A implements a coherent, well-reasoned syntax change (explanation-first votes, title-first items) with a real parser rewrite, updated error messages, and exhaustive updates across docs, fixtures, unit tests, and browser tests to keep everything consistent and correct. B adds a generic JSON-template-with-holes UI plumbing layer (form_template.rs, ui_action.rs) that is more speculative infrastructure—useful for reducing duplication but introduces indirection and an explicitly acknowledged security caveat, and its vague 'progress' commit message reflects a less finished, less validated change than A's deliberate, tested DSL redesign.
constitution · epochs · watch · epoch 3
comparison
c_2f5d9e0370f8 (tommy-mor) vs c_48edc893c5b0 (tommy-mor)
download prompt · raw event · cmp_7301899046add8
council reasoning
A lands a real product/language design change: votes become explanation-first and items stay path-then-body, with a genuine parser rewrite (block-prefixed votes, pending blocks, rejection of legacy trailing explanations) plus matching docs and call sites. B adds useful browser infrastructure (form_template holes, HtmlUiAction, unified POST /ui, shared web_post runners) but is more plumbing/UX wiring than a lasting core semantic shift.
Side A implements a substantive DSL redesign by changing the parser to support leading explanation blocks for votes, enforcing item-body placement, updating UI generation, validation, documentation, fixtures, and adding parser tests that reject legacy syntax and malformed inputs. Side B adds a useful browser UI dispatch layer (`POST /ui`), form-template infrastructure, and refactors shared handlers, but it is largely architectural plumbing for the web interface rather than a project-wide language and parsing change.
sides
A — c_2f5d9e0370f8 (tommy-mor)
message
[6bda2635] Use title-first items and explanation-first votes (#135) * Require block-first sorter DSL statements Co-authored-by: tommy <thmorriss@gmail.com> * Use title-first items with explanation-first votes Co-authored-by: tommy <thmorriss@gmail.com> * Update garden vote test DSL fixtures Co-authored-by: tommy <thmorriss@gmail.com> * Update browser vote DSL payloads Co-authored-by: tommy <thmorriss@gmail.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com>
diff preview
diff --git a/cli/DSL.txt b/cli/DSL.txt
index 18f69ef25f01583fddf9fc90e077bb2c3fa72bb6..c9b12bf0edaf73ad252f0a202b7fe61e311df50a 100644
--- a/cli/DSL.txt
+++ b/cli/DSL.txt
@@ -18,9 +18,20 @@ Blank lines are preserved to maintain paragraph structure.
~/item/a {itembody}
~/python { A high-level scripting language }
-~/item/a > ~/python { Item A is better because of X. }
-~/python 3:1 ~/go { Python's ecosystem is much richer than Go's. }
-https://example.com/lang = ~/go { They are equally good in this context. }
+{
+Item A is better because of X.
+}
+~/item/a > ~/python
+
+{
+Python's ecosystem is much richer than Go's.
+}
+~/python 3:1 ~/go
+
+{
+They are equally good in this context.
+}
+https://example.com/lang = ~/go
```
SYNTAX RULES
@@ -35,7 +46,7 @@ Starts a thread. Tag allows alphanumeric, `-`, `_`, and `/`. Subtitle max 100 ch
~/<local-item-path> { description }
```
Defines an ontology item (garden layer). Paths can be nested (e.g. `~/languages/python`).
-A leading `/` alone is **not** allowed in the DSL — use `~/` only. Descriptions (bodies) are wrapped in `{}`. Can be adjacent (e.g. `~/arrived{ready}`).
+A leading `/` alone is **not** allowed in the DSL — use `~/` only. Descriptions (bodies) are wrapped in `{}` and follow the item path.
```sorter
https://example.com/item { description }
@@ -46,7 +57,10 @@ Canonicalization rules for URLs:
- `~/` and `https://slug.social/~/` map to the same local item path.
```sorter
-<item1> <comparison> <item2> { required explanation }
+{
+required explanation
+}
+<item1> <comparison> <item2>
```
Compares two items. The explanation is REQUIRED.
