@everysk/apps-devkit 0.1.0-beta.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Everysk Technologies
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,106 @@
+# @everysk/apps-devkit
+
+(C) Copyright 2026 EVERYSK TECHNOLOGIES
+
+The build configuration every Everysk app extends: Vite, ESLint, Vitest, TypeScript and
+Prettier presets — and the toolchain itself. Declared as a `devDependency`.
+
+Part of [everysk/apps-sdk](https://github.com/everysk/apps-sdk), alongside
+[`@everysk/apps-sdk`](../apps-sdk) (the runtime) and [`@everysk/apps-cli`](../apps-cli) (the
+`everysk-apps` bin).
+
+## Install
+
+```bash
+npm install --save-dev @everysk/apps-devkit
+```
+
+Vite, ESLint, Vitest and Prettier are its own `dependencies`, not peers, so an app gets the
+whole toolchain from this one line — and `npm ci --omit=dev` still drops every bit of it from a
+deploy image. That is the boundary the package exists to draw: a required peer of a
+`dependency` **is** installed under `--omit=dev`, measured, so putting the runner there would
+have shipped it to production.
+
+## Use
+
+Each preset takes overrides, merged with Vite's own `mergeConfig`, so an app adds to the preset
+rather than replacing it.
+
+```ts
+// vite.config.ts
+import { defineAppConfig } from "@everysk/apps-devkit/vite";
+
+export default defineAppConfig();
+```
+
+```ts
+// vitest.config.ts
+import { defineAppTestConfig } from "@everysk/apps-devkit/vitest";
+
+export default defineAppTestConfig();
+```
+
+```js
+// eslint.config.js
+import { everyskConfig } from "@everysk/apps-devkit/eslint";
+
+export default everyskConfig();
+```
+
+```jsonc
+// tsconfig.app.json
+{
+  "extends": "@everysk/apps-devkit/tsconfig",
+  // paths is re-declared here on purpose — see below
+  "compilerOptions": { "paths": { "@/*": ["./src/*"] } },
+  "include": ["src"]
+}
+```
+
+```
+"@everysk/apps-devkit/prettier"    // .prettierrc
+```
+
+| Subpath | |
+|---|---|
+| `/vite` | `defineAppConfig`, plus the dev proxy and the two config plugins on their own |
+| `/vitest` | `defineAppTestConfig` |
+| `/eslint` | `everyskConfig` |
+| `/prettier` | the Prettier config as JSON |
+| `/tsconfig`, `/tsconfig/node`, `/tsconfig/vitest` | the TypeScript bases |
+
+## What the presets decide
+
+**Vite** — `base: "./"`, `envDir` at `PROJECT_ROOT` (an app builds from `apps/<name>/project`
+but `.env` lives at the repository root), the `@` alias, React with the compiler, Tailwind, and
+the `/api` dev proxy that authenticates with OAuth2 client credentials and refreshes the token
+before it expires.
+
+It also serves the app's `config.json` `env_vars` at `/app-config.json` in dev, read **one level
+above** the Vite root. That is why an app is `<name>/{config.json, project/}`: flatten it and the
+app boots with no configuration, silently.
+
+**ESLint** — the conventions lint can actually check: no MUI barrel imports, and no direct data
+access from `src/pages/**` or `src/components/**`.
+
+**Vitest** — jsdom, `@everysk/apps-sdk/test/setup` as the setup file, a 30s timeout (Vitest's 5s
+default trips MUI transition-driven tests under `--coverage`, and every app was raising it by
+hand) and an 80 % coverage floor.
+
+## Two traps this package encodes
+
+**`tsconfig/app.json` deliberately omits `paths`.** TypeScript resolves a config's paths relative
+to the file that *declares* them, so an `@/*` mapping written here would point at this package's
+own `src`. Each app re-declares it.
+
+**Barrels are excluded from coverage at exactly one level.** The recursive form also matches every
+`index.tsx`, which silently drops real components out of the report — found while building the
+SDK, encoded here so no app repeats it.
+
+## Requirements
+
+Node 22 or newer, npm 12 or newer.
+
+## License
+
+MIT — see [LICENSE](./LICENSE).

