npm - @biffo/cli - Versions diffs - 0.273.13 → 0.274.0 - Mend

@biffo/cli 0.273.13 → 0.274.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (18) hide show

package/_skeletons/plugin-template/web-admin/_gitignore ADDED Viewed

@@ -0,0 +1,5 @@
+# Dependencies
+node_modules
+# Build output
+dist

package/_skeletons/plugin-template/web-admin/eslint.config.js ADDED Viewed

@@ -0,0 +1,8 @@
+import js from '@eslint/js'
+import tseslint from 'typescript-eslint'
+export default tseslint.config(
+  { ignores: ['dist'] },
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+)

package/_skeletons/plugin-template/web-admin/index.html ADDED Viewed

@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>example-plugin — Admin</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>

package/_skeletons/plugin-template/web-admin/package.json ADDED Viewed

@@ -0,0 +1,40 @@
+{
+  "name": "example-plugin-admin",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "tsc -b && vite build",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint .",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@biffo/design-tokens": "^0.152.0",
+    "amazon-cognito-identity-js": "^6.3.12",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
+  },
+  "devDependencies": {
+    "@testing-library/dom": "^10.4.1",
+    "@testing-library/jest-dom": "^6.9.1",
+    "@testing-library/react": "^16.3.2",
+    "@testing-library/user-event": "^14.6.1",
+    "@types/node": "^26.1.2",
+    "@types/react": "^19.0.7",
+    "@types/react-dom": "^19.0.3",
+    "@vitejs/plugin-react": "^4.7.0",
+    "eslint": "^9.18.0",
+    "jsdom": "^30.0.1",
+    "typescript": "^5.7.3",
+    "typescript-eslint": "^8.20.0",
+    "vite": "^6.4.3",
+    "vitest": "^4.1.0"
+  },
+  "pnpm": {
+    "overrides": {
+      "brace-expansion@<5.0.9": ">=5.0.9"
+    }
+  }
+}

package/_skeletons/plugin-template/web-admin/src/App.test.tsx ADDED Viewed

@@ -0,0 +1,22 @@
+import { render, screen } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import App from './App'
+import { __resetCoreIdentityForTests } from './lib/identity'
+import { __resetUserPoolForTests } from './lib/auth'
+afterEach(() => {
+  vi.restoreAllMocks()
+  __resetCoreIdentityForTests()
+  __resetUserPoolForTests()
+})
+describe('App', () => {
+  it('shows the signed-out message when the identity document is unreachable', async () => {
+    vi.spyOn(globalThis, 'fetch').mockRejectedValue(new Error('network error'))
+    render(<App />)
+    expect(await screen.findByText(/not signed in/i)).toBeInTheDocument()
+  })
+})

package/_skeletons/plugin-template/web-admin/src/App.tsx ADDED Viewed

@@ -0,0 +1,50 @@
+import { useEffect, useState } from 'react'
+import { getCurrentSession } from './lib/auth'
+/**
+ * Starter admin surface. It proves the SHARED-SESSION INVARIANT works — reads
+ * the portal's Cognito session, shows a signed-in/signed-out state, nothing
+ * more — and is meant to be replaced with this plugin's own admin UI.
+ *
+ * Wire real screens against `./lib/api`'s starter `request()` helper, which
+ * already carries the `Authorization: Bearer` header and error handling this
+ * plugin's calls will need; the endpoints themselves are this plugin's own.
+ */
+export default function App() {
+  const [signedIn, setSignedIn] = useState<boolean | null>(null)
+  useEffect(() => {
+    let cancelled = false
+    void getCurrentSession().then((session) => {
+      if (cancelled) return
+      setSignedIn(session != null)
+    })
+    return () => {
+      cancelled = true
+    }
+  }, [])
+  if (signedIn === false) {
+    return (
+      <main className="page">
+        <h1>example-plugin — Admin</h1>
+        <p className="error">Not signed in. Open this from the Biffo portal.</p>
+      </main>
+    )
+  }
+  return (
+    <main className="page">
+      <h1>example-plugin — Admin</h1>
+      {signedIn === null ? (
+        <p className="muted">Loading…</p>
+      ) : (
+        <p className="muted">
+          Signed in via the shared portal session. Replace this screen with the plugin's own admin
+          UI.
+        </p>
+      )}
+    </main>
+  )
+}