Comparisons:
@@ -65,7 +79,8 @@ When writing bodies or explanations, you can use braces `{}` and code blocks wit
3. Single braces: { ... }
```sorter
-~/code { Here is a block: ```def foo(): return {"a": 1}``` }
+{ Here is a block: ```def foo(): return {"a": 1}``` }
+~/code
```
STYLE
diff --git a/cli/GUIDE.sorter b/cli/GUIDE.sorter
index 7ea1c2649cb4a323b46f0bf389025079a9c9ab43..86accba72ecea547215d947fb6552e0ead25687c 100644
--- a/cli/GUIDE.sorter
+++ b/cli/GUIDE.sorter
@@ -83,7 +83,8 @@ Item definitions (attaches a description to an item):
~/thread/item { description }
Comparisons:
- ~/thread/item-a 3:1 ~/thread/item-b { reasoning }
+ { reasoning }
+ ~/thread/item-a 3:1 ~/thread/item-b
Ratio formats:
3:1 left is 3x better than right
@@ -95,8 +96,7 @@ Shorthand:
< means 1:2 (right is better)
= means 1:1 (equal)
-Bodies can attach without whitespace:
- ~/thread/item{Description here}
+Item bodies follow the item path. Vote explanations come first; the comparison is the verdict line.
}
You can write any prose in your posts. These won't be part of the garden but only the thread.
@@ -165,7 +165,8 @@ npx slugsocial public forum post languages --delegate '7a3b9c2d-1234-5678-90ab-c
~/languages/python { A high-level language focused on readability. }
~/languages/rust { A systems language focused on safety and performance. }
-~/languages/python 2:1 ~/languages/rust { Python has simpler syntax for beginners - fewer symbols, explicit over implicit. Rust's borrow checker adds cognitive load even for simple programs. Both are readable once learned, but Python's learning curve is gentler. }
+{ Python has simpler syntax for beginners - fewer symbols, explicit over implicit. Rust's borrow checker adds cognitive load even for simple programs. Both are readable once learned, but Python's learning curve is gentler. }
+~/languages/python 2:1 ~/languages/rust
EOF
# See current ranking
diff --git a/ideas/single-thread.md b/ideas/single-thread.md
index 86230fe6119c31045c21dbfcb12311b323c02fa8..0efb7199524cc3b308b1922c03e3a99193e4586c 100644
--- a/ideas/single-thread.md
+++ b/ideas/single-thread.md
@@ -15,7 +15,8 @@ Previously a `.sorter` document could scatter `#tags` throughout:
~/languages/rust {A systems language.}
#tools
~/tools/cargo {Rust's build system.}
-~/languages/rust 2:1 ~/tools/cargo {Rust is more foundational than its tooling.}
+{Rust is more foundational than its tooling.}
+~/languages/rust 2:1 ~/tools/cargo
```
The system would fan the ingest into both `#languages` and `#tools` — the same
diff --git a/server/src/api/mod.rs b/server/src/api/mod.rs
index 9f3c1cc21c2ae157c024a447980a97e190c8f066..920e967b47852ea82fa61b84c457ae3582dd9800 100644
--- a/server/src/api/mod.rs
+++ b/server/src/api/mod.rs
@@ -72,16 +72,16 @@ mod tests {
apply_ingest(
&mut reduced,
1,
- "~/t/a {a}\n~/t/b {b}\n~/t/a 2:1 ~/t/b {because}\n",
+ "~/t/a {a}\n~/t/b {b}\n{because}\n~/t/a 2:1 ~/t/b\n",
);
- let text = "~/t/a 1:1 ~/t/b {equal}\n";
+ let text = "{equal}\n~/t/a 1:1 ~/t/b\n";
validate_ingest_document(&reduced, text, &crate::reducer::ScopeId::Public).unwrap();
}
#[test]
fn validate_ingest_document_rejects_vote_on_undefined_item() {
let reduced = ReducerState::default();
- let text = "~/t/a {x}\n~/t/b 1:1 ~/t/missing {why}\n";
+ let text = "~/t/a {x}\n{why}\n~/t/b 1:1 ~/t/missing\n";
let err = validate_ingest_document(&reduced, text, &crate::reducer::ScopeId::Public).unwrap_err();
