@fluid-app/fluid-cli-widget 0.1.27 → 0.1.29

package/dist/vite/plugin.mjs

@@ -1,200 +1,2 @@
-import { validateSingleSourceWidgetPackage } from "@fluid-app/fluid-cli-portal";
-//#region src/vite/plugin.ts
-function fluidWidgetDevPlugin() {
-	return {
-		name: "fluid-widget-dev-routes",
-		apply: "serve",
-		configureServer(server) {
-			server.middlewares.use(async (request, response, next) => {
-				const pathname = (request.url ?? "").split("?")[0] ?? "";
-				if (pathname === "/__runtime-entry__" || pathname === "/__runtime-entry__/") {
-					sendJavaScript(request, response, buildRuntimeEntryBootstrapScript(WIDGET_ENTRY_MODULE_PATH));
-					return;
-				}
-				if (pathname === "/__widget-packages__" || pathname === "/__widget-packages__/") {
-					await sendWidgetPackages(server, request, response);
-					return;
-				}
-				next();
-			});
-		}
-	};
-}
-/** Source-relative path of a widget project's entry module. The dev
-*  scaffold always places it here (see the widget template) — this is
-*  the one thing the bootstrap script below needs from the plugin
-*  that isn't itself part of the race/preamble fix. */
-const WIDGET_ENTRY_MODULE_PATH = "/src/index.ts";
-/**
-* Builds the `/__runtime-entry__` worker bootstrap. Runtime-verified
-* against a real widget dev server + `@fluid-app/widget-runtime` host
-* in a Playwright harness (styled Leaderboard widget rendering,
-* mutation records flowing, `mounted.ready` resolving) — every piece
-* below exists to fix something that reproduced in that harness:
-*
-* 1. **Message-buffer race (the silent-mount killer).** The host
-*    (widget-runtime) posts the "mount" message immediately after
-*    `new Worker(...)`. A production-built worker bundle evaluates
-*    synchronously and never races that message. In dev, though, the
-*    worker's module graph loads asynchronously over many HTTP
-*    requests (this bootstrap script, then the entry module, then
-*    everything it imports, each a separate fetch) — so the "mount"
-*    message can be dispatched and consumed by the Worker's default
-*    (listener-less) handling before the widget entry's own
-*    `message` listener, wired up deep inside the awaited import
-*    below, is ever attached. The message is dropped silently, with
-*    no error anywhere — the old `void import("/src/index.ts")` also
-*    swallowed the import's own rejections, compounding the silence.
-*    Traced live: host→worker "mount" posts, zero worker→host replies
-*    until this buffer-and-replay was added; after it, mutation
-*    records flow and `mounted.ready` resolves. Fix: buffer every
-*    message from the instant the worker boots (before anything else
-*    runs), then replay the buffer, in order, once the entry module
-*    has finished importing and has had the chance to attach its
-*    real listener.
-* 2. **React-refresh preamble.** `@vitejs/plugin-react` injects a
-*    preamble into every dev-transformed `.tsx` module referencing
-*    `window.$RefreshReg$` / `$RefreshSig$`. A Worker global scope has
-*    no `window` and no preamble, so importing a react-based widget
-*    entry throws `window is not defined`, and — once `window` is
-*    aliased to `globalThis` — throws again on the bare
-*    `$RefreshSig$` alias. Installing the canonical preamble
-*    (`RefreshRuntime.injectIntoGlobalHook` + no-op `$RefreshReg$` /
-*    `$RefreshSig$`) before the entry import fixes both. The
-*    `window = globalThis` alias was checked against widget-runtime's
-*    worker lockdown / scope detection (which is
-*    `globalThis.postMessage`-based) — no conflict. `/@react-refresh`
-*    is `@vitejs/plugin-react`'s stable virtual module id, but a
-*    widget project isn't guaranteed to use the react plugin, so the
-*    whole block is try/catch-guarded — a project with no
-*    `/@react-refresh` module (no react plugin) boots straight
-*    through to the entry import unaffected.
-* 3. **`await import`, not `void import`.** A genuine failure to
-*    import the entry module (syntax error, missing dependency, …)
-*    must reject the worker's module evaluation loudly, not vanish
-*    the way a fire-and-forget `void import` did.
-*
-* Dev-only: this only ever serves from `configureServer` (the
-* plugin's `apply: "serve"` gate), never a built/published package.
-*/
-function buildRuntimeEntryBootstrapScript(entryPath) {
-	return [
-		"// Dev-only worker bootstrap — see buildRuntimeEntryBootstrapScript",
-		"// in packages/cli/widget/src/vite/plugin.ts for why each piece",
-		"// here exists (message-buffer race, react-refresh preamble,",
-		"// await-not-void import).",
-		"const __q = [];",
-		"const __buf = (e) => { __q.push(e.data); };",
-		"self.addEventListener(\"message\", __buf);",
-		"if (typeof window === \"undefined\") { globalThis.window = globalThis; }",
-		"try {",
-		"  const { default: RefreshRuntime } = await import(\"/@react-refresh\");",
-		"  RefreshRuntime.injectIntoGlobalHook(window);",
-		"  window.$RefreshReg$ = () => {};",
-		"  window.$RefreshSig$ = () => (type) => type;",
-		"  window.__vite_plugin_react_preamble_installed__ = true;",
-		"} catch {",
-		"  // No @vitejs/plugin-react in this widget project (no",
-		"  // /@react-refresh virtual module) — nothing to preinstall.",
-		"}",
-		`await import(${JSON.stringify(entryPath)});`,
-		"self.removeEventListener(\"message\", __buf);",
-		"for (const data of __q) {",
-		"  self.dispatchEvent(new MessageEvent(\"message\", { data }));",
-		"}",
-		""
-	].join("\n");
-}
-function createDevWidgetPackageDescriptors(configModule, origin) {