package/dist/eslint/index.d.ts

@@ -0,0 +1,20 @@
+import { defineConfig } from "eslint/config";
+/**
+ * everyskConfig
+ *
+ * The ESLint configuration every Everysk app shares, so an app's `eslint.config.js` is:
+ *
+ * ```js
+ * import { everyskConfig } from "@everysk/apps-devkit/eslint";
+ * export default everyskConfig();
+ * ```
+ *
+ * It encodes the conventions that lint can actually check: no MUI barrel imports, and no
+ * direct data access from pages or components. The rules that lint cannot express — which
+ * subpath to import, which provider to wire — belong to the `everysk-apps` generator.
+ *
+ * @param {ReturnType<typeof defineConfig>} [extra] - Appended after the preset, so an app can
+ *   add or override rules for its own files.
+ */
+export declare const everyskConfig: (extra?: ReturnType<typeof defineConfig>) => import("eslint/config").Config[];
+//# sourceMappingURL=index.d.ts.map

package/dist/eslint/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/eslint/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAiB,MAAM,eAAe,CAAC;AAmB5D;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa,GAAI,QAAO,UAAU,CAAC,OAAO,YAAY,CAAM,qCAgDnE,CAAC"}

package/dist/eslint/index.js

@@ -0,0 +1,85 @@
+import js from "@eslint/js";
+import globals from "globals";
+import reactHooks from "eslint-plugin-react-hooks";
+import reactRefresh from "eslint-plugin-react-refresh";
+import tseslint from "typescript-eslint";
+import { defineConfig, globalIgnores } from "eslint/config";
+// Barrel bans applied to every file: faster dev startup and reliable tree-shaking.
+const noBarrelPaths = [
+    {
+        name: "@mui/material",
+        message: "Avoid the barrel. Import from the deep path, e.g. `@mui/material/Button` or `@mui/material/styles`.",
+    },
+    {
+        name: "@mui/icons-material",
+        message: "Avoid the barrel. Import the specific icon, e.g. `@mui/icons-material/Search`.",
+    },
+];
+// Data-layer rule: pages and components reach data only through entity hooks.
+const dataLayerMessage = "Data access only via entity hooks (@everysk/apps-sdk/<entity> or @/hooks/...). Pages and components must not call axios or an api module directly.";
+/**
+ * everyskConfig
+ *
+ * The ESLint configuration every Everysk app shares, so an app's `eslint.config.js` is:
+ *
+ * ```js
+ * import { everyskConfig } from "@everysk/apps-devkit/eslint";
+ * export default everyskConfig();
+ * ```
+ *
+ * It encodes the conventions that lint can actually check: no MUI barrel imports, and no
+ * direct data access from pages or components. The rules that lint cannot express — which
+ * subpath to import, which provider to wire — belong to the `everysk-apps` generator.
+ *
+ * @param {ReturnType<typeof defineConfig>} [extra] - Appended after the preset, so an app can
+ *   add or override rules for its own files.
+ */
+export const everyskConfig = (extra = []) => defineConfig([
+    globalIgnores(["dist", "coverage"]),
+    {
+        files: ["**/*.{ts,tsx}"],
+        extends: [
+            js.configs.recommended,
+            tseslint.configs.recommended,
+            reactHooks.configs.flat["recommended-latest"],
+            reactRefresh.configs.vite,
+        ],
+        languageOptions: {
+            ecmaVersion: 2020,
+            globals: globals.browser,
+        },
+        rules: {
+            "@typescript-eslint/no-restricted-imports": ["error", { paths: noBarrelPaths }],
+        },
+    },
+    {
+        // A same-named rule REPLACES the base one for these files rather than merging, so
+        // the barrel bans are repeated here.
+        files: ["src/pages/**/*.{ts,tsx}", "src/components/**/*.{ts,tsx}"],
+        rules: {
+            "@typescript-eslint/no-restricted-imports": [
+                "error",
+                {
+                    paths: [
+                        ...noBarrelPaths,
+                        { name: "axios", message: dataLayerMessage },
+                        { name: "@/api", message: dataLayerMessage },
+                    ],
+                    patterns: [{ group: ["@/api/*"], message: dataLayerMessage }],
+                },
+            ],
+        },
+    },
+    {
+        // Tests may reach the data layer directly, to mock an api module or build axios
+        // stubs. Only the barrel bans remain, and the Fast Refresh rule is relaxed for
+        // test utilities that export helpers.
+        files: ["src/**/*.{test,spec}.{ts,tsx}", "src/test/**/*.{ts,tsx}"],
+        rules: {
+            "@typescript-eslint/no-restricted-imports": ["error", { paths: noBarrelPaths }],
+            "react-refresh/only-export-components": "off",
+        },
+    },
+    ...extra,
+]);
+//# sourceMappingURL=index.js.map