assert_eq!(err.0, StatusCode::BAD_REQUEST);
assert!(err.1.contains("undefined item"));
diff --git a/server/src/api/ui_html.rs b/server/src/api/ui_html.rs
index 696e7b3605e2e68aee0351116c494c2958506add..7cbda3876451687aa7a55547fc06bbe86ac9d260 100644
--- a/server/src/api/ui_html.rs
+++ b/server/src/api/ui_html.rs
@@ -222,13 +222,13 @@ async fn dispatch_ui_action(
}
let text = format!(
- "@{}\n{} {}:{} {} {{\n{}\n}}\n",
+ "@{}\n{{\n{}\n}}\n{} {}:{} {}\n",
crate::api::auth::WEB_BROWSER_AGENT,
+ exp,
left_id.as_str(),
rl,
rr,
- right_id.as_str(),
- exp
+ right_id.as_str()
);
match rpc_post_with_bearer(state, &session.bearer, room.clone(), thread_tag.clone(), text).await {
diff --git a/server/src/dsl.rs b/server/src/dsl.rs
index 7962342bd023b3b5061a684d84d4ab164134b111..def8b497c71567016a522648b9630d7038163e41 100644
--- a/server/src/dsl.rs
+++ b/server/src/dsl.rs
@@ -11,16 +11,21 @@ pub struct Document {
/// A single statement in the DSL (or prose when using `parse_full`).
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum Stmt {
- Item { title: String, body: Option<String> },
+ Item {
+ title: String,
+ body: Option<String>,
+ },
Vote {
item1: String,
item2: String,
ratio_left: i32,
ratio_right: i32,
- /// Required non-empty explanation (from trailing `{ ... }`).
+ /// Required non-empty explanation (from leading `{ ... }`).
explanation: String,
},
- Prose { text: String },
+ Prose {
+ text: String,
+ },
}
#[derive(Debug, thiserror::Error)]
@@ -391,71 +396,46 @@ fn parse_comparison_at(s: &str, i: usize) -> Option<((i32, i32), usize)> {
Some(((left, right), j))
}
-fn parse_item_statement(stripped: &str, masker: &BlockMasker) -> Result<Stmt, DslError> {
- // item: ("~/" | "https://..." | "http://...") item_ref body?
- // vote: same for both operands.
- //
- // Important: body token can be adjacent to the item name (no whitespace),
- // e.g. "~/arrived{...}" -> "~/arrived__BLOCK_x__".
- let s = stripped;
- let bytes = s.as_bytes();
- if bytes.is_empty() {
- return Err(DslError::Parse("missing item statement".to_string()));
+fn parse_block_prefixed_statement(
+ block_token: &str,
+ tail: &str,
+ masker: &BlockMasker,
+) -> Result<Stmt, DslError> {
+ // vote: block item_ref comparison item_ref
+ let s = tail.trim_start();
+ if s.is_empty() {
+ return Err(DslError::Parse(
+ "missing vote statement after leading explanation block".to_string(),
+ ));
}
let (item1, j) =
parse_item_name_at(s, 0).ok_or_else(|| DslError::Parse("invalid item name".to_string()))?;
+ let explanation = masker.extract_body(block_token);
+ let mut i = skip_ws(s, j);
- // Either we have:
- // - immediate/whitespace block token => Item
- // - comparison => Vote
- // - whitespace then block token => Item
- // - whitespace then comparison => Vote
- let i = skip_ws(s, j);
-
- // If next is end or a block token => Item.
if i >= s.len() {
- return Ok(Stmt::Item {
- title: item1,
- body: None,
- });
- }
- if let Some((tok, end)) = parse_block_token_at(s, i) {
- let body = masker.extract_body(&tok);
- let tail = s[end..].trim();
- if !tail.is_empty() {
- return Err(DslError::Parse("extra tokens after item".to_string()));
- }
- return Ok(Stmt::Item {
- title: item1,
- body: Some(body),
- });
+ return Err(DslError::Parse(
+ "leading `{ ... }` blocks are vote explanations; item bodies belong after item paths"
+ .to_string(),
+ ));
}
- // Otherwise parse comparison then "/item2" then REQUIRED body.
