@llui/vite-plugin 0.0.31 → 0.0.34

package/dist/index.d.ts

@@ -1,6 +1,4 @@
 import type { Plugin } from 'vite';
-import { type DiagnosticRule } from './diagnostics.js';
-export type { DiagnosticRule } from './diagnostics.js';
 export interface LluiPluginOptions {
     /**
      * Port for the MCP debug bridge. In dev mode, the runtime relay connects
@@ -17,28 +15,6 @@ export interface LluiPluginOptions {
      * silently skips the connection — no retry noise.
      */
     mcpPort?: number | false;
-    /**
-     * Treat every compiler diagnostic as a build error.
-     *
-     * Default `false` — diagnostics are emitted via rollup's `this.warn` and
-     * can be ignored. Set to `true` in CI so lint-style regressions (namespace
-     * imports, bitmask overflow, spread-in-children, `.map()` on state, etc.)
-     * fail the build without requiring a custom `build.rollupOptions.onwarn`
-     * handler.
-     */
-    failOnWarning?: boolean;
-    /**
-     * Silence specific diagnostic rules without disabling the whole lint
-     * pass. Each message is tagged with a rule name (shown in brackets at
-     * the start of every warning, e.g. `[spread-in-children]`). Listing
-     * a rule here drops all diagnostics with that tag before rollup sees
-     * them — so they don't fire via `this.warn` and don't fail the build
-     * even when `failOnWarning` is enabled.
-     *
-     * The valid rule names are enumerated by the `DiagnosticRule` type
-     * re-exported from this module. Unknown rule names are ignored.
-     */
-    disabledWarnings?: readonly DiagnosticRule[];
     /**
      * Emit `[llui]`-prefixed `console.info` logs for every transformed
      * component file — state-path bit assignments, mask injections, and
@@ -66,13 +42,13 @@ export interface LluiPluginOptions {
      */
     agent?: boolean | AgentPluginConfig;
 }
-export type AgentPluginConfig = {
-    /**
-     * HMAC signing key for tokens. ≥32 bytes. Rotation invalidates all
-     * tokens. Falls back to `process.env.AGENT_SIGNING_KEY`, then to a
-     * per-session random key (dev-only).
-     */
-    signingKey?: string;
-};
+/**
+ * Reserved for future agent-server config. Empty today — opaque tokens
+ * (post-0.0.35) need no signing key, and the dev server hard-codes the
+ * identity resolver to `'dev-user'`. The shape is kept so callers can
+ * pass `agent: { ... }` and we can grow options without churning the
+ * public type.
+ */
+export type AgentPluginConfig = Record<string, never>;
 export default function llui(options?: LluiPluginOptions): Plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAiB,MAAM,MAAM,CAAA;AAOjD,OAAO,EAAY,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEhE,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAqBtD,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;IAExB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IAEvB;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IAE5C;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IAEjB;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,iBAAiB,CAAA;CACpC;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,CAAA;AAmLD,MAAM,CAAC,OAAO,UAAU,IAAI,CAAC,OAAO,GAAE,iBAAsB,GAAG,MAAM,CA6UpE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAiB,MAAM,MAAM,CAAA;AAsOjD,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;IAExB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IAEjB;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,iBAAiB,CAAA;CACpC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;AAuMrD,MAAM,CAAC,OAAO,UAAU,IAAI,CAAC,OAAO,GAAE,iBAAsB,GAAG,MAAM,CAqWpE"}

package/dist/index.js

@@ -1,10 +1,182 @@
 import MagicString from 'magic-string';
 import { existsSync, readFileSync, writeFileSync, watch as fsWatch } from 'node:fs';
+import { readFile } from 'node:fs/promises';
 import { dirname, relative, resolve } from 'node:path';
 import { createRequire } from 'node:module';
 import { spawn } from 'node:child_process';
-import { transformLlui, transformUseClientSsr, hasUseClientDirective } from './transform.js';
-import { diagnose } from './diagnostics.js';
+import { transformLlui, transformUseClientSsr, hasUseClientDirective, } from './transform.js';
+import { findTypeSource, readComponentTypeArgNames, extractMsgAnnotationsCrossFile, extractDiscriminatedUnionSchemaCrossFile, } from './cross-file-resolver.js';
+import ts from 'typescript';
+/**
+ * Pre-resolution step run before `transformLlui`. Scans the source for
+ * `component<State, Msg, Effect>(...)` calls; for each type argument that
+ * is an identifier (the common case), walks imports and re-exports to
+ * find the source file declaring that alias. The result is plumbed into
+ * `transformLlui` so the schema/annotation extractors operate on the
+ * declaring file's source instead of silently returning `null` when the
+ * type lives in a separate file.