package/dist/eslint/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/eslint/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,UAAU,MAAM,2BAA2B,CAAC;AACnD,OAAO,YAAY,MAAM,6BAA6B,CAAC;AACvD,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE5D,mFAAmF;AACnF,MAAM,aAAa,GAAG;IAClB;QACI,IAAI,EAAE,eAAe;QACrB,OAAO,EACH,qGAAqG;KAC5G;IACD;QACI,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,gFAAgF;KAC5F;CACJ,CAAC;AAEF,8EAA8E;AAC9E,MAAM,gBAAgB,GAClB,oJAAoJ,CAAC;AAEzJ;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAyC,EAAE,EAAE,EAAE,CACzE,YAAY,CAAC;IACT,aAAa,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACnC;QACI,KAAK,EAAE,CAAC,eAAe,CAAC;QACxB,OAAO,EAAE;YACL,EAAE,CAAC,OAAO,CAAC,WAAW;YACtB,QAAQ,CAAC,OAAO,CAAC,WAAW;YAC5B,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC;YAC7C,YAAY,CAAC,OAAO,CAAC,IAAI;SAC5B;QACD,eAAe,EAAE;YACb,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,OAAO,CAAC,OAAO;SAC3B;QACD,KAAK,EAAE;YACH,0CAA0C,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;SAClF;KACJ;IACD;QACI,kFAAkF;QAClF,qCAAqC;QACrC,KAAK,EAAE,CAAC,yBAAyB,EAAE,8BAA8B,CAAC;QAClE,KAAK,EAAE;YACH,0CAA0C,EAAE;gBACxC,OAAO;gBACP;oBACI,KAAK,EAAE;wBACH,GAAG,aAAa;wBAChB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE;wBAC5C,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE;qBAC/C;oBACD,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;iBAChE;aACJ;SACJ;KACJ;IACD;QACI,gFAAgF;QAChF,+EAA+E;QAC/E,sCAAsC;QACtC,KAAK,EAAE,CAAC,+BAA+B,EAAE,wBAAwB,CAAC;QAClE,KAAK,EAAE;YACH,0CAA0C,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;YAC/E,sCAAsC,EAAE,KAAK;SAChD;KACJ;IACD,GAAG,KAAK;CACX,CAAC,CAAC"}

package/dist/prettier/index.json

@@ -0,0 +1,8 @@
+{
+    "semi": true,
+    "singleQuote": false,
+    "trailingComma": "all",
+    "printWidth": 100,
+    "tabWidth": 4,
+    "endOfLine": "lf"
+}