package/_skeletons/plugin-template/web-admin/src/base-path.test.ts ADDED Viewed

@@ -0,0 +1,65 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+/**
+ * The Vite `base` must name THIS plugin, and the built HTML's asset
+ * references must actually live under it.
+ *
+ * Ported from idea-scout's guard (biffo-template#1492), which exists because
+ * idea-scout's own vite.config.ts was pasted from ideation's and kept
+ * ideation's base — 503, blank page, and every other local gate (eslint, tsc,
+ * unit tests, `vite build` itself) passed, because `base` only affects the
+ * URLs inside the emitted HTML. It was found by loading the deployed page and
+ * reading the network log — not a check that runs on every PR. This is that
+ * check, generalised so a plugin scaffolded from this skeleton inherits it
+ * automatically rather than every plugin author re-discovering the bug.
+ *
+ * Reads the plugin name OUT of vite.config.ts itself rather than hardcoding
+ * it, so this file needs no token substitution at scaffold time and stays
+ * correct whatever `biffo plugin create` rewrites `base` to.
+ */
+const ROOT = join(__dirname, '..')
+function pluginFromConfig(config: string): string {
+  const match = config.match(/base:\s*'\/api\/v1\/plugins\/([^/]+)\/admin\/'/)
+  expect(match, "no `base: '/api/v1/plugins/<name>/admin/'` found in vite.config.ts").not.toBeNull()
+  return match![1]
+}
+describe('vite base path', () => {
+  const config = readFileSync(join(ROOT, 'vite.config.ts'), 'utf8')
+  const plugin = pluginFromConfig(config)
+  it('is the full API Gateway path for THIS plugin', () => {
+    expect(config).toContain(`base: '/api/v1/plugins/${plugin}/admin/'`)
+  })
+  // There is deliberately NO "the config mentions no other plugin" test. That
+  // shape (ban a token) rejects the correct fix as readily as the bug: a
+  // comment legitimately naming a DIFFERENT plugin, to explain this exact
+  // trap, is exactly what this file's own header does. Assert the property,
+  // not the absence of a string.
+  it('the built index.html requests assets under that base', () => {
+    // Skipped when dist/ is absent (a source checkout, not a built one). CI
+    // runs `build` before `test` — but if it ever does not, this must not
+    // pass silently, so the skip is explicit and visible.
+    let html: string
+    try {
+      html = readFileSync(join(ROOT, 'dist', 'index.html'), 'utf8')
+    } catch {
+      console.warn('dist/index.html absent — build not run; base-path check skipped')
+      return
+    }
+    const srcs = [...html.matchAll(/(?:src|href)="([^"]+)"/g)].map((m) => m[1])
+    const assetRefs = srcs.filter((s) => s.includes('/assets/'))
+    expect(assetRefs.length, 'no asset references in the built HTML').toBeGreaterThan(0)
+    for (const ref of assetRefs) {
+      expect(ref.startsWith(`/api/v1/plugins/${plugin}/admin/`), `bad asset path: ${ref}`).toBe(
+        true,
+      )
+    }
+  })
+})

package/_skeletons/plugin-template/web-admin/src/index.css ADDED Viewed

@@ -0,0 +1,40 @@
+/* Shares the design tokens the rest of the estate uses so a plugin admin panel
+   does not become its own brand blue (the drift @biffo/design-tokens was
+   created to end). */
+@import '@biffo/design-tokens/tokens.css';
+* {
+  box-sizing: border-box;
+}
+body {
+  margin: 0;
+  font-family: var(--font-sans, system-ui, sans-serif);
+  color: var(--text, #1b1c1f);
+  background: var(--bg, #f7f8fa);
+}
+.page {
+  max-width: 60rem;
+  margin: 0 auto;
+  padding: 2rem 1.5rem 4rem;
+}
+h1 {
+  font-size: 1.55rem;
+  margin: 0 0 0.35rem;
+}
+.muted {
+  color: var(--text-muted, #5b6070);
+  font-size: 0.9rem;
+  margin: 0 0 1.25rem;
+}
+.error {
+  background: var(--state-negative-soft, #fdeaea);
+  color: var(--state-negative, #8c2b2b);
+  padding: 0.6rem 0.8rem;
+  border-radius: 6px;
+  font-size: 0.9rem;
+}

