@everysk/apps-devkit 0.2.0 → 0.3.0-beta-20261016180126

package/README.md

@@ -56,9 +56,14 @@ export default defineAppTestConfig();
 // eslint.config.js
 import { everyskConfig } from "@everysk/apps-devkit/eslint";
 
-export default everyskConfig();
+export default everyskConfig({ tsconfigRootDir: import.meta.dirname });
 ```
 
+`tsconfigRootDir` is the app's own directory, which only its config can name. In a repository of
+several apps, linting them in one run (an editor does, and so does `eslint` from the root) fails
+with "No tsconfigRootDir was set, and multiple candidate TSConfigRootDirs are present" without it.
+`everyskConfig(extra)` still works, and so does `everyskConfig({ tsconfigRootDir, extra })`.
+
 ```jsonc
 // tsconfig.app.json
 {
@@ -75,7 +80,7 @@ export default everyskConfig();
 
 | Subpath | |
 |---|---|
-| `/vite` | `defineAppConfig`, plus the dev proxy and the two config plugins on their own |
+| `/vite` | `defineAppConfig`, plus on their own: the dev proxy, the `/file/` route plugin, the token source they share, and the two config plugins |
 | `/vitest` | `defineAppTestConfig` |
 | `/eslint` | `everyskConfig` |
 | `/prettier` | the Prettier config as JSON |
@@ -88,6 +93,11 @@ but `.env` lives at the repository root), the `@` alias, React with the compiler
 the `/api` dev proxy that authenticates with OAuth2 client credentials and refreshes the token
 before it expires.
 
+The dev server and `vite preview` also answer the platform's `/file/<hash>` route, so a file's
+own `url` shows it there as on the platform. That route reads only the user's session, which the
+dev server does not have, so the file is found through the API with the proxy's OAuth2 token,
+by its `url`, and its content decoded and sent inline with its type.
+
 It also serves the app's `config.json` `env_vars` at `/app-config.json` in dev, read **one level
 above** the Vite root. That is why an app is `<name>/{config.json, project/}`: flatten it and the
 app boots with no configuration, silently.

package/dist/eslint/index.d.ts

@@ -1,4 +1,14 @@
 import { defineConfig } from "eslint/config";
+export type EveryskConfigOptions = {
+    /**
+     * The app's directory, `import.meta.dirname` in its `eslint.config.js`. An editor lints a
+     * repository of several apps in one ESLint process, where typescript-eslint refuses to pick
+     * among their tsconfigs; only the app's own config knows which directory is its root.
+     */
+    tsconfigRootDir?: string;
+    /** Appended after the preset, so an app can add or override rules for its own files. */
+    extra?: ReturnType<typeof defineConfig>;
+};
 /**
  * everyskConfig
  *
@@ -6,15 +16,14 @@ import { defineConfig } from "eslint/config";
  *
  * ```js
  * import { everyskConfig } from "@everysk/apps-devkit/eslint";
- * export default everyskConfig();
+ * export default everyskConfig({ tsconfigRootDir: import.meta.dirname });
  * ```
  *
  * It encodes the conventions that lint can actually check: no MUI barrel imports, and no
  * direct data access from pages or components. The rules that lint cannot express — which
  * subpath to import, which provider to wire — belong to the `everysk-apps` generator.
  *
- * @param {ReturnType<typeof defineConfig>} [extra] - Appended after the preset, so an app can
- *   add or override rules for its own files.
+ * Takes the options, or the app's own blocks alone, as it did before there were options.
  */
-export declare const everyskConfig: (extra?: ReturnType<typeof defineConfig>) => import("eslint/config").ConfigObject[];
+export declare const everyskConfig: (optionsOrExtra?: EveryskConfigOptions | ReturnType<typeof defineConfig>) => import("eslint/config").ConfigObject[];
 //# sourceMappingURL=index.d.ts.map

package/dist/eslint/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/eslint/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAiB,MAAM,eAAe,CAAC;AAmB5D;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa,GAAI,QAAO,UAAU,CAAC,OAAO,YAAY,CAAM,2CAgDnE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/eslint/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAiB,MAAM,eAAe,CAAC;AAmB5D,MAAM,MAAM,oBAAoB,GAAG;IAC/B;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wFAAwF;IACxF,KAAK,CAAC,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;CAC3C,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,aAAa,GACtB,iBAAgB,oBAAoB,GAAG,UAAU,CAAC,OAAO,YAAY,CAAM,2CAuD9E,CAAC"}