+ *
+ * Returns `undefined` (no external sources) when:
+ *   - No `component<...>()` call is in the file
+ *   - No type arguments are identifiers we can chase
+ *   - All type arguments are declared locally (the resolver returns the
+ *     same source we already have, so external sources are redundant)
+ *
+ * `resolveModule` comes from Rollup's `this.resolve()`; we wrap it to
+ * return the absolute id (or null when unresolved) and read the source
+ * via `fs/promises.readFile`.
+ */
+async function preResolveTypeSources(source, filePath, rollupResolve) {
+    // Cheap filter: nothing to resolve unless the file contains a
+    // component<...>() call. Avoids parsing every TS file in the project.
+    if (!/\bcomponent\s*</.test(source))
+        return undefined;
+    // Find the first component<...>() call and read its type arg names.
+    // Multiple component() calls in one file would each technically need
+    // their own type-arg lookup; we resolve based on the first call and
+    // accept the (rare) edge case where two component() calls in one file
+    // use different non-local Msg types. The lint rule catches divergence.
+    const sf = ts.createSourceFile(filePath, source, ts.ScriptTarget.Latest, true);
+    const args = findFirstComponentTypeArgs(sf);
+    if (!args)
+        return undefined;
+    const ctx = {
+        resolveModule: async (spec, importer) => {
+            const result = await rollupResolve(spec, importer);
+            if (!result || result.external)
+                return null;
+            // Rollup ids can include query/hash suffixes for virtual modules;
+            // strip those so fs.readFile sees a real path. Also skip files
+            // outside our control (node_modules) — we don't want to follow
+            // imports into third-party packages just to scrape types.
+            const idStripped = result.id.split('?')[0]?.split('#')[0];
+            if (!idStripped)
+                return null;
+            if (idStripped.includes('/node_modules/'))
+                return null;
+            return idStripped;
+        },
+        readSource: async (p) => {
+            return await readFile(p, 'utf8');
+        },
+    };
+    // Helper to resolve one type-arg name into an external source if it
+    // isn't declared locally (or if the resolver chases through imports).
+    const resolve = async (typeName) => {
+        if (!typeName)
+            return undefined;
+        const found = await findTypeSource(typeName, source, filePath, ctx);
+        if (!found)
+            return undefined;
+        // If the alias was declared locally, the existing extractor path
+        // already handles it — no need to populate external sources.
+        if (found.filePath === filePath)
+            return undefined;
+        return { source: found.source, typeName: found.localName };
+    };
+    const [state, msg, effect] = await Promise.all([
+        resolve(args.state),
+        resolve(args.msg),
+        resolve(args.effect),
+    ]);
+    if (!state && !msg && !effect)
+        return undefined;
+    return { state, msg, effect };
+}
+/**
+ * Cross-file + composition-aware schema extraction. The extractors
+ * follow imports/re-exports AND walk into TypeReferences inside Msg /
+ * Effect unions, so a developer who organises types as
+ * `type Msg = ImportedFoo | { type: 'extra' }` gets every variant in
+ * `__msgAnnotations` and `__msgSchema`. Without this step the
+ * file-local sync extractors would silently emit half-annotations
+ * (only the inline TypeLiteral members) — the worst kind of failure
+ * mode because the build appears to succeed.
+ *
+ * Returns `undefined` (no pre-extraction) when there's no
+ * `component()` call to resolve types for.