- let ((ratio_left, ratio_right), mut k) = parse_comparison_at(s, i)
+ let ((ratio_left, ratio_right), k) = parse_comparison_at(s, i)
.ok_or_else(|| DslError::Parse(format!("invalid comparison near: {}", &s[i..])))?;
if ratio_left == 0 && ratio_right == 0 {
return Err(DslError::Parse(
"vote ratio 0:0 is invalid; use 1:1 for a tie or omit the vote".to_string(),
));
}
- k = skip_ws(s, k);
- let (item2, mut m) = parse_item_name_at(s, k)
+ i = skip_ws(s, k);
+ let (item2, m) = parse_item_name_at(s, i)
.ok_or_else(|| DslError::Parse("invalid rhs item name".to_string()))?;
- m = skip_ws(s, m);
-
- let Some((tok, end)) = parse_block_token_at(s, m) else {
- return Err(DslError::Parse(
- "missing vote explanation (add a trailing `{ ... }`)".to_string(),
- ));
- };
- let explanation = masker.extract_body(&tok);
+ i = skip_ws(s, m);
if explanation.trim().is_empty() {
return Err(DslError::Parse("empty vote explanation".to_string()));
}
- m = end;
- let tail = s[m..].trim();
+ let tail = s[i..].trim();
if !tail.is_empty() {
return Err(DslError::Parse("extra tokens after vote".to_string()));
}
@@ -469,6 +449,35 @@ fn parse_item_statement(stripped: &str, masker: &BlockMasker) -> Result<Stmt, Ds
})
}
+fn parse_item_definition_statement(stripped: &str, masker: &BlockMasker) -> Result<Stmt, DslError> {
+ let (item1, j) =
+ parse_item_name_at(stripped, 0).ok_or_else(|| DslError::Parse("invalid item name".to_string()))?;
+ let i = skip_ws(stripped, j);
+
+ if i >= stripped.len() {
+ return Ok(Stmt::Item {
+ title: item1,
+ body: None,
+ });
+ }
+
+ if let Some((tok, end)) = parse_block_token_at(stripped, i) {
+ let body = masker.extract_body(&tok);
+ let tail = stripped[end..].trim();
+ if !tail.is_empty() {
+ return Err(DslError::Parse("extra tokens after item".to_string()));
+ }
+ return Ok(Stmt::Item {
+ title: item1,
+ body: Some(body),
+ });
+ }
+
+ Err(DslError::Parse(
+ "vote explanations must start with a `{ ... }` block before the comparison".to_string(),
+ ))
+}
+
fn parse_line(masked_line: &str, masker: &BlockMasker) -> Result<Vec<Stmt>, DslError> {
let stripped = masked_line.trim_start();
if stripped.is_empty() {
@@ -477,27 +486,28 @@ fn parse_line(masked_line: &str, masker: &BlockMasker) -> Result<Vec<Stmt>, DslE
let first = stripped.chars().next().unwrap();
match first {
'#' => Err(DslError::Parse("not a DS
… preview truncated; 47,409 characters omittedB — c_48edc893c5b0 (tommy-mor)
message
[3f35edab] progress
diff preview
diff --git a/server/src/api/mod.rs b/server/src/api/mod.rs
index a10ce662105cff8fad949c6b83f7035ce79bed18..a986f706ea4b261cbaf004c02b4cf84184b41371 100644
--- a/server/src/api/mod.rs
+++ b/server/src/api/mod.rs
@@ -3,6 +3,7 @@ mod helpers;
mod rpc;
mod stream;
mod validate;
+mod ui_html;
mod web_post;
pub use auth::{
@@ -33,6 +34,7 @@ pub use stream::{get_html_stream, get_stream};
pub use validate::{normalize_room_and_thread, validate_ingest_document, ValidatedIngest};
+pub use ui_html::post_ui_html;
pub use web_post::{check_web_ingest, post_web_ingest, post_web_redact};
#[cfg(test)]
diff --git a/server/src/api/ui_html.rs b/server/src/api/ui_html.rs
new file mode 100644
index 0000000000000000000000000000000000000000..2b40a72059981d558768f73d189b991f3448c257
--- /dev/null
+++ b/server/src/api/ui_html.rs
@@ -0,0 +1,139 @@
+//! Single `POST /ui` entry for browser [`crate::html::ui_action::HtmlUiAction`] (JSON in `__rpc__` + holes).