package/dist/eslint/index.js

@@ -24,62 +24,67 @@ const dataLayerMessage = "Data access only via entity hooks (@everysk/apps-sdk/<
  *
  * ```js
  * import { everyskConfig } from "@everysk/apps-devkit/eslint";
- * export default everyskConfig();
+ * export default everyskConfig({ tsconfigRootDir: import.meta.dirname });
  * ```
  *
  * It encodes the conventions that lint can actually check: no MUI barrel imports, and no
  * direct data access from pages or components. The rules that lint cannot express — which
  * subpath to import, which provider to wire — belong to the `everysk-apps` generator.
  *
- * @param {ReturnType<typeof defineConfig>} [extra] - Appended after the preset, so an app can
- *   add or override rules for its own files.
+ * Takes the options, or the app's own blocks alone, as it did before there were options.
  */
-export const everyskConfig = (extra = []) => defineConfig([
-    globalIgnores(["dist", "coverage"]),
-    {
-        files: ["**/*.{ts,tsx}"],
-        extends: [
-            js.configs.recommended,
-            tseslint.configs.recommended,
-            reactHooks.configs.flat["recommended-latest"],
-            reactRefresh.configs.vite,
-        ],
-        languageOptions: {
-            ecmaVersion: 2020,
-            globals: globals.browser,
-        },
-        rules: {
-            "@typescript-eslint/no-restricted-imports": ["error", { paths: noBarrelPaths }],
-        },
-    },
-    {
-        // A same-named rule REPLACES the base one for these files rather than merging, so
-        // the barrel bans are repeated here.
-        files: ["src/pages/**/*.{ts,tsx}", "src/components/**/*.{ts,tsx}"],
-        rules: {
-            "@typescript-eslint/no-restricted-imports": [
-                "error",
-                {
-                    paths: [
-                        ...noBarrelPaths,
-                        { name: "axios", message: dataLayerMessage },
-                        { name: "@/api", message: dataLayerMessage },
-                    ],
-                    patterns: [{ group: ["@/api/*"], message: dataLayerMessage }],
-                },
+export const everyskConfig = (optionsOrExtra = {}) => {
+    const { tsconfigRootDir, extra = [] } = Array.isArray(optionsOrExtra)
+        ? { extra: optionsOrExtra }
+        : optionsOrExtra;
+    return defineConfig([
+        globalIgnores(["dist", "coverage"]),
+        {
+            files: ["**/*.{ts,tsx}"],
+            extends: [
+                js.configs.recommended,
+                tseslint.configs.recommended,
+                reactHooks.configs.flat["recommended-latest"],
+                reactRefresh.configs.vite,
             ],
+            languageOptions: {
+                ecmaVersion: 2020,
+                globals: globals.browser,
+                ...(tsconfigRootDir ? { parserOptions: { tsconfigRootDir } } : {}),
+            },
+            rules: {
+                "@typescript-eslint/no-restricted-imports": ["error", { paths: noBarrelPaths }],
+            },
         },
-    },
-    {
-        // Tests may reach the data layer directly, to mock an api module or build axios
-        // stubs. Only the barrel bans remain, and the Fast Refresh rule is relaxed for
-        // test utilities that export helpers.
-        files: ["src/**/*.{test,spec}.{ts,tsx}", "src/test/**/*.{ts,tsx}"],
-        rules: {
-            "@typescript-eslint/no-restricted-imports": ["error", { paths: noBarrelPaths }],
-            "react-refresh/only-export-components": "off",
+        {
+            // A same-named rule REPLACES the base one for these files rather than merging, so
+            // the barrel bans are repeated here.
+            files: ["src/pages/**/*.{ts,tsx}", "src/components/**/*.{ts,tsx}"],
+            rules: {
+                "@typescript-eslint/no-restricted-imports": [
+                    "error",
+                    {
+                        paths: [
+                            ...noBarrelPaths,
+                            { name: "axios", message: dataLayerMessage },
+                            { name: "@/api", message: dataLayerMessage },
+                        ],
+                        patterns: [{ group: ["@/api/*"], message: dataLayerMessage }],
+                    },
+                ],
+            },
         },
-    },
-    ...extra,
-]);
+        {
+            // Tests may reach the data layer directly, to mock an api module or build axios
+            // stubs. Only the barrel bans remain, and the Fast Refresh rule is relaxed for
+            // test utilities that export helpers.
+            files: ["src/**/*.{test,spec}.{ts,tsx}", "src/test/**/*.{ts,tsx}"],
+            rules: {
+                "@typescript-eslint/no-restricted-imports": ["error", { paths: noBarrelPaths }],
+                "react-refresh/only-export-components": "off",
+            },
+        },
+        ...extra,
+    ]);
+};
 //# sourceMappingURL=index.js.map