-	const validation = validateSingleSourceWidgetPackage(readSourcePackages(configModule), { owner: "droplet" });
-	if (!validation.success || !validation.value) throw new Error(validation.errors.map((error) => error.message).join("\n") || "Widget package validation failed.");
-	return [validatedPackageToDescriptor(validation.value, origin)];
-}
-function validatedPackageToDescriptor(validated, origin) {
-	const cssUrls = validated.sourcePackage.cssUrls ?? [];
-	return {
-		manifestVersion: 1,
-		runtime: "remote-dom",
-		packageId: validated.packageId,
-		source: validated.owner,
-		version: validated.version,
-		workerEntryUrl: new URL("/__runtime-entry__", origin).href,
-		cssUrls: cssUrls.length > 0 ? cssUrls.map((url) => toDevCssUrl(url, origin)) : [toDevCssUrl("/styles.css", origin)],
-		assetUrls: [],
-		widgets: validated.widgets.map(({ name: _name, ...widget }) => widget)
-	};
-}
-/**
-* Vite's dev server serves a `.css` source file as a JS module by
-* default (so `import "./x.css"` hot-reloads) — fetching that URL
-* directly, as the widget-runtime host does to inject real
-* `<style>`/adopted-stylesheet content into a widget's shadow root,
-* returns `text/javascript`, not CSS. Vite's own dev server
-* recognizes a `?direct` query as a request for the genuine `text/css`
-* response, bypassing the JS-module transform.
-*
-* This descriptor builder only ever runs inside `configureServer`
-* (the plugin's `apply: "serve"` gate — see `fluidWidgetDevPlugin`
-* above), i.e. only for the dev preview's `/__widget-packages__`
-* response. A published/built widget package's `cssUrls` are produced
-* by a completely different path (the CLI's build pipeline) and point
-* at real static `.css` files with no Vite transform in front of
-* them, so this suffix can never leak into a production descriptor.
-*/
-function toDevCssUrl(url, origin) {
-	const { href } = new URL(url, origin);
-	return href.includes("?") ? `${href}&direct` : `${href}?direct`;
-}
-async function sendWidgetPackages(server, request, response) {
-	if (handleOptions(request, response)) return;
-	try {
-		sendJson(response, createDevWidgetPackageDescriptors(await server.ssrLoadModule("/fluid.widget.config.ts"), getRequestOrigin(request)));
-	} catch (error) {
-		server.config.logger.error(`[fluid] Failed to load widget packages: ${String(error)}`);
-		sendJson(response, { error: String(error) }, 500);
-	}
-}
-function readSourcePackages(configModule) {
-	const packages = configModule["widgetPackages"];
-	if (Array.isArray(packages) && packages.length > 0) return packages;
-	const widgetPackage = configModule["widgetPackage"];
-	return widgetPackage === void 0 ? [] : [widgetPackage];
-}
-function sendJavaScript(request, response, source) {
-	if (handleOptions(request, response)) return;
-	setCorsHeaders(response);
-	response.setHeader("Content-Type", "text/javascript");
-	response.statusCode = 200;
-	response.end(source);
-}
-function sendJson(response, body, statusCode = 200) {
-	setCorsHeaders(response);
-	response.setHeader("Content-Type", "application/json");
-	response.statusCode = statusCode;
-	response.end(JSON.stringify(body, null, 2));
-}
-function handleOptions(request, response) {
-	if (request.method !== "OPTIONS") return false;
-	setCorsHeaders(response);
-	response.statusCode = 204;
-	response.end();
-	return true;
-}
-function setCorsHeaders(response) {
-	response.setHeader("Access-Control-Allow-Origin", "*");
-	response.setHeader("Access-Control-Allow-Methods", "GET, HEAD, OPTIONS");
-	response.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
-}
-function getRequestOrigin(request) {
-	const host = readHeader(request.headers.host);
-	if (!host) throw new Error("Widget dev request is missing the Host header.");
-	return `${readHeader(request.headers["x-forwarded-proto"]) === "https" ? "https" : "http"}://${host}`;
-}
-function readHeader(value) {
-	const candidate = Array.isArray(value) ? value[0] : value;
-	return typeof candidate === "string" && candidate.trim().length > 0 ? candidate.trim() : void 0;
-}
-//#endregion
-export { buildRuntimeEntryBootstrapScript, createDevWidgetPackageDescriptors, fluidWidgetDevPlugin };
-
-//# sourceMappingURL=plugin.mjs.map
+import { a as buildRuntimeEntryBootstrapScript, c as fluidWidgetDevPlugin, o as createDevWidgetPackageDescriptors, s as createWidgetDevServerConfig } from "../src-_wfDoBLp.mjs";
+export { buildRuntimeEntryBootstrapScript, createDevWidgetPackageDescriptors, createWidgetDevServerConfig, fluidWidgetDevPlugin };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fluid-app/fluid-cli-widget",
-  "version": "0.1.27",
+  "version": "0.1.29",
   "description": "Fluid CLI plugin for standalone widget package workflows",
   "files": [
     "dist",
@@ -28,10 +28,12 @@
     "chalk": "^5.3.0",
     "commander": "^12.0.0",
     "execa": "^8.0.0",
+    "fs-extra": "^11.2.0",
     "ora": "^8.0.0",
     "prompts": "^2.4.2",
-    "@fluid-app/fluid-cli": "0.1.14",
-    "@fluid-app/fluid-cli-portal": "0.1.52"
+    "tsx": "^4.21.0",
+    "vite": "^6.4.1",
+    "@fluid-app/fluid-cli": "0.1.14"
   },
   "devDependencies": {
     "@types/node": "24.10.12",
@@ -39,9 +41,10 @@
     "@vitejs/plugin-react": "^4.3.0",
     "tsdown": "^0.21.0",
     "typescript": "^5",
-    "vite": "^6.4.1",
     "vitest": "^4.0.18",
-    "@fluid-app/typescript-config": "0.0.0"
+    "@fluid-app/fluid-cli-widget-tooling": "0.1.0",
+    "@fluid-app/typescript-config": "0.0.0",
+    "@fluid-app/fluidos-api-client": "0.1.0"
   },
   "engines": {
     "node": ">=24.0.0"