package/_skeletons/plugin-template/web-admin/src/lib/api-core.ts ADDED Viewed

@@ -0,0 +1,61 @@
+// Shared admin-API request core, DISTRIBUTED across every plugin's web-admin
+// (biffo-template#1492). It carries exactly the parts that were rewritten
+// identically, badly, by hand in three plugins: the fetch wrapper, the bearer
+// auth header, error handling, and per-request base resolution. It carries
+// NONE of a plugin's own endpoints — those are plugin-owned and live beside
+// this module in each repo's own api.ts (see this skeleton's starter copy).
+//
+// `getIdToken` is `() => string | null | Promise<string | null>`, matching
+// `./auth.ts`'s `getFreshIdToken()`, and MUST be called fresh per request —
+// never snapshotted. `CognitoUserSession` is an immutable value object, so a
+// client built from a token captured once at mount sends whatever was left on
+// the token's remaining lifetime at that instant; once it lapses every call
+// 401s for the rest of the page's life (ideation#69). idea-scout's original
+// api.ts used a synchronous `token: () => string | null` for exactly this
+// reason — it could not await a fresh resolution — and shipped the bug. This
+// core is built async from the start so that mistake cannot recur here.
+export class ApiError extends Error {
+  constructor(
+    public readonly status: number,
+    message: string,
+  ) {
+    super(message)
+    this.name = 'ApiError'
+  }
+}
+export type GetIdToken = () => string | null | Promise<string | null>
+/**
+ * Build a `request<T>(method, path, body?, base?)` function bound to a token
+ * source and a default base. A plugin's own api.ts calls this once per
+ * `createApi()` and defines its endpoints on top of the result — see the
+ * starter `api.ts` in this same directory for the worked shape.
+ */
+export function createRequest(getIdToken: GetIdToken, defaultBase: string) {
+  return async function request<T>(
+    method: string,
+    path: string,
+    body?: unknown,
+    base: string = defaultBase,
+  ): Promise<T> {
+    const token = await getIdToken()
+    const res = await fetch(`${base}${path}`, {
+      method,
+      headers: {
+        'Content-Type': 'application/json',
+        ...(token != null ? { Authorization: `Bearer ${token}` } : {}),
+      },
+      ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+    })
+    if (!res.ok) {
+      // Read the body for the reason: Core returns a JSON detail for a
+      // permission failure, and "403" alone tells an admin nothing about
+      // which rule bit.
+      const detail = await res.text().catch(() => res.statusText)
+      throw new ApiError(res.status, detail || res.statusText)
+    }
+    if (res.status === 204) return undefined as T
+    return (await res.json()) as T
+  }
+}

package/_skeletons/plugin-template/web-admin/src/lib/api.ts ADDED Viewed

@@ -0,0 +1,40 @@
+// STARTER admin API client — wires this plugin's own endpoints on top of the
+// DISTRIBUTED shared request core in ./api-core.ts, then gets replaced with
+// this plugin's real resources. See api-core.ts's header for why the core is
+// shared and this file is not: every existing plugin's api.ts mixed the same
+// fetch/auth/error core with a wholly different endpoint surface (idea-scout:
+// build-types/agents/models; ideation: chat-agents; marketing: campaigns), so
+// only the core distributes — this file is this plugin's own and is never
+// synced (biffo-template#1492).
+//
+// The base MUST be under `/api/v1/plugins/<this-plugin-slug>` — not
+// `/api/v1/admin/*`. The CDN forwards `/api/v1/plugins/*` to the plugin host;
+// everything else falls through to the portal origin, which answers with its
+// own HTML shell and a 403 that reads as "no data" rather than "wrong route"
+// (biffo-template#1492, ideation#69 in miniature).
+import { createRequest } from './api-core'
+import { getFreshIdToken } from './auth'
+export { ApiError } from './api-core'
+const BASE = '/api/v1/plugins/example-plugin'
+/**
+ * Example shape for a plugin-owned API client. Replace `Widget`/`list`/`create`
+ * with this plugin's real resources — see idea-scout's or ideation's api.ts
+ * for a worked example with multiple resource groups and bases.
+ */
+export interface Widget {
+  id: string
+  label: string
+}
+export function createApi(getIdToken = getFreshIdToken) {
+  const request = createRequest(getIdToken, BASE)
+  return {
+    list: () => request<Widget[]>('GET', '/widgets'),
+    create: (draft: Omit<Widget, 'id'>) => request<Widget>('POST', '/widgets', draft),
+  }
+}
+export type Api = ReturnType<typeof createApi>