package/dist/eslint/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/eslint/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,UAAU,MAAM,2BAA2B,CAAC;AACnD,OAAO,YAAY,MAAM,6BAA6B,CAAC;AACvD,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE5D,mFAAmF;AACnF,MAAM,aAAa,GAAG;IAClB;QACI,IAAI,EAAE,eAAe;QACrB,OAAO,EACH,qGAAqG;KAC5G;IACD;QACI,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,gFAAgF;KAC5F;CACJ,CAAC;AAEF,8EAA8E;AAC9E,MAAM,gBAAgB,GAClB,oJAAoJ,CAAC;AAEzJ;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAyC,EAAE,EAAE,EAAE,CACzE,YAAY,CAAC;IACT,aAAa,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACnC;QACI,KAAK,EAAE,CAAC,eAAe,CAAC;QACxB,OAAO,EAAE;YACL,EAAE,CAAC,OAAO,CAAC,WAAW;YACtB,QAAQ,CAAC,OAAO,CAAC,WAAW;YAC5B,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC;YAC7C,YAAY,CAAC,OAAO,CAAC,IAAI;SAC5B;QACD,eAAe,EAAE;YACb,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,OAAO,CAAC,OAAO;SAC3B;QACD,KAAK,EAAE;YACH,0CAA0C,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;SAClF;KACJ;IACD;QACI,kFAAkF;QAClF,qCAAqC;QACrC,KAAK,EAAE,CAAC,yBAAyB,EAAE,8BAA8B,CAAC;QAClE,KAAK,EAAE;YACH,0CAA0C,EAAE;gBACxC,OAAO;gBACP;oBACI,KAAK,EAAE;wBACH,GAAG,aAAa;wBAChB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE;wBAC5C,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE;qBAC/C;oBACD,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;iBAChE;aACJ;SACJ;KACJ;IACD;QACI,gFAAgF;QAChF,+EAA+E;QAC/E,sCAAsC;QACtC,KAAK,EAAE,CAAC,+BAA+B,EAAE,wBAAwB,CAAC;QAClE,KAAK,EAAE;YACH,0CAA0C,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;YAC/E,sCAAsC,EAAE,KAAK;SAChD;KACJ;IACD,GAAG,KAAK;CACX,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/eslint/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,UAAU,MAAM,2BAA2B,CAAC;AACnD,OAAO,YAAY,MAAM,6BAA6B,CAAC;AACvD,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE5D,mFAAmF;AACnF,MAAM,aAAa,GAAG;IAClB;QACI,IAAI,EAAE,eAAe;QACrB,OAAO,EACH,qGAAqG;KAC5G;IACD;QACI,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,gFAAgF;KAC5F;CACJ,CAAC;AAEF,8EAA8E;AAC9E,MAAM,gBAAgB,GAClB,oJAAoJ,CAAC;AAazJ;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CACzB,iBAAyE,EAAE,EAC7E,EAAE;IACA,MAAM,EAAE,eAAe,EAAE,KAAK,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;QACjE,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE;QAC3B,CAAC,CAAC,cAAc,CAAC;IAErB,OAAO,YAAY,CAAC;QAChB,aAAa,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACnC;YACI,KAAK,EAAE,CAAC,eAAe,CAAC;YACxB,OAAO,EAAE;gBACL,EAAE,CAAC,OAAO,CAAC,WAAW;gBACtB,QAAQ,CAAC,OAAO,CAAC,WAAW;gBAC5B,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC;gBAC7C,YAAY,CAAC,OAAO,CAAC,IAAI;aAC5B;YACD,eAAe,EAAE;gBACb,WAAW,EAAE,IAAI;gBACjB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrE;YACD,KAAK,EAAE;gBACH,0CAA0C,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;aAClF;SACJ;QACD;YACI,kFAAkF;YAClF,qCAAqC;YACrC,KAAK,EAAE,CAAC,yBAAyB,EAAE,8BAA8B,CAAC;YAClE,KAAK,EAAE;gBACH,0CAA0C,EAAE;oBACxC,OAAO;oBACP;wBACI,KAAK,EAAE;4BACH,GAAG,aAAa;4BAChB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE;4BAC5C,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE;yBAC/C;wBACD,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;qBAChE;iBACJ;aACJ;SACJ;QACD;YACI,gFAAgF;YAChF,+EAA+E;YAC/E,sCAAsC;YACtC,KAAK,EAAE,CAAC,+BAA+B,EAAE,wBAAwB,CAAC;YAClE,KAAK,EAAE;gBACH,0CAA0C,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;gBAC/E,sCAAsC,EAAE,KAAK;aAChD;SACJ;QACD,GAAG,KAAK;KACX,CAAC,CAAC;AACP,CAAC,CAAC"}

package/dist/vite/apiToken.d.ts

@@ -0,0 +1,27 @@
+/** The API the dev server talks to, and the token it talks to it with. */
+export type ApiTokenSource = {
+    /** `EVERYSK_API_URL`, without a trailing slash, so a path can be appended as is. */
+    apiUrl: string;
+    /** The current access token; `null` until one arrives, and once it has expired. */
+    token: () => string | null;
+    /** Why there is no token: the last failed request, until one succeeds. */
+    lastError: () => Error | null;
+};
+/**
+ * createApiTokenSource
+ *
+ * An OAuth2 access token for `EVERYSK_API_URL`, from the `client_credentials` grant at
+ * `${EVERYSK_API_URL}/oauth2/token`, cached in memory and renewed in the background a minute
+ * before it expires. It is fetched at once, so a token is ready before the first request. A
+ * failed request is logged and tried again, waiting 5 seconds and doubling up to a minute, so a
+ * VPN or API that comes back later does not need a restart of the dev server; until then the
+ * `/api` proxy sends no token (the API answers 401) and the `/file/` route says why, from
+ * `lastError`. `defineAppConfig` creates one source and hands it to both, so the dev server asks
+ * for one token, not one per use.
+ *
+ * @returns {ApiTokenSource} The API URL, the current token, and the last failure.
+ * @throws {Error} If `EVERYSK_API_URL`, `EVERYSK_API_CLIENT_ID`, or `EVERYSK_API_CLIENT_SECRET`
+ *   is missing.
+ */
+export declare function createApiTokenSource(): ApiTokenSource;
+//# sourceMappingURL=apiToken.d.ts.map