+ */
+async function preExtractCompositional(source, filePath, rollupResolve) {
+    if (!/\bcomponent\s*</.test(source))
+        return undefined;
+    const sf = ts.createSourceFile(filePath, source, ts.ScriptTarget.Latest, true);
+    const args = findFirstComponentTypeArgs(sf);
+    if (!args)
+        return undefined;
+    // No identifier type args at all → nothing for the resolver to chase.
+    if (!args.msg && !args.effect && !args.state)
+        return undefined;
+    const ctx = {
+        resolveModule: async (spec, importer) => {
+            const result = await rollupResolve(spec, importer);
+            if (!result || result.external)
+                return null;
+            const idStripped = result.id.split('?')[0]?.split('#')[0];
+            if (!idStripped)
+                return null;
+            if (idStripped.includes('/node_modules/'))
+                return null;
+            return idStripped;
+        },
+        readSource: async (p) => readFile(p, 'utf8'),
+    };
+    const [msgAnnotations, msgSchema, effectSchema] = await Promise.all([
+        args.msg
+            ? extractMsgAnnotationsCrossFile(source, args.msg, filePath, ctx)
+            : Promise.resolve(null),
+        args.msg
+            ? extractDiscriminatedUnionSchemaCrossFile(source, args.msg, filePath, ctx)
+            : Promise.resolve(null),
+        args.effect
+            ? extractDiscriminatedUnionSchemaCrossFile(source, args.effect, filePath, ctx)
+            : Promise.resolve(null),
+    ]);
+    // Only return a populated payload when we actually extracted
+    // something useful. Returning `undefined` lets transformLlui fall
+    // back to its file-local extractors, which is the right behavior
+    // for the (rare) case where every type the resolver sees is
+    // unreachable.
+    if (msgAnnotations === null && msgSchema === null && effectSchema === null)
+        return undefined;
+    // Note: state schema isn't a discriminated union, so composition
+    // doesn't apply. We leave state on the simpler `typeSources` path
+    // (already plumbed through preResolveTypeSources) which the
+    // file-local `extractStateSchema` consumes.
+    const out = {};
+    if (msgAnnotations !== null)
+        out.msgAnnotations = msgAnnotations;
+    if (msgSchema !== null)
+        out.msgSchema = msgSchema;
+    if (effectSchema !== null)
+        out.effectSchema = effectSchema;
+    return out;
+}
+function findFirstComponentTypeArgs(sf) {
+    let result = null;
+    const visit = (node) => {
+        if (result)
+            return true;
+        if (ts.isCallExpression(node) &&
+            ts.isIdentifier(node.expression) &&
+            node.expression.text === 'component' &&
+            node.typeArguments) {
+            result = readComponentTypeArgNames(node);
+            return true;
+        }
+        let stopped = false;
+        ts.forEachChild(node, (child) => {
+            if (stopped)
+                return;
+            if (visit(child))
+                stopped = true;
+        });
+        return stopped;
+    };
+    ts.forEachChild(sf, (child) => {
+        visit(child);
+    });
+    return result;
+}
 /**
  * Locate the workspace root so we share the MCP active marker file
  * with @llui/mcp regardless of which subdirectory the dev server runs in.
@@ -67,7 +239,7 @@ function resolveMcpCliPath(root) {
  * construct an agent server instance. Returns null if @llui/agent isn't
  * installed — the plugin degrades to "prod schema emission only" mode.
  */
-async function loadAgentServer(appRoot, cfg) {
+async function loadAgentServer(appRoot, _cfg) {
     let serverModule;
     try {
         // Walk up from the app root to find node_modules/@llui/agent. Works
@@ -90,10 +262,11 @@ async function loadAgentServer(appRoot, cfg) {
             (e instanceof Error ? e.message : String(e)));
         return null;
     }
-    const { randomBytes } = await import('node:crypto');
-    const signingKey = cfg.signingKey ?? process.env['AGENT_SIGNING_KEY'] ?? randomBytes(32).toString('base64url');
+    // The pre-0.0.35 agent server required an HMAC signingKey for JWT
+    // tokens. The opaque-token rewrite removed that option; the dev
+    // server here just calls the factory with no auth config — the
+    // in-memory token store is the source of truth.
     return serverModule.createLluiAgentServer({
-        signingKey,
         identityResolver: async () => 'dev-user',
     });
 }
@@ -106,12 +279,31 @@ function registerAgentMiddleware(server, agent) {
     // Connect-style middleware. Vite's middleware chain runs in order, so
     // synchronous registration during configureServer places us ahead of
     // Vite's catch-all fallback.
