a750528
@@ -14,6 +14,16 @@
FORGE_APP_DATA=./data bun run src/tty.ts                # the terminal
FORGE_APP_DATA=./data bun run src/db.ts --check         # schema version, integrity
```
## What is real, and what is not yet
The page is the arena and nothing else: a square the sea will be drawn in,
a round clock, one line of the rule, a roster and a ladder — all rendered
on the server, all legible with JavaScript off, none of them fed by a
simulation yet. There is no world tick, no socket and no score behind
them; the regions are shells with honest empty states, and the round loop,
the canvas and the ladder fill them in the issues that follow. `POST /mcp`
answers and lists no tool.
## The shape
One implementation, many doors. `src/actions.ts` is every operation as a
@@ -23,28 +33,28 @@
decide nothing themselves. `AGENTS.md` says how to add to it.
| file                               | what it is                                                   |
| ---------------------------------- | ------------------------------------------------------------ |
| `src/actions.ts`                   | list, add, delete — and who may                              |
| `src/actions.ts`                   | every operation, and who may — empty until #DATA             |
| `src/who.ts`                       | who is asking, from the forge's signed headers               |
| `src/db.ts`                        | SQLite under `FORGE_APP_DATA`, WAL, forward-only migrations  |
| `src/live.ts`                      | the in-process bus and `GET /events`                         |
| `src/mcp.ts`                       | the actions as MCP tools at `POST /mcp`                      |
| `src/mcp.ts`                       | the actions as MCP tools at `POST /mcp` — none yet           |
| `src/routes.ts`                    | every path, in one table                                     |
| `src/page.ts`                      | the HTML, rendered on the server                             |
| `src/page.ts`                      | the HTML of the arena, rendered on the server                |
| `src/http.ts`                      | the floor: headers, body cap, same-origin, rate limit, files |
| `src/server.ts`                    | boot: open the database, serve                               |
| `src/tty.ts`                       | the terminal, over the same actions                          |
| `src/tty.ts`                       | the terminal — a placeholder until the world runs            |
| `src/env.ts`                       | what the forge told this process                             |
| `static/app.css`, `static/live.js` | the look, and the list that stays current                    |
| `static/app.css`, `static/live.js` | the look, and the regions that stay current                  |
## Who you are
The forge says who is asking on every request it proxies, and the app
verifies the signature (`src/who.ts`); nothing else is trusted. Three tiers:
- **anon** — anyone. Reads.
- **user** — signed in to the forge and able to see this app. Adds notes, as
  themselves, and removes their own.
- **admin** — able to write this repository. Removes any note.
- **anon** — anyone. Watches, and will swim as a guest.
- **user** — signed in to the forge and able to see this app. Swims under
  their forge name, and is the only kind of swimmer the ladder names.
- **admin** — able to write this repository.
"Sign in" is `/__forge/signin?to=<path>` and "Sign out" is
`/__forge/signout`; the forge answers both on the app's own host.
@@ -52,35 +62,27 @@
verifies the signature (`src/who.ts`); nothing else is trusted. Three tiers:
## Any interface
The same actions, the same rules, at every door. A script is the person
whose forge grant it carries; a bare script is anonymous.
whose forge grant it carries; a bare script is anonymous. The MCP endpoint
is already here — its tools arrive with the round:
```sh
curl https://<app>/api/notes
curl -X POST https://<app>/api/notes -H 'content-type: application/json' -d '{"body":"hi"}'
curl -X DELETE https://<app>/api/notes/1
```
As an MCP server, for Claude Code or Claude Desktop — `list_notes`,
`add_note`, `delete_note`:
```sh
claude mcp add --transport http __TITLE__ https://<app>/mcp
claude mcp add --transport http drift https://<app>/mcp
```
```json
{
  "mcpServers": { "__TITLE__": { "type": "http", "url": "https://<app>/mcp" } }
  "mcpServers": { "drift": { "type": "http", "url": "https://<app>/mcp" } }
}
```
The page stays current over `/events`: a note someone else adds or removes
appears without a reload. Without JavaScript it is the same page, one
reload behind.
The page stays current over `/events`: a region marked `data-live` is
refetched when the round says something on the bus. Without JavaScript it
is the same page, one reload behind.
The terminal opens with the exact command in `FORGE_APP_SSH` when the app
runs (`ssh -p 2222 <name>@<forge>` — the app is the login name, the forge
the host; `<name>--<pull>@<forge>` for a preview's). It is `src/tty.ts` on
a real pty over the same data, as the account at the keyboard.
runs (the app is the login name, the forge the host). It is `src/tty.ts` on
a real pty, as the account at the keyboard; today it prints where it is and
quits on `q`, and the sea drawn in text arrives with the world.
The forge sets `PORT`, `FORGE_APP_DATA`, `FORGE_APP_ENV` (`production` or
`preview`), `FORGE_APP_URL`, `FORGE_APP_COMMIT`, `FORGE_APP_SSH` and
@@ -1,58 +0,0 @@
import { expect, test } from "bun:test";
import { mkdtempSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { addNote, deleteNote, listNotes } from "./actions.ts";
import { openDb } from "./db.ts";
import type { Who } from "./who.ts";
const db = openDb(mkdtempSync(join(tmpdir(), "app-actions-")));
const anon: Who = { role: "anon" };
const alice: Who = { role: "user", id: "u1", name: "alice" };
const bob: Who = { role: "user", id: "u2", name: "bob" };
const root: Who = { role: "admin", id: "u0", name: "root" };
test("anyone reads; only a signed-in person adds, as themselves", () => {
  expect(listNotes(db, anon)).toEqual({ ok: true, value: [] });
  const refused = addNote(db, anon, { body: "hello" });
  expect(refused.ok).toBe(false);
  if (!refused.ok) expect(refused.error).toBe("signin_required");
  const added = addNote(db, alice, { body: "  hello  " });
  expect(added.ok).toBe(true);
  if (!added.ok) return;
  expect(added.value.body).toBe("hello");
  expect(added.value.author_id).toBe("u1");
  expect(added.value.author_name).toBe("alice");
  const all = listNotes(db, anon);
  expect(all.ok && all.value.length).toBe(1);
});
test("a note is one to five hundred characters", () => {
  for (const body of ["", "   ", "x".repeat(501)]) {
    const r = addNote(db, alice, { body });
    expect(r.ok).toBe(false);
    if (!r.ok) expect(r.error).toBe("invalid");
  }
});
test("only the author or an admin removes a note", () => {
  const mine = addNote(db, alice, { body: "mine" });
  if (!mine.ok) throw new Error(mine.message);
  const byBob = deleteNote(db, bob, { id: mine.value.id });
  expect(byBob.ok).toBe(false);
  if (!byBob.ok) expect(byBob.error).toBe("forbidden");
  const byAnon = deleteNote(db, anon, { id: mine.value.id });
  expect(byAnon.ok).toBe(false);
  if (!byAnon.ok) expect(byAnon.error).toBe("signin_required");
  expect(deleteNote(db, alice, { id: mine.value.id }).ok).toBe(true);
  const gone = deleteNote(db, alice, { id: mine.value.id });
  expect(gone.ok).toBe(false);
  if (!gone.ok) expect(gone.error).toBe("not_found");
  const bobs = addNote(db, bob, { body: "bob's" });
  if (!bobs.ok) throw new Error(bobs.message);
  expect(deleteNote(db, root, { id: bobs.value.id }).ok).toBe(true);
  const odd = deleteNote(db, root, { id: 1.5 });
  expect(odd.ok).toBe(false);
  if (!odd.ok) expect(odd.error).toBe("invalid");
});
@@ -4,90 +4,20 @@
 * the terminal are doors onto these and decide nothing themselves — so a
 * rule written here holds at every door, and a new door is only a new
 * way to call.
 *
 * The scaffold left with #PAGE; the vocabulary it was written in stays,
 * because that vocabulary is the app's. The first real operations — a
 * player, a round, a score — land with #DATA.
 */
import type { Database } from "bun:sqlite";
import { emit } from "./live.ts";
import type { Who } from "./who.ts";
export interface Note {
  readonly id: number;
  readonly body: string;
  readonly author_id: string;
  readonly author_name: string;
  readonly created_at: string;
  readonly updated_at: string;
}
export type Failure = "signin_required" | "forbidden" | "not_found" | "invalid";
export type Result<T> =
  | { ok: true; value: T }
  | { ok: false; error: Failure; message: string };
const ok = <T>(value: T): Result<T> => ({ ok: true, value });
const fail = <T>(error: Failure, message: string): Result<T> => ({
export const ok = <T>(value: T): Result<T> => ({ ok: true, value });
export const fail = <T>(error: Failure, message: string): Result<T> => ({
  ok: false,
  error,
  message,
});
export const BODY_MAX = 500;
export function listNotes(
  db: Database,
  _who: Who,
  input: { limit?: number } = {},
): Result<Note[]> {
  const limit = Math.min(
    Math.max(Math.trunc(input.limit ?? 100) || 100, 1),
    500,
  );
  return ok(
    db
      .query<Note, [number]>("SELECT * FROM note ORDER BY id DESC LIMIT ?1")
      .all(limit),
  );
}
export function addNote(
  db: Database,
  who: Who,
  input: { body: string },
): Result<Note> {
  if (who.role === "anon")
    return fail("signin_required", "Sign in to add a note.");
  const body = input.body.trim();
  if (body.length === 0 || body.length > BODY_MAX)
    return fail("invalid", `A note is 1 to ${BODY_MAX} characters.`);
  const note = db
    .query<
      Note,
      [string, string, string]
    >("INSERT INTO note (body, author_id, author_name) VALUES (?1, ?2, ?3) RETURNING *")
    .get(body, who.id, who.name)!;
  emit("note.added", note);
  return ok(note);
}
export function deleteNote(
  db: Database,
  who: Who,
  input: { id: number },
): Result<{ id: number }> {
  if (who.role === "anon")
    return fail("signin_required", "Sign in to remove a note.");
  if (!Number.isInteger(input.id))
    return fail("invalid", "A note id is a whole number.");
  const note = db
    .query<Note, [number]>("SELECT * FROM note WHERE id = ?1")
    .get(input.id);
  if (note === null) return fail("not_found", "No such note.");
  if (!canDelete(who, note))
    return fail("forbidden", "Only the author or an admin can remove a note.");
  db.query("DELETE FROM note WHERE id = ?1").run(note.id);
  emit("note.removed", { id: note.id });
  return ok({ id: note.id });
}
/** Whether `who` may remove `note`. The page and the terminal draw from this, so the rule lives once. */
export const canDelete = (who: Who, note: Note): boolean =>
  who.role === "admin" || (who.role === "user" && who.id === note.author_id);
@@ -20,4 +20,14 @@
test("migrations apply once, in order, and the file checks out", () => {
    db.query<{ foreign_keys: number }, []>("PRAGMA foreign_keys").get()
      ?.foreign_keys,
  ).toBe(1);
  // The scaffold's table left the way a table leaves here: forward, in a
  // migration of its own, on a database that already had it.
  expect(
    db
      .query<
        { name: string },
        []
      >("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' AND name <> 'schema_version'")
      .all(),
  ).toEqual([]);
});
@@ -24,6 +24,10 @@
export const migrations: string[] = [
    updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
  )`,
  `CREATE INDEX note_author ON note (author_id)`,
  // The scaffold left (#PAGE) and its table goes with it. A migration that
  // has run is history, so the two above stay as they are and this one
  // undoes them forward.