package/dist/vite/apiToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiToken.d.ts","sourceRoot":"","sources":["../../src/vite/apiToken.ts"],"names":[],"mappings":"AAOA,0EAA0E;AAC1E,MAAM,MAAM,cAAc,GAAG;IACzB,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,KAAK,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAC3B,0EAA0E;IAC1E,SAAS,EAAE,MAAM,KAAK,GAAG,IAAI,CAAC;CACjC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,IAAI,cAAc,CAyErD"}

package/dist/vite/apiToken.js

@@ -0,0 +1,86 @@
+/** How long before a token expires it is renewed, so a request in flight never meets an expired one. */
+const REFRESH_SKEW_MS = 60_000;
+/** The first wait after a failed token request; it doubles on each failure, up to the maximum. */
+const FIRST_RETRY_MS = 5_000;
+const MAX_RETRY_MS = 60_000;
+/**
+ * createApiTokenSource
+ *
+ * An OAuth2 access token for `EVERYSK_API_URL`, from the `client_credentials` grant at
+ * `${EVERYSK_API_URL}/oauth2/token`, cached in memory and renewed in the background a minute
+ * before it expires. It is fetched at once, so a token is ready before the first request. A
+ * failed request is logged and tried again, waiting 5 seconds and doubling up to a minute, so a
+ * VPN or API that comes back later does not need a restart of the dev server; until then the
+ * `/api` proxy sends no token (the API answers 401) and the `/file/` route says why, from
+ * `lastError`. `defineAppConfig` creates one source and hands it to both, so the dev server asks
+ * for one token, not one per use.
+ *
+ * @returns {ApiTokenSource} The API URL, the current token, and the last failure.
+ * @throws {Error} If `EVERYSK_API_URL`, `EVERYSK_API_CLIENT_ID`, or `EVERYSK_API_CLIENT_SECRET`
+ *   is missing.
+ */
+export function createApiTokenSource() {
+    const apiUrl = process.env.EVERYSK_API_URL?.replace(/\/$/, "");
+    if (!apiUrl)
+        throw new Error("EVERYSK_API_URL must be set.");
+    const clientId = process.env.EVERYSK_API_CLIENT_ID;
+    const clientSecret = process.env.EVERYSK_API_CLIENT_SECRET;
+    if (!clientId || !clientSecret) {
+        throw new Error("EVERYSK_API_CLIENT_ID and EVERYSK_API_CLIENT_SECRET must be set (OAuth2 client credentials).");
+    }
+    const credentials = { clientId, clientSecret };
+    const tokenUrl = `${apiUrl}/oauth2/token`;
+    let accessToken = null;
+    let expiresAt = 0;
+    let lastError = null;
+    let retryMs = FIRST_RETRY_MS;
+    let timer = null;
+    const schedule = (delayMs) => {
+        if (timer)
+            clearTimeout(timer);
+        timer = setTimeout(() => void refreshToken(), delayMs);
+        timer.unref?.();
+    };
+    /** Asks for a token, then schedules the next request: a renewal on success, a retry on failure. */
+    async function requestToken() {
+        const res = await fetch(tokenUrl, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "client_credentials",
+                client_id: credentials.clientId,
+                client_secret: credentials.clientSecret,
+            }),
+        });
+        if (!res.ok)
+            throw new Error(`OAuth2 token request failed: ${res.status} ${res.statusText}`);
+        const data = (await res.json());
+        if (!data.access_token)
+            throw new Error("OAuth2 token response had no access_token.");
+        const ttlMs = (data.expires_in ?? 3600) * 1000;
+        accessToken = data.access_token;
+        expiresAt = Date.now() + ttlMs;
+        return ttlMs;
+    }
+    async function refreshToken() {
+        try {
+            const ttlMs = await requestToken();
+            lastError = null;
+            retryMs = FIRST_RETRY_MS;
+            schedule(Math.max(ttlMs - REFRESH_SKEW_MS, 30_000));
+        }
+        catch (error) {
+            lastError = error instanceof Error ? error : new Error(String(error));
+            console.error(`[dev server] OAuth2 token request failed; trying again in ${retryMs / 1000}s:`, lastError);
+            schedule(retryMs);
+            retryMs = Math.min(retryMs * 2, MAX_RETRY_MS);
+        }
+    }
+    void refreshToken();
+    return {
+        apiUrl,
+        token: () => (accessToken && Date.now() < expiresAt ? accessToken : null),
+        lastError: () => lastError,
+    };
+}
+//# sourceMappingURL=apiToken.js.map