package/dist/vite/index.d.ts

@@ -0,0 +1,30 @@
+import { type UserConfig } from "vite";
+export { createDevServerProxy } from "./serverProxy.js";
+export { envVarsLocationPlugin } from "./plugins/envVarsLocation.js";
+export { serveDevAppConfigPlugin } from "./plugins/serveDevAppConfig.js";
+/**
+ * defineAppConfig
+ *
+ * The Vite configuration every Everysk app shares, so an app's own `vite.config.ts` is three
+ * lines instead of a copy that drifts:
+ *
+ * ```ts
+ * import { defineAppConfig } from "@everysk/apps-devkit/vite";
+ * export default defineAppConfig();
+ * ```
+ *
+ * What it sets up:
+ *
+ * - `base: "./"` and `envDir` at `PROJECT_ROOT`, because an app is built from
+ *   `apps/<name>/project/` but its `.env` lives at the repository root.
+ * - The `@` alias to the app's `src/`.
+ * - The dev server on `PORT` (default 5173, `strictPort`), with the `/api` proxy that
+ *   authenticates against `EVERYSK_API_URL` using OAuth2 client credentials.
+ * - React with the compiler preset, Tailwind, and the two plugins that carry the app's
+ *   `config.json` `env_vars` into the page — a meta tag in build, `/app-config.json` in dev.
+ *
+ * @param {UserConfig} [overrides] - Merged over the preset with Vite's own `mergeConfig`, so
+ *   arrays (plugins, aliases) are concatenated rather than replaced.
+ */
+export declare const defineAppConfig: (overrides?: UserConfig) => import("vite").UserConfigFnObject;
+//# sourceMappingURL=index.d.ts.map

package/dist/vite/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vite/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsC,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAU3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,eAAe,GAAI,YAAW,UAAe,sCAyCpD,CAAC"}

package/dist/vite/index.js

@@ -0,0 +1,70 @@
+import { fileURLToPath, URL } from "node:url";
+import { defineConfig, loadEnv, mergeConfig } from "vite";
+import react, { reactCompilerPreset } from "@vitejs/plugin-react";
+import babel from "@rolldown/plugin-babel";
+import tailwindcss from "@tailwindcss/vite";
+import { createDevServerProxy } from "./serverProxy.js";
+import { envVarsLocationPlugin } from "./plugins/envVarsLocation.js";
+import { serveDevAppConfigPlugin } from "./plugins/serveDevAppConfig.js";
+export { createDevServerProxy } from "./serverProxy.js";
+export { envVarsLocationPlugin } from "./plugins/envVarsLocation.js";
+export { serveDevAppConfigPlugin } from "./plugins/serveDevAppConfig.js";
+/**
+ * defineAppConfig
+ *
+ * The Vite configuration every Everysk app shares, so an app's own `vite.config.ts` is three
+ * lines instead of a copy that drifts:
+ *
+ * ```ts
+ * import { defineAppConfig } from "@everysk/apps-devkit/vite";
+ * export default defineAppConfig();
+ * ```
+ *
+ * What it sets up:
+ *
+ * - `base: "./"` and `envDir` at `PROJECT_ROOT`, because an app is built from
+ *   `apps/<name>/project/` but its `.env` lives at the repository root.
+ * - The `@` alias to the app's `src/`.
+ * - The dev server on `PORT` (default 5173, `strictPort`), with the `/api` proxy that
+ *   authenticates against `EVERYSK_API_URL` using OAuth2 client credentials.
+ * - React with the compiler preset, Tailwind, and the two plugins that carry the app's
+ *   `config.json` `env_vars` into the page — a meta tag in build, `/app-config.json` in dev.
+ *
+ * @param {UserConfig} [overrides] - Merged over the preset with Vite's own `mergeConfig`, so
+ *   arrays (plugins, aliases) are concatenated rather than replaced.
+ */
+export const defineAppConfig = (overrides = {}) => defineConfig(({ mode, command }) => {
+    // The app is built from apps/<name>/project, but .env lives at the repo root; the
+    // devcontainer exports PROJECT_ROOT for exactly this.
+    const root = process.env.PROJECT_ROOT ?? process.cwd();
+    const env = loadEnv(mode, root, "");
+    Object.assign(process.env, env);
+    const preset = {
+        base: "./",
+        envDir: root,
+        resolve: {
+            alias: {
+                "@": fileURLToPath(new URL("./src", `file://${process.cwd()}/`)),
+            },
+        },
+        build: {
+            outDir: "./dist",
+            emptyOutDir: true,
+        },
+        server: {
+            host: true,
+            port: Number(process.env.PORT) || 5173,
+            strictPort: true,
+            proxy: command === "serve" ? createDevServerProxy() : undefined,
+        },
+        plugins: [
+            react(),
+            babel({ presets: [reactCompilerPreset()] }),
+            tailwindcss(),
+            envVarsLocationPlugin(),
+            serveDevAppConfigPlugin(),
+        ],
+    };
+    return mergeConfig(preset, overrides);
+});
+//# sourceMappingURL=index.js.map