  `DROP TABLE IF EXISTS note`,
];
export function openDb(dir = dataDir): Database {
@@ -1,6 +1,6 @@
/**
 * The floor every response stands on, and the few things a route needs to
 * read a request safely. Nothing in here knows what a note is.
 * read a request safely. Nothing in here knows what the game is.
 */
import { createHash } from "node:crypto";
@@ -7,7 +7,7 @@
 */
import type { Database } from "bun:sqlite";
import { addNote, deleteNote, listNotes, type Result } from "./actions.ts";
import type { Result } from "./actions.ts";
import { title } from "./env.ts";
import { fields } from "./http.ts";
import type { Who } from "./who.ts";
@@ -23,46 +23,9 @@
interface Tool {
  ) => Result<unknown>;
}
export const tools: readonly Tool[] = [
  {
    name: "list_notes",
    description: "The notes, newest first.",
    inputSchema: {
      type: "object",
      properties: {
        limit: {
          type: "integer",
          minimum: 1,
          maximum: 500,
          description: "At most this many (100).",
        },
      },
    },
    run: (db, who, args) =>
      listNotes(db, who, { limit: Number(args.limit ?? 100) }),
  },
  {
    name: "add_note",
    description:
      "Add a note as the signed-in person. Anonymous callers cannot.",
    inputSchema: {
      type: "object",
      properties: { body: { type: "string", maxLength: 500 } },
      required: ["body"],
    },
    run: (db, who, args) => addNote(db, who, { body: String(args.body ?? "") }),
  },
  {
    name: "delete_note",
    description: "Remove a note by id. Only its author or an admin can.",
    inputSchema: {
      type: "object",
      properties: { id: { type: "integer" } },
      required: ["id"],
    },
    run: (db, who, args) => deleteNote(db, who, { id: Number(args.id) }),
  },
];
// No tool yet: the scaffold left with #PAGE and the round's tools arrive
// with #DOORS. A caller still gets a well-formed `tools/list`.
export const tools: readonly Tool[] = [];
/** One JSON-RPC message in, an HTTP status and a body out (a notification gets 202 and no body). */
export function rpc(
@@ -1,14 +1,26 @@
/**
 * The page, rendered on the server: the first paint is complete HTML, and
 * `static/live.js` keeps the notes fresh afterwards. When a second page
 * arrives, move `layout` to `src/pages/layout.ts` and give each page a file.
 * The page, rendered on the server: the first paint is the whole arena —
 * the sea's square, the round clock, the rule, the roster and the ladder —
 * and it is legible with JavaScript off. `static/live.js` swaps a region
 * when the round says something on the bus. Nothing here is a simulation
 * yet: the regions are shells with honest empty states, and the round
 * (#ROUND), the canvas (#CANVAS) and the ladder (#LADDER) fill them.
 *
 * When a second page arrives, move `layout` to `src/pages/layout.ts` and
 * give each page a file.
 */
import { canDelete, type Note } from "./actions.ts";
import { commit, description, env, ssh, title, where } from "./env.ts";
import { asset, escape } from "./http.ts";
import type { Who } from "./who.ts";
/** The one sentence a newcomer has to read: the whole game is other people. */
export const RULE =
  "Your own thruster is feeble; the wake other swimmers leave is not. Ride their lane, braid it, and throw the bloom through the gate.";
      
        sentinelcrew
        1mo ago
        
      
      x
    
/** The roster cap the concept sets (#CONCEPT); the round enforces it. */
export const ROSTER_MAX = 24;
export function layout(body: string, who: Who): string {
  const door =
    who.role === "anon"
@@ -22,6 +34,7 @@
export function layout(body: string, who: Who): string {
<meta name="color-scheme" content="light dark">
<link rel="icon" href="data:,">
<title>${escape(title)}</title>
<meta name="description" content="${escape(description)}">
<link rel="stylesheet" href="${asset("app.css")}">
<script type="module" src="${asset("live.js")}"></script>
<body>
@@ -38,8 +51,8 @@
export function layout(body: string, who: Who): string {
  </header>
  <main>${body}</main>
  <footer class="muted">
    ${ssh === undefined ? "" : `<p>Terminal: <code>${escape(ssh)}</code></p>`}
    <p>Also at <a href="/api/notes">/api/notes</a> and <code>POST /mcp</code>, with the same rules.</p>
    ${ssh === undefined ? "<p>The terminal is off in this environment.</p>" : `<p>Terminal: <code>${escape(ssh)}</code></p>`}
    <p><code>POST /mcp</code> answers here already; the round's tools and its JSON join it.</p>
  </footer>
</div>
</body>
@@ -47,50 +60,61 @@
export function layout(body: string, who: Who): string {
`;
}
export function home(input: {
  who: Who;
  notes: readonly Note[];
  notice?: string | undefined;
}): string {
  const { who, notes, notice } = input;
  const composer =
    who.role === "anon"
      ? `<p class="muted">Reading as a guest. <a href="/__forge/signin?to=/">Sign in</a> to add a note.</p>`
      : `<form class="row" method="post" action="/notes">
        <input class="input" name="body" placeholder="Write a note" aria-label="New note" required maxlength="500" autocomplete="off" autofocus>
        <button class="button">Add</button>
      </form>`;
  const list =
    notes.length === 0
      ? `<p class="empty">No notes yet. Notes written here stay in ${escape(where)} data.</p>`
      : `<ul class="list">${notes.map((note) => item(note, who)).join("")}</ul>`;
export function home(input: { who: Who; notice?: string | undefined }): string {
  const { who, notice } = input;
  return layout(
    `<section class="card">${composer}</section>
  <section id="notes" data-live="note.added note.removed">${list}</section>
    `<div class="arena-layout">
    <div class="arena-column">
      ${arena()}
      <p class="rule">${escape(RULE)}</p>
    </div>
    <div class="side-column">
      ${clock()}
      ${roster(who)}
      ${ladder()}
    </div>
  </div>
  ${notice === undefined ? "" : `<p class="toast" role="status">${escape(notice)}</p>`}`,
    who,
  );
}
const item = (note: Note, who: Who): string => `<li class="note">
  <div>
    <p>${escape(note.body)}</p>
    <small class="muted">${escape(note.author_name)} · <time datetime="${escape(note.created_at)}">${ago(note.created_at)}</time></small>
  </div>
  ${
    canDelete(who, note)
      ? `<form method="post" action="/notes/${note.id}/delete"><button class="button button-quiet" aria-label="Remove this note">Remove</button></form>`
      : ""
  }
</li>`;
// The square the sea is drawn in. It holds its size from CSS alone —
// `aspect-ratio: 1`, capped to the viewport — so the canvas (#CANVAS) drops
// in later without moving a pixel of what is around it.
const arena = (): string =>
  `<section id="arena" class="arena" aria-labelledby="arena-title" data-live="round.started round.ended">
        <h2 id="arena-title" class="sr-only">The sea</h2>
        <div class="arena-box">
          <p class="arena-empty">The sea is flat.
            <span class="muted">Motes, the currents they leave behind and the bloom they carry are drawn here once the world is running.</span>
          </p>
        </div>
      </section>`;
const ago = (iso: string): string => {
  const s = Math.max(0, (Date.now() - Date.parse(iso)) / 1000);
  if (s < 60) return "just now";
  if (s < 3600) return `${Math.floor(s / 60)}m ago`;
  if (s < 86400) return `${Math.floor(s / 3600)}h ago`;
  return new Date(iso).toLocaleDateString("en", {
    month: "short",
    day: "numeric",
  });
};
// A clock that cannot shift when it starts counting: tabular figures, and a
// width reserved for the widest time it will ever show. The dashes are a
// placeholder and say nothing a screen reader needs — the sentence under
// them does; when #ROUND puts a real time there, that attribute goes.
const clock = (): string =>
  `<section id="clock" class="panel clock" aria-labelledby="clock-title" data-live="round.started round.ended">
        <h2 id="clock-title" class="panel-title">Round</h2>
        <p class="clock-time" aria-hidden="true">--:--</p>
        <p class="empty">No round yet. One runs three minutes, then twenty seconds of quiet.</p>
      </section>`;
const roster = (who: Who): string =>
  `<section id="roster" class="panel" aria-labelledby="roster-title" data-live="round.started round.ended">
        <h2 id="roster-title" class="panel-title">In the sea <span class="count">0/${ROSTER_MAX}</span></h2>
        <p class="empty">Nobody is swimming yet. ${
          who.role === "anon"
            ? "When the world starts you can swim as a guest, or sign in first and swim under your forge name."
            : `When the world starts you swim as <b>${escape(who.name)}</b>.`
        }</p>
      </section>`;
const ladder = (): string =>
  `<section id="ladder" class="panel" aria-labelledby="ladder-title" data-live="round.ended">
        <h2 id="ladder-title" class="panel-title">Ladder</h2>
        <p class="empty">No round has finished. Seven days of them will stand here, credited to the swimmers whose current moved the bloom.</p>
      </section>`;
@@ -2,27 +2,14 @@
 * Every path the app answers, in one table. A route reads its request,
 * calls an action, and shapes the answer for its door — HTML for a
 * browser, JSON for a script — and that is all a route does.