package/templates/default/.gitignore.template

@@ -5,3 +5,9 @@ dist
 .env.local
 .fluid
 *.tsbuildinfo
+
+# Local tooling state — never belongs in the widget repo.
+# .mist-desktop/ holds Mist Desktop's private chats, attachments, and
+# screenshots for this project; .mist is its clone/slug marker.
+.mist
+.mist-desktop/

package/templates/default/AGENTS.md

@@ -210,6 +210,21 @@ Light/dark behavior:
 
 Runtime CSS rules:
 
+**A stylesheet is the only way to style a widget. Inline styles do not work.**
+
+The host sanitizes every Remote DOM mutation before it reaches the shadow root. The
+`style` attribute is rejected and `<style>` elements are a banned tag, so:
+
+- `style={{ color: "red" }}` on any element is **silently dropped**. The element renders
+  with no styling and no error — this is the single most common reason a widget "looks
+  broken" or "came out unstyled".
+- An inline `<style>` block never renders.
+- Only CSS reachable from the widget build graph is published as a `cssUrls` artifact and
+  adopted into the shadow root.
+
+So: put every rule in a stylesheet, give elements `className`s, and target those classes.
+Never reach for an inline style — it will not survive.
+
 - Put runtime selectors in `styles.css` or imported CSS modules.
 - Keep selectors prefixed with the widget name to avoid leaking styles into the host.
 - Do not rely on global body styles for runtime appearance.

