACR,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE;AACrB,CAAC;AACD;AACA,CAAC,aAAa,CAAC,OAAO,EAAE;AACxB,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC;AAC9B,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,YAAY,GAAG;AAChB,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE;AAC7B,CAAC;AACD,CAAC,aAAa,CAAC,EAAE,EAAE;AACnB,EAAE,IAAI,IAAI,CAAC,iBAAiB,EAAE;AAC9B,GAAG,IAAI,CAAC,iBAAiB,EAAE;AAC3B,GAAG,IAAI,CAAC,iBAAiB,GAAG,IAAI;AAChC,EAAE;AACF,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE;AAC/B,GAAG,IAAI,CAAC,kBAAkB,EAAE;AAC5B,GAAG,IAAI,CAAC,kBAAkB,GAAG,IAAI;AACjC,EAAE;AACF,EAAE,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC;AAC7C,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM;AACtB,EAAE,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK;AAC5D,GAAG,IAAI,MAAM,KAAK,OAAO,EAAE;AAC3B,GAAG,IAAI,CAAC,IAAI,EAAE;AACd,GAAG,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE,EAAE;AAC9B,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;AACvB,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO;AAC9C,EAAE,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM;AAC5C,EAAE,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,KAAK;AAC5D,GAAG,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE,EAAE;AAC9B,GAAG,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,OAAO;AACrC,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM;AACnC,EAAE,CAAC,CAAC;AACJ,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,SAAS,CAAC,IAAI,EAAE;AACjB,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;AACrB,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI;AACtB,GAAG;AACH,EAAE;AACF,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;AACtC,CAAC;AACD,CAAC;AACE,IAAC,YAAY,GAAG,IAAI,YAAY;;;;"}

package/build/server/chunks/{hooks.server-Rv301GTB.js → hooks.server-y3jdg_sB.js}

@@ -1,3 +1,6 @@
+import { p as public_env } from './shared-server-CCs2CV3b.js';
+import { p as parseThemeId } from './registry-DqAn_hVE.js';
+
 //#region src/lib/server/security/auth.ts
 /**
 * Optional shared-token auth for the dashboard's REST + WebSocket
@@ -142,8 +145,9 @@ var handle = async ({ event, resolve }) => {
 			headers: { "WWW-Authenticate": "Bearer realm=\"unspa-dashboard\"" }
 		});
 	}
-	return resolve(event);
+	const theme = parseThemeId(public_env.PUBLIC_UNSPA_THEME);
+	return resolve(event, { transformPageChunk: ({ html }) => html.replace("%unspa.theme%", theme) });
 };
 
 export { handle };
-//# sourceMappingURL=hooks.server-Rv301GTB.js.map
+//# sourceMappingURL=hooks.server-y3jdg_sB.js.map

package/build/server/chunks/hooks.server-y3jdg_sB.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.server-y3jdg_sB.js","sources":["../../../.svelte-kit/adapter-node/chunks/auth.js","../../../.svelte-kit/adapter-node/entries/hooks.server.js"],"sourcesContent":["//#region src/lib/server/security/auth.ts\n/**\n* Optional shared-token auth for the dashboard's REST + WebSocket\n* surface, plus an Origin allowlist that complements it.\n*\n* Trust model (local-first by default):\n*   - No env var set → no auth, no origin check. This is the right\n*     stance for the default `unspa dashboard` install (loopback bind,\n*     single human). Forcing auth here would be friction with zero\n*     payoff.\n*   - `UNSPA_AUTH_TOKEN` set → every API request and every WebSocket\n*     upgrade must carry the token. REST honors `Authorization: Bearer\n*     <token>`; the WebSocket carries it as a `?token=` query because\n*     browsers can't set headers on WS upgrades. Server-to-server\n*     callers (the MCP `notifySyncReload`) use the header.\n*   - `UNSPA_ALLOWED_ORIGIN` set → cross-site browser requests are\n*     rejected. Covers the \"malicious page in your other tab fetches\n*     localhost:3000/api/projects from your logged-in browser\" CSRF\n*     class. curl / server-to-server has no Origin header and passes\n*     through (the threat model is browser-mediated, not arbitrary\n*     HTTP).\n*\n* One env var, one check function per surface. No accounts, no roles,\n* no session store. The aim is \"an enterprise IT person can install\n* this on a VLAN without a heart attack\", not full enterprise IAM —\n* which is a separate tier on the roadmap.