package/dist/vite/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/vite/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAmB,MAAM,MAAM,CAAC;AAE3E,OAAO,KAAK,EAAE,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,KAAK,MAAM,wBAAwB,CAAC;AAC3C,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAE5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAEzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,YAAwB,EAAE,EAAE,EAAE,CAC1D,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;IAC/B,kFAAkF;IAClF,sDAAsD;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAEvD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACpC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAEhC,MAAM,MAAM,GAAe;QACvB,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,IAAI;QAEZ,OAAO,EAAE;YACL,KAAK,EAAE;gBACH,GAAG,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,UAAU,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;aACnE;SACJ;QAED,KAAK,EAAE;YACH,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,IAAI;SACpB;QAED,MAAM,EAAE;YACJ,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI;YACtC,UAAU,EAAE,IAAI;YAChB,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,SAAS;SAClE;QAED,OAAO,EAAE;YACL,KAAK,EAAE;YACP,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,mBAAmB,EAAE,CAAC,EAAE,CAAC;YAC3C,WAAW,EAAE;YACb,qBAAqB,EAAE;YACvB,uBAAuB,EAAE;SAC5B;KACJ,CAAC;IAEF,OAAO,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC"}

package/dist/vite/plugins/envVarsLocation.d.ts

@@ -0,0 +1,3 @@
+import type { Plugin } from "vite";
+export declare function envVarsLocationPlugin(): Plugin;
+//# sourceMappingURL=envVarsLocation.d.ts.map

package/dist/vite/plugins/envVarsLocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envVarsLocation.d.ts","sourceRoot":"","sources":["../../../src/vite/plugins/envVarsLocation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,wBAAgB,qBAAqB,IAAI,MAAM,CAQ9C"}

package/dist/vite/plugins/envVarsLocation.js

@@ -0,0 +1,10 @@
+export function envVarsLocationPlugin() {
+    return {
+        name: "env_vars_location",
+        apply: "build",
+        transformIndexHtml() {
+            return [{ tag: "meta", attrs: { name: "app-config" }, injectTo: "head" }];
+        },
+    };
+}
+//# sourceMappingURL=envVarsLocation.js.map

package/dist/vite/plugins/envVarsLocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envVarsLocation.js","sourceRoot":"","sources":["../../../src/vite/plugins/envVarsLocation.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,OAAO;QACd,kBAAkB;YAChB,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/vite/plugins/serveDevAppConfig.d.ts

@@ -0,0 +1,15 @@
+import type { Plugin } from "vite";
+/**
+ * In production the platform injects `window.APP_CONFIG` from the app's `config.json` `env_vars`
+ * (via the `app-config` meta tag added by the build plugin). There is no platform in dev, so this
+ * plugin serves that same `env_vars` object at `/app-config.json`, read from the app's `config.json`
+ * one level up from the Vite root (apps/<name>/config.json, sibling of project/). `main.tsx` fetches
+ * it on bootstrap and merges it into `window.APP_CONFIG`, so dev mirrors production from a single
+ * source of truth — there is no separate dev config file to keep in sync.
+ *
+ * Because `config.json` lives outside the Vite root it is not watched by default, and `main.tsx`
+ * only reads it once at bootstrap. So we also add it to the watcher and trigger a full page reload
+ * on change — a full reload re-runs the bootstrap fetch, picking up edits to `env_vars` live.
+ */
+export declare function serveDevAppConfigPlugin(): Plugin;
+//# sourceMappingURL=serveDevAppConfig.d.ts.map