 *
 * Today that is the page, the event stream, the MCP endpoint and the
 * files: the scaffold's routes left with #PAGE, and the round's JSON
 * doors arrive with #DOORS.
 */
import type { Database } from "bun:sqlite";
import {
  addNote,
  deleteNote,
  listNotes,
  type Failure,
  type Result,
} from "./actions.ts";
import {
  back,
  fields,
  html,
  json,
  readForm,
  readJson,
  readNotice,
  staticFile,
  text,
} from "./http.ts";
import { html, json, readJson, readNotice, staticFile, text } from "./http.ts";
import { events } from "./live.ts";
import { rpc } from "./mcp.ts";
import { home } from "./page.ts";
@@ -42,86 +29,17 @@
export interface Route {
  readonly handle: (ctx: Context) => Response | Promise<Response>;
}
const STATUS: Record<Failure, number> = {
  signin_required: 401,
  forbidden: 403,
  not_found: 404,
  invalid: 422,
};
/** A result as JSON: the value, or `{ error, message }` with the matching status. */
const answer = <T>(result: Result<T>, status = 200): Response =>
  result.ok
    ? json(result.value, status)
    : json(
        { error: result.error, message: result.message },
        STATUS[result.error],
      );
/** A result for a form: back to the page, with what went wrong if it did. */
const done = <T>(result: Result<T>): Response =>
  result.ok ? back() : back(result.message);
export const routes: readonly Route[] = [
  // The page. Forms post and come back; the list stays live over /events.
  // The page: the whole arena in the first paint, live regions kept fresh
  // over /events.
  {
    method: "GET",
    path: "/",
    handle: (c) => {
      const { notice, clear } = readNotice(c.request);
      const notes = listNotes(c.db, c.who);
      return html(
        home({ who: c.who, notes: notes.ok ? notes.value : [], notice }),
        200,
        clear,
      );
      return html(home({ who: c.who, notice }), 200, clear);
    },
  },
  {
    method: "POST",
    path: "/notes",
    handle: async (c) => {
      const form = await readForm(c.request);
      if (form === undefined) return text("too large", 413);
      return done(
        addNote(c.db, c.who, { body: String(form.get("body") ?? "") }),
      );
    },
  },
  {
    method: "POST",
    path: "/notes/:id/delete",
    handle: (c) => done(deleteNote(c.db, c.who, { id: Number(c.params.id) })),
  },
  // The JSON API: the same actions, the same identity, plain status codes.
  {
    method: "GET",
    path: "/api/notes",
    handle: (c) =>
      answer(
        listNotes(c.db, c.who, {
          limit: Number(c.url.searchParams.get("limit") ?? 100),
        }),
      ),
  },
  {
    method: "POST",
    path: "/api/notes",
    handle: async (c) => {
      const body = await readJson(c.request);
      if (body === undefined) return json({ error: "too_large" }, 413);
      return answer(
        addNote(c.db, c.who, { body: String(fields(body).body ?? "") }),
        201,
      );
    },
  },
  {
    method: "DELETE",
    path: "/api/notes/:id",
    handle: (c) => answer(deleteNote(c.db, c.who, { id: Number(c.params.id) })),
  },
  // Live events, and the MCP server (the tools are the actions too).
  { method: "GET", path: "/events", handle: (c) => events(c.request) },
@@ -2,6 +2,8 @@
import { afterAll, expect, test } from "bun:test";
import { mkdtempSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { emit } from "./live.ts";
import { RULE } from "./page.ts";
import { serve } from "./server.ts";
import { sign } from "./who.ts";
@@ -27,8 +29,6 @@
const as = (
  };
};
const alice = as("u1", "alice");
const bob = as("u2", "bob");
const root = as("u0", "root", "admin");
const jsonBody = (body: unknown): RequestInit => ({
  headers: { "content-type": "application/json" },
  body: JSON.stringify(body),
@@ -47,81 +47,52 @@
const rpc = (message: unknown, who: Record<string, string> = {}) =>
    (r) => r.json() as Promise<any>,
  );
test("/ is the arena, whole in the first paint", async () => {
  const response = await fetch(base + "/");
  expect(response.status).toBe(200);
  expect(response.headers.get("content-type")).toContain("text/html");
  const page = await response.text();
  expect(page).toContain("<h1>");
  // The four regions the round, the canvas and the ladder fill later.
  for (const id of ["arena", "clock", "roster", "ladder"])
    expect(page).toContain(`id="${id}"`);
  // One line of rule text, and a clock that reads before it runs.
  expect(page).toContain(RULE.slice(0, 40));
  expect(page).toContain('class="clock-time"');
  // No script is needed for any of it: the markup is all server-rendered.
  expect(page).toContain("No round has finished");
});
test("the arena box reserves its square in CSS, not in script", async () => {
  const css = await (await fetch(base + "/static/app.css")).text();
  const box = /\.arena-box \{([^}]*)\}/.exec(css)?.[1] ?? "";
  expect(box).toContain("aspect-ratio: 1");
  expect(box).toContain("width: min(100%, 68svh)");
});
test("the page knows who you are and offers the right door", async () => {
  const guest = await (await fetch(base + "/")).text();
  expect(guest).toContain("<h1>");
  expect(guest).toContain("/__forge/signin?to=/");
  expect(guest).not.toContain('action="/notes"');
  const signed = await (await api("/", {}, alice)).text();
  expect(signed).toContain("<b>alice</b>");
  expect(signed).toContain("/__forge/signout");
  expect(signed).toContain('action="/notes"');
});
test("a form post adds as the person; a guest is sent to sign in", async () => {
  const form = new FormData();
  form.set("body", "hello from a form");
  const refused = await api("/notes", {
    method: "POST",
    body: form,
    redirect: "manual",
  });
  expect(refused.status).toBe(303);
  expect(refused.headers.get("set-cookie")).toContain("notice=");
  expect(refused.headers.get("set-cookie")).toContain("SameSite=Lax");
  expect(await (await fetch(base + "/")).text()).not.toContain(
    "hello from a form",
  );
  const posted = await api(
    "/notes",
    { method: "POST", body: form, redirect: "manual" },
    alice,
  );
  expect(posted.status).toBe(303);
  expect(posted.headers.get("set-cookie")).toBeNull();
  const page = await (await api("/", {}, alice)).text();
  expect(page).toContain("hello from a form");
  expect(page).toContain("alice ·");
test("the scaffold's routes are gone, and a 404 stands on the floor", async () => {
  const page = await (await fetch(base + "/")).text();
  expect(page.toLowerCase()).not.toContain("note");
  for (const path of ["/api/notes", "/api/notes/1", "/notes"]) {
    const response = await fetch(base + path);
    expect(response.status).toBe(404);
    expect(response.headers.get("content-security-policy")).toContain(
      "default-src 'self'",
    );
    expect(response.headers.get("x-content-type-options")).toBe("nosniff");
  }
  expect((await api("/notes", { method: "POST" }, alice)).status).toBe(404);
});
test("the JSON API is the same actions with the same identity", async () => {
  const created = await api(
    "/api/notes",
    { method: "POST", ...jsonBody({ body: "over the api" }) },
    alice,
  );
  expect(created.status).toBe(201);
  const note = (await created.json()) as { id: number; author_name: string };
  expect(note.author_name).toBe("alice");
  const listed = (await (await fetch(base + "/api/notes")).json()) as {
    id: number;
  }[];
  expect(listed.map((n) => n.id)).toContain(note.id);
  expect(
    (await api("/api/notes", { method: "POST", ...jsonBody({ body: "anon" }) }))
      .status,
  ).toBe(401);
  expect(
    (await api(`/api/notes/${note.id}`, { method: "DELETE" }, bob)).status,
  ).toBe(403);
  expect(
    (await api(`/api/notes/${note.id}`, { method: "DELETE" }, alice)).status,
  ).toBe(200);
  expect(
    (await api(`/api/notes/${note.id}`, { method: "DELETE" }, alice)).status,
  ).toBe(404);
  expect(
    (
      await api(
        "/api/notes",
        { method: "POST", ...jsonBody({ body: "" }) },
        alice,
      )
    ).status,
  ).toBe(422);
});
test("the MCP server lists the tools and calls them as the caller", async () => {
test("the MCP server answers, with no tool to call yet", async () => {
  const hello = await rpc({
    jsonrpc: "2.0",
    id: 1,
@@ -130,34 +101,14 @@
test("the MCP server lists the tools and calls them as the caller", async () =>
  });
  expect(hello.result.capabilities).toEqual({ tools: {} });
  const listed = await rpc({ jsonrpc: "2.0", id: 2, method: "tools/list" });
  expect(listed.result.tools.map((t: { name: string }) => t.name)).toEqual([
    "list_notes",
    "add_note",
    "delete_note",
  ]);
  const call = (name: string, args: unknown, who = {}) =>
    rpc(
      {
        jsonrpc: "2.0",
        id: 3,
        method: "tools/call",
        params: { name, arguments: args },
      },
      who,
    );
  const refused = await call("add_note", { body: "as nobody" });
  expect(refused.result.isError).toBe(true);
  const added = await call("add_note", { body: "over mcp" }, root);
  expect(added.result.isError).toBeUndefined();
  const note = JSON.parse(added.result.content[0].text);
  expect(note.author_name).toBe("root");
  const notes = JSON.parse(
    (await call("list_notes", {})).result.content[0].text,
  );
  expect(notes.map((n: { id: number }) => n.id)).toContain(note.id);
  expect(
    (await call("delete_note", { id: note.id }, root)).result.isError,
  ).toBeUndefined();
  expect(listed.result.tools).toEqual([]);
  const missing = await rpc({
    jsonrpc: "2.0",
    id: 3,
    method: "tools/call",
    params: { name: "join", arguments: {} },
  });
  expect(missing.error.code).toBe(-32602);
  expect(
    (await rpc({ jsonrpc: "2.0", id: 4, method: "nothing" })).error.code,
  ).toBe(-32601);
@@ -181,13 +132,9 @@
test("a change is on the event stream, and a late client hears what it missed",
      if (frame) return { id: frame[1]!, type: JSON.parse(frame[2]!).type };
    }
  };
  await api(
    "/api/notes",
    { method: "POST", ...jsonBody({ body: "live" }) },
    alice,
  );
  emit("round.started", { id: 1 });
  const heard = await next();
  expect(heard.type).toBe("note.added");
  expect(heard.type).toBe("round.started");
  await reader.cancel();
  const late = await fetch(base + "/events", {
    headers: { "last-event-id": String(Number(heard.id) - 1) },
@@ -196,22 +143,24 @@
test("a change is on the event stream, and a late client hears what it missed",
    (await late.body!.getReader().read()).value,
  );
  expect(replay).toContain(`id: ${heard.id}\n`);
  expect(replay).toContain("note.added");
  expect(replay).toContain("round.started");
});
test("writes are rationed per person", async () => {
  const flood = as("u9", "flood");
  const answers = await Promise.all(
  const codes = await Promise.all(
    Array.from({ length: 40 }, () =>
      api(
        "/api/notes",
        { method: "POST", ...jsonBody({ body: "again" }) },
