// components.js — the shared kernel every page of a make-my-arg project loads. // // Loaded by every page BEFORE the vendored Alpine runtime (script order: base.md §2). It carries // only what never changes between projects: the md5 primitive, the hash helper, the session store, // and the readState store. The module components themselves are registered on alpine:init from the // template files in the skill repo (assets/templates/js/modules/) — copy in ONLY the components // docs/system-profile.md selected and delete the rest: shipping machinery the profile did not // select is a module drift (references/common-mistakes.md §6). Never redefine hash / session / // readState inside a copied body — this file is their single home. // // Hash contract (four sides, byte-identical — references/structure/tooling.md §3 item 4): // this helper · tools/hash.mjs · tools/build-keywords.mjs · tools/check-credentials.mjs // String(w).trim().toLowerCase() -> md5 -> base64 // Switching algorithms means editing all of them in one change, then re-generating every table // built under the old rule (R3). /* ── md5 (RFC 1321) ────────────────────────────────────────────────────────────── Synchronous and dependency-free: WebCrypto has no MD5, so the primitive lives here. The output is byte-identical to node:crypto's md5, which is what the tools above compute. */ const md5 = (input) => { const msg = new TextEncoder().encode(String(input)); const blocks = Math.ceil((msg.length + 9) / 64); // 0x80 pad + 8-byte length const buf = new Uint8Array(blocks * 64); buf.set(msg); buf[msg.length] = 0x80; const view = new DataView(buf.buffer); const bits = msg.length * 8; // safe below 2^53 bits view.setUint32(buf.length - 8, bits >>> 0, true); view.setUint32(buf.length - 4, Math.floor(bits / 4294967296), true); // Per-step rotate amounts and the sine-derived constant table (RFC 1321 T[1..64]). const S = [7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21]; const K = Array.from({ length: 64 }, (_, i) => Math.floor(Math.abs(Math.sin(i + 1)) * 4294967296)); let a0 = 0x67452301, b0 = 0xefcdab89, c0 = 0x98badcfe, d0 = 0x10325476; for (let off = 0; off < buf.length; off += 64) { const M = Array.from({ length: 16 }, (_, i) => view.getUint32(off + i * 4, true)); let A = a0, B = b0, C = c0, D = d0; for (let i = 0; i < 64; i++) { let F, g; if (i < 16) { F = (B & C) | (~B & D); g = i; } else if (i < 32) { F = (D & B) | (~D & C); g = (5 * i + 1) % 16; } else if (i < 48) { F = B ^ C ^ D; g = (3 * i + 5) % 16; } else { F = C ^ (B | ~D); g = (7 * i) % 16; } F = (F + A + K[i] + M[g]) | 0; A = D; D = C; C = B; B = (B + ((F << S[i]) | (F >>> (32 - S[i])))) | 0; // rotate left, then add } a0 = (a0 + A) | 0; b0 = (b0 + B) | 0; c0 = (c0 + C) | 0; d0 = (d0 + D) | 0; } const hex = []; for (const v of [a0, b0, c0, d0]) for (let i = 0; i < 4; i++) hex.push(((v >>> (i * 8)) & 0xff).toString(16).padStart(2, '0')); return hex.join(''); }; /* ── hash: the one helper gate inputs and keyword tables are keyed by ───────────── Mirrors tools/hash.mjs exactly. md5 is hex here, base64 out — never mix the two forms. */ const hash = (w) => btoa(String.fromCharCode(...md5(String(w).trim().toLowerCase()).match(/../g).map((h) => parseInt(h, 16)))); /* ── Session store ────────────────────────────────────────────────────────────── Access state MUST survive a result opened in a new tab (target="_blank"): per-tab sessionStorage does not, so the state lives in a session cookie (no max-age/expires → cleared when the browser closes) with sessionStorage as the private-mode fallback. Rename ACCESS_KEY per project. Session state is technical, never explained to the player. */ const ACCESS_KEY = 'access', SKIN_KEY = 'skin'; const session = { _read(key) { const m = document.cookie.match(new RegExp('(?:^|; )' + key + '=([^;]*)')); if (m) { try { return JSON.parse(decodeURIComponent(m[1])); } catch (e) { /* fall through */ } } try { return JSON.parse(sessionStorage.getItem(key) || 'null'); } catch (e) { return null; } }, _write(key, val) { const v = encodeURIComponent(JSON.stringify(val)); document.cookie = `${key}=${v}; path=/; SameSite=Lax`; // session cookie: deliberately no expiry try { sessionStorage.setItem(key, JSON.stringify(val)); } catch (e) { /* private mode */ } }, access() { return this._read(ACCESS_KEY) || []; }, grant(ids) { this._write(ACCESS_KEY, [...new