package/dist/vite/apiToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiToken.js","sourceRoot":"","sources":["../../src/vite/apiToken.ts"],"names":[],"mappings":"AAAA,wGAAwG;AACxG,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,kGAAkG;AAClG,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,YAAY,GAAG,MAAM,CAAC;AAY5B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,oBAAoB;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAE7D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACnD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAC3D,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACX,8FAA8F,CACjG,CAAC;IACN,CAAC;IACD,MAAM,WAAW,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAE/C,MAAM,QAAQ,GAAG,GAAG,MAAM,eAAe,CAAC;IAC1C,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,SAAS,GAAiB,IAAI,CAAC;IACnC,IAAI,OAAO,GAAG,cAAc,CAAC;IAC7B,IAAI,KAAK,GAAyC,IAAI,CAAC;IAEvD,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,EAAE;QACjC,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC;QACvD,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACpB,CAAC,CAAC;IAEF,mGAAmG;IACnG,KAAK,UAAU,YAAY;QACvB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YAC9B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACtB,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,WAAW,CAAC,QAAQ;gBAC/B,aAAa,EAAE,WAAW,CAAC,YAAY;aAC1C,CAAC;SACL,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YACP,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAEpF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmD,CAAC;QAClF,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAEtF,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;QAC/C,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC;QAChC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QAC/B,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,YAAY;QACvB,IAAI,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC;YACnC,SAAS,GAAG,IAAI,CAAC;YACjB,OAAO,GAAG,cAAc,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACtE,OAAO,CAAC,KAAK,CACT,6DAA6D,OAAO,GAAG,IAAI,IAAI,EAC/E,SAAS,CACZ,CAAC;YACF,QAAQ,CAAC,OAAO,CAAC,CAAC;YAClB,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;QAClD,CAAC;IACL,CAAC;IAED,KAAK,YAAY,EAAE,CAAC;IAEpB,OAAO;QACH,MAAM;QACN,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS;KAC7B,CAAC;AACN,CAAC"}

package/dist/vite/index.d.ts

@@ -1,7 +1,9 @@
 import { type UserConfig } from "vite";
+export { createApiTokenSource, type ApiTokenSource } from "./apiToken.js";
 export { createDevServerProxy } from "./serverProxy.js";
 export { envVarsLocationPlugin } from "./plugins/envVarsLocation.js";
 export { serveDevAppConfigPlugin } from "./plugins/serveDevAppConfig.js";
+export { serveDevFilesPlugin } from "./plugins/serveDevFiles.js";
 /**
  * defineAppConfig
  *
@@ -22,6 +24,8 @@ export { serveDevAppConfigPlugin } from "./plugins/serveDevAppConfig.js";
  *   authenticates against `EVERYSK_API_URL` using OAuth2 client credentials.
  * - React with the compiler preset, Tailwind, and the two plugins that carry the app's
  *   `config.json` `env_vars` into the page — a meta tag in build, `/app-config.json` in dev.
+ * - The platform's `/file/<hash>` route, on the dev server and `vite preview`, so a file's own
+ *   `url` shows it there too. It shares the `/api` proxy's OAuth2 token.
  *
  * @param {UserConfig} [overrides] - Merged over the preset with Vite's own `mergeConfig`, so
  *   arrays (plugins, aliases) are concatenated rather than replaced.

package/dist/vite/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vite/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsC,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAU3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,eAAe,GAAI,YAAW,UAAe,sCAyCpD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vite/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsC,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAY3E,OAAO,EAAE,oBAAoB,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,eAAe,GAAI,YAAW,UAAe,sCA4CpD,CAAC"}

package/dist/vite/index.js

@@ -3,12 +3,16 @@ import { defineConfig, loadEnv, mergeConfig } from "vite";
 import react, { reactCompilerPreset } from "@vitejs/plugin-react";
 import babel from "@rolldown/plugin-babel";
 import tailwindcss from "@tailwindcss/vite";
+import { createApiTokenSource } from "./apiToken.js";
 import { createDevServerProxy } from "./serverProxy.js";
 import { envVarsLocationPlugin } from "./plugins/envVarsLocation.js";
 import { serveDevAppConfigPlugin } from "./plugins/serveDevAppConfig.js";
+import { serveDevFilesPlugin } from "./plugins/serveDevFiles.js";
+export { createApiTokenSource } from "./apiToken.js";
 export { createDevServerProxy } from "./serverProxy.js";
 export { envVarsLocationPlugin } from "./plugins/envVarsLocation.js";
 export { serveDevAppConfigPlugin } from "./plugins/serveDevAppConfig.js";
+export { serveDevFilesPlugin } from "./plugins/serveDevFiles.js";
 /**
  * defineAppConfig
  *
@@ -29,6 +33,8 @@ export { serveDevAppConfigPlugin } from "./plugins/serveDevAppConfig.js";
  *   authenticates against `EVERYSK_API_URL` using OAuth2 client credentials.
  * - React with the compiler preset, Tailwind, and the two plugins that carry the app's
  *   `config.json` `env_vars` into the page — a meta tag in build, `/app-config.json` in dev.
+ * - The platform's `/file/<hash>` route, on the dev server and `vite preview`, so a file's own
+ *   `url` shows it there too. It shares the `/api` proxy's OAuth2 token.
  *
  * @param {UserConfig} [overrides] - Merged over the preset with Vite's own `mergeConfig`, so
  *   arrays (plugins, aliases) are concatenated rather than replaced.
@@ -39,6 +45,7 @@ export const defineAppConfig = (overrides = {}) => defineConfig(({ mode, command
     const root = process.env.PROJECT_ROOT ?? process.cwd();
     const env = loadEnv(mode, root, "");
     Object.assign(process.env, env);
+    const tokens = command === "serve" ? createApiTokenSource() : undefined;
     const preset = {
         base: "./",
         envDir: root,
@@ -55,7 +62,7 @@ export const defineAppConfig = (overrides = {}) => defineConfig(({ mode, command
             host: true,
             port: Number(process.env.PORT) || 5173,
             strictPort: true,
-            proxy: command === "serve" ? createDevServerProxy() : undefined,
+            proxy: tokens ? createDevServerProxy(tokens) : undefined,
         },
         plugins: [
             react(),
@@ -63,6 +70,7 @@ export const defineAppConfig = (overrides = {}) => defineConfig(({ mode, command
             tailwindcss(),
             envVarsLocationPlugin(),
             serveDevAppConfigPlugin(),
+            serveDevFilesPlugin(tokens),
         ],
     };
     return mergeConfig(preset, overrides);