        "/mcp",
        {
          method: "POST",
          ...jsonBody({ jsonrpc: "2.0", id: 1, method: "ping" }),
        },
        flood,
      ),
      ).then((r) => r.status),
    ),
  );
  const codes = answers.map((r) => r.status);
  expect(codes).toContain(201);
  expect(codes).toContain(200);
  expect(codes).toContain(429);
});
@@ -221,21 +170,21 @@
test("stands on the security floor", async () => {
    "default-src 'self'",
  );
  expect(response.headers.get("x-content-type-options")).toBe("nosniff");
  expect(
    (await fetch(base + "/api/notes")).headers.get("content-security-policy"),
  ).toContain("default-src");
  expect(response.headers.get("referrer-policy")).toBe(
    "strict-origin-when-cross-origin",
  );
});
test("a body is capped by the bytes read, whatever it claims", async () => {
  const response = await api(
    "/notes",
    {
      method: "POST",
      headers: { "content-type": "application/x-www-form-urlencoded" },
      body: "body=" + "x".repeat(1024 * 1024),
    },
    alice,
  );
  const response = await api("/mcp", {
    method: "POST",
    headers: { "content-type": "application/json" },
    body: JSON.stringify({
      jsonrpc: "2.0",
      id: 1,
      ping: "x".repeat(1024 * 1024),
    }),
  });
  expect(response.status).toBe(413);
});
@@ -246,21 +195,15 @@
test("HEAD sees the app up", async () => {
});
test("refuses a cross-site post", async () => {
  const form = new FormData();
  form.set("body", "from another site");
  const posted = await api(
    "/notes",
    {
      method: "POST",
      body: form,
      redirect: "manual",
      headers: {
        origin: "https://evil.example",
        "sec-fetch-site": "cross-site",
      },
  const posted = await api("/mcp", {
    method: "POST",
    ...jsonBody({ jsonrpc: "2.0", id: 1, method: "ping" }),
    headers: {
      "content-type": "application/json",
      origin: "https://evil.example",
      "sec-fetch-site": "cross-site",
    },
    alice,
  );
  });
  expect(posted.status).toBe(403);
});
@@ -1,22 +1,17 @@
/**
 * The app in a terminal. The forge runs this on a pty when someone
 * `ssh`es to the app, over the same data as the page and through the same
 * actions, as the account at the keyboard. j/k move, a adds, d removes the
 * note under the cursor, q leaves. Plain ANSI, no dependencies.
 * `ssh`es to the app, as the account at the keyboard, under exactly the
 * page's rules.
 *
 * There is nothing to watch yet: the scaffold it used to show left with
 * #PAGE, and #TTY rebuilds this as the sea drawn in text from the running
 * server's frames. Until then it says where it is, how to reach it, and
 * quits on q. Plain ANSI, no dependencies.
 */
import {
  addNote,
  canDelete,
  deleteNote,
  listNotes,
  type Note,
} from "./actions.ts";
import { openDb } from "./db.ts";
import { ssh, title, where } from "./env.ts";
import { whoAtTty } from "./who.ts";
const db = openDb();
const me = whoAtTty();
const esc = "\x1b[";
const dim = (s: string): string => `${esc}2m${s}${esc}0m`;
@@ -25,47 +20,21 @@
const out = (s: string): void => {
  process.stdout.write(s);
};
let cursor = 0;
let typing: string | undefined;
let said = "";
const notes = (): Note[] => {
  const listed = listNotes(db, me);
  return listed.ok ? listed.value : [];
};
function draw(): void {
  const rows = notes();
  const lines = [
    `${bold(title)}  ${dim(where)}  ${dim(me.role === "anon" ? "guest" : `${me.name}${me.role === "admin" ? " (admin)" : ""}`)}`,
    ssh === undefined ? "" : dim(`connect: ${ssh}`),
    // The exact command that reaches this terminal, verbatim from the
    // forge — never a guess at one.
    ssh === undefined
      ? dim("the terminal is off in this environment")
      : dim(`connect: ${ssh}`),
    "",
    "The sea is not running yet.",
    dim("A round drawn in text arrives here with the world; the page is"),
    dim("the shell it fills."),
    "",
    dim("q quit"),
  ];
  if (rows.length === 0)
    lines.push(
      dim(
        me.role === "anon"
          ? "No notes yet."
          : "No notes yet. Press a to add one.",
      ),
    );
  rows.forEach((note, i) => {
    const body = i === cursor ? bold(note.body) : note.body;
    lines.push(
      `${i === cursor ? "▸" : " "} ${body}  ${dim(`${note.author_name} · ${note.created_at.slice(0, 16).replace("T", " ")}`)}`,
    );
  });
  lines.push("");
  if (typing !== undefined) lines.push(`New note: ${typing}${esc}7m ${esc}0m`);
  else if (said !== "") lines.push(said);
  else
    lines.push(
      dim(
        me.role === "anon"
          ? "j/k move · q quit · sign in with a key the forge knows to add"
          : "j/k move · a add · d delete · q quit",
      ),
    );
  out(`${esc}2J${esc}H${lines.join("\r\n")}`);
}
@@ -74,42 +43,9 @@
process.stdin.resume();
process.stdin.setEncoding("utf8");
draw();
process.stdin.on("data", (key: string) => {
  said = "";
  if (typing !== undefined) {
    if (key === "\r") {
      const added = addNote(db, me, { body: typing });
      if (!added.ok) said = added.message;
      typing = undefined;
      cursor = 0;
    } else if (key === "\x1b") typing = undefined;
    else if (key === "\x7f") typing = typing.slice(0, -1);
    else if (key >= " ") typing += key;
    draw();
    return;
  }
  if (key === "q" || key === "\x03") {
    out(`${esc}2J${esc}H`);
    process.exit(0);
  }
  const rows = notes();
  if (key === "j" || key === "\x1b[B")
    cursor = Math.min(cursor + 1, Math.max(0, rows.length - 1));
  if (key === "k" || key === "\x1b[A") cursor = Math.max(cursor - 1, 0);
  if (key === "a") {
    if (me.role === "anon") said = "Sign in to add a note.";
    else typing = "";
  }
  if (key === "d") {
    const note = rows[cursor];
    if (note === undefined) said = "Nothing to remove.";
    else if (!canDelete(me, note))
      said = "Only the author or an admin can remove a note.";
    else {
      const removed = deleteNote(db, me, { id: note.id });
      if (!removed.ok) said = removed.message;
      cursor = Math.min(cursor, Math.max(0, rows.length - 2));
    }
  }
  draw();
});
process.stdout.on("resize", draw);
@@ -65,7 +65,7 @@
body {
    sans-serif;
}
.page {
  max-width: 40rem;
  max-width: 58rem;
  margin: 0 auto;
  padding: var(--s5) var(--s4) var(--s6);
}
@@ -110,46 +110,138 @@
code,
}
/* Blocks. */
.card {
.row {
  display: flex;
  flex-wrap: wrap;
  align-items: center;
  gap: var(--s2);
}
.empty {
  color: var(--muted);
  font-size: var(--text-sm);
  text-wrap: pretty;
}
/* The arena and what stands beside it. One column on a phone; the sea and
   its panels side by side once there is room for both to breathe. */
.arena-layout {
  display: grid;
  gap: var(--s5);
  align-items: start;
}
@media (min-width: 52rem) {
  .arena-layout {
    grid-template-columns: minmax(0, 1.5fr) minmax(17rem, 1fr);
    gap: var(--s5) var(--s6);
  }
}
.arena-column,
.side-column {
  display: grid;
  gap: var(--s5);
  min-width: 0;
}
/* The sea keeps its square from CSS alone: width is what makes it square,
   so a height cap can never flatten it, and nothing shifts when the canvas
   arrives to fill it. */
.arena-box {
  width: min(100%, 68vh);
  width: min(100%, 68svh);
  aspect-ratio: 1;
  margin-inline: auto;
  display: grid;
  place-items: center;
  padding: var(--s5);
  box-sizing: border-box;
  background: var(--surface);
  background:
    radial-gradient(
      circle at 50% 42%,
      color-mix(in oklab, var(--accent) 12%, var(--surface)),
      var(--surface) 70%
    ),
    var(--surface);
  border: 1px solid var(--line);
  border-radius: calc(var(--radius) * 1.6);
  position: relative;
  overflow: hidden;
}
/* The rim of the circular sea, drawn once so the square reads as water. */
.arena-box::before {
  content: "";
  position: absolute;
  inset: 4%;
  border: 1px dashed var(--line);
  border-radius: 50%;
}
.arena-empty {
  position: relative;
  max-width: 24rem;
  text-align: center;
  text-wrap: balance;
  font-size: var(--text-lg);
  line-height: 1.4;
}
.arena-empty .muted {
  display: inline-block;
  margin-top: var(--s2);
  font-size: var(--text-sm);
  line-height: 1.5;
}
.rule {
  max-width: 34rem;
  margin-inline: auto;
  text-align: center;
  text-wrap: pretty;
  color: var(--muted);
  font-size: var(--text-sm);
}
/* A panel: a small heading, then the one thing it says. */
.panel {
  background: var(--surface);
  border: 1px solid var(--line);
  border-radius: var(--radius);
  padding: var(--s4);
  margin-bottom: var(--s5);
}
.row {
  display: flex;
  align-items: center;
  display: grid;
  gap: var(--s2);
}
.list {
  list-style: none;
  margin: 0;
  padding: 0;
}
.note {
.panel-title {
  display: flex;
  justify-content: space-between;
  align-items: flex-start;
  align-items: baseline;
  gap: var(--s3);
  padding: var(--s3) 0;
  border-top: 1px solid var(--line);
}
.note:first-child {
  border-top: 0;
}
.note p {
  overflow-wrap: anywhere;
}
.note small {
  margin: 0;
  font-size: var(--text-sm);
}
.empty {
  padding: var(--s6) var(--s4);
  text-align: center;
  font-weight: 650;
  letter-spacing: 0.08em;
  text-transform: uppercase;
  color: var(--muted);
  border: 1px dashed var(--line);
  border-radius: var(--radius);
}
.count {
  font-variant-numeric: tabular-nums;
  letter-spacing: 0;
  font-weight: 500;
}
.clock-time {
  font-size: 2.5rem;
  font-weight: 600;
  line-height: 1;
  letter-spacing: -0.02em;
  font-variant-numeric: tabular-nums;
  /* Room for the widest time it will ever show, reserved now. */
  min-width: 5ch;
}
.sr-only {
  position: absolute;
  width: 1px;
  height: 1px;
  padding: 0;
  margin: -1px;
  overflow: hidden;
  clip-path: inset(50%);
  white-space: nowrap;
}
footer {
  margin-top: var(--s6);
@@ -162,20 +254,6 @@
footer code {
}
/* Controls: at least 44px on a side, keyboard and mouse alike. */
.input {
  flex: 1;
  min-width: 0;
  min-height: var(--tap);
  padding: 0 var(--s3);
  font: inherit;
  color: inherit;
  background: var(--bg);
  border: 1px solid var(--line);
  border-radius: var(--radius);
}
.input::placeholder {
  color: var(--muted);
}
.button {
  min-height: var(--tap);
  padding: 0 var(--s4);
		@@ -14,6 +14,16 @@ FORGE_APP_DATA=./data bun run src/tty.ts # the terminal
14	14	FORGE_APP_DATA=./data bun run src/db.ts --check # schema version, integrity
15	15	```
16	16
	17	## What is real, and what is not yet
	18
	19	The page is the arena and nothing else: a square the sea will be drawn in,
	20	a round clock, one line of the rule, a roster and a ladder — all rendered
	21	on the server, all legible with JavaScript off, none of them fed by a
	22	simulation yet. There is no world tick, no socket and no score behind
	23	them; the regions are shells with honest empty states, and the round loop,
	24	the canvas and the ladder fill them in the issues that follow. `POST /mcp`
	25	answers and lists no tool.