+
+use axum::{
+ body::Body,
+ extract::State,
+ http::{header, HeaderMap, StatusCode},
+ response::{IntoResponse, Response},
+ Form,
+};
+use axum_extra::extract::cookie::CookieJar;
+use std::collections::HashMap;
+
+use crate::{
+ api::{
+ auth::optional_principal,
+ web_post::{run_check_web_ingest, run_post_web_ingest, run_post_web_redact, WebPostForm, WebRedactForm},
+ },
+ html::{
+ fragment_public_new_thread_form, fragment_room_new_thread_form, login_to_post_hint_markup,
+ parse_html_ui_from_form, user_can_post_room, user_can_view_room, HtmlUiAction, JsBuilder,
+ ThreadNav,
+ },
+ state::AppState,
+};
+
+pub async fn post_ui_html(
+ State(state): State<AppState>,
+ headers: HeaderMap,
+ jar: CookieJar,
+ Form(form): Form<HashMap<String, String>>,
+) -> impl IntoResponse {
+ let action = match parse_html_ui_from_form(&form) {
+ Ok(a) => a,
+ Err(e) => return ui_js_warn(&e.to_string()).into_response(),
+ };
+
+ match action {
+ HtmlUiAction::PostIngest {
+ room,
+ thread_tag,
+ text,
+ error_target,
+ form_id,
+ } => {
+ run_post_web_ingest(
+ &state,
+ &headers,
+ &jar,
+ WebPostForm {
+ room,
+ thread_tag,
+ text,
+ error_target,
+ form_id,
+ },
+ )
+ .await
+ }
+ HtmlUiAction::CheckIngest {
+ room,
+ thread_tag,
+ text,
+ error_target,
+ form_id,
+ } => {
+ run_check_web_ingest(
+ &state,
+ &headers,
+ &jar,
+ WebPostForm {
+ room,
+ thread_tag,
+ text,
+ error_target,
+ form_id,
+ },
+ )
+ .await
+ }
+ HtmlUiAction::RedactPost { post_id } => {
+ run_post_web_redact(&state, &headers, &jar, WebRedactForm { post_id }).await
+ }
+ HtmlUiAction::ExpandPublicNewThreadForm => {
+ let reduced = state.reduced.read().await;
+ let user = optional_principal(&headers, &jar, &reduced);
+ drop(reduced);
+ let markup = if user.is_some() {
+ fragment_public_new_thread_form(true)
+ } else {
+ login_to_post_hint_markup()
+ };
+ JsBuilder::new()
+ .morph_selector("#public-new-thread-ui-slot", markup)
+ .into_response()
+ }
+ HtmlUiAction::ExpandRoomNewThreadForm { room_wire } => {
+ let room_wire = room_wire.trim().to_string();
+ if room_wire.is_empty() {
+ return ui_js_warn("missing room").into_response();
+ }
+ let reduced = state.reduced.read().await;
+ let user = optional_principal(&headers, &jar, &reduced);
+ if !reduced.rooms.contains(&room_wire) {
+ drop(reduced);
+ return ui_js_warn("room not found").into_response();
+ }
+ if !user_can_view_room(&reduced, &room_wire, user.as_deref()) {
+ drop(reduced);
+ return ui_js_warn("forbidden").into_response();
+ }
+ let can_post = user
+ .as_ref()
+ .map(|u| user_can_post_room(&reduced, &room_wire, u))
+ .unwrap_or(false);
+ drop(reduced);
+ let Some(nav) = ThreadNav::from_room_id(&room_wire) else {
+ return ui_js_warn("bad room").into_response();
+ };
+ let markup = if can_post {
+ fragment_room_new_thread_form(&nav, true)
+ } else {
+ login_to_post_hint_markup()
+ };
+ JsBuilder::new()
+ .morph_selector("#room-new-thread-ui-slot", markup)
+ .into_response()
+ }
+ }
+}
+
+fn ui_js_warn(msg: &str) -> Response {
+ use crate::html::js_string_literal;