package/_skeletons/plugin-template/web-admin/src/lib/auth.ts ADDED Viewed

@@ -0,0 +1,82 @@
+import {
+  CognitoUserPool,
+  type CognitoUserSession,
+  type ICognitoUserPoolData,
+} from 'amazon-cognito-identity-js'
+import { pruneForeignCognitoCredentials } from './cognito-hygiene'
+import { resolveCoreIdentity } from './identity'
+// SHARED-SESSION INVARIANT (ADR-0007), mirroring the sibling skeleton's auth.ts.
+//
+// This app NEVER signs anyone in — the core portal owns authentication. It only
+// READS the session the portal already established, which works because it points
+// at the SAME Cognito User Pool / App Client as the portal (resolved at runtime
+// from identity.ts). Same origin + one App Client means amazon-cognito-identity-js's
+// localStorage keys (keyed by Client ID, not path) carry the portal's session over
+// here for free. Do NOT point at a different pool/client (breaks SSO), and do NOT
+// add signIn/signOut here (a second login path bypasses the portal).
+//
+// The pool is built lazily and memoised: a missing identity resolves to null →
+// "signed out", never a hard crash.
+let userPool: CognitoUserPool | null = null
+async function getUserPool(): Promise<CognitoUserPool | null> {
+  if (userPool) return userPool
+  const identity = await resolveCoreIdentity()
+  if (!identity) return null
+  // Once per page load, and only with a resolved client id: drop credentials
+  // left behind by pools this deployment no longer uses (biffo-template#834).
+  // The portal and the sibling skeleton do the same; this origin is shared, so
+  // whichever app loads first does the cleaning.
+  pruneForeignCognitoCredentials(identity.clientId)
+  const poolData: ICognitoUserPoolData = {
+    UserPoolId: identity.userPoolId,
+    ClientId: identity.clientId,
+  }
+  userPool = new CognitoUserPool(poolData)
+  return userPool
+}
+/** The shared portal session, or null if there isn't a valid one (→ redirect to login). */
+export async function getCurrentSession(): Promise<CognitoUserSession | null> {
+  const pool = await getUserPool()
+  if (!pool) return null
+  return new Promise((resolve) => {
+    const user = pool.getCurrentUser()
+    if (!user) {
+      resolve(null)
+      return
+    }
+    user.getSession((err: Error | null, session: CognitoUserSession | null) => {
+      resolve((err ?? !session?.isValid()) ? null : session)
+    })
+  })
+}
+/**
+ * A currently-valid ID token for the shared portal session, or null.
+ *
+ * Call this per request; NEVER snapshot the JWT. A `CognitoUserSession` is an
+ * immutable value object — `getIdToken()` hands back the same `CognitoIdToken`
+ * forever, and `isValid()` is true right up to the expiry second. So a client
+ * built from `createApi(() => sessionCapturedAtMount.getIdToken().getJwtToken())`
+ * sends a token frozen at mount whose remaining life is whatever was left on the
+ * *cached* token — possibly seconds. Once it lapses every call 401s for the life
+ * of the page and nothing recovers it but a reload (#69).
+ *
+ * Re-resolving instead is cheap and self-healing: `pool.getCurrentUser()` returns
+ * a fresh `CognitoUser` with no in-memory session, so `getSession()` re-reads
+ * storage every time and swaps in a new token via the refresh token exactly when
+ * the stored one has expired. No network call while the token is still good.
+ */
+export async function getFreshIdToken(): Promise<string | null> {
+  const session = await getCurrentSession()
+  return session ? session.getIdToken().getJwtToken() : null
+}
+/** Test-only: reset the memoised pool. */
+export function __resetUserPoolForTests(): void {
+  userPool = null
+}

package/_skeletons/plugin-template/web-admin/src/lib/cognito-hygiene.ts ADDED Viewed