	26
17	27	## The shape
18	28
19	29	One implementation, many doors. `src/actions.ts` is every operation as a
		@@ -23,28 +33,28 @@ decide nothing themselves. `AGENTS.md` says how to add to it.
23	33
24	34	\| file \| what it is \|
25	35	\| ---------------------------------- \| ------------------------------------------------------------ \|
26		\| `src/actions.ts` \| list, add, delete — and who may \|
	36	\| `src/actions.ts` \| every operation, and who may — empty until #DATA \|
27	37	\| `src/who.ts` \| who is asking, from the forge's signed headers \|
28	38	\| `src/db.ts` \| SQLite under `FORGE_APP_DATA`, WAL, forward-only migrations \|
29	39	\| `src/live.ts` \| the in-process bus and `GET /events` \|
30		\| `src/mcp.ts` \| the actions as MCP tools at `POST /mcp` \|
	40	\| `src/mcp.ts` \| the actions as MCP tools at `POST /mcp` — none yet \|
31	41	\| `src/routes.ts` \| every path, in one table \|
32		\| `src/page.ts` \| the HTML, rendered on the server \|
	42	\| `src/page.ts` \| the HTML of the arena, rendered on the server \|
33	43	\| `src/http.ts` \| the floor: headers, body cap, same-origin, rate limit, files \|
34	44	\| `src/server.ts` \| boot: open the database, serve \|
35		\| `src/tty.ts` \| the terminal, over the same actions \|
	45	\| `src/tty.ts` \| the terminal — a placeholder until the world runs \|
36	46	\| `src/env.ts` \| what the forge told this process \|
37		\| `static/app.css`, `static/live.js` \| the look, and the list that stays current \|
	47	\| `static/app.css`, `static/live.js` \| the look, and the regions that stay current \|
38	48
39	49	## Who you are
40	50
41	51	The forge says who is asking on every request it proxies, and the app
42	52	verifies the signature (`src/who.ts`); nothing else is trusted. Three tiers:
43	53
44		- anon — anyone. Reads.
45		- user — signed in to the forge and able to see this app. Adds notes, as
46		themselves, and removes their own.
47		- admin — able to write this repository. Removes any note.
	54	- anon — anyone. Watches, and will swim as a guest.
	55	- user — signed in to the forge and able to see this app. Swims under
	56	their forge name, and is the only kind of swimmer the ladder names.
	57	- admin — able to write this repository.
48	58
49	59	"Sign in" is `/__forge/signin?to=<path>` and "Sign out" is
50	60	`/__forge/signout`; the forge answers both on the app's own host.
		@@ -52,35 +62,27 @@ verifies the signature (`src/who.ts`); nothing else is trusted. Three tiers:
52	62	## Any interface
53	63
54	64	The same actions, the same rules, at every door. A script is the person
55		whose forge grant it carries; a bare script is anonymous.
	65	whose forge grant it carries; a bare script is anonymous. The MCP endpoint
	66	is already here — its tools arrive with the round:
56	67
57	68	```sh
58		curl https://<app>/api/notes
59		curl -X POST https://<app>/api/notes -H 'content-type: application/json' -d '{"body":"hi"}'
60		curl -X DELETE https://<app>/api/notes/1
61		```
62
63		As an MCP server, for Claude Code or Claude Desktop — `list_notes`,
64		`add_note`, `delete_note`:
65
66		```sh
67		claude mcp add --transport http __TITLE__ https://<app>/mcp
	69	claude mcp add --transport http drift https://<app>/mcp
68	70	```
69	71
70	72	```json
71	73	{
72		"mcpServers": { "__TITLE__": { "type": "http", "url": "https://<app>/mcp" } }
	74	"mcpServers": { "drift": { "type": "http", "url": "https://<app>/mcp" } }
73	75	}
74	76	```
75	77
76		The page stays current over `/events`: a note someone else adds or removes
77		appears without a reload. Without JavaScript it is the same page, one
78		reload behind.
	78	The page stays current over `/events`: a region marked `data-live` is
	79	refetched when the round says something on the bus. Without JavaScript it
	80	is the same page, one reload behind.
79	81
80	82	The terminal opens with the exact command in `FORGE_APP_SSH` when the app
81		runs (`ssh -p 2222 <name>@<forge>` — the app is the login name, the forge
82		the host; `<name>--<pull>@<forge>` for a preview's). It is `src/tty.ts` on
83		a real pty over the same data, as the account at the keyboard.
	83	runs (the app is the login name, the forge the host). It is `src/tty.ts` on
	84	a real pty, as the account at the keyboard; today it prints where it is and
	85	quits on `q`, and the sea drawn in text arrives with the world.
84	86
85	87	The forge sets `PORT`, `FORGE_APP_DATA`, `FORGE_APP_ENV` (`production` or
86	88	`preview`), `FORGE_APP_URL`, `FORGE_APP_COMMIT`, `FORGE_APP_SSH` and
		@@ -1,58 +0,0 @@
1		import { expect, test } from "bun:test";
2		import { mkdtempSync } from "node:fs";
3		import { tmpdir } from "node:os";
4		import { join } from "node:path";
5		import { addNote, deleteNote, listNotes } from "./actions.ts";
6		import { openDb } from "./db.ts";
7		import type { Who } from "./who.ts";
8
9		const db = openDb(mkdtempSync(join(tmpdir(), "app-actions-")));
10		const anon: Who = { role: "anon" };
11		const alice: Who = { role: "user", id: "u1", name: "alice" };
12		const bob: Who = { role: "user", id: "u2", name: "bob" };
13		const root: Who = { role: "admin", id: "u0", name: "root" };
14
15		test("anyone reads; only a signed-in person adds, as themselves", () => {
16		expect(listNotes(db, anon)).toEqual({ ok: true, value: [] });
17		const refused = addNote(db, anon, { body: "hello" });
18		expect(refused.ok).toBe(false);
19		if (!refused.ok) expect(refused.error).toBe("signin_required");
20		const added = addNote(db, alice, { body: " hello " });
21		expect(added.ok).toBe(true);
22		if (!added.ok) return;
23		expect(added.value.body).toBe("hello");
24		expect(added.value.author_id).toBe("u1");
25		expect(added.value.author_name).toBe("alice");
26		const all = listNotes(db, anon);
27		expect(all.ok && all.value.length).toBe(1);
28		});
29
30		test("a note is one to five hundred characters", () => {
31		for (const body of ["", " ", "x".repeat(501)]) {
32		const r = addNote(db, alice, { body });
33		expect(r.ok).toBe(false);
34		if (!r.ok) expect(r.error).toBe("invalid");
35		}
36		});
37
38		test("only the author or an admin removes a note", () => {
39		const mine = addNote(db, alice, { body: "mine" });
40		if (!mine.ok) throw new Error(mine.message);
41		const byBob = deleteNote(db, bob, { id: mine.value.id });
42		expect(byBob.ok).toBe(false);
43		if (!byBob.ok) expect(byBob.error).toBe("forbidden");
44		const byAnon = deleteNote(db, anon, { id: mine.value.id });
45		expect(byAnon.ok).toBe(false);
46		if (!byAnon.ok) expect(byAnon.error).toBe("signin_required");
47		expect(deleteNote(db, alice, { id: mine.value.id }).ok).toBe(true);
48		const gone = deleteNote(db, alice, { id: mine.value.id });
49		expect(gone.ok).toBe(false);
50		if (!gone.ok) expect(gone.error).toBe("not_found");
51
52		const bobs = addNote(db, bob, { body: "bob's" });
53		if (!bobs.ok) throw new Error(bobs.message);
54		expect(deleteNote(db, root, { id: bobs.value.id }).ok).toBe(true);
55		const odd = deleteNote(db, root, { id: 1.5 });
56		expect(odd.ok).toBe(false);
57		if (!odd.ok) expect(odd.error).toBe("invalid");
58		});
		@@ -4,90 +4,20 @@
4	4	* the terminal are doors onto these and decide nothing themselves — so a
5	5	* rule written here holds at every door, and a new door is only a new
6	6	* way to call.