+ let js = format!("console.warn({});", js_string_literal(msg));
+ Response::builder()
+ .status(StatusCode::OK)
+ .header(header::CONTENT_TYPE, "text/javascript; charset=utf-8")
+ .body(Body::from(js))
+ .unwrap()
+}
diff --git a/server/src/api/web_post.rs b/server/src/api/web_post.rs
index a64010e382d3039821c836a5529adad0fe67cce5..265025f41ff1548d05b2d2d5d84202245388053f 100644
--- a/server/src/api/web_post.rs
+++ b/server/src/api/web_post.rs
@@ -222,8 +222,18 @@ pub async fn post_web_redact(
jar: CookieJar,
Form(form): Form<WebRedactForm>,
) -> impl IntoResponse {
+ run_post_web_redact(&state, &headers, &jar, form).await
+}
+
+/// Shared with [`crate::api::ui_html::post_ui_html`].
+pub(crate) async fn run_post_web_redact(
+ state: &AppState,
+ headers: &HeaderMap,
+ jar: &CookieJar,
+ form: WebRedactForm,
+) -> Response {
let reduced = state.reduced.read().await;
- let Some(_username) = optional_principal(&headers, &jar, &reduced) else {
+ let Some(_username) = optional_principal(headers, jar, &reduced) else {
drop(reduced);
return js_redirect("/login").into_response();
};
@@ -239,8 +249,8 @@ pub async fn post_web_redact(
return js_redirect("/login").into_response();
};
- match rpc_post_redact(&state, &headers, form.post_id).await {
- Ok(RpcResult::RedactPostOk {}) => redact_success_response(&state).await.into_response(),
+ match rpc_post_redact(state, headers, form.post_id).await {
+ Ok(RpcResult::RedactPostOk {}) => redact_success_response(state).await.into_response(),
Ok(_) => (StatusCode::BAD_REQUEST, "unexpected response").into_response(),
Err((msg, hint)) => {
let detail = hint.as_deref().unwrap_or("");
@@ -255,8 +265,18 @@ pub async fn post_web_ingest(
jar: CookieJar,
Form(form): Form<WebPostForm>,
) -> impl IntoResponse {
+ run_post_web_ingest(&state, &headers, &jar, form).await
+}
+
+/// Shared with [`crate::api::ui_html::post_ui_html`] (`POST /ui`).
+pub(crate) async fn run_post_web_ingest(
+ state: &AppState,
+ headers: &HeaderMap,
+ jar: &CookieJar,
+ form: WebPostForm,
+) -> Response {
let reduced = state.reduced.read().await;
- let Some(_username) = optional_principal(&headers, &jar, &reduced) else {
+ let Some(_username) = optional_principal(headers, jar, &reduced) else {
drop(reduced);
return js_redirect("/login").into_response();
};
@@ -282,8 +302,8 @@ pub async fn post_web_ingest(
.into_response();
}
- match rpc_post_with_bearer(&state, &bearer, room.clone(), thread_tag.clone(), text).await {
- Ok(RpcResult::PostOk { .. }) => post_success_response(&state, &form, &headers, &jar)
+ match rpc_post_with_bearer(state, &bearer, room.clone(), thread_tag.clone(), text).await {
+ Ok(RpcResult::PostOk { .. }) => post_success_response(state, &form, headers, jar)
.await
.into_response(),
Ok(_) => form_js_error(&form, "unexpected response", "Post did not return PostOk.").into_response(),
@@ -297,8 +317,18 @@ pub async fn check_web_ingest(
jar: CookieJar,
Form(form): Form<WebPostForm>,
) -> impl IntoResponse {
+ run_check_web_ingest(&state, &headers, &jar, form).await
+}
+
+/// Shared with [`crate::api::ui_html::post_ui_html`] (`POST /ui`).