package/dist/vite/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/vite/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAmB,MAAM,MAAM,CAAC;AAE3E,OAAO,KAAK,EAAE,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,KAAK,MAAM,wBAAwB,CAAC;AAC3C,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAE5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAEzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,YAAwB,EAAE,EAAE,EAAE,CAC1D,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;IAC/B,kFAAkF;IAClF,sDAAsD;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAEvD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACpC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAEhC,MAAM,MAAM,GAAe;QACvB,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,IAAI;QAEZ,OAAO,EAAE;YACL,KAAK,EAAE;gBACH,GAAG,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,UAAU,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;aACnE;SACJ;QAED,KAAK,EAAE;YACH,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,IAAI;SACpB;QAED,MAAM,EAAE;YACJ,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI;YACtC,UAAU,EAAE,IAAI;YAChB,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,SAAS;SAClE;QAED,OAAO,EAAE;YACL,KAAK,EAAE;YACP,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,mBAAmB,EAAE,CAAC,EAAE,CAAC;YAC3C,WAAW,EAAE;YACb,qBAAqB,EAAE;YACvB,uBAAuB,EAAE;SAC5B;KACJ,CAAC;IAEF,OAAO,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/vite/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAmB,MAAM,MAAM,CAAC;AAE3E,OAAO,KAAK,EAAE,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,KAAK,MAAM,wBAAwB,CAAC;AAC3C,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAE5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EAAE,oBAAoB,EAAuB,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,YAAwB,EAAE,EAAE,EAAE,CAC1D,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;IAC/B,kFAAkF;IAClF,sDAAsD;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAEvD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACpC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAEhC,MAAM,MAAM,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAExE,MAAM,MAAM,GAAe;QACvB,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,IAAI;QAEZ,OAAO,EAAE;YACL,KAAK,EAAE;gBACH,GAAG,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,UAAU,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;aACnE;SACJ;QAED,KAAK,EAAE;YACH,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,IAAI;SACpB;QAED,MAAM,EAAE;YACJ,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI;YACtC,UAAU,EAAE,IAAI;YAChB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;SAC3D;QAED,OAAO,EAAE;YACL,KAAK,EAAE;YACP,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,mBAAmB,EAAE,CAAC,EAAE,CAAC;YAC3C,WAAW,EAAE;YACb,qBAAqB,EAAE;YACvB,uBAAuB,EAAE;YACzB,mBAAmB,CAAC,MAAM,CAAC;SAC9B;KACJ,CAAC;IAEF,OAAO,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC"}

package/dist/vite/plugins/envVarsLocation.js.map

@@ -1 +1 @@
-{"version":3,"file":"envVarsLocation.js","sourceRoot":"","sources":["../../../src/vite/plugins/envVarsLocation.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,OAAO;QACd,kBAAkB;YAChB,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"envVarsLocation.js","sourceRoot":"","sources":["../../../src/vite/plugins/envVarsLocation.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,qBAAqB;IACjC,OAAO;QACH,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,OAAO;QACd,kBAAkB;YACd,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9E,CAAC;KACJ,CAAC;AACN,CAAC"}

package/dist/vite/plugins/serveDevAppConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"serveDevAppConfig.js","sourceRoot":"","sources":["../../../src/vite/plugins/serveDevAppConfig.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIlC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,OAAO;QACd,eAAe,CAAC,MAAM;YACpB,sFAAsF;YACtF,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;YAEpE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBAC9C,IAAI,GAAG,CAAC,GAAG,KAAK,kBAAkB;oBAAE,OAAO,IAAI,EAAE,CAAC;gBAElD,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;oBACvD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;oBAEhF,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;oBACjE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;gBACnC,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,0FAA0F;YAC1F,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC/B,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;gBACnC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;oBACtC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"serveDevAppConfig.js","sourceRoot":"","sources":["../../../src/vite/plugins/serveDevAppConfig.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIlC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB;IACnC,OAAO;QACH,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,OAAO;QACd,eAAe,CAAC,MAAM;YAClB,sFAAsF;YACtF,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;YAEpE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBAC5C,IAAI,GAAG,CAAC,GAAG,KAAK,kBAAkB;oBAAE,OAAO,IAAI,EAAE,CAAC;gBAElD,IAAI,CAAC;oBACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;oBACvD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;oBAEhF,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;oBACjE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBACL,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACd,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,0FAA0F;YAC1F,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC/B,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;gBACjC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;oBACpC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;gBAC7C,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC;KACJ,CAAC;AACN,CAAC"}