	7	*
	8	* The scaffold left with #PAGE; the vocabulary it was written in stays,
	9	* because that vocabulary is the app's. The first real operations — a
	10	* player, a round, a score — land with #DATA.
7	11	*/
8	12
9		import type { Database } from "bun:sqlite";
10		import { emit } from "./live.ts";
11		import type { Who } from "./who.ts";
12
13		export interface Note {
14		readonly id: number;
15		readonly body: string;
16		readonly author_id: string;
17		readonly author_name: string;
18		readonly created_at: string;
19		readonly updated_at: string;
20		}
21
22	13	export type Failure = "signin_required" \| "forbidden" \| "not_found" \| "invalid";
23	14	export type Result<T> =
24	15	\| { ok: true; value: T }
25	16	\| { ok: false; error: Failure; message: string };
26		const ok = <T>(value: T): Result<T> => ({ ok: true, value });
27		const fail = <T>(error: Failure, message: string): Result<T> => ({
	17
	18	export const ok = <T>(value: T): Result<T> => ({ ok: true, value });
	19	export const fail = <T>(error: Failure, message: string): Result<T> => ({
28	20	ok: false,
29	21	error,
30	22	message,
31	23	});
32
33		export const BODY_MAX = 500;
34
35		export function listNotes(
36		db: Database,
37		_who: Who,
38		input: { limit?: number } = {},
39		): Result<Note[]> {
40		const limit = Math.min(
41		Math.max(Math.trunc(input.limit ?? 100) \|\| 100, 1),
42		500,
43		);
44		return ok(
45		db
46		.query<Note, [number]>("SELECT * FROM note ORDER BY id DESC LIMIT ?1")
47		.all(limit),
48		);
49		}
50
51		export function addNote(
52		db: Database,
53		who: Who,
54		input: { body: string },
55		): Result<Note> {
56		if (who.role === "anon")
57		return fail("signin_required", "Sign in to add a note.");
58		const body = input.body.trim();
59		if (body.length === 0 \|\| body.length > BODY_MAX)
60		return fail("invalid", `A note is 1 to ${BODY_MAX} characters.`);
61		const note = db
62		.query<
63		Note,
64		[string, string, string]
65		>("INSERT INTO note (body, author_id, author_name) VALUES (?1, ?2, ?3) RETURNING *")
66		.get(body, who.id, who.name)!;
67		emit("note.added", note);
68		return ok(note);
69		}
70
71		export function deleteNote(
72		db: Database,
73		who: Who,
74		input: { id: number },
75		): Result<{ id: number }> {
76		if (who.role === "anon")
77		return fail("signin_required", "Sign in to remove a note.");
78		if (!Number.isInteger(input.id))
79		return fail("invalid", "A note id is a whole number.");
80		const note = db
81		.query<Note, [number]>("SELECT * FROM note WHERE id = ?1")
82		.get(input.id);
83		if (note === null) return fail("not_found", "No such note.");
84		if (!canDelete(who, note))
85		return fail("forbidden", "Only the author or an admin can remove a note.");
86		db.query("DELETE FROM note WHERE id = ?1").run(note.id);
87		emit("note.removed", { id: note.id });
88		return ok({ id: note.id });
89		}
90
91		/** Whether `who` may remove `note`. The page and the terminal draw from this, so the rule lives once. */
92		export const canDelete = (who: Who, note: Note): boolean =>
93		who.role === "admin" \|\| (who.role === "user" && who.id === note.author_id);
		@@ -20,4 +20,14 @@ test("migrations apply once, in order, and the file checks out", () => {
20	20	db.query<{ foreign_keys: number }, []>("PRAGMA foreign_keys").get()
21	21	?.foreign_keys,
22	22	).toBe(1);
	23	// The scaffold's table left the way a table leaves here: forward, in a
	24	// migration of its own, on a database that already had it.
	25	expect(
	26	db
	27	.query<
	28	{ name: string },
	29	[]
	30	>("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' AND name <> 'schema_version'")
	31	.all(),
	32	).toEqual([]);
23	33	});
		@@ -24,6 +24,10 @@ export const migrations: string[] = [
24	24	updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
25	25	)`,
26	26	`CREATE INDEX note_author ON note (author_id)`,
	27	// The scaffold left (#PAGE) and its table goes with it. A migration that
	28	// has run is history, so the two above stay as they are and this one
	29	// undoes them forward.
	30	`DROP TABLE IF EXISTS note`,
27	31	];
28	32
29	33	export function openDb(dir = dataDir): Database {
		@@ -1,6 +1,6 @@
1	1	/**
2	2	* The floor every response stands on, and the few things a route needs to
3		* read a request safely. Nothing in here knows what a note is.
	3	* read a request safely. Nothing in here knows what the game is.
4	4	*/
5	5
6	6	import { createHash } from "node:crypto";
		@@ -7,7 +7,7 @@
7	7	*/
8	8
9	9	import type { Database } from "bun:sqlite";
10		import { addNote, deleteNote, listNotes, type Result } from "./actions.ts";
	10	import type { Result } from "./actions.ts";
11	11	import { title } from "./env.ts";
12	12	import { fields } from "./http.ts";
13	13	import type { Who } from "./who.ts";
		@@ -23,46 +23,9 @@ interface Tool {
23	23	) => Result<unknown>;
24	24	}
25	25
26		export const tools: readonly Tool[] = [
27		{
28		name: "list_notes",
29		description: "The notes, newest first.",
30		inputSchema: {
31		type: "object",
32		properties: {
33		limit: {
34		type: "integer",
35		minimum: 1,
36		maximum: 500,
37		description: "At most this many (100).",
38		},
39		},
40		},
41		run: (db, who, args) =>
42		listNotes(db, who, { limit: Number(args.limit ?? 100) }),
43		},
44		{
45		name: "add_note",
46		description:
47		"Add a note as the signed-in person. Anonymous callers cannot.",
48		inputSchema: {
49		type: "object",
50		properties: { body: { type: "string", maxLength: 500 } },
51		required: ["body"],
52		},
53		run: (db, who, args) => addNote(db, who, { body: String(args.body ?? "") }),
54		},
55		{
56		name: "delete_note",
57		description: "Remove a note by id. Only its author or an admin can.",
58		inputSchema: {
59		type: "object",
60		properties: { id: { type: "integer" } },
61		required: ["id"],
62		},
63		run: (db, who, args) => deleteNote(db, who, { id: Number(args.id) }),
64		},
65		];
	26	// No tool yet: the scaffold left with #PAGE and the round's tools arrive
	27	// with #DOORS. A caller still gets a well-formed `tools/list`.
	28	export const tools: readonly Tool[] = [];
66	29
67	30	/** One JSON-RPC message in, an HTTP status and a body out (a notification gets 202 and no body). */
68	31	export function rpc(
		@@ -1,14 +1,26 @@
1	1	/**
2		* The page, rendered on the server: the first paint is complete HTML, and
3		* `static/live.js` keeps the notes fresh afterwards. When a second page
4		* arrives, move `layout` to `src/pages/layout.ts` and give each page a file.
	2	* The page, rendered on the server: the first paint is the whole arena —
	3	* the sea's square, the round clock, the rule, the roster and the ladder —
	4	* and it is legible with JavaScript off. `static/live.js` swaps a region
	5	* when the round says something on the bus. Nothing here is a simulation
	6	* yet: the regions are shells with honest empty states, and the round
	7	* (#ROUND), the canvas (#CANVAS) and the ladder (#LADDER) fill them.
	8	*
	9	* When a second page arrives, move `layout` to `src/pages/layout.ts` and
	10	* give each page a file.