+    //
+    // Dual-path: handle the canonical `/agent/*` (every project) AND
+    // `/cdn-cgi/agent/*` (defensive — Cloudflare's `@cloudflare/vite-plugin`
+    // routes everything except `/cdn-cgi/*` to the worker, which means
+    // canonical `/agent/*` paths are shadowed in cloudflare-vite projects).
+    // The cdn-cgi prefix is stripped before forwarding so the agent
+    // server's router sees its own canonical paths regardless of which
+    // public URL the client used. This matches the dual-path strategy
+    // used for `/__llui_mcp_status`.
     server.middlewares.use((req, res, next) => {
         const url = req.url ?? '/';
-        if (!url.startsWith('/agent/') && url !== '/agent') {
+        let stripped = null;
+        if (url.startsWith('/agent/') || url === '/agent')
+            stripped = url;
+        else if (url.startsWith('/cdn-cgi/agent/') || url === '/cdn-cgi/agent') {
+            stripped = url.slice('/cdn-cgi'.length);
+        }
+        if (stripped === null) {
             next();
             return;
         }
+        // Rewrite the request URL in-place so handleAgentRequest's path
+        // matching sees `/agent/*`. Connect middleware can mutate req.url
+        // for downstream handlers; we own the request from here.
+        req.url = stripped;
         void handleAgentRequest(req, res, agent.router).catch((e) => {
             console.error('[llui] agent middleware error:', e);
             next(e);
@@ -119,14 +311,18 @@ function registerAgentMiddleware(server, agent) {
     });
     // WS upgrade: only /agent/ws goes to the agent. Vite's own HMR upgrade
     // uses a different path and runs as a separate listener on the same
-    // event, so this filter keeps both coexisting.
+    // event, so this filter keeps both coexisting. Same dual-path
+    // accommodation as the HTTP middleware — the WS-upgrade path doesn't
+    // actually matter to most cloudflare setups (the worker handles WS
+    // upgrades natively), but keeping the parity simplifies the mental
+    // model for ops.
     server.httpServer?.on('upgrade', (req, socket, head) => {
         const url = new URL(req.url ?? '/', 'http://localhost');
-        if (url.pathname === '/agent/ws') {
+        if (url.pathname === '/agent/ws' || url.pathname === '/cdn-cgi/agent/ws') {
             agent.wsUpgrade(req, socket, head);
         }
     });
-    console.info('[llui] agent dev endpoints active: POST /agent/mint, WS /agent/ws, LAP /agent/lap/v1/*');
+    console.info('[llui] agent dev endpoints active: POST /agent/mint, WS /agent/ws, LAP /agent/lap/v1/* (also reachable under /cdn-cgi/agent/* for cloudflare-vite parity)');
 }
 /**
  * Walk up from `start` looking for `node_modules/<pkgName>`. Returns the
@@ -187,8 +383,6 @@ export default function llui(options = {}) {
     let mcpMode = 'disabled';
     let mcpCliPath = null;
     let mcpChild = null;
-    const failOnWarning = options.failOnWarning === true;
-    const disabledWarnings = new Set(options.disabledWarnings ?? []);
     const verbose = options.verbose === true;
     const agent = options.agent ?? false;
     const agentConfig = typeof agent === 'object' ? agent : {};
@@ -342,7 +536,17 @@ export default function llui(options = {}) {
             // the import.meta.hot listener registers get dropped — and lets
             // the browser connect to the actual port (which may differ from
             // the compile-time default if MCP was started with LLUI_MCP_PORT).
-            server.middlewares.use('/__llui_mcp_status', (_req, res) => {
+            //
+            // Two paths register the same handler:
+            //  * `/__llui_mcp_status` — canonical, served from any Vite
+            //    project.