package/dist/vite/plugins/serveDevFiles.d.ts

@@ -0,0 +1,41 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { Plugin } from "vite";
+import { type ApiTokenSource } from "../apiToken.js";
+/** What `createDevFileRoute` needs: the API and its token, a `fetch` and a log to replace in tests. */
+type DevFileRouteParams = ApiTokenSource & {
+    fetch?: typeof fetch;
+    log?: (message: string) => void;
+};
+type RouteRequest = Pick<IncomingMessage, "url" | "method">;
+type RouteResponse = Pick<ServerResponse, "statusCode" | "setHeader" | "end">;
+/**
+ * createDevFileRoute
+ *
+ * The dev server's stand-in for the platform's `/file/<hash>` route. On the platform a file's
+ * `url` is that route, served with the user's session and shown inline; the dev server has no
+ * session, so the file is found through the API with the dev proxy's OAuth2 token instead, by
+ * its stored `url`, and its base64 content is decoded here and sent with its own type. So an app
+ * shows a file through its `url` wherever it runs.
+ *
+ * Read with the OAuth2 client's permissions, not a user's, as everything through the dev proxy is.
+ * Every path under `/file/` is answered here, never handed on: Vite would answer it with the
+ * app's `index.html` and a 200. A file that cannot be served gets a status that says why, and a
+ * line in the terminal, since an `<img>` or `<iframe>` never shows the body. Nothing escapes the
+ * middleware: Connect ignores its promise, and a rejection would end the dev server.
+ *
+ * @param params - The API, its token and last failure, and a `fetch` and a log to replace in tests.
+ * @returns A Connect middleware that answers `/file/` and passes everything else on.
+ */
+export declare const createDevFileRoute: ({ apiUrl, token, lastError, fetch: fetchApi, log, }: DevFileRouteParams) => (req: RouteRequest, res: RouteResponse, next: () => void) => Promise<void>;
+/**
+ * serveDevFilesPlugin
+ *
+ * Mounts `createDevFileRoute` on the dev server and on `vite preview`, neither of which has the
+ * platform's `/file/` route, logging through Vite's own logger.
+ *
+ * @param {ApiTokenSource} [tokens] - The token to send; created when the server starts if
+ *   omitted. `defineAppConfig` passes the one it shares with the `/api` proxy.
+ */
+export declare function serveDevFilesPlugin(tokens?: ApiTokenSource): Plugin;
+export {};
+//# sourceMappingURL=serveDevFiles.d.ts.map

package/dist/vite/plugins/serveDevFiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serveDevFiles.d.ts","sourceRoot":"","sources":["../../../src/vite/plugins/serveDevFiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAW3E,uGAAuG;AACvG,KAAK,kBAAkB,GAAG,cAAc,GAAG;IACvC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC,CAAC;AAIF,KAAK,YAAY,GAAG,IAAI,CAAC,eAAe,EAAE,KAAK,GAAG,QAAQ,CAAC,CAAC;AAC5D,KAAK,aAAa,GAAG,IAAI,CAAC,cAAc,EAAE,YAAY,GAAG,WAAW,GAAG,KAAK,CAAC,CAAC;AAgG9E;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB,GAC1B,qDAME,kBAAkB,MACd,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,MAAM,IAAI,kBA6C7D,CAAC;AAEN;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,MAAM,CAanE"}