5	11	*/
6	12
7		import { canDelete, type Note } from "./actions.ts";
8	13	import { commit, description, env, ssh, title, where } from "./env.ts";
9	14	import { asset, escape } from "./http.ts";
10	15	import type { Who } from "./who.ts";
11	16
	17	/** The one sentence a newcomer has to read: the whole game is other people. */
	18	export const RULE =
	19	"Your own thruster is feeble; the wake other swimmers leave is not. Ride their lane, braid it, and throw the bloom through the gate.";
	20
		sentinelcrew 1mo ago x
	21	/** The roster cap the concept sets (#CONCEPT); the round enforces it. */
	22	export const ROSTER_MAX = 24;
	23
12	24	export function layout(body: string, who: Who): string {
13	25	const door =
14	26	who.role === "anon"
		@@ -22,6 +34,7 @@ export function layout(body: string, who: Who): string {
22	34	<meta name="color-scheme" content="light dark">
23	35	<link rel="icon" href="data:,">
24	36	<title>${escape(title)}</title>
	37	<meta name="description" content="${escape(description)}">
25	38	<link rel="stylesheet" href="${asset("app.css")}">
26	39	<script type="module" src="${asset("live.js")}"></script>
27	40	<body>
		@@ -38,8 +51,8 @@ export function layout(body: string, who: Who): string {
38	51	</header>
39	52	<main>${body}</main>
40	53	<footer class="muted">
41		${ssh === undefined ? "" : `<p>Terminal: <code>${escape(ssh)}</code></p>`}
42		<p>Also at <a href="/api/notes">/api/notes</a> and <code>POST /mcp</code>, with the same rules.</p>
	54	${ssh === undefined ? "<p>The terminal is off in this environment.</p>" : `<p>Terminal: <code>${escape(ssh)}</code></p>`}
	55	<p><code>POST /mcp</code> answers here already; the round's tools and its JSON join it.</p>
43	56	</footer>
44	57	</div>
45	58	</body>
		@@ -47,50 +60,61 @@ export function layout(body: string, who: Who): string {
47	60	`;
48	61	}
49	62
50		export function home(input: {
51		who: Who;
52		notes: readonly Note[];
53		notice?: string \| undefined;
54		}): string {
55		const { who, notes, notice } = input;
56		const composer =
57		who.role === "anon"
58		? `<p class="muted">Reading as a guest. <a href="/__forge/signin?to=/">Sign in</a> to add a note.</p>`
59		: `<form class="row" method="post" action="/notes">
60		<input class="input" name="body" placeholder="Write a note" aria-label="New note" required maxlength="500" autocomplete="off" autofocus>
61		<button class="button">Add</button>
62		</form>`;
63		const list =
64		notes.length === 0
65		? `<p class="empty">No notes yet. Notes written here stay in ${escape(where)} data.</p>`
66		: `<ul class="list">${notes.map((note) => item(note, who)).join("")}</ul>`;
	63	export function home(input: { who: Who; notice?: string \| undefined }): string {
	64	const { who, notice } = input;
67	65	return layout(
68		`<section class="card">${composer}</section>
69		<section id="notes" data-live="note.added note.removed">${list}</section>
	66	`<div class="arena-layout">
	67	<div class="arena-column">
	68	${arena()}
	69	<p class="rule">${escape(RULE)}</p>
	70	</div>
	71	<div class="side-column">
	72	${clock()}
	73	${roster(who)}
	74	${ladder()}
	75	</div>
	76	</div>
70	77	${notice === undefined ? "" : `<p class="toast" role="status">${escape(notice)}</p>`}`,
71	78	who,
72	79	);
73	80	}
74	81
75		const item = (note: Note, who: Who): string => `<li class="note">
76		<div>
77		<p>${escape(note.body)}</p>
78		<small class="muted">${escape(note.author_name)} · <time datetime="${escape(note.created_at)}">${ago(note.created_at)}</time></small>
79		</div>
80		${
81		canDelete(who, note)
82		? `<form method="post" action="/notes/${note.id}/delete"><button class="button button-quiet" aria-label="Remove this note">Remove</button></form>`
83		: ""
84		}
85		</li>`;
	82	// The square the sea is drawn in. It holds its size from CSS alone —
	83	// `aspect-ratio: 1`, capped to the viewport — so the canvas (#CANVAS) drops
	84	// in later without moving a pixel of what is around it.
	85	const arena = (): string =>
	86	`<section id="arena" class="arena" aria-labelledby="arena-title" data-live="round.started round.ended">
	87	<h2 id="arena-title" class="sr-only">The sea</h2>
	88	<div class="arena-box">
	89	<p class="arena-empty">The sea is flat.
	90	<span class="muted">Motes, the currents they leave behind and the bloom they carry are drawn here once the world is running.</span>
	91	</p>
	92	</div>
	93	</section>`;
86	94
87		const ago = (iso: string): string => {
88		const s = Math.max(0, (Date.now() - Date.parse(iso)) / 1000);
89		if (s < 60) return "just now";
90		if (s < 3600) return `${Math.floor(s / 60)}m ago`;
91		if (s < 86400) return `${Math.floor(s / 3600)}h ago`;
92		return new Date(iso).toLocaleDateString("en", {
93		month: "short",
94		day: "numeric",
95		});
96		};
	95	// A clock that cannot shift when it starts counting: tabular figures, and a
	96	// width reserved for the widest time it will ever show. The dashes are a
	97	// placeholder and say nothing a screen reader needs — the sentence under
	98	// them does; when #ROUND puts a real time there, that attribute goes.
	99	const clock = (): string =>
	100	`<section id="clock" class="panel clock" aria-labelledby="clock-title" data-live="round.started round.ended">
	101	<h2 id="clock-title" class="panel-title">Round</h2>
	102	<p class="clock-time" aria-hidden="true">--:--</p>
	103	<p class="empty">No round yet. One runs three minutes, then twenty seconds of quiet.</p>
	104	</section>`;
	105
	106	const roster = (who: Who): string =>
	107	`<section id="roster" class="panel" aria-labelledby="roster-title" data-live="round.started round.ended">
	108	<h2 id="roster-title" class="panel-title">In the sea <span class="count">0/${ROSTER_MAX}</span></h2>
	109	<p class="empty">Nobody is swimming yet. ${
	110	who.role === "anon"
	111	? "When the world starts you can swim as a guest, or sign in first and swim under your forge name."
	112	: `When the world starts you swim as <b>${escape(who.name)}</b>.`
	113	}</p>
	114	</section>`;
	115
	116	const ladder = (): string =>
	117	`<section id="ladder" class="panel" aria-labelledby="ladder-title" data-live="round.ended">
	118	<h2 id="ladder-title" class="panel-title">Ladder</h2>
	119	<p class="empty">No round has finished. Seven days of them will stand here, credited to the swimmers whose current moved the bloom.</p>
	120	</section>`;
		@@ -2,27 +2,14 @@
2	2	* Every path the app answers, in one table. A route reads its request,
3	3	* calls an action, and shapes the answer for its door — HTML for a
4	4	* browser, JSON for a script — and that is all a route does.
	5	*
	6	* Today that is the page, the event stream, the MCP endpoint and the
	7	* files: the scaffold's routes left with #PAGE, and the round's JSON
	8	* doors arrive with #DOORS.
5	9	*/
6	10
7	11	import type { Database } from "bun:sqlite";
8		import {
9		addNote,
10		deleteNote,
11		listNotes,
12		type Failure,
13		type Result,
14		} from "./actions.ts";
15		import {
16		back,
17		fields,
18		html,
19		json,
20		readForm,
21		readJson,
22		readNotice,
23		staticFile,
24		text,
25		} from "./http.ts";
	12	import { html, json, readJson, readNotice, staticFile, text } from "./http.ts";
26	13	import { events } from "./live.ts";
27	14	import { rpc } from "./mcp.ts";
28	15	import { home } from "./page.ts";
		@@ -42,86 +29,17 @@ export interface Route {
42	29	readonly handle: (ctx: Context) => Response \| Promise<Response>;
43	30	}
44	31
45		const STATUS: Record<Failure, number> = {
46		signin_required: 401,
47		forbidden: 403,
48		not_found: 404,
49		invalid: 422,
50		};
51
52		/** A result as JSON: the value, or `{ error, message }` with the matching status. */
53		const answer = <T>(result: Result<T>, status = 200): Response =>
54		result.ok
55		? json(result.value, status)
56		: json(
57		{ error: result.error, message: result.message },
58		STATUS[result.error],
59		);
60
61		/** A result for a form: back to the page, with what went wrong if it did. */
62		const done = <T>(result: Result<T>): Response =>
63		result.ok ? back() : back(result.message);
64
65	32	export const routes: readonly Route[] = [
66		// The page. Forms post and come back; the list stays live over /events.
	33	// The page: the whole arena in the first paint, live regions kept fresh
	34	// over /events.
67	35	{
68	36	method: "GET",
69	37	path: "/",
70	38	handle: (c) => {
71	39	const { notice, clear } = readNotice(c.request);
72		const notes = listNotes(c.db, c.who);
73		return html(
74		home({ who: c.who, notes: notes.ok ? notes.value : [], notice }),
75		200,
76		clear,
77		);
	40	return html(home({ who: c.who, notice }), 200, clear);
78	41	},
79	42	},
80		{
81		method: "POST",
82		path: "/notes",
83		handle: async (c) => {
84		const form = await readForm(c.request);
85		if (form === undefined) return text("too large", 413);
86		return done(
87		addNote(c.db, c.who, { body: String(form.get("body") ?? "") }),
88		);
89		},
90		},
91		{
92		method: "POST",
93		path: "/notes/:id/delete",
94		handle: (c) => done(deleteNote(c.db, c.who, { id: Number(c.params.id) })),
95		},
96
97		// The JSON API: the same actions, the same identity, plain status codes.
98		{
99		method: "GET",
100		path: "/api/notes",
101		handle: (c) =>
102		answer(
103		listNotes(c.db, c.who, {
104		limit: Number(c.url.searchParams.get("limit") ?? 100),
105		}),
106		),
107		},
108		{
109		method: "POST",
110		path: "/api/notes",
111		handle: async (c) => {
112		const body = await readJson(c.request);
113		if (body === undefined) return json({ error: "too_large" }, 413);
114		return answer(
115		addNote(c.db, c.who, { body: String(fields(body).body ?? "") }),
116		201,
117		);
118		},
119		},
120		{
121		method: "DELETE",
122		path: "/api/notes/:id",
123		handle: (c) => answer(deleteNote(c.db, c.who, { id: Number(c.params.id) })),
124		},
125	43
126	44	// Live events, and the MCP server (the tools are the actions too).
127	45	{ method: "GET", path: "/events", handle: (c) => events(c.request) },
		@@ -2,6 +2,8 @@ import { afterAll, expect, test } from "bun:test";
2	2	import { mkdtempSync } from "node:fs";
3	3	import { tmpdir } from "node:os";
4	4	import { join } from "node:path";
	5	import { emit } from "./live.ts";
	6	import { RULE } from "./page.ts";
5	7	import { serve } from "./server.ts";
6	8	import { sign } from "./who.ts";
7	9
		@@ -27,8 +29,6 @@ const as = (
27	29	};
28	30	};
29	31	const alice = as("u1", "alice");
30		const bob = as("u2", "bob");
31		const root = as("u0", "root", "admin");
32	32	const jsonBody = (body: unknown): RequestInit => ({
33	33	headers: { "content-type": "application/json" },
34	34	body: JSON.stringify(body),
		@@ -47,81 +47,52 @@ const rpc = (message: unknown, who: Record<string, string> = {}) =>
47	47	(r) => r.json() as Promise<any>,
48	48	);
49	49
	50	test("/ is the arena, whole in the first paint", async () => {
	51	const response = await fetch(base + "/");
	52	expect(response.status).toBe(200);
	53	expect(response.headers.get("content-type")).toContain("text/html");
	54	const page = await response.text();
	55	expect(page).toContain("<h1>");
	56	// The four regions the round, the canvas and the ladder fill later.