package/templates/default/package.json.template

@@ -18,6 +18,7 @@
     "@tanstack/react-query": "^5.90.11",
     "lucide-react": "~0.575.0",
     "react": "^19.2.4",
+    "react-dom": "^19.2.4",
     "react-hook-form": "^7.64.0",
     "zod": "4.3.5",
     "zustand": "^5.0.9"
@@ -29,7 +30,8 @@
     "vite": "^6.4.1",
     "@fluid-app/fluid-cli-widget": "{{widgetCliVersion}}",
     "@types/node": "^24.0.0",
-    "@types/react": "^19.2.13"
+    "@types/react": "^19.2.13",
+    "@types/react-dom": "^19.2.3"
   },
   "engines": {
     "node": ">=24.0.0"

package/templates/default/styles.css

@@ -1,22 +1,47 @@
+/* Runtime styles for the example widget.
+ *
+ * This file is the worked example every new widget is copied from, so it is
+ * deliberately written the way widget CSS SHOULD be written:
+ *
+ *   • Colors, fonts, and radii come from the HOST's semantic CSS variables.
+ *     The portal theme sets them, they inherit through the widget's shadow
+ *     root, and the same widget then looks correct on every portal and in
+ *     both light and dark — without a second, hand-written dark palette.
+ *
+ *   • Every var() carries a fallback. Tokens are absent in some hosts (a bare
+ *     dev harness, a preview surface that has not adopted the portal theme),
+ *     and a widget must still be legible there rather than collapsing to
+ *     unstyled text. The fallback is a floor, never the intended look.
+ *
+ *   • Selectors stay prefixed with the widget name so nothing leaks into the
+ *     host, and nothing here depends on global body styles.
+ *
+ * Do not reintroduce hard-coded brand colors. A widget that hard-codes
+ * #ffffff / #111827 ignores the portal's theme entirely and will look wrong
+ * on any portal that is not white-on-near-black. See AGENTS.md → "Theme and
+ * styling guidance". */
+
 .review-carousel {
-  font-family:
+  font-family: var(
+    --font-body,
     Inter,
     ui-sans-serif,
     system-ui,
     -apple-system,
     BlinkMacSystemFont,
     "Segoe UI",
-    sans-serif;
-  border: 1px solid #e5e7eb;
-  border-radius: 24px;
+    sans-serif
+  );
+  border: 1px solid var(--border, #e5e7eb);
+  border-radius: var(--radius-xl, 24px);
   padding: 32px;
-  background: #ffffff;
+  background: var(--card, #ffffff);
   box-shadow: 0 24px 80px rgb(15 23 42 / 10%);
 }
 
 .review-carousel__eyebrow {
   margin: 0 0 8px;
-  color: #4f46e5;
+  color: var(--primary, #4f46e5);
   font-size: 0.75rem;
   font-weight: 700;
   letter-spacing: 0.08em;
@@ -25,7 +50,8 @@
 
 .review-carousel__title {
   margin: 0;
-  color: #111827;
+  color: var(--card-foreground, #111827);
+  font-family: var(--font-header, inherit);
   font-size: clamp(2rem, 4vw, 3.5rem);
   line-height: 0.95;
   letter-spacing: -0.05em;
@@ -33,7 +59,7 @@
 
 .review-carousel__quote {
   margin: 32px 0 0;
-  color: #1f2937;
+  color: var(--card-foreground, #1f2937);
   font-size: clamp(1.25rem, 2vw, 1.75rem);
   line-height: 1.35;
 }
@@ -48,13 +74,13 @@
 
 .review-carousel__author {
   margin: 0;
-  color: #111827;
+  color: var(--card-foreground, #111827);
   font-weight: 700;
 }
 
 .review-carousel__role {
   margin: 4px 0 0;
-  color: #6b7280;
+  color: var(--muted-foreground, #6b7280);
 }
 
 .review-carousel__controls {
@@ -65,15 +91,21 @@
 .review-carousel__button {
   width: 40px;
   height: 40px;
-  border: 1px solid #d1d5db;
+  border: 1px solid var(--border, #d1d5db);
+  /* Intentionally a pill, not themed — shape is this control's identity. */
   border-radius: 999px;
-  color: #111827;
-  background: #ffffff;
+  color: var(--card-foreground, #111827);
+  background: var(--card, #ffffff);
   font: inherit;
   cursor: pointer;
 }
 