package/dist/vite/plugins/serveDevAppConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serveDevAppConfig.d.ts","sourceRoot":"","sources":["../../../src/vite/plugins/serveDevAppConfig.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAiChD"}

package/dist/vite/plugins/serveDevAppConfig.js

@@ -0,0 +1,47 @@
+import path from "node:path";
+import fs from "node:fs/promises";
+/**
+ * In production the platform injects `window.APP_CONFIG` from the app's `config.json` `env_vars`
+ * (via the `app-config` meta tag added by the build plugin). There is no platform in dev, so this
+ * plugin serves that same `env_vars` object at `/app-config.json`, read from the app's `config.json`
+ * one level up from the Vite root (apps/<name>/config.json, sibling of project/). `main.tsx` fetches
+ * it on bootstrap and merges it into `window.APP_CONFIG`, so dev mirrors production from a single
+ * source of truth — there is no separate dev config file to keep in sync.
+ *
+ * Because `config.json` lives outside the Vite root it is not watched by default, and `main.tsx`
+ * only reads it once at bootstrap. So we also add it to the watcher and trigger a full page reload
+ * on change — a full reload re-runs the bootstrap fetch, picking up edits to `env_vars` live.
+ */
+export function serveDevAppConfigPlugin() {
+    return {
+        name: "serve-dev-app-config",
+        apply: "serve",
+        configureServer(server) {
+            // apps/<name>/config.json — one level up from the Vite root (the app's project/ dir).
+            const configPath = path.resolve(process.cwd(), "..", "config.json");
+            server.middlewares.use(async (req, res, next) => {
+                if (req.url !== "/app-config.json")
+                    return next();
+                try {
+                    const content = await fs.readFile(configPath, "utf-8");
+                    const envVars = (JSON.parse(content).env_vars ?? {});
+                    res.setHeader("Content-Type", "application/json; charset=utf-8");
+                    res.statusCode = 200;
+                    res.end(JSON.stringify(envVars));
+                }
+                catch {
+                    res.statusCode = 404;
+                    res.end();
+                }
+            });
+            // config.json is outside the Vite root, so watch it explicitly and full-reload on change.
+            server.watcher.add(configPath);
+            server.watcher.on("change", (file) => {
+                if (path.resolve(file) === configPath) {
+                    server.hot.send({ type: "full-reload" });
+                }
+            });
+        },
+    };
+}
+//# sourceMappingURL=serveDevAppConfig.js.map

package/dist/vite/plugins/serveDevAppConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serveDevAppConfig.js","sourceRoot":"","sources":["../../../src/vite/plugins/serveDevAppConfig.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIlC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,OAAO;QACd,eAAe,CAAC,MAAM;YACpB,sFAAsF;YACtF,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;YAEpE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBAC9C,IAAI,GAAG,CAAC,GAAG,KAAK,kBAAkB;oBAAE,OAAO,IAAI,EAAE,CAAC;gBAElD,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;oBACvD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;oBAEhF,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;oBACjE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;gBACnC,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,0FAA0F;YAC1F,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC/B,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;gBACnC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;oBACtC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/vite/serverProxy.d.ts

@@ -0,0 +1,16 @@
+import type { ProxyOptions } from "vite";
+/**
+ * createDevServerProxy — Vite dev proxy for `/api`, authenticated with OAuth2 client credentials.
+ *
+ * Forwards `/api/*` to `EVERYSK_API_URL` (stripping the `/api` prefix) and injects an
+ * `Authorization: Bearer <access_token>` header. The token is obtained from
+ * `${EVERYSK_API_URL}/oauth2/token` with the `client_credentials` grant, cached in memory, and
+ * refreshed in the background shortly before it expires. It is fetched eagerly at startup so a
+ * token is ready before the first API call.
+ *
+ * @returns {Record<string, string | ProxyOptions>} The Vite `server.proxy` config for `/api`.
+ * @throws {Error} If `EVERYSK_API_URL`, `EVERYSK_API_CLIENT_ID`, or `EVERYSK_API_CLIENT_SECRET`
+ *   is missing.
+ */
+export declare function createDevServerProxy(): Record<string, string | ProxyOptions>;
+//# sourceMappingURL=serverProxy.d.ts.map