Set([...this.access(), ...ids])]); }, reskin(name) { if (name) this._write(SKIN_KEY, name); }, // optional: a skin token deep pages apply skin() { return this._read(SKIN_KEY); }, }; /* ── Read-state store (M14) ───────────────────────────────────────────────── World-response state (references/guardrails.md R13): an entry appears once its source page was read. Persist ONLY when docs/system-profile.md records the persistent/world-response contract (references/structure/form-device.md §3); on a remote system swap localStorage for sessionStorage. The checker-visible contract is the data-after attribute on the anchor — this store is what the DOM render reads. Storage is technical, never explained to the player. */ const READ_KEY = 'read'; // rename per project const readState = { mark(page) { try { const s = new Set(JSON.parse(localStorage.getItem(READ_KEY) || '[]')); s.add(page); localStorage.setItem(READ_KEY, JSON.stringify([...s])); } catch (e) { /* private mode */ } }, has(page) { try { return JSON.parse(localStorage.getItem(READ_KEY) || '[]').includes(page); } catch (e) { return false; } }, }; /* ── Component registration ───────────────────────────────────────────────────── The vendored runtime auto-starts right after its own script tag, so registrations queue on the alpine:init event it dispatches before the DOM walk. Register ONLY what the profile selected; each component body ships as a real file in the skill repo under assets/templates/js/modules/ (step 6a copies the selected bodies into this listener; mount markup: assets/templates/html/, rules: references/structure/components.md): search.js (M1) · x-data="search", data-index="data/keywords.surface.json" gate.js (M2) · x-data="gate", data-expect-hash on each input, data-next / x-show="unlocked" access.js (M3) · x-data="access", data-access on the protected page (references/structure/form-system.md) staging.js (M12) · blackout / typewriter / reveal — timers released in destroy() progress.js (M7) · footer span, data-page / data-total on read-state.js (M14) · x-data="markRead(page)" on the source page; anchors carry data-after (references/structure/form-device.md §3–§4) phone.js (device class phone) · x-data="phone" on the shell M5 reskin needs no component here: deep pages link secret.css directly and session.reskin() above carries the token. The stores above (hash / session / readState) are THIS file — copied bodies depend on them; never redefine one inside a component. No component may route or switch scenes: Alpine owns in-page lifecycle only (R1). */ /* Project registrations — docs/system-profile.md (Container A + nested D, pure-web): search (M1) · gate (M2, shapes A/B/C incl. login-multi) · access (M3) · staging (M12) · progress (M7, SESSION MODE) · markRead (M14). State contract: login = kernel session cookie; progress = none persistent — the M7 footer numbering runs off a session-scoped seen list (the template's localStorage swapped to sessionStorage per references/structure/form-device.md §3 / components.md §6: remote system, cleared on browser close, no save/continue/wipe boot surface); world-response = kernel readState store + markRead + data-after anchors (2 edges, landed in 6b). Out of the game per the profile: phone.js (pure-web), forbidden.css (M6 off — data/forbidden.json ships as an empty zero-entry table ONLY because the verbatim search.js fetches it unconditionally; no forbidden state can fire and no M6 skin is linked). Bodies below are copied verbatim from assets/templates/js/modules/ except the one sanctioned storage swap in progress. No component routes or switches scenes (R1). */ document.addEventListener('alpine:init', () => { // M1 search — Alpine component body. Depends on the starter kernel's hash() // (assets/starter/assets/js/components.js, byte-identical to tools/hash.mjs). // Copy into the project's components.js inside the alpine:init listener when the profile selects M1. // Mount shape: assets/templates/html/search.html (layer scoping, R8; result titles are catalog // entries, R9; see references/structure/components.md §2). Alpine.data('search', () => ({ q: '', state: 'empty', // empty | forbidden | hit | miss results: [], forbidden: null, async init() { // Alpine lifecycle: runs before the component renders this.q = new URLSearchParams(location.search).get('q')?.trim().toLowerCase() ?? ''; if (!this.q) return; const enc = hash(this.q); // Resolve both tables relative to the mounting page: data-index is kept relative to the mounting // page (search.html template contract), so a deep search carries "../../data/keywords.secret.json" // and its forbidden table lives beside it. Deriving forbidden from the index directory keeps the // root hub ("data/…") and a deep page ("../../data/…") both correct. const idx = this.