@@ -0,0 +1,60 @@
+// Removing Cognito credentials belonging to pools this deployment no longer uses.
+//
+// `amazon-cognito-identity-js` stores tokens under keys shaped
+// `CognitoIdentityServiceProvider.<ClientId>.<username>.<tokenType>` and reads
+// them back scoped by Client ID. Replacing a user pool therefore does not clear
+// the old one's keys: they are simply never read again, and they accumulate for
+// as long as the browser profile lives. `dev.biffo.io` was measured carrying
+// four pools' credentials — three of them dead — where AWS has one pool and one
+// client (biffo-template#834).
+//
+// What this is NOT: a fix for a wrong-identity read. Because every consumer
+// resolves its pool from the runtime identity document (#403) and lets
+// amazon-cognito-identity-js scope the lookup by Client ID, a stale pool's
+// tokens are never enumerated and never selected. That claim was made and
+// withdrawn on #834.
+//
+// What it IS: dead bearer tokens for real identities should not sit in browser
+// storage forever, and any future code that enumerates
+// `CognitoIdentityServiceProvider.*` — a debug helper, a sign-out-everywhere
+// action, a migration — should not inherit a growing minefield.
+/** `CognitoIdentityServiceProvider.<clientId>.<rest…>` — capture the client id. */
+const COGNITO_KEY = /^CognitoIdentityServiceProvider\.([^.]+)\./
+/**
+ * Delete every Cognito credential key whose Client ID is not `clientId`.
+ *
+ * Returns the keys removed, so a caller can log or assert on them. A no-op when
+ * `clientId` is falsy — an unresolved identity must never be treated as "no
+ * client matches", which would delete the live session along with the residue.
+ *
+ * Storage is injected for tests and to stay safe where there is none: this
+ * module is imported during `next build`'s prerender in Node, where
+ * `localStorage` does not exist.
+ */
+export function pruneForeignCognitoCredentials(
+  clientId: string | null | undefined,
+  storage: Storage | undefined = typeof localStorage === 'undefined' ? undefined : localStorage,
+): string[] {
+  if (!clientId || !storage) return []
+  // Snapshot the keys first, via the Storage API rather than Object.keys:
+  // removeItem() mutates the live key set, so index-based iteration would skip
+  // entries as it shrinks and leave half the residue behind.
+  const keys: string[] = []
+  for (let i = 0; i < storage.length; i++) {
+    const key = storage.key(i)
+    if (key !== null) keys.push(key)
+  }
+  const removed: string[] = []
+  for (const key of keys) {
+    const match = COGNITO_KEY.exec(key)
+    if (match && match[1] !== clientId) {
+      storage.removeItem(key)
+      removed.push(key)
+    }
+  }
+  return removed
+}

package/_skeletons/plugin-template/web-admin/src/lib/identity.ts ADDED Viewed

@@ -0,0 +1,73 @@
+// Runtime core identity — same mechanism as the founder-facing web/'s own
+// identity.ts (ADR-0007). This used to fetch admin_app's own /identity route
+// instead, on the theory that this app (served by the plugin host at
+// /api/v1/plugins/<plugin-slug>/admin/*) is a different origin from the portal
+// and so can't reach /.well-known/biffo-identity.json directly. That theory
+// was wrong: both are served from the same dev.biffo.io origin. The self-served
+// /identity route also turned out to be a dead end even for same-origin
+// callers — the API Gateway's own JWT authorizer and the plugin host's
+// group_gate both sit in front of it, so it can never be reached before a
+// session exists to prove admin-group membership with (confirmed live: a
+// direct fetch 401'd). /.well-known/biffo-identity.json has no such problem:
+// it's public, unauthenticated static content on the portal's own bucket, and
+// was already reachable the whole time.
+//
+// Core publishes its Cognito coordinates there. We resolve it at RUNTIME so
+// this app never bakes the core's pool/client id into its bundle — when core
+// replaces its pool, we always see the current one. Same-origin makes a
+// relative fetch valid with no CORS. Memoised: at most one request per page
+// load. Unreachable → null → the caller treats the visitor as signed out (a
+// clean redirect beats trusting a stale local pool id).
+export interface CoreIdentity {
+  userPoolId: string
+  clientId: string
+  region?: string
+  apiUrl?: string
+  portalUrl?: string
+}
+const IDENTITY_DOCUMENT_PATH = '/.well-known/biffo-identity.json'
+let cached: Promise<CoreIdentity | null> | null = null
+function identityFromDocument(data: unknown): CoreIdentity | null {
+  if (typeof data !== 'object' || data === null) return null
+  const doc = data as Record<string, unknown>
+  const userPoolId = typeof doc['userPoolId'] === 'string' ? doc['userPoolId'] : ''
+  const clientId = typeof doc['clientId'] === 'string' ? doc['clientId'] : ''
+  if (!userPoolId || !clientId) return null
+  const identity: CoreIdentity = { userPoolId, clientId }
+  if (typeof doc['region'] === 'string') identity.region = doc['region']
+  if (typeof doc['apiUrl'] === 'string') identity.apiUrl = doc['apiUrl']
+  if (typeof doc['portalUrl'] === 'string') identity.portalUrl = doc['portalUrl']
+  return identity
+}
+async function fetchCoreIdentity(): Promise<CoreIdentity | null> {
+  try {
+    const res = await fetch(IDENTITY_DOCUMENT_PATH, { cache: 'no-store' })
+    if (res.ok) {
+      const identity = identityFromDocument(await res.json())
+      if (identity) return identity
+    }
+  } catch {
+    // Network error or fetch unavailable — fall through to null.
+  }
+  console.warn(
+    `[biffo] could not resolve the core identity document at ${IDENTITY_DOCUMENT_PATH}; ` +
+      'treating the visitor as signed out.',
+  )
+  return null
+}
+/** Resolve core's Cognito identity at runtime. Memoised; null when unreachable. */
+export function resolveCoreIdentity(): Promise<CoreIdentity | null> {
+  cached ??= fetchCoreIdentity()
+  return cached
+}
+/** Test-only: clear the memoised resolution. */
+export function __resetCoreIdentityForTests(): void {
+  cached = null
+}

package/_skeletons/plugin-template/web-admin/src/main.tsx ADDED Viewed

@@ -0,0 +1,11 @@
+import { StrictMode } from 'react'
+import { createRoot } from 'react-dom/client'
+import App from './App'
+import './index.css'
+createRoot(document.getElementById('root')!).render(
+  <StrictMode>
+    <App />
+  </StrictMode>,
+)

package/_skeletons/plugin-template/web-admin/src/test-setup.ts ADDED Viewed

	@@ -0,0 +1 @@
1	+ import '@testing-library/jest-dom'

package/_skeletons/plugin-template/web-admin/tsconfig.json ADDED Viewed

@@ -0,0 +1,21 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "useDefineForClassFields": true,
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "skipLibCheck": true,
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "noEmit": true,
+    "jsx": "react-jsx",
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noFallthroughCasesInSwitch": true,
+    "types": ["vitest/globals", "@testing-library/jest-dom"]
+  },
+  "include": ["src", "vite.config.ts"]
+}

package/_skeletons/plugin-template/web-admin/vite.config.ts ADDED Viewed

@@ -0,0 +1,28 @@
+import { defineConfig } from 'vitest/config'
+import react from '@vitejs/plugin-react'
+// Served by the shared plugin host at /api/v1/plugins/example-plugin/admin/*
+// (the API Gateway path, not a separate CloudFront/S3 origin the way the
+// founder-facing web/ app is) — every asset/link URL must carry that full
+// prefix, INCLUDING THIS PLUGIN'S OWN NAME. `biffo plugin create` rewrites
+// `example-plugin` to the real slug (see .scaffold-tokens.json); do not hand-edit
+// this after scaffolding without updating BOTH this file and base-path.test.ts.
+//
+// This is not a theoretical trap. idea-scout's copy of this file was pasted
+// from ideation's and kept ideation's base. The built index.html then requested
+// idea-scout's own asset filenames under ideation's path — 503, blank page, and
+// NOT ONE local gate caught it: lint, typecheck, unit tests and the production
+// build all passed, because `base` only affects the URLs inside the emitted
+// HTML. It was visible solely by loading the page and reading the network log.
+//
+// The neighbouring trap: with a short base like "/example-plugin/admin/",
+// CloudFront's 404->index.html rule papers the miss over as a 200 serving the
+// PORTAL's homepage, so the browser tries to parse HTML as JS. Both failure
+// modes are silent in different ways — hence the full path, and hence
+// base-path.test.ts asserting it stays correct rather than trusting eyes alone.
+export default defineConfig({
+  base: '/api/v1/plugins/example-plugin/admin/',
+  plugins: [react()],
+  build: { outDir: 'dist' },
+  test: { environment: 'jsdom', globals: true, setupFiles: ['./src/test-setup.ts'] },
+})

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.273.13",
+  "version": "0.274.0",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",