 .review-carousel__button:hover {
-  border-color: #4f46e5;
-  color: #4f46e5;
+  border-color: var(--primary, #4f46e5);
+  color: var(--primary, #4f46e5);
+}
+
+.review-carousel__button:focus-visible {
+  outline: 2px solid var(--ring, #4f46e5);
+  outline-offset: 2px;
 }

package/dist/vite/plugin.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"plugin.d.mts","names":[],"sources":["../../src/vite/plugin.ts"],"mappings":";;;;iBAQgB,oBAAA,CAAA,GAAwB,MAAA;;AAAxC;;;;;AA4FA;;;;;AA6BA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA7BgB,gCAAA,CAAiC,SAAA;AAAA,iBA6BjC,iCAAA,CACd,YAAA,EAAc,QAAA,CAAS,MAAA,oBACvB,MAAA,oBACU,gCAAA"}

package/dist/vite/plugin.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"plugin.mjs","names":[],"sources":["../../src/vite/plugin.ts"],"sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport {\n  validateSingleSourceWidgetPackage,\n  type RemoteDomWidgetPackageDescriptor,\n  type ValidatedWidgetPackageBuild,\n} from \"@fluid-app/fluid-cli-portal\";\nimport type { Plugin, ViteDevServer } from \"vite\";\n\nexport function fluidWidgetDevPlugin(): Plugin {\n  return {\n    name: \"fluid-widget-dev-routes\",\n    apply: \"serve\",\n    configureServer(server) {\n      server.middlewares.use(async (request, response, next): Promise<void> => {\n        const pathname = (request.url ?? \"\").split(\"?\")[0] ?? \"\";\n\n        if (\n          pathname === \"/__runtime-entry__\" ||\n          pathname === \"/__runtime-entry__/\"\n        ) {\n          sendJavaScript(\n            request,\n            response,\n            buildRuntimeEntryBootstrapScript(WIDGET_ENTRY_MODULE_PATH),\n          );\n          return;\n        }\n\n        if (\n          pathname === \"/__widget-packages__\" ||\n          pathname === \"/__widget-packages__/\"\n        ) {\n          await sendWidgetPackages(server, request, response);\n          return;\n        }\n\n        next();\n      });\n    },\n  };\n}\n\n/** Source-relative path of a widget project's entry module. The dev\n *  scaffold always places it here (see the widget template) — this is\n *  the one thing the bootstrap script below needs from the plugin\n *  that isn't itself part of the race/preamble fix. */\nconst WIDGET_ENTRY_MODULE_PATH = \"/src/index.ts\";\n\n/**\n * Builds the `/__runtime-entry__` worker bootstrap. Runtime-verified\n * against a real widget dev server + `@fluid-app/widget-runtime` host\n * in a Playwright harness (styled Leaderboard widget rendering,\n * mutation records flowing, `mounted.ready` resolving) — every piece\n * below exists to fix something that reproduced in that harness:\n *\n * 1. **Message-buffer race (the silent-mount killer).** The host\n *    (widget-runtime) posts the \"mount\" message immediately after\n *    `new Worker(...)`. A production-built worker bundle evaluates\n *    synchronously and never races that message. In dev, though, the\n *    worker's module graph loads asynchronously over many HTTP\n *    requests (this bootstrap script, then the entry module, then\n *    everything it imports, each a separate fetch) — so the \"mount\"\n *    message can be dispatched and consumed by the Worker's default\n *    (listener-less) handling before the widget entry's own\n *    `message` listener, wired up deep inside the awaited import\n *    below, is ever attached. The message is dropped silently, with\n *    no error anywhere — the old `void import(\"/src/index.ts\")` also\n *    swallowed the import's own rejections, compounding the silence.