+pub(crate) async fn run_check_web_ingest(
+ state: &AppState,
+ headers: &HeaderMap,
+ jar: &CookieJar,
+ form: WebPostForm,
+) -> Response {
let reduced = state.reduced.read().await;
- let Some(_username) = optional_principal(&headers, &jar, &reduced) else {
+ let Some(_username) = optional_principal(headers, jar, &reduced) else {
drop(reduced);
return js_redirect("/login").into_response();
};
@@ -324,7 +354,7 @@ pub async fn check_web_ingest(
return js_clear_errors(&form_error_target(&form)).into_response();
}
- match rpc_check_with_bearer(&state, &bearer, room, form.text.clone()).await {
+ match rpc_check_with_bearer(state, &bearer, room, form.text.clone()).await {
Ok(RpcResult::CheckOk { .. }) => js_clear_errors(&form_error_target(&form)).into_response(),
Ok(_) => form_js_error(&form, "unexpected response", "Check did not return CheckOk.").into_response(),
Err((msg, hint)) => form_js_error(&form, &msg, hint.as_deref().unwrap_or("")).into_response(),
diff --git a/server/src/form_template.rs b/server/src/form_template.rs
new file mode 100644
index 0000000000000000000000000000000000000000..3709c2c09a859da006e4af173413d5d235bc19be
--- /dev/null
+++ b/server/src/form_template.rs
@@ -0,0 +1,142 @@
+//! Plan2-style JSON templates with `{"$form": "field_name"}` holes, filled from
+//! `application/x-www-form-urlencoded` (or any `String` → `String` map) **before**
+//! deserializing into a typed struct.
+//!
+//! # Wire format
+//!
+//! Templates are **compact JSON** (`serde_json::to_string`): one line, no pretty
+//! printing, strings escaped per JSON rules (`\"`, `\n`, etc.). Embed that string
+//! in HTML attributes or text nodes with normal HTML escaping (e.g. maud), not
+//! bespoke encodings.
+//!
+//! # Power vs flat hidden fields
+//!
+//! A form is always a string→string map. You can fake depth with dotted keys (`a.b.c`),
+//! but one structured blob (`__rpc__` = compact JSON) gives you nested objects,
+//! arrays, and optional fields without inventing a new naming scheme each time.
+//!
+//! # Security
+//!
+//! Substitution runs **before** `serde` into your command type. It does not fix
+//! authorization: if the client can replace the hidden `__rpc__` value, they can
+//! change the command shape unless you validate (signed blob, server-side session
+//! context, or treat the blob as hints only). Same threat model as any hidden field.
+
+use serde::Serialize;
+use serde_json::Value;
+use std::collections::HashMap;
+
+/// Serialize a value to compact JSON for a hidden `__rpc__` (or similar) field.
+pub fn template_json_compact<T: Serialize>(v: &T) -> serde_json::Result<String> {
+ serde_json::to_string(v)
+}
+
+/// Recursively walk the JSON AST and replace `{"$form": "key"}` with the submitted
+/// string for `key` (empty if missing). Other keys are unchanged.
+pub fn substitute_form_vars(val: &mut Value, form_data: &HashMap<String, String>) {
+ match val {
+ Value::Object(map) => {
+ if map.len() == 1 {
+ if let Some(Value::String(field_name)) = map.get("$form") {
+ let submitted = form_data
+ .get(field_name.as_str())
+ .map(|s| s.as_str())
+ .unwrap_or("");
+
… preview truncated; 13,273 characters omittedHardlinks — judgments / attempts / prompt
judgments
attempts
Prompt text is loaded only by the download route.