package/dist/vite/serverProxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverProxy.d.ts","sourceRoot":"","sources":["../../src/vite/serverProxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,MAAM,CAAC;AAMzC;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAAC,CAoE5E"}

package/dist/vite/serverProxy.js

@@ -0,0 +1,81 @@
+// Refresh the OAuth2 token this many ms before it actually expires, so an in-flight
+// request never races a just-expired token.
+const REFRESH_SKEW_MS = 60_000;
+/**
+ * createDevServerProxy — Vite dev proxy for `/api`, authenticated with OAuth2 client credentials.
+ *
+ * Forwards `/api/*` to `EVERYSK_API_URL` (stripping the `/api` prefix) and injects an
+ * `Authorization: Bearer <access_token>` header. The token is obtained from
+ * `${EVERYSK_API_URL}/oauth2/token` with the `client_credentials` grant, cached in memory, and
+ * refreshed in the background shortly before it expires. It is fetched eagerly at startup so a
+ * token is ready before the first API call.
+ *
+ * @returns {Record<string, string | ProxyOptions>} The Vite `server.proxy` config for `/api`.
+ * @throws {Error} If `EVERYSK_API_URL`, `EVERYSK_API_CLIENT_ID`, or `EVERYSK_API_CLIENT_SECRET`
+ *   is missing.
+ */
+export function createDevServerProxy() {
+    const EVERYSK_API_URL = process.env.EVERYSK_API_URL;
+    if (!EVERYSK_API_URL)
+        throw new Error("EVERYSK_API_URL must be set.");
+    const clientId = process.env.EVERYSK_API_CLIENT_ID;
+    const clientSecret = process.env.EVERYSK_API_CLIENT_SECRET;
+    if (!clientId || !clientSecret) {
+        throw new Error("EVERYSK_API_CLIENT_ID and EVERYSK_API_CLIENT_SECRET must be set (OAuth2 client credentials).");
+    }
+    // Captured into an object so the narrowed `string` type survives inside the async closure below.
+    const credentials = { clientId, clientSecret };
+    const tokenUrl = `${EVERYSK_API_URL.replace(/\/$/, "")}/oauth2/token`;
+    let accessToken = null;
+    let refreshTimer = null;
+    /**
+     * refreshToken — fetch a fresh access token and schedule the next refresh before it expires.
+     *
+     * @returns {Promise<void>} Resolves once `accessToken` is updated.
+     * @throws {Error} If the token request fails or returns no `access_token`.
+     */
+    async function refreshToken() {
+        const res = await fetch(tokenUrl, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "client_credentials",
+                client_id: credentials.clientId,
+                client_secret: credentials.clientSecret,
+            }),
+        });
+        if (!res.ok)
+            throw new Error(`OAuth2 token request failed: ${res.status} ${res.statusText}`);
+        const data = (await res.json());
+        if (!data.access_token)
+            throw new Error("OAuth2 token response had no access_token.");
+        accessToken = data.access_token;
+        const ttlMs = (data.expires_in ?? 3600) * 1000;
+        if (refreshTimer)
+            clearTimeout(refreshTimer);
+        refreshTimer = setTimeout(() => {
+            void refreshToken().catch((error) => console.error("[dev proxy] OAuth2 token refresh failed:", error));
+        }, Math.max(ttlMs - REFRESH_SKEW_MS, 30_000));
+        refreshTimer.unref?.();
+    }
+    // Warm the token before the first request; a failure is logged, not fatal (the request will 401).
+    void refreshToken().catch((error) => console.error("[dev proxy] initial OAuth2 token fetch failed:", error));
+    return {
+        "/api": {
+            target: EVERYSK_API_URL,
+            changeOrigin: true,
+            xfwd: true,
+            rewrite: (p) => p.replace(/^\/api(?=\/|$)/, ""),
+            configure: (proxy) => {
+                proxy.on("proxyReq", (proxyReq) => {
+                    proxyReq.removeHeader("origin");
+                    proxyReq.removeHeader("referer");
+                    if (accessToken) {
+                        proxyReq.setHeader("Authorization", `Bearer ${accessToken}`);
+                    }
+                });
+            },
+        },
+    };
+}
+//# sourceMappingURL=serverProxy.js.map