	57	for (const id of ["arena", "clock", "roster", "ladder"])
	58	expect(page).toContain(`id="${id}"`);
	59	// One line of rule text, and a clock that reads before it runs.
	60	expect(page).toContain(RULE.slice(0, 40));
	61	expect(page).toContain('class="clock-time"');
	62	// No script is needed for any of it: the markup is all server-rendered.
	63	expect(page).toContain("No round has finished");
	64	});
	65
	66	test("the arena box reserves its square in CSS, not in script", async () => {
	67	const css = await (await fetch(base + "/static/app.css")).text();
	68	const box = /\.arena-box \{([^}]*)\}/.exec(css)?.[1] ?? "";
	69	expect(box).toContain("aspect-ratio: 1");
	70	expect(box).toContain("width: min(100%, 68svh)");
	71	});
	72
50	73	test("the page knows who you are and offers the right door", async () => {
51	74	const guest = await (await fetch(base + "/")).text();
52		expect(guest).toContain("<h1>");
53	75	expect(guest).toContain("/__forge/signin?to=/");
54		expect(guest).not.toContain('action="/notes"');
55	76	const signed = await (await api("/", {}, alice)).text();
56	77	expect(signed).toContain("<b>alice</b>");
57	78	expect(signed).toContain("/__forge/signout");
58		expect(signed).toContain('action="/notes"');
59	79	});
60	80
61		test("a form post adds as the person; a guest is sent to sign in", async () => {
62		const form = new FormData();
63		form.set("body", "hello from a form");
64		const refused = await api("/notes", {
65		method: "POST",
66		body: form,
67		redirect: "manual",
68		});
69		expect(refused.status).toBe(303);
70		expect(refused.headers.get("set-cookie")).toContain("notice=");
71		expect(refused.headers.get("set-cookie")).toContain("SameSite=Lax");
72		expect(await (await fetch(base + "/")).text()).not.toContain(
73		"hello from a form",
74		);
75		const posted = await api(
76		"/notes",
77		{ method: "POST", body: form, redirect: "manual" },
78		alice,
79		);
80		expect(posted.status).toBe(303);
81		expect(posted.headers.get("set-cookie")).toBeNull();
82		const page = await (await api("/", {}, alice)).text();
83		expect(page).toContain("hello from a form");
84		expect(page).toContain("alice ·");
	81	test("the scaffold's routes are gone, and a 404 stands on the floor", async () => {
	82	const page = await (await fetch(base + "/")).text();
	83	expect(page.toLowerCase()).not.toContain("note");
	84	for (const path of ["/api/notes", "/api/notes/1", "/notes"]) {
	85	const response = await fetch(base + path);
	86	expect(response.status).toBe(404);
	87	expect(response.headers.get("content-security-policy")).toContain(
	88	"default-src 'self'",
	89	);
	90	expect(response.headers.get("x-content-type-options")).toBe("nosniff");
	91	}
	92	expect((await api("/notes", { method: "POST" }, alice)).status).toBe(404);
85	93	});
86	94
87		test("the JSON API is the same actions with the same identity", async () => {
88		const created = await api(
89		"/api/notes",
90		{ method: "POST", ...jsonBody({ body: "over the api" }) },
91		alice,
92		);
93		expect(created.status).toBe(201);
94		const note = (await created.json()) as { id: number; author_name: string };
95		expect(note.author_name).toBe("alice");
96		const listed = (await (await fetch(base + "/api/notes")).json()) as {
97		id: number;
98		}[];
99		expect(listed.map((n) => n.id)).toContain(note.id);
100		expect(
101		(await api("/api/notes", { method: "POST", ...jsonBody({ body: "anon" }) }))
102		.status,
103		).toBe(401);
104		expect(
105		(await api(`/api/notes/${note.id}`, { method: "DELETE" }, bob)).status,
106		).toBe(403);
107		expect(
108		(await api(`/api/notes/${note.id}`, { method: "DELETE" }, alice)).status,
109		).toBe(200);
110		expect(
111		(await api(`/api/notes/${note.id}`, { method: "DELETE" }, alice)).status,
112		).toBe(404);
113		expect(
114		(
115		await api(
116		"/api/notes",
117		{ method: "POST", ...jsonBody({ body: "" }) },
118		alice,
119		)
120		).status,
121		).toBe(422);
122		});
123
124		test("the MCP server lists the tools and calls them as the caller", async () => {
	95	test("the MCP server answers, with no tool to call yet", async () => {
125	96	const hello = await rpc({
126	97	jsonrpc: "2.0",
127	98	id: 1,
		@@ -130,34 +101,14 @@ test("the MCP server lists the tools and calls them as the caller", async () =>
130	101	});
131	102	expect(hello.result.capabilities).toEqual({ tools: {} });
132	103	const listed = await rpc({ jsonrpc: "2.0", id: 2, method: "tools/list" });
133		expect(listed.result.tools.map((t: { name: string }) => t.name)).toEqual([
134		"list_notes",
135		"add_note",
136		"delete_note",
137		]);
138		const call = (name: string, args: unknown, who = {}) =>
139		rpc(
140		{
141		jsonrpc: "2.0",
142		id: 3,
143		method: "tools/call",
144		params: { name, arguments: args },
145		},
146		who,
147		);
148		const refused = await call("add_note", { body: "as nobody" });
149		expect(refused.result.isError).toBe(true);
150		const added = await call("add_note", { body: "over mcp" }, root);
151		expect(added.result.isError).toBeUndefined();
152		const note = JSON.parse(added.result.content[0].text);
153		expect(note.author_name).toBe("root");
154		const notes = JSON.parse(
155		(await call("list_notes", {})).result.content[0].text,
156		);
157		expect(notes.map((n: { id: number }) => n.id)).toContain(note.id);
158		expect(
159		(await call("delete_note", { id: note.id }, root)).result.isError,
160		).toBeUndefined();
	104	expect(listed.result.tools).toEqual([]);
	105	const missing = await rpc({
	106	jsonrpc: "2.0",
	107	id: 3,
	108	method: "tools/call",
	109	params: { name: "join", arguments: {} },
	110	});
	111	expect(missing.error.code).toBe(-32602);
161	112	expect(
162	113	(await rpc({ jsonrpc: "2.0", id: 4, method: "nothing" })).error.code,
163	114	).toBe(-32601);
		@@ -181,13 +132,9 @@ test("a change is on the event stream, and a late client hears what it missed",
181	132	if (frame) return { id: frame[1]!, type: JSON.parse(frame[2]!).type };
182	133	}
183	134	};
184		await api(
185		"/api/notes",
186		{ method: "POST", ...jsonBody({ body: "live" }) },
187		alice,
188		);
	135	emit("round.started", { id: 1 });
189	136	const heard = await next();
190		expect(heard.type).toBe("note.added");
	137	expect(heard.type).toBe("round.started");
191	138	await reader.cancel();
192	139	const late = await fetch(base + "/events", {
193	140	headers: { "last-event-id": String(Number(heard.id) - 1) },
		@@ -196,22 +143,24 @@ test("a change is on the event stream, and a late client hears what it missed",
196	143	(await late.body!.getReader().read()).value,
197	144	);
198	145	expect(replay).toContain(`id: ${heard.id}\n`);
199		expect(replay).toContain("note.added");
	146	expect(replay).toContain("round.started");
200	147	});
201	148
202	149	test("writes are rationed per person", async () => {
203	150	const flood = as("u9", "flood");
204		const answers = await Promise.all(
	151	const codes = await Promise.all(
205	152	Array.from({ length: 40 }, () =>
206	153	api(
207		"/api/notes",
208		{ method: "POST", ...jsonBody({ body: "again" }) },
	154	"/mcp",
	155	{
	156	method: "POST",
	157	...jsonBody({ jsonrpc: "2.0", id: 1, method: "ping" }),
	158	},
209	159	flood,
210		),
	160	).then((r) => r.status),
211	161	),
212	162	);
213		const codes = answers.map((r) => r.status);
214		expect(codes).toContain(201);
	163	expect(codes).toContain(200);
215	164	expect(codes).toContain(429);
216	165	});
217	166
		@@ -221,21 +170,21 @@ test("stands on the security floor", async () => {
221	170	"default-src 'self'",
222	171	);
223	172	expect(response.headers.get("x-content-type-options")).toBe("nosniff");
224		expect(
225		(await fetch(base + "/api/notes")).headers.get("content-security-policy"),
226		).toContain("default-src");
	173	expect(response.headers.get("referrer-policy")).toBe(
	174	"strict-origin-when-cross-origin",
	175	);
227	176	});
228	177
229	178	test("a body is capped by the bytes read, whatever it claims", async () => {
230		const response = await api(
231		"/notes",
232		{
233		method: "POST",
234		headers: { "content-type": "application/x-www-form-urlencoded" },
235		body: "body=" + "x".repeat(1024 * 1024),
236		},
237		alice,
238		);
	179	const response = await api("/mcp", {
	180	method: "POST",
	181	headers: { "content-type": "application/json" },
	182	body: JSON.stringify({
	183	jsonrpc: "2.0",
	184	id: 1,
	185	ping: "x".repeat(1024 * 1024),
	186	}),
	187	});
239	188	expect(response.status).toBe(413);
240	189	});
241	190
		@@ -246,21 +195,15 @@ test("HEAD sees the app up", async () => {
246	195	});
247	196
248	197	test("refuses a cross-site post", async () => {
249		const form = new FormData();
250		form.set("body", "from another site");
251		const posted = await api(
252		"/notes",
253		{
254		method: "POST",
255		body: form,
256		redirect: "manual",
257		headers: {
258		origin: "https://evil.example",
259		"sec-fetch-site": "cross-site",
260		},
	198	const posted = await api("/mcp", {
	199	method: "POST",
	200	...jsonBody({ jsonrpc: "2.0", id: 1, method: "ping" }),
	201	headers: {
	202	"content-type": "application/json",
	203	origin: "https://evil.example",
	204	"sec-fetch-site": "cross-site",
261	205	},
262		alice,
263		);
	206	});
264	207	expect(posted.status).toBe(403);
265	208	});
266	209