+            //  * `/cdn-cgi/llui_mcp_status` — fallback for projects that
+            //    bundle `@cloudflare/vite-plugin`. The cloudflare plugin
+            //    intercepts every HTTP request in `configureServer` and
+            //    routes it to the worker, except `/cdn-cgi/*` which it
+            //    explicitly lets through. Without this fallback, MCP
+            //    auto-discovery silently fails under workerd.
+            const mcpStatusHandler = (_req, res) => {
                 const marker = readMcpMarker();
                 if (marker === null) {
                     res.statusCode = 404;
@@ -352,7 +556,9 @@ export default function llui(options = {}) {
                 res.statusCode = 200;
                 res.setHeader('content-type', 'application/json');
                 res.end(JSON.stringify({ port: marker.port }));
-            });
+            };
+            server.middlewares.use('/__llui_mcp_status', mcpStatusHandler);
+            server.middlewares.use('/cdn-cgi/llui_mcp_status', mcpStatusHandler);
             // Watch the marker file for create/delete. fs.watch on the parent
             // directory catches both events; the file itself may not exist
             // when we start watching.
@@ -436,7 +642,7 @@ export default function llui(options = {}) {
             // themselves — configureServer also fires in middleware mode, but
             // there server.httpServer is null so the upgrade hook is a no-op.
         },
-        transform(code, id, options) {
+        async transform(code, id, options) {
             if (!id.endsWith('.ts') && !id.endsWith('.tsx'))
                 return;
             // `'use client'` directive — SSR builds replace the module with a
@@ -455,28 +661,31 @@ export default function llui(options = {}) {
                     return { code: result.output, map: { mappings: '' } };
                 }
             }
-            const diagnostics = diagnose(code);
-            if (diagnostics.length > 0) {
-                // Prefix every diagnostic with `<file>:<line>:<col>` plus the
-                // `[rule-name]` tag so consumers logging `warning.message` in a
-                // custom onwarn handler see both the location and the rule they
-                // could silence via `disabledWarnings`.
-                const cwd = process.cwd();
-                const rel = relative(cwd, id);
-                const display = rel.startsWith('..') ? id : rel;
-                for (const d of diagnostics) {
-                    if (disabledWarnings.has(d.rule))
-                        continue;
-                    const message = `${display}:${d.line}:${d.column}: [${d.rule}] ${d.message}`;
-                    if (failOnWarning) {
-                        this.error({ message, loc: { line: d.line, column: d.column, file: id } });
-                    }
-                    else {
-                        this.warn(message, { line: d.line, column: d.column });
-                    }
-                }
-            }
-            const result = transformLlui(code, id, devMode, Boolean(agent), mcpPort, verbose);
+            // Pre-resolve cross-file type sources for any `component<S, M, E>()`
+            // call in this file. The extractors look for `type Msg = ...` etc.
+            // in a single source string; if the user keeps `Msg` in a sibling
+            // file, the local extraction returns null and the plugin emits no
+            // annotations. Pre-resolution chases imports and re-exports to
+            // find the declaring file, so the schema/annotation extractors run
+            // against the right source. See cross-file-resolver.ts.
+            //
+            // `this.resolve` may be undefined in test harnesses that call the
+            // hook directly without going through Rollup; in that case skip
+            // pre-resolution and the local extractors handle whatever's in
+            // the source string.
+            const resolverAvailable = typeof this.resolve === 'function';
+            const [typeSources, preExtracted] = resolverAvailable
+                ? await Promise.all([
+                    preResolveTypeSources(code, id, this.resolve.bind(this)),
+                    // Cross-file + composition-aware extraction. Replaces the
+                    // file-local sync extractors when active. Without this step
+                    // a `type Msg = ImportedFoo | { type: 'extra' }`
+                    // composition would only see the inline `'extra'` variant
+                    // and silently emit half-annotations.
+                    preExtractCompositional(code, id, this.resolve.bind(this)),
+                ])
+                : [undefined, undefined];
+            const result = transformLlui(code, id, devMode, Boolean(agent), mcpPort, verbose, typeSources, preExtracted);
             if (!result)
                 return undefined;
             // Apply per-statement edits via MagicString for accurate source maps.