\n*\n* Constant-time comparison on the token check resists timing leaks\n* even though the realistic attack surface is small (loopback or LAN).\n*/\nvar tokenEnv = () => {\n\tconst raw = process.env.UNSPA_AUTH_TOKEN;\n\tif (typeof raw !== \"string\") return void 0;\n\tconst trimmed = raw.trim();\n\treturn trimmed.length > 0 ? trimmed : void 0;\n};\nvar originEnv = () => {\n\tconst raw = process.env.UNSPA_ALLOWED_ORIGIN;\n\tif (typeof raw !== \"string\") return void 0;\n\tconst trimmed = raw.trim().replace(/\\/$/, \"\");\n\treturn trimmed.length > 0 ? trimmed : void 0;\n};\nvar isAuthEnabled = () => tokenEnv() !== void 0;\nvar isOriginCheckEnabled = () => originEnv() !== void 0;\n/**\n* Length-independent constant-time compare. `crypto.timingSafeEqual`\n* requires equal-length buffers and an early `===` length check would\n* itself leak length; this normalises both inputs to the longer of the\n* two before comparing.\n*/\nvar constantTimeEqual = (a, b) => {\n\tconst len = Math.max(a.length, b.length);\n\tlet mismatch = a.length === b.length ? 0 : 1;\n\tfor (let i = 0; i < len; i += 1) {\n\t\tconst ai = i < a.length ? a.charCodeAt(i) : 0;\n\t\tconst bi = i < b.length ? b.charCodeAt(i) : 0;\n\t\tmismatch |= ai ^ bi;\n\t}\n\treturn mismatch === 0;\n};\nvar extractBearerToken = (headers) => {\n\tconst raw = headers.get(\"authorization\");\n\tif (!raw) return null;\n\tconst match = /^Bearer\\s+(.+)$/i.exec(raw);\n\treturn match ? match[1].trim() : null;\n};\n/**\n* Validate a Request's bearer token against UNSPA_AUTH_TOKEN. Returns\n* true when auth is disabled (env unset) so callers can wrap any\n* request without branching on `isAuthEnabled`.\n*/\nvar checkBearerAuth = (request) => {\n\tconst expected = tokenEnv();\n\tif (expected === void 0) return true;\n\tconst provided = extractBearerToken(request.headers);\n\tif (provided === null) return false;\n\treturn constantTimeEqual(provided, expected);\n};\n/**\n* Validate a token carried as `?token=...` on a URL. Used by the\n* WebSocket upgrade path (browsers can't set headers on WS) and by SSE\n* (EventSource can't set headers either).\n*/\nvar checkQueryAuth = (url) => {\n\tconst expected = tokenEnv();\n\tif (expected === void 0) return true;\n\tconst provided = (typeof url === \"string\" ? new URL(url, \"http://x\") : url).searchParams.get(\"token\");\n\tif (provided === null) return false;\n\treturn constantTimeEqual(provided, expected);\n};\n/**\n* Accepts either header OR query — the inclusive OR variant for\n* endpoints that need to serve both browsers (via header) and\n* EventSource (via query).\n*/\nvar checkRequestAuth = (request, url) => {\n\tif (!isAuthEnabled()) return true;\n\tif (checkBearerAuth(request)) return true;\n\tif (url && checkQueryAuth(url)) return true;\n\treturn false;\n};\n/**\n* Origin allowlist check. Returns true when:\n*   - the check is disabled (env unset), OR\n*   - the request has no Origin header (server-to-server callers like\n*     curl / the MCP notify don't send Origin), OR\n*   - the Origin matches the configured allowlist.\n* Callers should pair this with auth: a malicious server-to-server\n* caller would skip the origin check, which is fine because they're\n* still gated by the token.\n*/\nvar checkOrigin = (request) => {\n\tconst expected = originEnv();\n\tif (expected === void 0) return true;\n\tconst origin = request.headers.get(\"origin\");\n\tif (!origin) return true;\n\treturn origin.replace(/\\/$/, \"\") === expected;\n};\n//#endregion\nexport { isOriginCheckEnabled as i, checkRequestAuth as n, isAuthEnabled as r, checkOrigin as t };\n","import { t as public_env } from \"../chunks/shared-server.js\";\nimport { i as isOriginCheckEnabled, n as checkRequestAuth, r as isAuthEnabled, t as checkOrigin } from \"../chunks/auth.js\";\nimport { t as parseThemeId } from \"../chunks/registry.js\";\n//#region src/hooks.server.ts\n/**\n* Global request gate for the dashboard. When `UNSPA_AUTH_TOKEN` is\n* set, every /api/* request must carry the token (header for fetch,\n* `?token=` for SSE). When `UNSPA_ALLOWED_ORIGIN` is set, cross-site\n* browser requests with a mismatching Origin are rejected.\n*\n* Why /api/* specifically: page navigations (HTML routes) are safe to\n* leave unauthenticated — they don't expose data on their own, and a\n* page that can't fetch its data renders empty + triggers the\n* client-side token prompt. Gating only the data plane means an\n* incorrectly-configured client surfaces the auth failure clearly\n* instead of getting a vague 401 on every navigation.\n*\n* Default install (neither env set) is unchanged from before: no\n* checks fire and the handle pass-through is essentially free.\n*/\nvar handle = async ({ event, resolve }) => {\n\tif (event.url.pathname.startsWith(\"/api/\")) {\n\t\tif (isOriginCheckEnabled() && !checkOrigin(event.request)) return new Response(\"Forbidden: origin not allowed\", { status: 403 });\n\t\tif (isAuthEnabled() && !checkRequestAuth(event.request, event.url)) return new Response(\"Unauthorized: missing or invalid token\", {\n\t\t\tstatus: 401,\n\t\t\theaders: { \"WWW-Authenticate\": \"Bearer realm=\\\"unspa-dashboard\\\"\" }\n\t\t});\n\t}\n\tconst theme = parseThemeId(public_env.PUBLIC_UNSPA_THEME);\n\treturn resolve(event, { transformPageChunk: ({ html }) => html.replace(\"%unspa.theme%\", theme) });\n};\n//#endregion\nexport { handle };\n"],"names":[],"mappings":";;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,QAAQ,GAAG,MAAM;AACrB,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB;AACzC,CAAC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,OAAO,MAAM;AAC3C,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE;AAC3B,CAAC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,GAAG,MAAM;AAC7C,CAAC;AACD,IAAI,SAAS,GAAG,MAAM;AACtB,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB;AAC7C,CAAC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,OAAO,MAAM;AAC3C,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AAC9C,CAAC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,GAAG,MAAM;AAC7C,CAAC;AACD,IAAI,aAAa,GAAG,MAAM,QAAQ,EAAE,KAAK,MAAM;AAC/C,IAAI,oBAAoB,GAAG,MAAM,SAAS,EAAE,KAAK,MAAM;AACvD;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,iBAAiB,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK;AAClC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC;AAC7C,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE;AAClC,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC;AAC/C,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC;AAC/C,EAAE,QAAQ,IAAI,EAAE,GAAG,EAAE;AACrB,CAAC;AACD,CAAC,OAAO,QAAQ,KAAK,CAAC;AACtB,CAAC;AACD,IAAI,kBAAkB,GAAG,CAAC,OAAO,KAAK;AACtC,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;AACzC,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI;AACtB,CAAC,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;AAC3C,CAAC,OAAO,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI;AACtC,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,IAAI,eAAe,GAAG,CAAC,OAAO,KAAK;AACnC,CAAC,MAAM,QAAQ,GAAG,QAAQ,EAAE;AAC5B,CAAC,IAAI,QAAQ,KAAK,MAAM,EAAE,OAAO,IAAI;AACrC,CAAC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC;AACrD,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,OAAO,KAAK;AACpC,CAAC,OAAO,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC;AAC7C,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,IAAI,cAAc,GAAG,CAAC,GAAG,KAAK;AAC9B,CAAC,MAAM,QAAQ,GAAG,QAAQ,EAAE;AAC5B,CAAC,IAAI,QAAQ,KAAK,MAAM,EAAE,OAAO,IAAI;AACrC,CAAC,MAAM,QAAQ,GAAG,CAAC,OAAO,GAAG,KAAK,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;AACtG,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,OAAO,KAAK;AACpC,CAAC,OAAO,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC;AAC7C,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,IAAI,gBAAgB,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK;AACzC,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,OAAO,IAAI;AAClC,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,OAAO,IAAI;AAC1C,CAAC,IAAI,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,OAAO,IAAI;AAC5C,CAAC,OAAO,KAAK;AACb,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,WAAW,GAAG,CAAC,OAAO,KAAK;AAC/B,CAAC,MAAM,QAAQ,GAAG,SAAS,EAAE;AAC7B,CAAC,IAAI,QAAQ,KAAK,MAAM,EAAE,OAAO,IAAI;AACrC,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC7C,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI;AACzB,CAAC,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,QAAQ;AAC9C,CAAC;;AClHD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,MAAM,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AAC3C,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;AAC7C,EAAE,IAAI,oBAAoB,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,IAAI,QAAQ,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAClI,EAAE,IAAI,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,IAAI,QAAQ,CAAC,wCAAwC,EAAE;AACpI,GAAG,MAAM,EAAE,GAAG;AACd,GAAG,OAAO,EAAE,EAAE,kBAAkB,EAAE,kCAAkC;AACpE,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,kBAAkB,CAAC;AAC1D,CAAC,OAAO,OAAO,CAAC,KAAK,EAAE,EAAE,kBAAkB,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC;AAClG;;;;"}

package/build/server/chunks/{internal-BPKrFkK1.js → internal-KYK0WpL7.js}

@@ -1791,10 +1791,10 @@ var options = {
 	service_worker_options: void 0,
 	server_error_boundaries: false,
 	templates: {
-		app: ({ head, body, assets, nonce, env }) => "<!doctype html>\n<html lang=\"en\" class=\"h-full\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n    <link rel=\"icon\" href=\"" + assets + "/unspaghettit_logo.png\" type=\"image/png\" />\n    <meta name=\"description\" content=\"Executable specifications for AI-assisted software development. Local-first and MCP-native by Lyriks.io.\" />\n    <meta property=\"og:title\" content=\"Unspaghettit\" />\n    <meta property=\"og:description\" content=\"Executable specifications for AI-assisted software development. Local-first and MCP-native.\" />\n    <meta property=\"og:image\" content=\"" + assets + "/unspaghettit_logo.png\" />\n    <meta property=\"og:type\" content=\"website\" />\n    <meta name=\"twitter:card\" content=\"summary\" />\n    <meta name=\"twitter:title\" content=\"Unspaghettit\" />\n    <meta name=\"twitter:description\" content=\"Executable specifications for AI-assisted software development.\" />\n    <meta name=\"twitter:image\" content=\"" + assets + "/unspaghettit_logo.png\" />\n    <link rel=\"preconnect\" href=\"https://fonts.googleapis.com\" />\n    <link rel=\"preconnect\" href=\"https://fonts.gstatic.com\" crossorigin />\n    <link\n      rel=\"stylesheet\"\n      href=\"https://fonts.googleapis.com/css2?family=Dancing+Script:wght@500;600;700&family=Space+Grotesk:wght@400;500;600&display=swap\"\n    />\n    <title>Unspaghettit</title>\n    " + head + "\n  </head>\n  <body data-sveltekit-preload-data=\"hover\" class=\"h-full bg-neutral-50 text-neutral-900 antialiased\">\n    <div id=\"app\" class=\"h-full\">" + body + "</div>\n  </body>\n</html>\n",
+		app: ({ head, body, assets, nonce, env }) => "<!doctype html>\n<html lang=\"en\" class=\"h-full\" data-theme=\"%unspa.theme%\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n    <!--\n      Theme bootstrap. The server fills the data-theme placeholder above from\n      PUBLIC_UNSPA_THEME (the CLI default) in hooks.server.ts. This runs before\n      first paint and lets a saved in-app switcher choice (localStorage) win\n      over that default, so the page never flashes the wrong colour skin. Kept\n      tiny + guarded so a blocked storage API (private browsing) just leaves\n      the server default.\n    -->\n    <script>\n      try {\n        var t = localStorage.getItem('unspa.theme');\n        if (t) document.documentElement.dataset.theme = t;\n      } catch (e) {}\n    <\/script>\n    <link rel=\"icon\" href=\"" + assets + "/unspaghettit_logo.png\" type=\"image/png\" />\n    <meta name=\"description\" content=\"Executable specifications for AI-assisted software development. Local-first and MCP-native by Lyriks.io.\" />\n    <meta property=\"og:title\" content=\"Unspaghettit\" />\n    <meta property=\"og:description\" content=\"Executable specifications for AI-assisted software development. Local-first and MCP-native.\" />\n    <meta property=\"og:image\" content=\"" + assets + "/unspaghettit_logo.png\" />\n    <meta property=\"og:type\" content=\"website\" />\n    <meta name=\"twitter:card\" content=\"summary\" />\n    <meta name=\"twitter:title\" content=\"Unspaghettit\" />\n    <meta name=\"twitter:description\" content=\"Executable specifications for AI-assisted software development.\" />\n    <meta name=\"twitter:image\" content=\"" + assets + "/unspaghettit_logo.png\" />\n    <link rel=\"preconnect\" href=\"https://fonts.googleapis.com\" />\n    <link rel=\"preconnect\" href=\"https://fonts.gstatic.com\" crossorigin />\n    <link\n      rel=\"stylesheet\"\n      href=\"https://fonts.googleapis.com/css2?family=Dancing+Script:wght@500;600;700&family=Space+Grotesk:wght@400;500;600&display=swap\"\n    />\n    <title>Unspaghettit</title>\n    " + head + "\n  </head>\n  <body data-sveltekit-preload-data=\"hover\" class=\"h-full bg-neutral-50 text-neutral-900 antialiased\">\n    <div id=\"app\" class=\"h-full\">" + body + "</div>\n  </body>\n</html>\n",
 		error: ({ status, message }) => "<!doctype html>\n<html lang=\"en\">\n	<head>\n		<meta charset=\"utf-8\" />\n		<title>" + message + "</title>\n\n		<style>\n			body {\n				--bg: white;\n				--fg: #222;\n				--divider: #ccc;\n				background: var(--bg);\n				color: var(--fg);\n				font-family:\n					system-ui,\n					-apple-system,\n					BlinkMacSystemFont,\n					'Segoe UI',\n					Roboto,\n					Oxygen,\n					Ubuntu,\n					Cantarell,\n					'Open Sans',\n					'Helvetica Neue',\n					sans-serif;\n				display: flex;\n				align-items: center;\n				justify-content: center;\n				height: 100vh;\n				margin: 0;\n			}\n\n			.error {\n				display: flex;\n				align-items: center;\n				max-width: 32rem;\n				margin: 0 1rem;\n			}\n\n			.status {\n				font-weight: 200;\n				font-size: 3rem;\n				line-height: 1;\n				position: relative;\n				top: -0.05rem;\n			}\n\n			.message {\n				border-left: 1px solid var(--divider);\n				padding: 0 0 0 1rem;\n				margin: 0 0 0 1rem;\n				min-height: 2.5rem;\n				display: flex;\n				align-items: center;\n			}\n\n			.message h1 {\n				font-weight: 400;\n				font-size: 1em;\n				margin: 0;\n			}\n\n			@media (prefers-color-scheme: dark) {\n				body {\n					--bg: #222;\n					--fg: #ddd;\n					--divider: #666;\n				}\n			}\n		</style>\n	</head>\n	<body>\n		<div class=\"error\">\n			<span class=\"status\">" + status + "</span>\n			<div class=\"message\">\n				<h1>" + message + "</h1>\n			</div>\n		</div>\n	</body>\n</html>\n"
 	},
-	version_hash: "644wac"
+	version_hash: "1o6l84"
 };
 async function get_hooks() {
 	let handle;
@@ -1802,7 +1802,7 @@ async function get_hooks() {
 	let handleError;
 	let handleValidationError;
 	let init;
-	({handle, handleFetch, handleError, handleValidationError, init} = await import('./hooks.server-Rv301GTB.js'));
+	({handle, handleFetch, handleError, handleValidationError, init} = await import('./hooks.server-y3jdg_sB.js'));
 	let reroute;
 	let transport;
 	return {
@@ -1817,4 +1817,4 @@ async function get_hooks() {
 }
 
 export { resolve as A, set_read_implementation as B, split_remote_key as C, stringify as D, stringify$1 as E, strip_data_suffix as F, strip_resolution_suffix as G, text_encoder as H, INVALIDATED_PARAM as I, validate_layout_exports as J, validate_layout_server_exports as K, validate_page_exports as L, validate_page_server_exports as M, with_request_store as N, TRAILING_SLASH_PARAM as T, add_data_suffix as a, add_resolution_suffix as b, base64_encode as c, coalesce_to_error as d, compact as e, create_remote_key as f, decode_pathname as g, disable_search as h, find_route as i, get_hooks as j, get_message as k, get_relative_path as l, get_status as m, has_data_suffix as n, has_resolution_suffix as o, hash as p, make_trackable as q, noop as r, noop_span as s, normalize_error as t, normalize_path as u, once as v, options as w, parse as x, parse_remote_arg as y, read_implementation as z };
-//# sourceMappingURL=internal-BPKrFkK1.js.map
+//# sourceMappingURL=internal-KYK0WpL7.js.map