package/dist/vite/serverProxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverProxy.js","sourceRoot":"","sources":["../../src/vite/serverProxy.ts"],"names":[],"mappings":"AAEA,oFAAoF;AACpF,4CAA4C;AAC5C,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACpD,IAAI,CAAC,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAEtE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACnD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAC3D,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;IAClH,CAAC;IACD,iGAAiG;IACjG,MAAM,WAAW,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAE/C,MAAM,QAAQ,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC;IACtE,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,YAAY,GAAyC,IAAI,CAAC;IAE9D;;;;;OAKG;IACH,KAAK,UAAU,YAAY;QACzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,WAAW,CAAC,QAAQ;gBAC/B,aAAa,EAAE,WAAW,CAAC,YAAY;aACxC,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAE7F,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmD,CAAC;QAClF,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACtF,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC;QAEhC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;QAC/C,IAAI,YAAY;YAAE,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,KAAK,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC,CAAC;QACzG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9C,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC;IACzB,CAAC;IAED,kGAAkG;IAClG,KAAK,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,gDAAgD,EAAE,KAAK,CAAC,CAAC,CAAC;IAE7G,OAAO;QACL,MAAM,EAAE;YACN,MAAM,EAAE,eAAe;YACvB,YAAY,EAAE,IAAI;YAClB,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;YAE/C,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;gBACnB,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE;oBAChC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;oBAChC,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;oBAEjC,IAAI,WAAW,EAAE,CAAC;wBAChB,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,WAAW,EAAE,CAAC,CAAC;oBAC/D,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/vitest/index.d.ts

@@ -0,0 +1,33 @@
+import { type ViteUserConfig } from "vitest/config";
+/**
+ * defineAppTestConfig
+ *
+ * The Vitest configuration every Everysk app shares:
+ *
+ * ```ts
+ * import { defineAppTestConfig } from "@everysk/apps-devkit/vitest";
+ * export default defineAppTestConfig();
+ * ```
+ *
+ * Standalone from the Vite config on purpose — the same split the template kept. The library
+ * build, the dev proxy and the React Compiler pass are irrelevant to tests; all they need is
+ * the React transform, the `@` alias and jsdom.
+ *
+ * Notable defaults:
+ *
+ * - `setupFiles` points at `@everysk/apps-sdk/test/setup`, which installs the jsdom gaps MUI
+ *   needs (matchMedia, ResizeObserver). It seeds no page globals: an app injects configuration
+ *   per test with `renderWithProviders(ui, { appId, appEnvironmentVar })`.
+ * - `testTimeout` is 30s, not Vitest's 5s. The template's default trips MUI transition-driven
+ *   tests under `--coverage`, and every app had to raise it by hand.
+ * - Coverage thresholds at 80% on all four counters, which the deploy gate enforces. `branches`
+ *   is listed explicitly: leaving it out does not inherit the others, it leaves that counter
+ *   unenforced, and an untested `if` is exactly what a coverage floor is there to catch. Barrels
+ *   are excluded at
+ *   exactly one level deep. A recursive glob would also swallow every `index.tsx` and quietly
+ *   drop real components out of the report — which is what happened while building the SDK.
+ *
+ * @param {ViteUserConfig} [overrides] - Merged over the preset with Vite's `mergeConfig`.
+ */
+export declare const defineAppTestConfig: (overrides?: ViteUserConfig) => ViteUserConfig;
+//# sourceMappingURL=index.d.ts.map

package/dist/vitest/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vitest/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAI/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,mBAAmB,GAAI,YAAW,cAAmB,mBA4CjE,CAAC"}