mirror of
https://github.com/hanzoai/works.git
synced 2026-10-30 18:17:58 +00:00
zeekay
81660426dc
A one-page site for the operator's half of the cloud — sales, marketing, support, books, cap table, incorporation, workflows — built so that a claim and a served route are the same object. Every card names a real capability, its real /v1 address, and the sentence that capability publishes about itself: its Go package doc, lifted into the OpenAPI tag and read back out of public.yaml, the ga-only public contract. Copy therefore cannot outrun the fleet. A gate asserts llms.txt still names every capability the page shows, because the drift that matters is the one where the site tells a person about something it never tells a model. robots.txt names the AI crawlers and allows them, and declares Content-Signal: search=yes, ai-input=yes, ai-train=yes. It carries no Disallow, and a gate fails the build if one appears. Auth is Hanzo IAM and nothing else — PKCE-S256, which is what lets a static export run it with no server. The gates prove it against the real issuer rather than asserting it.
40 lines
1.5 KiB
JavaScript
40 lines
1.5 KiB
JavaScript
// The gates measure the EXPORT, so they need something that serves the export
|
|
// the way the Sites plane does: directory indexes, and a real 404 for a path
|
|
// with no file. Twenty lines of node beats a dependency.
|
|
import { createServer } from 'node:http'
|
|
import { readFile, stat } from 'node:fs/promises'
|
|
import { join, extname, normalize } from 'node:path'
|
|
|
|
const root = new URL('../out/', import.meta.url).pathname
|
|
const port = Number(process.env.PORT || 4319)
|
|
|
|
const TYPES = {
|
|
'.html': 'text/html; charset=utf-8',
|
|
'.js': 'text/javascript; charset=utf-8',
|
|
'.css': 'text/css; charset=utf-8',
|
|
'.txt': 'text/plain; charset=utf-8',
|
|
'.xml': 'application/xml; charset=utf-8',
|
|
'.json': 'application/json; charset=utf-8',
|
|
'.woff2': 'font/woff2',
|
|
'.svg': 'image/svg+xml',
|
|
}
|
|
|
|
createServer(async (req, res) => {
|
|
// normalize() collapses `..`, so a crafted path cannot climb out of out/.
|
|
const rel = normalize(decodeURIComponent(req.url.split('?')[0])).replace(/^(\.\.[/\\])+/, '')
|
|
let file = join(root, rel)
|
|
try {
|
|
if ((await stat(file)).isDirectory()) file = join(file, 'index.html')
|
|
} catch {
|
|
file = extname(file) ? file : `${file}/index.html`
|
|
}
|
|
try {
|
|
const body = await readFile(file)
|
|
res.writeHead(200, { 'content-type': TYPES[extname(file)] || 'application/octet-stream' })
|
|
res.end(body)
|
|
} catch {
|
|
res.writeHead(404, { 'content-type': 'text/plain' })
|
|
res.end('not found')
|
|
}
|
|
}).listen(port, () => console.log(`serving out/ on http://127.0.0.1:${port}`))
|