\n *    Traced live: host→worker \"mount\" posts, zero worker→host replies\n *    until this buffer-and-replay was added; after it, mutation\n *    records flow and `mounted.ready` resolves. Fix: buffer every\n *    message from the instant the worker boots (before anything else\n *    runs), then replay the buffer, in order, once the entry module\n *    has finished importing and has had the chance to attach its\n *    real listener.\n * 2. **React-refresh preamble.** `@vitejs/plugin-react` injects a\n *    preamble into every dev-transformed `.tsx` module referencing\n *    `window.$RefreshReg$` / `$RefreshSig$`. A Worker global scope has\n *    no `window` and no preamble, so importing a react-based widget\n *    entry throws `window is not defined`, and — once `window` is\n *    aliased to `globalThis` — throws again on the bare\n *    `$RefreshSig$` alias. Installing the canonical preamble\n *    (`RefreshRuntime.injectIntoGlobalHook` + no-op `$RefreshReg$` /\n *    `$RefreshSig$`) before the entry import fixes both. The\n *    `window = globalThis` alias was checked against widget-runtime's\n *    worker lockdown / scope detection (which is\n *    `globalThis.postMessage`-based) — no conflict. `/@react-refresh`\n *    is `@vitejs/plugin-react`'s stable virtual module id, but a\n *    widget project isn't guaranteed to use the react plugin, so the\n *    whole block is try/catch-guarded — a project with no\n *    `/@react-refresh` module (no react plugin) boots straight\n *    through to the entry import unaffected.\n * 3. **`await import`, not `void import`.** A genuine failure to\n *    import the entry module (syntax error, missing dependency, …)\n *    must reject the worker's module evaluation loudly, not vanish\n *    the way a fire-and-forget `void import` did.\n *\n * Dev-only: this only ever serves from `configureServer` (the\n * plugin's `apply: \"serve\"` gate), never a built/published package.\n */\nexport function buildRuntimeEntryBootstrapScript(entryPath: string): string {\n  return [\n    \"// Dev-only worker bootstrap — see buildRuntimeEntryBootstrapScript\",\n    \"// in packages/cli/widget/src/vite/plugin.ts for why each piece\",\n    \"// here exists (message-buffer race, react-refresh preamble,\",\n    \"// await-not-void import).\",\n    \"const __q = [];\",\n    \"const __buf = (e) => { __q.push(e.data); };\",\n    'self.addEventListener(\"message\", __buf);',\n    'if (typeof window === \"undefined\") { globalThis.window = globalThis; }',\n    \"try {\",\n    '  const { default: RefreshRuntime } = await import(\"/@react-refresh\");',\n    \"  RefreshRuntime.injectIntoGlobalHook(window);\",\n    \"  window.$RefreshReg$ = () => {};\",\n    \"  window.$RefreshSig$ = () => (type) => type;\",\n    \"  window.__vite_plugin_react_preamble_installed__ = true;\",\n    \"} catch {\",\n    \"  // No @vitejs/plugin-react in this widget project (no\",\n    \"  // /@react-refresh virtual module) — nothing to preinstall.\",\n    \"}\",\n    `await import(${JSON.stringify(entryPath)});`,\n    'self.removeEventListener(\"message\", __buf);',\n    \"for (const data of __q) {\",\n    '  self.dispatchEvent(new MessageEvent(\"message\", { data }));',\n    \"}\",\n    \"\",\n  ].join(\"\\n\");\n}\n\nexport function createDevWidgetPackageDescriptors(\n  configModule: Readonly<Record<string, unknown>>,\n  origin: string,\n): readonly RemoteDomWidgetPackageDescriptor[] {\n  const validation = validateSingleSourceWidgetPackage(\n    readSourcePackages(configModule),\n    { owner: \"droplet\" },\n  );\n  if (!validation.success || !validation.value) {\n    throw new Error(\n      validation.errors.map((error) => error.message).join(\"\\n\") ||\n        \"Widget package validation failed.