$el.dataset.index; const forbiddenUrl = new URL('forbidden.json', new URL(idx, location.href)).href; const forbiddenTable = await (await fetch(forbiddenUrl)).json(); const hit = Object.values(forbiddenTable).find(f => f.keywords.includes(enc)); if (hit) { // State 3: forbidden — full-page reskin (background/title/logo/footer) this.forbidden = hit; this.state = 'forbidden'; document.body.classList.add('body-forbidden'); document.querySelector('.progress').textContent = 'ex/36'; return; } const map = await (await fetch(idx)).json(); this.results = map[enc] ?? []; this.state = this.results.length ? 'hit' : 'miss'; }, })); // M2 gate — Alpine component body. Depends on the starter kernel's hash() and session store // (assets/starter/assets/js/components.js) — do NOT redefine them here; the session cookie helper // and ACCESS_KEY/SKIN_KEY live in the kernel, shared with the access component (references/structure/components.md §3). // Shapes and mount markup: assets/templates/html/gate-a.html (navigate on success), // gate-b.html (unlock in place — the post-gate block must carry x-show="unlocked", the marker // check-solvable.mjs keys on), login-multi.html (system containers, data-grants map). // Credential triad + design rules (R3, R4): references/structure/components.md §3. Alpine.data('gate', () => ({ error: '', busy: false, unlocked: false, successText: '', _t: null, init() { this.successText = this.$el.dataset.successText || ''; }, submit() { const el = this.$root; // data-* live on the component root; the submit event's target is the
const inputs = Array.from(el.querySelectorAll('input[data-expect-hash],input[data-expect-any]')); // Single-box multi-identity (login-multi.html). data-grants is a JSON map on the root: // { "": { "id": "intern", "pw": ["", …], "reskin": "secret" }, … } // It resolves WHICH identity the typed account grants and validates the password against that identity, // so one login box can serve several roles without splitting into several forms on the page. data-grant // stays on the root as the flat list of identities check-solvable walks; data-grants is the runtime truth. let ok, grantIds = []; if (el.dataset.grants) { const map = JSON.parse(el.dataset.grants); const acc = inputs.find((i) => i.type !== 'password'); const pw = inputs.find((i) => i.type === 'password'); const entry = acc ? map[hash(acc.value || '')] : null; ok = !!entry && (!pw || (entry.pw || []).includes(hash(pw.value || ''))); // account+password are paired if (ok) { grantIds = entry.id ? [entry.id] : []; session.reskin(entry.reskin); } } else { // Legacy / multi-field gates: every data-expect-hash input must match; data-expect-any accepts any // non-empty value (a declared wildcard, references/structure/form-device.md §4); data-grant is unconditional. ok = inputs.length > 0 && inputs.every((inp) => { if (inp.dataset.expectAny) return (inp.value || '').trim() !== ''; const expects = (inp.dataset.expectHash || '').split(',').map((s) => s.trim()).filter(Boolean); return expects.includes(hash(inp.value || '')); }); grantIds = (el.dataset.grant || '').split(',').map((s) => s.trim()).filter(Boolean); } if (ok) { if (grantIds.length) session.grant(grantIds); const next = el.dataset.next; const hold = parseInt(el.dataset.successHold || '0', 10); const staged = this.successText && hold > 0; const finish = () => { if (next) location.href = next; else { this.busy = false; this.unlocked = true; } }; if (staged) { this.busy = true; this._t = setTimeout(finish, hold); } else finish(); return; } this.error = el.dataset.failHint || 'Verification failed.'; // inline red text; a bare alert breaks the facade el.animate([{ transform: 'translateX(0)' }, { transform: 'translateX(-6px)' }, { transform: 'translateX(6px)' }, { transform: 'translateX(0)' }], 320); }, destroy() { clearTimeout(this._t); }, })); // M3 access — Alpine component body. Depends on the starter kernel's session store // (assets/starter/assets/js/components.js — cookie-first, sessionStorage fallback in private mode); // do NOT redefine session or hash here. Copy into the project's components.js inside the // alpine:init listener when the profile selects M3 (system containers B/C/D). // Mount shape: assets/templates/html/access-protected.html (references/structure/form-system.md §3). // The x-show="unlocked" block is the marker check-solvable.mjs keys on; a page opens ONLY to the // accounts it names — no privilege ladder (R10). Alpine.data('access', () => ({ unlocked: false, init() { const held = session.access(); // kernel helper: cross-tab session cookie const need = (this.