package/dist/vite/plugins/serveDevFiles.js

@@ -0,0 +1,153 @@
+import { createApiTokenSource } from "../apiToken.js";
+/** Every path under the platform's file route, claimed whole so none falls through to `index.html`. */
+const FILE_ROUTE = /^\/file\//;
+/**
+ * A file's url as the platform serves it: the hex of a version-4 UUID, as everysk/client's
+ * `FileRequestHandler` matches it (`RE_FILE_URL`).
+ */
+const FILE_URL = /^\/file\/([0-9a-f]{12}4[0-9a-f]{3}[89ab][0-9a-f]{15})\/?(?:\?.*)?$/;
+/** Why a file could not be served, with the status to answer it with. */
+class FileRouteError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+/** The error and, when Node gives one, its cause, which is where fetch keeps ECONNREFUSED or DNS. */
+const describeError = (error) => {
+    if (!(error instanceof Error))
+        return String(error);
+    return error.cause instanceof Error
+        ? `${error.message}: ${error.cause.message}`
+        : error.message;
+};
+/** The API's own `message` from a refusal, or the start of whatever came back instead. */
+const refusalOf = async (response) => {
+    const text = await response.text();
+    try {
+        return JSON.parse(text).message ?? text.slice(0, 200);
+    }
+    catch {
+        return text.slice(0, 200);
+    }
+};
+/**
+ * The file whose stored url is `/<hash>`, read with its content. A file stores its url as
+ * `/<hash>` and the API adds `/file` only when it returns it, and the file list accepts a `url`
+ * filter without a workspace (everysk-lib 1.13.4 `sdk/entities/file`, everysk/client
+ * `File.validate_query`).
+ */
+const findFile = async (fetchApi, apiUrl, accessToken, hash) => {
+    const query = JSON.stringify({ filters: [["url", `/${hash}`]], page_size: 1 });
+    let response;
+    try {
+        response = await fetchApi(`${apiUrl}/files?query=${encodeURIComponent(query)}`, {
+            headers: { Authorization: `Bearer ${accessToken}` },
+        });
+    }
+    catch (error) {
+        throw new FileRouteError(502, `The API could not be reached: ${describeError(error)}`);
+    }
+    if (!response.ok) {
+        const refusal = await refusalOf(response);
+        throw new FileRouteError(502, `The API refused the file: ${response.status} ${response.statusText}: ${refusal}`);
+    }
+    let body;
+    try {
+        body = (await response.json());
+    }
+    catch {
+        throw new FileRouteError(502, `The API answered with ${response.headers.get("content-type")}, not JSON.`);
+    }
+    if (!Array.isArray(body.files)) {
+        throw new FileRouteError(502, `The file list came back without files: ${JSON.stringify(body).slice(0, 200)}`);
+    }
+    return body.files[0];
+};
+/** The content of a found file, refusing what would be served as an empty or corrupt file. */
+const contentOf = (file, hash) => {
+    if (typeof file.data !== "string") {
+        throw new FileRouteError(502, `The API returned ${file.name} (/file/${hash}) without its content.`);
+    }
+    if (file.data.startsWith("data:")) {
+        throw new FileRouteError(422, `${file.name} was stored as a data URL, so its bytes are not the file: upload it again, read with fileToBase64.`);
+    }
+    return Buffer.from(file.data, "base64");
+};
+/**
+ * createDevFileRoute
+ *
+ * The dev server's stand-in for the platform's `/file/<hash>` route. On the platform a file's
+ * `url` is that route, served with the user's session and shown inline; the dev server has no
+ * session, so the file is found through the API with the dev proxy's OAuth2 token instead, by
+ * its stored `url`, and its base64 content is decoded here and sent with its own type. So an app
+ * shows a file through its `url` wherever it runs.
+ *
+ * Read with the OAuth2 client's permissions, not a user's, as everything through the dev proxy is.
+ * Every path under `/file/` is answered here, never handed on: Vite would answer it with the
+ * app's `index.html` and a 200. A file that cannot be served gets a status that says why, and a
+ * line in the terminal, since an `<img>` or `<iframe>` never shows the body. Nothing escapes the
+ * middleware: Connect ignores its promise, and a rejection would end the dev server.
+ *
+ * @param params - The API, its token and last failure, and a `fetch` and a log to replace in tests.
+ * @returns A Connect middleware that answers `/file/` and passes everything else on.
+ */
+export const createDevFileRoute = ({ apiUrl, token, lastError, fetch: fetchApi = fetch, log = console.warn, }) => async (req, res, next) => {
+    const url = req.url ?? "";
+    if (!FILE_ROUTE.test(url))
+        return next();
+    const fail = (status, message) => {
+        log(`[dev server] ${url}: ${message}`);
+        res.statusCode = status;
+        res.setHeader("Content-Type", "text/plain; charset=utf-8");
+        res.end(message);
+    };
+    if (req.method !== "GET" && req.method !== "HEAD")
+        return fail(405, "A file is only read here.");
+    const hash = FILE_URL.exec(url)?.[1];
+    if (!hash)
+        return fail(400, "Not a file url: /file/ and the 32-character hex hash of a file.");
+    const accessToken = token();
+    if (!accessToken) {
+        return fail(503, `No OAuth2 token for EVERYSK_API_URL: ${lastError()?.message ?? "not there yet"}`);
+    }
+    try {
+        const file = await findFile(fetchApi, apiUrl, accessToken, hash);
+        if (!file) {
+            return fail(404, `No file has the url /file/${hash}, as the OAuth2 client EVERYSK_API_CLIENT_ID sees.`);
+        }
+        const content = contentOf(file, hash);
+        const disposition = `inline; filename*=UTF-8''${encodeURIComponent(file.name)}`;
+        res.setHeader("Content-Type", file.content_type || "application/octet-stream");
+        res.setHeader("Content-Length", content.length);
+        res.setHeader("Content-Disposition", disposition);
+        res.statusCode = 200;
+        res.end(req.method === "HEAD" ? undefined : content);
+    }
+    catch (error) {
+        fail(error instanceof FileRouteError ? error.status : 502, describeError(error));
+    }
+};
+/**
+ * serveDevFilesPlugin
+ *
+ * Mounts `createDevFileRoute` on the dev server and on `vite preview`, neither of which has the
+ * platform's `/file/` route, logging through Vite's own logger.
+ *
+ * @param {ApiTokenSource} [tokens] - The token to send; created when the server starts if
+ *   omitted. `defineAppConfig` passes the one it shares with the `/api` proxy.
+ */
+export function serveDevFilesPlugin(tokens) {
+    const route = (log) => createDevFileRoute({ ...(tokens ?? createApiTokenSource()), log });
+    return {
+        name: "serve-dev-files",
+        configureServer(server) {
+            server.middlewares.use(route((message) => server.config.logger.warn(message)));
+        },
+        configurePreviewServer(server) {
+            server.middlewares.use(route((message) => server.config.logger.warn(message)));
+        },
+    };
+}
+//# sourceMappingURL=serveDevFiles.js.map