\",\n    );\n  }\n\n  return [validatedPackageToDescriptor(validation.value, origin)];\n}\n\nfunction validatedPackageToDescriptor(\n  validated: ValidatedWidgetPackageBuild,\n  origin: string,\n): RemoteDomWidgetPackageDescriptor {\n  const cssUrls = validated.sourcePackage.cssUrls ?? [];\n  return {\n    manifestVersion: 1,\n    runtime: \"remote-dom\",\n    packageId: validated.packageId,\n    source: validated.owner,\n    version: validated.version,\n    workerEntryUrl: new URL(\"/__runtime-entry__\", origin).href,\n    cssUrls:\n      cssUrls.length > 0\n        ? cssUrls.map((url) => toDevCssUrl(url, origin))\n        : [toDevCssUrl(\"/styles.css\", origin)],\n    assetUrls: [],\n    widgets: validated.widgets.map(({ name: _name, ...widget }) => widget),\n  };\n}\n\n/**\n * Vite's dev server serves a `.css` source file as a JS module by\n * default (so `import \"./x.css\"` hot-reloads) — fetching that URL\n * directly, as the widget-runtime host does to inject real\n * `<style>`/adopted-stylesheet content into a widget's shadow root,\n * returns `text/javascript`, not CSS. Vite's own dev server\n * recognizes a `?direct` query as a request for the genuine `text/css`\n * response, bypassing the JS-module transform.\n *\n * This descriptor builder only ever runs inside `configureServer`\n * (the plugin's `apply: \"serve\"` gate — see `fluidWidgetDevPlugin`\n * above), i.e. only for the dev preview's `/__widget-packages__`\n * response. A published/built widget package's `cssUrls` are produced\n * by a completely different path (the CLI's build pipeline) and point\n * at real static `.css` files with no Vite transform in front of\n * them, so this suffix can never leak into a production descriptor.\n */\nfunction toDevCssUrl(url: string, origin: string): string {\n  const { href } = new URL(url, origin);\n  return href.includes(\"?\") ? `${href}&direct` : `${href}?direct`;\n}\n\nasync function sendWidgetPackages(\n  server: ViteDevServer,\n  request: IncomingMessage,\n  response: ServerResponse,\n): Promise<void> {\n  if (handleOptions(request, response)) return;\n\n  try {\n    const configModule = (await server.ssrLoadModule(\n      \"/fluid.widget.config.ts\",\n    )) as Record<string, unknown>;\n    sendJson(\n      response,\n      createDevWidgetPackageDescriptors(\n        configModule,\n        getRequestOrigin(request),\n      ),\n    );\n  } catch (error) {\n    server.config.logger.error(\n      `[fluid] Failed to load widget packages: ${String(error)}`,\n    );\n    sendJson(response, { error: String(error) }, 500);\n  }\n}\n\nfunction readSourcePackages(\n  configModule: Readonly<Record<string, unknown>>,\n): readonly unknown[] {\n  const packages = configModule[\"widgetPackages\"];\n  if (Array.isArray(packages) && packages.length > 0) return packages;\n\n  const widgetPackage = configModule[\"widgetPackage\"];\n  return widgetPackage === undefined ? [] : [widgetPackage];\n}\n\nfunction sendJavaScript(\n  request: IncomingMessage,\n  response: ServerResponse,\n  source: string,\n): void {\n  if (handleOptions(request, response)) return;\n  setCorsHeaders(response);\n  response.setHeader(\"Content-Type\", \"text/javascript\");\n  response.statusCode = 200;\n  response.end(source);\n}\n\nfunction sendJson(\n  response: ServerResponse,\n  body: unknown,\n  statusCode = 200,\n): void {\n  setCorsHeaders(response);\n  response.setHeader(\"Content-Type\", \"application/json\");\n  response.statusCode = statusCode;\n  response.end(JSON.stringify(body, null, 2));\n}\n\nfunction handleOptions(\n  request: IncomingMessage,\n  response: ServerResponse,\n): boolean {\n  if (request.method !== \"OPTIONS\") return false;\n  setCorsHeaders(response);\n  response.statusCode = 204;\n  response.end();\n  return true;\n}\n\nfunction setCorsHeaders(response: ServerResponse): void {\n  response.setHeader(\"Access-Control-Allow-Origin\", \"*\");\n  response.setHeader(\"Access-Control-Allow-Methods\", \"GET, HEAD, OPTIONS\");\n  response.setHeader(\n    \"Access-Control-Allow-Headers\",\n    \"Content-Type, Authorization\",\n  );\n}\n\nfunction getRequestOrigin(request: IncomingMessage): string {\n  const host = readHeader(request.headers.host);\n  if (!host) throw new Error(\"Widget dev request is missing the Host header.\");\n\n  const forwardedProtocol = readHeader(request.headers[\"x-forwarded-proto\"]);\n  const protocol = forwardedProtocol === \"https\" ? \"https\" : \"http\";\n  return `${protocol}://${host}`;\n}\n\nfunction readHeader(\n  value: string | readonly string[] | undefined,\n): string | undefined {\n  const candidate = Array.isArray(value) ? value[0] : value;\n  return typeof candidate === \"string\" && candidate.trim().length > 0\n    ? candidate.trim()\n    : undefined;\n}\n"],"mappings":";;AAQA,SAAgB,uBAA+B;AAC7C,QAAO;EACL,MAAM;EACN,OAAO;EACP,gBAAgB,QAAQ;AACtB,UAAO,YAAY,IAAI,OAAO,SAAS,UAAU,SAAwB;IACvE,MAAM,YAAY,QAAQ,OAAO,IAAI,MAAM,IAAI,CAAC,MAAM;AAEtD,QACE,aAAa,wBACb,aAAa,uBACb;AACA,oBACE,SACA,UACA,iCAAiC,yBAAyB,CAC3D;AACD;;AAGF,QACE,aAAa,0BACb,aAAa,yBACb;AACA,WAAM,mBAAmB,QAAQ,SAAS,SAAS;AACnD;;AAGF,UAAM;KACN;;EAEL;;;;;;AAOH,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDjC,SAAgB,iCAAiC,WAA2B;AAC1E,QAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,gBAAgB,KAAK,UAAU,UAAU,CAAC;EAC1C;EACA;EACA;EACA;EACA;EACD,CAAC,KAAK,KAAK;;AAGd,SAAgB,kCACd,cACA,QAC6C;CAC7C,MAAM,aAAa,kCACjB,mBAAmB,aAAa,EAChC,EAAE,OAAO,WAAW,CACrB;AACD,KAAI,CAAC,WAAW,WAAW,CAAC,WAAW,MACrC,OAAM,IAAI,MACR,WAAW,OAAO,KAAK,UAAU,MAAM,QAAQ,CAAC,KAAK,KAAK,IACxD,oCACH;AAGH,QAAO,CAAC,6BAA6B,WAAW,OAAO,OAAO,CAAC;;AAGjE,SAAS,6BACP,WACA,QACkC;CAClC,MAAM,UAAU,UAAU,cAAc,WAAW,EAAE;AACrD,QAAO;EACL,iBAAiB;EACjB,SAAS;EACT,WAAW,UAAU;EACrB,QAAQ,UAAU;EAClB,SAAS,UAAU;EACnB,gBAAgB,IAAI,IAAI,sBAAsB,OAAO,CAAC;EACtD,SACE,QAAQ,SAAS,IACb,QAAQ,KAAK,QAAQ,YAAY,KAAK,OAAO,CAAC,GAC9C,CAAC,YAAY,eAAe,OAAO,CAAC;EAC1C,WAAW,EAAE;EACb,SAAS,UAAU,QAAQ,KAAK,EAAE,MAAM,OAAO,GAAG,aAAa,OAAO;EACvE;;;;;;;;;;;;;;;;;;;AAoBH,SAAS,YAAY,KAAa,QAAwB;CACxD,MAAM,EAAE,SAAS,IAAI,IAAI,KAAK,OAAO;AACrC,QAAO,KAAK,SAAS,IAAI,GAAG,GAAG,KAAK,WAAW,GAAG,KAAK;;AAGzD,eAAe,mBACb,QACA,SACA,UACe;AACf,KAAI,cAAc,SAAS,SAAS,CAAE;AAEtC,KAAI;AAIF,WACE,UACA,kCALoB,MAAM,OAAO,cACjC,0BACD,EAKG,iBAAiB,QAAQ,CAC1B,CACF;UACM,OAAO;AACd,SAAO,OAAO,OAAO,MACnB,2CAA2C,OAAO,MAAM,GACzD;AACD,WAAS,UAAU,EAAE,OAAO,OAAO,MAAM,EAAE,EAAE,IAAI;;;AAIrD,SAAS,mBACP,cACoB;CACpB,MAAM,WAAW,aAAa;AAC9B,KAAI,MAAM,QAAQ,SAAS,IAAI,SAAS,SAAS,EAAG,QAAO;CAE3D,MAAM,gBAAgB,aAAa;AACnC,QAAO,kBAAkB,KAAA,IAAY,EAAE,GAAG,CAAC,cAAc;;AAG3D,SAAS,eACP,SACA,UACA,QACM;AACN,KAAI,cAAc,SAAS,SAAS,CAAE;AACtC,gBAAe,SAAS;AACxB,UAAS,UAAU,gBAAgB,kBAAkB;AACrD,UAAS,aAAa;AACtB,UAAS,IAAI,OAAO;;AAGtB,SAAS,SACP,UACA,MACA,aAAa,KACP;AACN,gBAAe,SAAS;AACxB,UAAS,UAAU,gBAAgB,mBAAmB;AACtD,UAAS,aAAa;AACtB,UAAS,IAAI,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;AAG7C,SAAS,cACP,SACA,UACS;AACT,KAAI,QAAQ,WAAW,UAAW,QAAO;AACzC,gBAAe,SAAS;AACxB,UAAS,aAAa;AACtB,UAAS,KAAK;AACd,QAAO;;AAGT,SAAS,eAAe,UAAgC;AACtD,UAAS,UAAU,+BAA+B,IAAI;AACtD,UAAS,UAAU,gCAAgC,qBAAqB;AACxE,UAAS,UACP,gCACA,8BACD;;AAGH,SAAS,iBAAiB,SAAkC;CAC1D,MAAM,OAAO,WAAW,QAAQ,QAAQ,KAAK;AAC7C,KAAI,CAAC,KAAM,OAAM,IAAI,MAAM,iDAAiD;AAI5E,QAAO,GAFmB,WAAW,QAAQ,QAAQ,qBAAqB,KACnC,UAAU,UAAU,OACxC,KAAK;;AAG1B,SAAS,WACP,OACoB;CACpB,MAAM,YAAY,MAAM,QAAQ,MAAM,GAAG,MAAM,KAAK;AACpD,QAAO,OAAO,cAAc,YAAY,UAAU,MAAM,CAAC,SAAS,IAC9D,UAAU,MAAM,GAChB,KAAA"}