$el.dataset.access || '').split(',').map((s) => s.trim()).filter(Boolean); this.unlocked = need.some((r) => (r === '*' ? held.length > 0 : held.includes(r))); const skin = session.skin(); // optional reskin token granted at login (M5) if (skin) document.body.classList.add(skin); }, })); // M12 interaction staging — Alpine component bodies: blackout / typewriter / reveal. // All timers and observers are registered in init() and released in destroy(), so a staged // effect survives or dies with its component. Copy the selected bodies into the project's // components.js inside the alpine:init listener when the profile selects M12. // Sensory variants (audio puzzle, flashlight mask) live in the fiction's own page; the same // lifecycle rule holds. references/design-playbook.md §2 M12; declare hardware on the entry page (step 8). // "The system has noticed you": delayed blackout after unlock; optional `next` navigates 5s later. Alpine.data('blackout', (delay = 3000, text = '', next = null) => ({ visible: false, text, showTimer: null, exitTimer: null, init() { this.showTimer = setTimeout(() => { this.visible = true; if (next) this.exitTimer = setTimeout(() => (location.href = next), 5000); }, delay); }, destroy() { clearTimeout(this.showTimer); clearTimeout(this.exitTimer); }, })); // mount:
// Delete the element's original text character by character, then retype newText — ceremonial effect. Alpine.data('typewriter', (newText, speed = 60) => ({ output: '', timer: null, init() { const original = this.$el.textContent; let i = original.length; this.output = original; this.timer = setInterval(() => { this.output = original.slice(0, --i); if (i > 0) return; clearInterval(this.timer); let j = 0; this.timer = setInterval(() => { this.output = newText.slice(0, ++j); if (j >= newText.length) clearInterval(this.timer); }, speed); }, speed); }, destroy() { clearInterval(this.timer); }, })); // mount:

// Scroll reveal: IntersectionObserver owned by the component, controlling reading pace. Alpine.data('reveal', () => ({ shown: false, observer: null, init() { this.observer = new IntersectionObserver(([entry]) => { if (!entry.isIntersecting) return; this.shown = true; this.observer.disconnect(); }); this.observer.observe(this.$el); }, destroy() { this.observer?.disconnect(); }, })); // mount:
…
.reveal{opacity:0;transition:opacity .6s}.reveal.shown{opacity:1} // M14 read-state — the runtime side of world-response state (references/guardrails.md R13): an entry // appears once its source page was read. The STORE (readState + READ_KEY) lives in the starter kernel // (assets/starter/assets/js/components.js) — never redefine it here. This file adds only the mount // component: the SOURCE page marks itself as read by carrying it. // The CHECKER-visible contract is the data-after attribute on the entry anchor // (assets/templates/html/read-entry.html): keep the page path written in data-after and in the // markRead(...) argument identical, or the walk proves an order the DOM does not render // (references/structure/form-device.md §4). // Persist ONLY when docs/system-profile.md records the persistent/world-response contract; the kernel // store is where `progress: session` swaps localStorage for sessionStorage. // // Mount on the SOURCE page's
so opening it marks the read: //
Alpine.data('markRead', (page) => ({ init() { readState.mark(page); } })); // M7 collection progress — Alpine component body (assets/templates/js/modules/progress.js). // State contract: NO persistence — this is the template's verbatim body with the single // sanctioned storage swap localStorage -> sessionStorage (references/structure/form-device.md §3: // session-only or none for a remote system; docs/system-profile.md records `none`). // Mount on the shared footer: