@metricinsights/pp-dev 1.5.0-beta.3 → 1.5.0-beta.31

package/README.md

@@ -31,18 +31,18 @@ npm install @metricinsights/pp-dev
 This package requires Next.js as a peer dependency for certain functionality:
 
 ```bash
-npm install next@^15
+npm install next@^16
 ```
 
-**Note**: pp-dev requires Next.js version 15 or higher (but less than 17) to be installed in your project. This is a peer dependency, meaning it won't be automatically installed with pp-dev.
+**Note**: pp-dev accepts Next.js 13 to 16 (`peerDependencies`: `>= 13 < 17`); the test apps run on Next.js 16. It is a peer dependency, so it isn't installed with pp-dev.
 
 ## Package Structure
 
 The pp-dev package provides multiple entry points for different use cases:
 
 ```javascript
-// Main package (includes everything)
-import ppDev from '@metricinsights/pp-dev';
+// Main package (includes everything, defineConfig too)
+import { withPPDev } from '@metricinsights/pp-dev';
 
 // Plugin only (for Vite integration)
 import { vitePPDev } from '@metricinsights/pp-dev/plugin';
@@ -51,7 +51,7 @@ import { vitePPDev } from '@metricinsights/pp-dev/plugin';
 import { defineConfig } from '@metricinsights/pp-dev/helpers';
 
 // Client assets (for development UI)
-import '@metricinsights/pp-dev/client/css/client.css';
+import '@metricinsights/pp-dev/client/client.css';
 ```
 
 ## Configuration
@@ -144,60 +144,62 @@ module.exports = defineConfig({
 
 ### `mi` — Metric Insights connection
 
-| Field        | Type                              | Default        | Description                                               |
-|--------------|-----------------------------------|----------------|-----------------------------------------------------------|
-| `url`        | `string`                          | —              | URL of the Metric Insights instance                       |
-| `token`      | `string`                          | `MI_ACCESS_TOKEN` env | Personal access token for authentication           |
-| `mode`       | `'standalone' \| 'embedding'`     | `'standalone'` | Standalone hides the MI navigation; embedding keeps it    |
-| `include`    | `'top-bar' \| 'shared-components'`| —              | Bundle MI top-bar assets into the build (requires `standalone`) |
-| `apiVersion` | `6 \| 7`                          | `7`            | MI API version to target                                  |
+| Field        | Type                               | Default               | Description                                                     |
+| ------------ | ---------------------------------- | --------------------- | --------------------------------------------------------------- |
+| `url`        | `string`                           | —                     | URL of the Metric Insights instance                             |
+| `token`      | `string`                           | `MI_ACCESS_TOKEN` env | Personal access token for authentication                        |
+| `mode`       | `'standalone' \| 'embedding'`      | `'standalone'`        | Standalone hides the MI navigation; embedding keeps it          |
+| `include`    | `'top-bar' \| 'shared-components'` | —                     | Bundle MI top-bar assets into the build (requires `standalone`) |
+| `apiVersion` | `6 \| 7`                           | `7`                   | MI API version to target                                        |
 
 ### `app` — Portal Page identity
 
-| Field  | Type                       | Default                  | Description                                                 |
-|--------|----------------------------|--------------------------|-------------------------------------------------------------|
-| `id`   | `number`                   | —                        | Portal Page ID used to fetch template variables             |
-| `type` | `'template' \| 'page'`     | `'template'`             | `template` syncs back to MI; `page` is standalone-only      |
-| `name` | `string`                   | `package.json#name`      | Template name on the MI instance (usually auto-resolved)    |
+| Field  | Type                   | Default             | Description                                              |
+| ------ | ---------------------- | ------------------- | -------------------------------------------------------- |
+| `id`   | `number`               | —                   | Portal Page ID used to fetch template variables          |
+| `type` | `'template' \| 'page'` | `'template'`        | `template` syncs back to MI; `page` is standalone-only   |
+| `name` | `string`               | `package.json#name` | Template name on the MI instance (usually auto-resolved) |
 
 ### `proxy` — Request proxying
 
-| Field               | Type      | Default  | Description                                          |
-|---------------------|-----------|----------|------------------------------------------------------|
-| `cache`             | `boolean` | `true`   | Enable caching of proxied requests                   |
-| `cacheTtl`          | `number`  | `600000` | Cache TTL in milliseconds (10 minutes)               |
-| `tls.allowSelfSigned` | `boolean` | `false` | Allow self-signed SSL certificates on the MI server |
+| Field                 | Type      | Default  | Description                                         |
+| --------------------- | --------- | -------- | --------------------------------------------------- |
+| `cache`               | `boolean` | `true`   | Enable caching of proxied requests                  |
+| `cacheTtl`            | `number`  | `600000` | Cache TTL in milliseconds (10 minutes)              |
+| `tls.allowSelfSigned` | `boolean` | `false`  | Allow self-signed SSL certificates on the MI server |
 
 ### `build` — Build output
 
-| Field               | Type                                                        | Default  | Description                                                                          |
-|---------------------|-------------------------------------------------------------|----------|--------------------------------------------------------------------------------------|
-| `outDir`            | `string`                                                    | `'dist'` | Output directory                                                                     |
-| `zip`               | `boolean \| { fileName?: string; outDir?: string; inDir?: string }` | `true` | Zip build output. Object form customizes filename and directories.        |
-| `versionFile`       | `boolean \| { enabled?: boolean; fileNameTemplate?: string }` | `true` | Write a VERSION file into the build                                                  |
-| `imageOptimisations`| `boolean \| Record<string, unknown>`                        | `true`   | Image optimization. See [vite-plugin-image-optimizer](https://www.npmjs.com/package/vite-plugin-image-optimizer#plugin-options) for object options |
+| Field                | Type                                                                | Default  | Description                                                                                                                                        |
+| -------------------- | ------------------------------------------------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `outDir`             | `string`                                                            | `'dist'` | Output directory                                                                                                                                   |
+| `zip`                | `boolean \| { fileName?: string; outDir?: string; inDir?: string }` | `true`   | Zip build output. Object form customizes filename and directories.                                                                                 |
+| `versionFile`        | `boolean \| { enabled?: boolean; fileNameTemplate?: string }`       | `true`   | Write a VERSION file into the build                                                                                                                |
+| `imageOptimisations` | `boolean \| Record<string, unknown>`                                | `true`   | Image optimization. See [vite-plugin-image-optimizer](https://www.npmjs.com/package/vite-plugin-image-optimizer#plugin-options) for object options |
 
 ### `inspector` — Request Inspector
 
-| Field          | Type      | Default     | Description                                                    |
-|----------------|-----------|-------------|----------------------------------------------------------------|
-| `enabled`      | `boolean` | `true`      | Enable the request inspector                                   |
-| `maxMemory`    | `number`  | `104857600` | Max total body memory (bytes) before oldest entries are evicted (default 100 MB) |
+| Field          | Type      | Default     | Description                                                                                             |
+| -------------- | --------- | ----------- | ------------------------------------------------------------------------------------------------------- |
+| `enabled`      | `boolean` | `true`      | Enable the request inspector                                                                            |
+| `maxMemory`    | `number`  | `104857600` | Max total body memory (bytes) before oldest entries are evicted (default 100 MB)                        |
 | `captureLimit` | `number`  | `10485760`  | Max body size captured per request/response (bytes, default 10 MB). Larger bodies are stored truncated. |
 
 ### `sync` — Template sync
 
-| Field        | Type     | Default     | Description                             |
-|--------------|----------|-------------|-----------------------------------------|
-| `backupsDir` | `string` | `'backups'` | Directory for backups from the MI server |
+| Field            | Type              | Default     | Description                                                                                                                                             |
+| ---------------- | ----------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `backupsDir`     | `string`          | `'backups'` | Directory for backups from the MI server                                                                                                                |
+| `maxBackups`     | `number \| false` | `20`        | How many of this page's backups to keep; each new backup deletes the oldest beyond that. `false` or `0` keeps them all.                                 |
+| `buildTimeoutMs` | `number`          | `600000`    | How long the build a sync starts (`pp-dev build`, `next build`) may run, in milliseconds, before it is stopped and the sync fails (default 10 minutes). |
 
 ### `devPanel` — Dev panel appearance
 
-| Field      | Type                                                            | Default          | Description                                                                 |
-|------------|-----------------------------------------------------------------|------------------|-----------------------------------------------------------------------------|
-| `position` | `'top-left' \| 'top-right' \| 'bottom-left' \| 'bottom-right'`  | `'bottom-right'` | Screen corner the dev panel is anchored to                                  |
-| `hidden`   | `boolean`                                                       | `false`          | Fully hide the panel. Restore in the browser with `?pp-dev-panel=show`      |
-| `autoHide` | `boolean`                                                       | `false`          | Panel slides behind the screen edge leaving a thin strip; hover reveals it  |
+| Field      | Type                                                           | Default          | Description                                                                |
+| ---------- | -------------------------------------------------------------- | ---------------- | -------------------------------------------------------------------------- |
+| `position` | `'top-left' \| 'top-right' \| 'bottom-left' \| 'bottom-right'` | `'bottom-right'` | Screen corner the dev panel is anchored to                                 |
+| `hidden`   | `boolean`                                                      | `false`          | Fully hide the panel. Restore in the browser with `?pp-dev-panel=show`     |
+| `autoHide` | `boolean`                                                      | `false`          | Panel slides behind the screen edge leaving a thin strip; hover reveals it |
 
 These values are **defaults**: the panel itself has a settings popover (gear icon) with a corner
 picker, an auto-hide toggle and a hide button, and the panel can be dragged by its grip handle and
@@ -211,36 +213,71 @@ section for the full feature description.
 
 ### `users` — Working as other users
 
-| Field     | Type      | Default | Description                                                                                                  |
-|-----------|-----------|---------|--------------------------------------------------------------------------------------------------------------|
-| `persist` | `boolean` | `false` | Keep the users added with an API token between dev server runs, in `~/.pp-dev/users/` (readable by you only) |
+| Field     | Type      | Default | Description                                                                                                                                                         |
+| --------- | --------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `persist` | `boolean` | `false` | Keep the users added with an API token between dev server runs, in `~/.pp-dev/users/` (plain text, readable by you only; on Windows, by your profile's permissions) |
 
 See [Working as other users](#working-as-other-users).
 
+### `server` — The dev server
+
+| Field          | Type               | Default | Description                                                                                                                                                                                                                                                                                        |
+| -------------- | ------------------ | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `allowedHosts` | `string[] \| true` | `[]`    | Host names the dev server answers besides `localhost`, `*.localhost` and IP addresses, as Vite's [`server.allowedHosts`](https://vite.dev/config/server-options#server-allowedhosts): `'my-app.ngrok.app'`, or `'.ngrok.app'` for the domain and its subdomains. `true` answers any host; avoid it |
+
+A request whose `Host` is any other name gets 403: that is how DNS rebinding reaches a local server
+(a page on `evil.example:3000` whose name is then pointed at `127.0.0.1`). `pp-dev` passes the list
+to Vite, which checks `Host` itself; `pp-dev next` checks it for every request and WebSocket. The
+`--host <name>` you start the server with is allowed too.
+
+**Tunnels** (ngrok, cloudflared, an nginx in front): list the tunnel's exact name
+(`'my-app.ngrok.app'`). The dev server then answers that `Host`, and the pages served through the
+tunnel may use its own API (`/@api/*`), the dev panel's WebSocket and, under `pp-dev next`, Next's
+HMR: in development `withPPDev()` adds the exact names to Next's
+[`allowedDevOrigins`](https://nextjs.org/docs/app/api-reference/config/next-config-js/allowedDevOrigins),
+next to the ones in your Next config. A `.domain` entry (`'.ngrok.app'`) only answers the `Host`:
+as a page's origin it would let any page on that domain, someone else's tunnel too, act with your MI
+token or read Next's dev resources.
+
+Use a tunnel that keeps its name in `Host` (ngrok's default). One that rewrites `Host` to
+`localhost` (`ngrok --host-header=rewrite`, cloudflared's `httpHostHeader`, nginx
+`proxy_set_header Host localhost`) serves the pages, but the dev server then knows itself only as
+`localhost`: MI's redirects and the MI links it rewrites in responses point the browser at
+`localhost`, out of the tunnel. `X-Forwarded-Host` is not trusted to fix that: a rebinding page
+can send it.
+
+```ts
+export default defineConfig({
+  // ...
+  server: { allowedHosts: ['my-app.ngrok.app'] },
+});
+```
+
 ### Validation
 
 pp-dev validates your config at startup and reports problems clearly:
 
-| Condition | Behaviour |
-|---|---|
-| `mi.include` set + `mi.mode !== 'standalone'` | error |
-| `mi.url` missing + `mi.mode === 'embedding'` or `app.type === 'template'` | error |
-| `mi.url` missing + `mi.mode === 'standalone'` + `app.type === 'page'` | warning |
-| `app.type === 'template'` without `app.id` | error |
-| `app.type === 'page'` + `mi.mode === 'standalone'` without `app.id` | error |
-| `app.name` missing and no `package.json#name` | error |
-| `devPanel.position` not one of the four corners | error |
+| Condition                                                                 | Behaviour |
+| ------------------------------------------------------------------------- | --------- |
+| `mi.include` set + `mi.mode !== 'standalone'`                             | error     |
+| `mi.url` missing + `mi.mode === 'embedding'` or `app.type === 'template'` | error     |
+| `mi.url` missing + `mi.mode === 'standalone'` + `app.type === 'page'`     | warning   |
+| `app.type === 'template'` without `app.id`                                | error     |
+| `app.type === 'page'` + `mi.mode === 'standalone'` without `app.id`       | error     |
+| `app.name` missing and no `package.json#name`                             | error     |
+| `devPanel.position` not one of the four corners                           | error     |
+| `server.allowedHosts` neither a list of host names nor `true`             | error     |
 
 ### Environment Variables
 
-| Variable                        | Description                                                                        |
-|----------------------------------|-------------------------------------------------------------------------------------|
-| `MI_ACCESS_TOKEN`                | Default value for `mi.token` when not set in config                                 |
-| `PP_DEV_DIST_ZIP`                | `true`/`false` — override `build.zip` for `pp-dev build` / `pp-dev next-build`       |
-| `PP_DEV_DIST_ZIP_DIR`            | Override the ZIP output directory (`build.zip.outDir`)                              |
-| `PP_DEV_DIST_ZIP_FILENAME`       | Override the ZIP file name (`build.zip.fileName`)                                   |
-| `PP_DEV_VERSION_MANIFEST`        | `true`/`false` — override `build.versionFile` (VERSION/BUILD-MANIFEST generation)    |
-| `PP_DEV_VERSION_FILE_TEMPLATE`   | Override the VERSION file name template                                             |
+| Variable                       | Description                                                                       |
+| ------------------------------ | --------------------------------------------------------------------------------- |
+| `MI_ACCESS_TOKEN`              | Default value for `mi.token` when not set in config                               |
+| `PP_DEV_DIST_ZIP`              | `true`/`false` — override `build.zip` for `pp-dev build` / `pp-dev next-build`    |
+| `PP_DEV_DIST_ZIP_DIR`          | Override the ZIP output directory (`build.zip.outDir`)                            |
+| `PP_DEV_DIST_ZIP_FILENAME`     | Override the ZIP file name (`build.zip.fileName`)                                 |
+| `PP_DEV_VERSION_MANIFEST`      | `true`/`false` — override `build.versionFile` (VERSION/BUILD-MANIFEST generation) |
+| `PP_DEV_VERSION_FILE_TEMPLATE` | Override the VERSION file name template                                           |
 
 The `PP_DEV_DIST_ZIP*`/`PP_DEV_VERSION_*` variables are read by `pp-dev build` and
 `pp-dev next-build`; an equivalent CLI flag always takes precedence over its env var. See
@@ -261,40 +298,40 @@ npx @metricinsights/pp-dev migrate
 
 Options:
 
-| Option | Description |
-|---|---|
-| `[config]` | Path to config file (auto-detected if omitted) |
-| `--dry-run` | Preview the migrated output without writing |
-| `--format ts\|js\|json` | Override output format |
-| `--output <file>` | Write to a specific file instead of overwriting |
-| `--no-backup` | Skip creating a `.bak` backup of the original |
+| Option                  | Description                                     |
+| ----------------------- | ----------------------------------------------- |
+| `[config]`              | Path to config file (auto-detected if omitted)  |
+| `--dry-run`             | Preview the migrated output without writing     |
+| `--format ts\|js\|json` | Override output format                          |
+| `--output <file>`       | Write to a specific file instead of overwriting |
+| `--no-backup`           | Skip creating a `.bak` backup of the original   |
 
 The command detects flat 0.x configs and legacy `pp-watch.config.*` files, converts them to the new grouped format, and writes a `.bak` backup before overwriting.
 
 **Field mapping** (0.x → 1.0):
 
-| 0.x | 1.0 |
-|---|---|
-| `backendBaseURL` | `mi.url` |
-| `personalAccessToken` | `mi.token` |
-| `miHudLess: true` | `mi.mode: 'standalone'` |
-| `miHudLess: false` | `mi.mode: 'embedding'` |
-| `integrateMiTopBar: true` | `mi.mode: 'standalone'`, `mi.include: 'top-bar'` |
-| `integrateMiTopBar: { addSharedComponentsScripts: true }` | `mi.include: 'shared-components'` |
-| `v7Features: true` | `mi.apiVersion: 7` |
-| `v7Features: false` | `mi.apiVersion: 6` |
-| `appId` / `portalPageId` | `app.id` |
-| `templateName` | `app.name` (usually omit — auto-resolved from `package.json#name`) |
-| `templateLess: true` | `app.type: 'page'` |
-| `templateLess: false` | `app.type: 'template'` |
-| `enableProxyCache` | `proxy.cache` |
-| `proxyCacheTTL` | `proxy.cacheTtl` |
-| `disableSSLValidation: true` | `proxy.tls.allowSelfSigned: true` |
-| `distZip` | `build.zip` |
-| `versionPlugin` | `build.versionFile` |
-| `imageOptimizer` | `build.imageOptimisations` |
-| `outDir` | `build.outDir` |
-| `syncBackupsDir` | `sync.backupsDir` |
+| 0.x                                                       | 1.0                                                                |
+| --------------------------------------------------------- | ------------------------------------------------------------------ |
+| `backendBaseURL`                                          | `mi.url`                                                           |
+| `personalAccessToken`                                     | `mi.token`                                                         |
+| `miHudLess: true`                                         | `mi.mode: 'standalone'`                                            |
+| `miHudLess: false`                                        | `mi.mode: 'embedding'`                                             |
+| `integrateMiTopBar: true`                                 | `mi.mode: 'standalone'`, `mi.include: 'top-bar'`                   |
+| `integrateMiTopBar: { addSharedComponentsScripts: true }` | `mi.include: 'shared-components'`                                  |
+| `v7Features: true`                                        | `mi.apiVersion: 7`                                                 |
+| `v7Features: false`                                       | `mi.apiVersion: 6`                                                 |
+| `appId` / `portalPageId`                                  | `app.id`                                                           |
+| `templateName`                                            | `app.name` (usually omit — auto-resolved from `package.json#name`) |
+| `templateLess: true`                                      | `app.type: 'page'`                                                 |
+| `templateLess: false`                                     | `app.type: 'template'`                                             |
+| `enableProxyCache`                                        | `proxy.cache`                                                      |
+| `proxyCacheTTL`                                           | `proxy.cacheTtl`                                                   |
+| `disableSSLValidation: true`                              | `proxy.tls.allowSelfSigned: true`                                  |
+| `distZip`                                                 | `build.zip`                                                        |
+| `versionPlugin`                                           | `build.versionFile`                                                |
+| `imageOptimizer`                                          | `build.imageOptimisations`                                         |
+| `outDir`                                                  | `build.outDir`                                                     |
+| `syncBackupsDir`                                          | `sync.backupsDir`                                                  |
 
 ## CLI Commands
 
@@ -337,11 +374,28 @@ pp-dev next [options]
 # Aliases: pp-dev next-server, pp-dev next-dev
 ```
 
-| Option          | Default     | Description                       |
-| --------------- | ----------- | --------------------------------- |
-| `[root]`        | `.`         | Root directory of the application |
-| `--port <port>` | `3000`      | Server port                       |
-| `--host <host>` | `localhost` | Server hostname                   |
+| Option          | Default     | Description                                                         |
+| --------------- | ----------- | ------------------------------------------------------------------- |
+| `[root]`        | `.`         | Root directory of the application                                   |
+| `--port <port>` | `3000`      | Server port                                                         |
+| `--host [host]` | `localhost` | Server hostname; `--host` without a value listens on all addresses  |
+| `--webpack`     | -           | Use Webpack for Next dev (when Turbopack/native SWC is unavailable) |
+| `--turbopack`   | -           | Use Turbopack for Next dev                                          |
+
+`--https`, `--open`, `--cors`, `--strictPort` and `--force` are accepted for compatibility but have no effect with `pp-dev next` (a warning says so); they will be removed.
+
+`--host` without a value listens on all addresses, as `next dev -H 0.0.0.0` does, and Next.js then needs the address another device opens the page from in its [`allowedDevOrigins`](https://nextjs.org/docs/app/api-reference/config/next-config-js/allowedDevOrigins) for HMR and its other dev resources: the host name alone, without scheme or port (`allowedDevOrigins: ['192.168.1.20']` for a page opened at `http://192.168.1.20:3000`). The pages and pp-dev's own routes work either way, since an IP address is always an allowed host.
+
+**Template sync.** The panel's Sync builds the app with `next build` next to the running dev
+server. That build is given Next's default `distDir`, so it goes to `.next` and its static export to
+`out`, and the dev server's `<distDir>/dev` (its manifests and cache) is left alone. Before the build,
+the dev server's generated route types (`<distDir>/dev/types`) are removed, as `pp-dev next-build`
+does, since `next build` would type-check them next to its own; the dev server writes them again on
+its next start. This needs `next.config` wrapped with `withPPDev()`, which applies the build's
+`distDir`; without it the build exports into the app's own `distDir`, as a plain `next build` would,
+and the dev server has to be restarted after the sync.
+
+**Config changes.** Both commands watch `pp-dev.config.*`, `next.config.*` / `vite.config.*`, `package.json` and the `.env*` files of the project root and restart the dev server when one changes, appears or is removed. A `pp-dev.config.*` that can't be loaded (half-written, a syntax error) is reported and the running server is kept; the next save tries again. `pp-dev next` runs its server in a process of its own and starts that process again on a change, as `next dev` does: Next.js caches its config for the life of a process, so a restart in place could not pick up a changed `withPPDev()` config or `next.config.*`.
 
 ### Build
 
@@ -349,18 +403,18 @@ pp-dev next [options]
 pp-dev build [options]
 ```
 
-| Option                          | Default   | Description                                            |
-| ------------------------------- | --------- | ------------------------------------------------------ |
-| `[root]`                        | `.`       | Root directory of the application                      |
-| `--target <target>`             | `modules` | Transpile target                                       |
-| `--outDir <dir>`                | `dist`    | Output directory                                       |
-| `--assetsDir <dir>`             | `assets`  | Assets directory under outDir                          |
-| `--changelog [file]`            | `true`    | Create changelog file                                  |
-| `--distZip` / `--no-distZip`    | see below | Override `build.zip` — pack (or skip) the output ZIP   |
-| `--distZipDir <dir>`            | see below | Override the ZIP output directory (`build.zip.outDir`) |
-| `--distZipFilename <file>`      | see below | Override the ZIP file name (`build.zip.fileName`)      |
+| Option                                       | Default   | Description                                                          |
+| -------------------------------------------- | --------- | -------------------------------------------------------------------- |
+| `[root]`                                     | `.`       | Root directory of the application                                    |
+| `--target <target>`                          | `modules` | Transpile target                                                     |
+| `--outDir <dir>`                             | `dist`    | Output directory                                                     |
+| `--assetsDir <dir>`                          | `assets`  | Assets directory under outDir                                        |
+| `--changelog [file]`                         | `true`    | Create changelog file                                                |
+| `--distZip` / `--no-distZip`                 | see below | Override `build.zip` — pack (or skip) the output ZIP                 |
+| `--distZipDir <dir>`                         | see below | Override the ZIP output directory (`build.zip.outDir`)               |
+| `--distZipFilename <file>`                   | see below | Override the ZIP file name (`build.zip.fileName`)                    |
 | `--versionManifest` / `--no-versionManifest` | see below | Override `build.versionFile` — emit (or skip) VERSION/BUILD-MANIFEST |
-| `--versionFileTemplate <tpl>`   | see below | Override the VERSION file name template                |
+| `--versionFileTemplate <tpl>`                | see below | Override the VERSION file name template                              |
 
 The `--distZip*`/`--versionManifest*` flags (and their `PP_DEV_*` env var equivalents, see
 [Environment Variables](#environment-variables)) let CI or ad-hoc builds override the `build.zip`
@@ -396,15 +450,15 @@ Use it in place of `next build` in your `package.json`:
 }
 ```
 
-| Option                          | Default   | Description                                            |
-| ------------------------------- | --------- | ------------------------------------------------------ |
-| `[root]`                        | `.`       | Root directory of the application                      |
-| `--changelog [file]`            | `true`    | Create changelog file                                  |
-| `--distZip` / `--no-distZip`    | see below | Override `build.zip` — pack (or skip) the output ZIP   |
-| `--distZipDir <dir>`            | see below | Override the ZIP output directory (`build.zip.outDir`) |
-| `--distZipFilename <file>`      | see below | Override the ZIP file name (`build.zip.fileName`)      |
+| Option                                       | Default   | Description                                                          |
+| -------------------------------------------- | --------- | -------------------------------------------------------------------- |
+| `[root]`                                     | `.`       | Root directory of the application                                    |
+| `--changelog [file]`                         | `true`    | Create changelog file                                                |
+| `--distZip` / `--no-distZip`                 | see below | Override `build.zip` — pack (or skip) the output ZIP                 |
+| `--distZipDir <dir>`                         | see below | Override the ZIP output directory (`build.zip.outDir`)               |
+| `--distZipFilename <file>`                   | see below | Override the ZIP file name (`build.zip.fileName`)                    |
 | `--versionManifest` / `--no-versionManifest` | see below | Override `build.versionFile` — emit (or skip) VERSION/BUILD-MANIFEST |
-| `--versionFileTemplate <tpl>`   | see below | Override the VERSION file name template                |
+| `--versionFileTemplate <tpl>`                | see below | Override the VERSION file name template                              |
 
 ### Migration
 
@@ -412,13 +466,13 @@ Use it in place of `next build` in your `package.json`:
 pp-dev migrate [config] [options]
 ```
 
-| Option | Description |
-|---|---|
-| `[config]` | Config file to migrate (auto-detected if omitted) |
-| `--dry-run` | Preview output without writing |
-| `--format ts\|js\|json` | Output format |
-| `--output <file>` | Write to a specific path |
-| `--no-backup` | Skip `.bak` backup |
+| Option                  | Description                                       |
+| ----------------------- | ------------------------------------------------- |
+| `[config]`              | Config file to migrate (auto-detected if omitted) |
+| `--dry-run`             | Preview output without writing                    |
+| `--format ts\|js\|json` | Output format                                     |
+| `--output <file>`       | Write to a specific path                          |
+| `--no-backup`           | Skip `.bak` backup                                |
 
 ### Changelog Generation
 
@@ -517,8 +571,8 @@ Runtime choices are saved in the browser's `localStorage` (`pp-dev-info-position
 export default defineConfig({
   devPanel: {
     position: 'bottom-right', // 'top-left' | 'top-right' | 'bottom-left' | 'bottom-right'
-    hidden: false,            // hide the panel entirely (restore with ?pp-dev-panel=show)
-    autoHide: false,          // slide behind the screen edge, reveal on hover
+    hidden: false, // hide the panel entirely (restore with ?pp-dev-panel=show)
+    autoHide: false, // slide behind the screen edge, reveal on hover
   },
 });
 ```
@@ -542,7 +596,7 @@ A standalone page at `/@pp-dev/variables-editor`, alongside the [Request Inspect
 
 ![Variables Editor — Schema tab](./docs/screenshots/06-editor-schema.png)
 
-- **Values** — edit the page's live variable values in place, with type-aware widgets (searchable select for `static` options, a per-item form for `list`, …). A JSON mode (`View/edit raw JSON`) shows/accepts the same values as plain JSON — list-type values as native arrays, not double-escaped strings — with **Save to JSON file…** / **Import from JSON file…** buttons, and flags values that don't match a declared option, changed since the last load, or aren't in the schema.
+- **Values** — edit the page's live variable values in place, with type-aware widgets (searchable select for `static` options, a per-item form for `list`, …). A JSON mode (`View/edit raw JSON`) shows/accepts the same values as plain JSON — list-type values as native arrays, not double-escaped strings — with **Save to JSON file…** / **Import from JSON file…** buttons, and flags values that don't match a declared option, changed since the last load, or aren't in the schema. Each variable's description is shown as markdown, the way MI renders it: **bold**, _italic_, `code` and fenced code blocks, lists, and `<u>` / `<s>` / `<del>` for underline and strikethrough.
 
   The pages the dev server serves substitute `[VarName]` from its own copy of the values, loaded from MI with the page data. **Save** updates that copy too, so every tab (any user) shows the saved values on its next load. When the values in MI change some other way (edited in MI itself, or the update after a save failed), the Values tab shows **Update local pages · N** in its bottom-right corner; its tooltip lists the values that differ, and a click updates the copy.
 
@@ -576,7 +630,7 @@ Every saved user gets its own host: `<name>.localhost:<port>`. The browser sends
 ### Adding users
 
 - **API token**: the token is checked with MI before the user is added. SSO users can only be added this way.
-- **Username + password** (local MI users): pp-dev adds the user and opens MI's usual login page on the user's own host. You log in there as in MI — 2FA included — and pp-dev never sees the password. Until then the user is *not logged in yet*; once MI ends the session it is *session expired* and **Log in** opens the login page again.
+- **Username + password** (local MI users): pp-dev adds the user and opens MI's usual login page on the user's own host. You log in there as in MI — 2FA included — and pp-dev never sees the password. Until then the user is _not logged in yet_; once MI ends the session it is _session expired_ and **Log in** opens the login page again.
 
 The name becomes the user's host, so it may contain only lowercase latin letters, digits and `-`, must start with a letter and be at most 32 characters long.
 
@@ -588,7 +642,7 @@ Logging out on a user's host ends that user's MI session (or token) as it would
 
 ### Keeping users between runs
 
-Users live as long as the dev server. With `users: { persist: true }` the users added with an API token are kept in `~/.pp-dev/users/<hash>.json` — one file per project and MI instance, readable by you only, outside the project so it never ends up in git or a build. Passwords and MI sessions are never written. On start, every kept token is checked with MI again; one MI turns down shows as *API token turned down by MI*.
+Users live as long as the dev server. With `users: { persist: true }` the users added with an API token are kept in `~/.pp-dev/users/<hash>.json` — one file per project and MI instance, outside the project so it never ends up in git or a build. The tokens are stored as plain text: on macOS and Linux the file is readable by you only (mode `0600`); Windows ignores file modes, so there it is as private as your user profile folder (by default readable by you, administrators and the system). Two dev servers on the same project and MI instance share the file: each keeps the users the other added. Passwords and MI sessions are never written. On start, every kept token is checked with MI again; one MI turns down shows as _API token turned down by MI_.
 
 ```typescript
 // pp-dev.config.ts
@@ -603,13 +657,13 @@ export default defineConfig({
 
 The popover uses a small JSON API:
 
-| Method   | Path                    | Description                                                                                       |
-|----------|-------------------------|---------------------------------------------------------------------------------------------------|
-| `GET`    | `/@api/users`           | The users (name, kind, state, MI user, `origin`, `loginUrl`), the default user, and whether users are available |
-| `POST`   | `/@api/users`           | Add a user: `{ "name", "token" }`, or `{ "name", "kind": "session" }` to log in with a password    |
-| `PUT`    | `/@api/users/default`   | Make a user the default: `{ "name" }`, or `{ "name": null }` for you                              |
-| `PATCH`  | `/@api/users/:name`     | Edit a user added with an API token: `{ "name" }` to rename it, `{ "token" }` to replace its token |
-| `DELETE` | `/@api/users/:name`     | Remove a user                                                                                     |
+| Method   | Path                  | Description                                                                                                     |
+| -------- | --------------------- | --------------------------------------------------------------------------------------------------------------- |
+| `GET`    | `/@api/users`         | The users (name, kind, state, MI user, `origin`, `loginUrl`), the default user, and whether users are available |
+| `POST`   | `/@api/users`         | Add a user: `{ "name", "token" }`, or `{ "name", "kind": "session" }` to log in with a password                 |
+| `PUT`    | `/@api/users/default` | Make a user the default: `{ "name" }`, or `{ "name": null }` for you                                            |
+| `PATCH`  | `/@api/users/:name`   | Edit a user added with an API token: `{ "name" }` to rename it, `{ "token" }` to replace its token              |
+| `DELETE` | `/@api/users/:name`   | Remove a user                                                                                                   |
 
 Tokens and MI sessions are never sent back.
 
@@ -632,17 +686,18 @@ Open `http://localhost:3000/@pp-dev/inspector` (replace port as needed) in any b
 Selecting a request opens the detail pane with headers and a syntax-highlighted body:
 
 ![Request Inspector — request detail](./docs/screenshots/05-inspector-detail.png)
+
 - A **Clear** button in the top-right removes all stored entries
 
 ### Source badges
 
 Each request in the list displays a colored letter badge to the left of the HTTP status:
 
-| Badge | Color  | Meaning                                      |
-|-------|--------|----------------------------------------------|
+| Badge | Color  | Meaning                                                  |
+| ----- | ------ | -------------------------------------------------------- |
 | `P`   | Purple | Forwarded to the upstream Metric Insights server (proxy) |
-| `C`   | Amber  | Served from the local proxy cache             |
-| `L`   | Grey   | Served locally (static file, dev route, etc.) |
+| `C`   | Amber  | Served from the local proxy cache                        |
+| `L`   | Grey   | Served locally (static file, dev route, etc.)            |
 
 ### Console banner
 
@@ -658,12 +713,12 @@ The message persists in DevTools history so it is visible even when you open the
 
 The inspector also exposes a lightweight JSON API, useful for tooling and AI agents:
 
-| Method   | Path                    | Description                                 |
-|----------|-------------------------|---------------------------------------------|
-| `GET`    | `/@api/requests`        | Paginated list of captured requests (metadata only, no bodies) |
-| `GET`    | `/@api/requests/:id`    | Full entry including captured request/response bodies (base64-encoded) |
-| `GET`    | `/@api/requests/stats`  | Store stats: entry count, memory usage, limits |
-| `DELETE` | `/@api/requests`        | Clear all stored entries                    |
+| Method   | Path                   | Description                                                            |
+| -------- | ---------------------- | ---------------------------------------------------------------------- |
+| `GET`    | `/@api/requests`       | Paginated list of captured requests (metadata only, no bodies)         |
+| `GET`    | `/@api/requests/:id`   | Full entry including captured request/response bodies (base64-encoded) |
+| `GET`    | `/@api/requests/stats` | Store stats: entry count, memory usage, limits                         |
+| `DELETE` | `/@api/requests`       | Clear all stored entries                                               |
 
 `GET /@api/requests` accepts `?limit=` (default 50) and `?offset=` query parameters for pagination.
 
@@ -675,8 +730,8 @@ Bodies in `GET /@api/requests/:id` are returned as base64 strings in `requestBod
 // pp-dev.config.ts
 export default defineConfig({
   inspector: {
-    enabled: true,         // set to false to disable entirely
-    maxMemory: 100 * 1024 * 1024,   // evict oldest entries above 100 MB
+    enabled: true, // set to false to disable entirely
+    maxMemory: 100 * 1024 * 1024, // evict oldest entries above 100 MB
     captureLimit: 10 * 1024 * 1024, // capture at most 10 MB per body
   },
 });
@@ -713,7 +768,7 @@ If you encounter an error like "Next.js is required but not available":
 
 #### Version Compatibility
 
-- **pp-dev** requires Next.js version 15 or higher (but less than 17)
+- **pp-dev** accepts Next.js 13 to 16 (`>= 13 < 17`); the test apps run on Next.js 16
 - **Node.js** version 24 or higher is required
 - **TypeScript** version 5 or higher is recommended
 

package/dist/cjs/auth.provider-fI0tFsf5.js

@@ -0,0 +1,2 @@
+"use strict";const e=require("fs"),t=require("path"),r=require("url"),i=require("picocolors"),s=require("node:path"),o=require("node:net"),n=require("vite");var a="undefined"!=typeof document?document.currentScript:null;const p=(e=>e&&"object"==typeof e&&"default"in e?e.default:e)(s),d=t.resolve("undefined"!=typeof __filename&&__filename||r.fileURLToPath("undefined"==typeof document?require("url").pathToFileURL(__filename).href:a&&"SCRIPT"===a.tagName.toUpperCase()&&a.src||new URL("auth.provider-fI0tFsf5.js",document.baseURI).href),"../../.."),l=t.resolve("undefined"!=typeof __filename&&__filename||r.fileURLToPath("undefined"==typeof document?require("url").pathToFileURL(__filename).href:a&&"SCRIPT"===a.tagName.toUpperCase()&&a.src||new URL("auth.provider-fI0tFsf5.js",document.baseURI).href),"../.."),c=e.existsSync(t.resolve(d,"package.json"))?d:l,u=t.resolve(c,"dist/client/client.js"),{version:f,name:m}=JSON.parse(e.readFileSync(t.resolve(c,"package.json")).toString()),h=f,v=m,g="info";let w,_;function E(){return w??={level:g,logger:n.createLogger(g)},w.logger}function P(e){return void 0!==e&&e!==w?.level&&(w={level:e,logger:n.createLogger(e)}),_??={info:(e,t)=>E().info(e,t),warn:(e,t)=>E().warn(e,t),warnOnce:(e,t)=>E().warnOnce(e,t),error:(e,t)=>E().error(e,t),clearScreen:e=>E().clearScreen(e),hasErrorLogged:e=>E().hasErrorLogged(e),get hasWarned(){return E().hasWarned},set hasWarned(e){E().hasWarned=e}},_}const y=i.createColors();function b(e,t){if(!e||e.includes("\0")||p.posix.isAbsolute(e)||p.win32.isAbsolute(e)||p.win32.parse(e).root)throw new Error(`[pp-dev] ${t} must be a relative path inside its output directory.`);const r=p.posix.normalize(e.replace(/\\/g,"/"));if("."===r||".."===r||r.startsWith("../"))throw new Error(`[pp-dev] ${t} must stay inside its output directory.`);return r}function x(e){return b(`${e.replace(/^@/,"").replace(/[\\/]+/g,"-")}.zip`,"default ZIP output file name")}const A=["top-left","top-right","bottom-left","bottom-right"],T=2147483647;function L(e,t){const r=e.mi?.mode??"standalone",i=e.app?.type??"template",s=e.mi?.apiVersion??7,o=e.mi?.url??process.env.MI_BACKEND_URL;if(!(e.app?.name??t))throw new Error("[pp-dev] app.name is required (or set package.json#name)");const n=e.sync?.maxBackups;if(void 0!==n&&!1!==n&&!(Number.isInteger(n)&&n>=0))throw new Error(`[pp-dev] sync.maxBackups must be a whole number ≥ 0 or false (0 and false keep every backup), got ${JSON.stringify(n)}`);const a=e.sync?.buildTimeoutMs;if(void 0!==a&&!(Number.isInteger(a)&&a>0&&a<=T))throw new Error(`[pp-dev] sync.buildTimeoutMs must be a whole number of milliseconds between 1 and 2147483647, got ${JSON.stringify(a)}`);if(e.mi?.include&&"standalone"!==r)throw console.warn('[pp-dev] mi.include is only valid when mi.mode is "standalone"'),new Error('[pp-dev] mi.include requires mi.mode to be "standalone"');if(!o){if("embedding"===r||"template"===i)throw new Error('[pp-dev] mi.url is required when mi.mode is "embedding" or app.type is "template"');"standalone"===r&&"page"===i&&console.warn("[pp-dev] mi.url is not set — dev server will run without a backend proxy")}if("template"===i&&!e.app?.id)throw new Error('[pp-dev] app.id is required when app.type is "template"');if("page"===i&&o&&("standalone"===r||s>=7)&&!e.app?.id)throw new Error('[pp-dev] app.id is required when backend page data is loaded for app.type "page"');if(void 0!==e.devPanel?.position&&!A.includes(e.devPanel.position))throw new Error(`[pp-dev] devPanel.position must be one of: ${A.join(", ")}`);const p=e.server?.allowedHosts;if(!(void 0===p||!0===p||Array.isArray(p)&&p.every(e=>"string"==typeof e&&""!==e.trim())))throw new Error(`[pp-dev] server.allowedHosts must be a list of host names or true, got ${JSON.stringify(p)}`)}function R(e,t){const{mi:r={},app:i={},proxy:s={},build:o={},sync:n={},inspector:a={},devPanel:p={},users:d={},server:l={}}=e,c=r.mode??"standalone",u=i.type??"template",f=r.apiVersion??7,m="standalone"===c;let h=!1;"top-bar"===r.include?h=!0:"shared-components"===r.include&&(h={addSharedComponentsScripts:!0,addRootElement:!1});const v="page"===u,g=i.name??t;if(!g)throw new Error("[pp-dev] app.name is required (or set package.json#name)");const w="VERSION-v{packageversion}-{currentDate}.json";let _;const E=o.zip;let P;_=!1!==E&&(!0===E||void 0===E?{outFileName:x(g),outDir:"dist-zip"}:{outFileName:b(E.fileName??x(g),"build.zip.fileName"),outDir:E.outDir??"dist-zip",...E.inDir?{inDir:E.inDir}:{}});const y=o.versionFile;let A;P=!1!==y&&(!0===y||void 0===y?{versionFileTemplate:w,enabled:!0}:{versionFileTemplate:b(y.fileNameTemplate??w,"build.versionFile.fileNameTemplate"),enabled:y.enabled??!0});const T=o.imageOptimisations;return A=!1!==T&&(!0===T||void 0===T?{}:T),{templateName:g,backendBaseURL:r.url??process.env.MI_BACKEND_URL,appId:i.id,templateLess:v,miHudLess:m,integrateMiTopBar:h,enableProxyCache:s.cache??!0,proxyCacheTTL:s.cacheTtl??6e5,disableSSLValidation:s.tls?.allowSelfSigned??!1,imageOptimizer:A,outDir:o.outDir??"dist",distZip:_,versionPlugin:P,syncBackupsDir:n.backupsDir??"backups",syncMaxBackups:n.maxBackups,syncBuildTimeoutMs:n.buildTimeoutMs,v7Features:f>=7,personalAccessToken:r.token??process.env.MI_ACCESS_TOKEN,inspectorEnabled:a.enabled??!0,inspectorMaxMemory:a.maxMemory??1073741824,inspectorCaptureLimit:a.captureLimit??10485760,devPanelPosition:p.position??"bottom-right",devPanelHidden:p.hidden??!1,devPanelAutoHide:p.autoHide??!1,persistUsers:d.persist??!1,allowedHosts:!0===l.allowedHosts||(l.allowedHosts??[]).map(e=>e.trim().toLowerCase())}}const D=Object.freeze({__proto__:null,normalizePPDevConfig:R,validatePPDevConfig:L}),N=new Set(["GET","HEAD","OPTIONS"]);function S(e){return!0===e?[]:e.filter(e=>!e.startsWith("."))}function I(e,t=[]){const r=e.headers.origin,i=e.headers.host;if("string"==typeof r){if("null"===r)return'Origin "null" (a sandboxed or file:// page)';let e;try{e=new URL(r)}catch{return`unreadable Origin "${r}"`}if("localhost"===(s=e.hostname)||s.endsWith(".localhost")||"[::1]"===s||/^127(?:\.\d{1,3}){3}$/.test(s)||S(t).includes(e.hostname))return null;const o=i?function(e,t){try{return new URL(`${e}//${t}`).host}catch{return}}(e.protocol,i):void 0;return o&&e.host===o?null:`Origin ${e.origin} is neither this dev server (${i??"no Host"}) nor this machine`}var s;const o=e.headers["sec-fetch-site"];return N.has((e.method??"GET").toUpperCase())||"cross-site"!==o?null:"sent from a cross-site page"}class C{state={isAuthenticated:!1,isRedirected:!1};listeners=new Set;getState(){return{...this.state}}isAuthenticated(){return this.state.isAuthenticated}isRedirected(){return this.state.isRedirected}setAuthenticated(e){this.state.isAuthenticated=e,this.notifyListeners()}setRedirected(e){this.state.isRedirected=e,this.notifyListeners()}updateState(e){void 0!==e.isAuthenticated&&(this.state.isAuthenticated=e.isAuthenticated),void 0!==e.isRedirected&&(this.state.isRedirected=e.isRedirected),this.notifyListeners()}reset(){this.state={isAuthenticated:!1,isRedirected:!1},this.notifyListeners()}subscribe(e){return this.listeners.add(e),()=>{this.listeners.delete(e)}}notifyListeners(){this.listeners.forEach(e=>{try{e(this.getState())}catch(e){P().error(`Error in auth state listener: ${e instanceof Error?e.stack??e.message:String(e)}`)}})}}const O=new C;exports.AuthProvider=C,exports.PACKAGE_NAME=v,exports.PATH_PAGE_PREFIX="/p",exports.PATH_TEMPLATE_LOCAL_PREFIX="/pl",exports.PATH_TEMPLATE_PREFIX="/pt",exports.PP_DEV_CLIENT_ENTRY=u,exports.PP_DEV_CONFIG_NAMES=[".pp-dev.config.js",".pp-dev.config.cjs",".pp-dev.config.mjs",".pp-dev.config.ts",".pp-dev.config.cts",".pp-dev.config.mts",".pp-dev.config.json","pp-dev.config.js","pp-dev.config.cjs","pp-dev.config.mjs","pp-dev.config.ts","pp-dev.config.cts","pp-dev.config.mts","pp-dev.config.json"],exports.PP_DEV_NEXT_BUILD_DIST_DIR_ENV_VAR="PP_DEV_NEXT_BUILD_DIST_DIR",exports.PP_DEV_NEXT_BUILD_ENV_VAR="PP_DEV_NEXT_BUILD",exports.PP_DEV_PACKAGE_DIR=c,exports.VERSION=h,exports.authProvider=O,exports.colors=y,exports.createDefaultZipFileName=x,exports.createLogger=P,exports.createOriginGuard=function(e=[]){return(t,r,i)=>{const s=I(t,e);s?r.status(403).json({error:`Blocked by pp-dev: ${s}.`}):i()}},exports.crossOriginReason=I,exports.exactAllowedHosts=S,exports.hostNotAllowedMessage=function(e){const t=JSON.stringify((e??"").replace(/:\d*$/,""));return`Blocked by pp-dev: this host (${t}) is not allowed. To allow it, add ${t} to server.allowedHosts in the pp-dev config.`},exports.isHostAllowed=function(e,t){if(void 0===e||!0===t)return!0;const r=function(e){const t=e.trim().toLowerCase();if(t.startsWith("[")){const e=t.indexOf("]");return e>0&&6===o.isIP(t.slice(1,e))?{ip:!0}:void 0}const r=t.replace(/:\d*$/,"");if(r&&!r.includes(":"))return 4===o.isIP(r)?{ip:!0}:{hostname:r}}(e);if(void 0===r)return!1;if("ip"in r)return!0;const{hostname:i}=r;return"localhost"===i||i.endsWith(".localhost")||function(e,t){return t.some(t=>t===e||t.startsWith(".")&&(t.slice(1)===e||e.endsWith(t)))}(i,t)},exports.normalizePPDevConfig=R,exports.normalizeRelativeOutputPath=b,exports.ppDevConfig=D,exports.resolveOutputFilePath=function(e,t,r){const i=b(t,r),s=p.resolve(e),o=p.resolve(s,...i.split("/")),n=p.relative(s,o);if(".."===n||n.startsWith(`..${p.sep}`)||p.isAbsolute(n))throw new Error(`[pp-dev] ${r} must resolve inside its output directory.`);return o},exports.resolveZipSourceDir=function(e,t,r){return p.resolve(e,r||t)},exports.validatePPDevConfig=L;
+//# sourceMappingURL=auth.provider-fI0tFsf5.js.map

package/dist/cjs/auth.provider-fI0tFsf5.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.provider-fI0tFsf5.js","sources":["../../../src/constants.ts","../../../src/lib/logger.ts","../../../src/lib/helpers/color.helper.ts","../../../src/lib/output-path.ts","../../../src/lib/pp-dev-config.ts","../../../src/lib/helpers/origin-guard.ts","../../../src/lib/auth.provider.ts"],"sourcesContent":[null,null,null,null,null,null,null],"names":["afterBundlePath","resolve","__filename","fileURLToPath","document","require","pathToFileURL","href","_documentCurrentScript","tagName","toUpperCase","src","URL","baseURI","beforeBundlePath","PP_DEV_PACKAGE_DIR","existsSync","PP_DEV_CLIENT_ENTRY","version","name","JSON","parse","readFileSync","toString","VERSION","PACKAGE_NAME","DEFAULT_LEVEL","current","shared","active","level","logger","createViteLogger","createLogger","undefined","info","msg","options","warn","warnOnce","error","clearScreen","type","hasErrorLogged","hasWarned","value","colors","createColors","normalizeRelativeOutputPath","relativePath","optionName","includes","path","posix","isAbsolute","win32","root","Error","normalized","normalize","replace","startsWith","createDefaultZipFileName","appName","DEV_PANEL_POSITIONS","MAX_TIMER_DELAY_MS","validatePPDevConfig","config","templateName","miMode","mi","mode","appType","app","apiVersion","miUrl","url","process","env","MI_BACKEND_URL","maxBackups","sync","Number","isInteger","stringify","buildTimeoutMs","include","console","id","devPanel","position","join","allowedHosts","server","Array","isArray","every","host","trim","normalizePPDevConfig","proxy","build","inspector","users","miHudLess","integrateMiTopBar","addSharedComponentsScripts","addRootElement","templateLess","resolvedName","defaultVersionFileTemplate","distZip","zipCfg","zip","versionPlugin","outFileName","outDir","fileName","inDir","vfCfg","versionFile","imageOptimizer","versionFileTemplate","enabled","fileNameTemplate","imgCfg","imageOptimisations","backendBaseURL","appId","enableProxyCache","cache","proxyCacheTTL","cacheTtl","disableSSLValidation","tls","allowSelfSigned","syncBackupsDir","backupsDir","syncMaxBackups","syncBuildTimeoutMs","v7Features","personalAccessToken","token","MI_ACCESS_TOKEN","inspectorEnabled","inspectorMaxMemory","maxMemory","inspectorCaptureLimit","captureLimit","devPanelPosition","devPanelHidden","hidden","devPanelAutoHide","autoHide","persistUsers","persist","map","toLowerCase","SAFE_METHODS","Set","exactAllowedHosts","filter","crossOriginReason","req","origin","headers","originUrl","hostname","endsWith","test","requestHost","scheme","normalizeHost","protocol","fetchSite","has","method","AuthProvider","state","isAuthenticated","isRedirected","listeners","getState","this","setAuthenticated","authenticated","notifyListeners","setRedirected","redirected","updateState","updates","reset","subscribe","listener","add","delete","forEach","stack","message","String","authProvider","res","next","reason","status","json","named","trimmed","end","indexOf","isIP","slice","ip","readHostHeader","some","allowed","matchesAllowedHost","directory","safeRelativePath","resolvedDirectory","resolvedFile","split","relativeToDirectory","relative","sep","projectRoot"],"mappings":"6RAIMA,EAAkBC,EAAAA,QAEC,oBAAfC,YAA8BA,YAAeC,EAAAA,cAAc,oBAAAC,SAAAC,QAAA,OAAAC,cAAAJ,YAAAK,KAAAC,GAAA,WAAAA,EAAAC,QAAAC,eAAAF,EAAAG,KAAA,IAAAC,IAAA,4BAAAR,SAAAS,SAAAN,MACnE,YAGIO,EAAmBb,EAAAA,QAEA,oBAAfC,YAA8BA,YAAeC,EAAAA,cAAc,oBAAAC,SAAAC,QAAA,OAAAC,cAAAJ,YAAAK,KAAAC,GAAA,WAAAA,EAAAC,QAAAC,eAAAF,EAAAG,KAAA,IAAAC,IAAA,4BAAAR,SAAAS,SAAAN,MACnE,SAGWQ,EAAqBC,EAAAA,WAAWf,UAAQD,EAAiB,iBAClEA,EACAc,EAESG,EAAsBhB,EAAAA,QAAQc,EAAoB,0BAEzDG,QAAEA,EAAOC,KAAEA,GAASC,KAAKC,MAAMC,EAAAA,aAAarB,EAAAA,QAAQc,EAAoB,iBAAiBQ,YAElFC,EAAUN,EACVO,EAAeN,ECvBtBO,EAA0B,OAEhC,IAAIC,EACAC,EAEJ,SAASC,IAGP,OAFAF,IAAY,CAAEG,MAAOJ,EAAeK,OAAQC,EAAAA,aAAiBN,IAEtDC,EAAQI,MACjB,CAUM,SAAUE,EAAaH,GAoB3B,YAnBcI,IAAVJ,GAAuBA,IAAUH,GAASG,QAC5CH,EAAU,CAAEG,QAAOC,OAAQC,EAAAA,aAAiBF,KAG9CF,IAAW,CACTO,KAAM,CAACC,EAAKC,IAAYR,IAASM,KAAKC,EAAKC,GAC3CC,KAAM,CAACF,EAAKC,IAAYR,IAASS,KAAKF,EAAKC,GAC3CE,SAAU,CAACH,EAAKC,IAAYR,IAASU,SAASH,EAAKC,GACnDG,MAAO,CAACJ,EAAKC,IAAYR,IAASW,MAAMJ,EAAKC,GAC7CI,YAAcC,GAASb,IAASY,YAAYC,GAC5CC,eAAiBH,GAAUX,IAASc,eAAeH,GACnD,aAAII,GACF,OAAOf,IAASe,SAClB,EACA,aAAIA,CAAUC,GACZhB,IAASe,UAAYC,CACvB,GAGKjB,CACT,CCxCO,MAAMkB,EAASC,EAAAA,eCKhB,SAAUC,EAA4BC,EAAsBC,GAChE,IACGD,GACDA,EAAaE,SAAS,OACtBC,EAAKC,MAAMC,WAAWL,IACtBG,EAAKG,MAAMD,WAAWL,IACtBG,EAAKG,MAAMlC,MAAM4B,GAAcO,KAE/B,MAAM,IAAIC,MAAM,YAAYP,0DAG9B,MAAMQ,EAAaN,EAAKC,MAAMM,UAAUV,EAAaW,QAAQ,MAAO,MAEpE,GAAmB,MAAfF,GAAqC,OAAfA,GAAuBA,EAAWG,WAAW,OACrE,MAAM,IAAIJ,MAAM,YAAYP,4CAG9B,OAAOQ,CACT,CAEM,SAAUI,EAAyBC,GAGvC,OAAOf,EAFU,GAAGe,EAAQH,QAAQ,KAAM,IAAIA,QAAQ,UAAW,WAEpB,+BAC/C,CCkKA,MAAMI,EAAmD,CAAC,WAAY,YAAa,cAAe,gBAG5FC,EAAqB,WAQrB,SAAUC,EAAoBC,EAAqBC,GACvD,MAAMC,EAASF,EAAOG,IAAIC,MAAQ,aAC5BC,EAAUL,EAAOM,KAAK/B,MAAQ,WAC9BgC,EAAaP,EAAOG,IAAII,YAAc,EACtCC,EAAQR,EAAOG,IAAIM,KAAOC,QAAQC,IAAIC,eAE5C,KAAMZ,EAAOM,KAAKtD,MAAQiD,GACxB,MAAM,IAAIX,MAAM,4DAGlB,MAAMuB,EAAab,EAAOc,MAAMD,WAEhC,QAAmB9C,IAAf8C,IAA2C,IAAfA,KAA0BE,OAAOC,UAAUH,IAAeA,GAAc,GACtG,MAAM,IAAIvB,MACR,qGAAqGrC,KAAKgE,UAAUJ,MAIxH,MAAMK,EAAiBlB,EAAOc,MAAMI,eAIpC,QACqBnD,IAAnBmD,KACEH,OAAOC,UAAUE,IAAmBA,EAAiB,GAAKA,GAAkBpB,GAE9E,MAAM,IAAIR,MACR,qGAAgHrC,KAAKgE,UAAUC,MAInI,GAAIlB,EAAOG,IAAIgB,SAAsB,eAAXjB,EAExB,MADAkB,QAAQjD,KAAK,kEACP,IAAImB,MAAM,2DAGlB,IAAKkB,EAAO,CACV,GAAe,cAAXN,GAAsC,aAAZG,EAC5B,MAAM,IAAIf,MAAM,qFAGH,eAAXY,GAAuC,SAAZG,GAC7Be,QAAQjD,KAAK,2EAEjB,CAEA,GAAgB,aAAZkC,IAA2BL,EAAOM,KAAKe,GACzC,MAAM,IAAI/B,MAAM,2DAKlB,GAFsC,SAAZe,GAAsBG,IAAqB,eAAXN,GAA2BK,GAAc,KAEzEP,EAAOM,KAAKe,GACpC,MAAM,IAAI/B,MAAM,oFAGlB,QAAkCvB,IAA9BiC,EAAOsB,UAAUC,WAA2B1B,EAAoBb,SAASgB,EAAOsB,SAASC,UAC3F,MAAM,IAAIjC,MAAM,8CAA8CO,EAAoB2B,KAAK,SAGzF,MAAMC,EAAwBzB,EAAO0B,QAAQD,aAE7C,UACmB1D,IAAjB0D,IACiB,IAAjBA,GACEE,MAAMC,QAAQH,IAAiBA,EAAaI,MAAOC,GAAyB,iBAATA,GAAqC,KAAhBA,EAAKC,SAE/F,MAAM,IAAIzC,MACR,0EAA0ErC,KAAKgE,UAAUQ,KAG/F,CAIM,SAAUO,EACdhC,EACAC,GAEA,MAAME,GACJA,EAAK,CAAA,EAAEG,IACPA,EAAM,CAAA,EAAE2B,MACRA,EAAQ,CAAA,EAAEC,MACVA,EAAQ,GAAEpB,KACVA,EAAO,CAAA,EAAEqB,UACTA,EAAY,GAAEb,SACdA,EAAW,CAAA,EAAEc,MACbA,EAAQ,GAAEV,OACVA,EAAS,CAAA,GACP1B,EAEEE,EAASC,EAAGC,MAAQ,aACpBC,EAAUC,EAAI/B,MAAQ,WACtBgC,EAAaJ,EAAGI,YAAc,EAE9B8B,EAAuB,eAAXnC,EAElB,IAAIoC,GAAqE,EAEtD,YAAfnC,EAAGgB,QACLmB,GAAoB,EACI,sBAAfnC,EAAGgB,UACZmB,EAAoB,CAAEC,4BAA4B,EAAMC,gBAAgB,IAG1E,MAAMC,EAA2B,SAAZpC,EAEfqC,EAAepC,EAAItD,MAAQiD,EAEjC,IAAKyC,EACH,MAAM,IAAIpD,MAAM,4DAGlB,MAAMqD,EAA6B,+CAEnC,IAAIC,EACJ,MAAMC,EAASX,EAAMY,IAiBrB,IAAIC,EAdFH,GADa,IAAXC,KAEkB,IAAXA,QAA8B9E,IAAX8E,EAClB,CAAEG,YAAarD,EAAyB+C,GAAeO,OAAQ,YAE/D,CACRD,YAAanE,EACXgE,EAAOK,UAAYvD,EAAyB+C,GAC5C,sBAEFO,OAAQJ,EAAOI,QAAU,cACrBJ,EAAOM,MAAQ,CAAEA,MAAON,EAAOM,OAAU,KAKjD,MAAMC,EAAQlB,EAAMmB,YAgBpB,IAAIC,EAbFP,GADY,IAAVK,KAEiB,IAAVA,QAA4BrF,IAAVqF,EACX,CAAEG,oBAAqBZ,EAA4Ba,SAAS,GAE5D,CACdD,oBAAqB1E,EACnBuE,EAAMK,kBAAoBd,EAC1B,sCAEFa,QAASJ,EAAMI,UAAW,IAK9B,MAAME,EAASxB,EAAMyB,mBAUrB,OAPEL,GADa,IAAXI,KAEkB,IAAXA,QAA8B3F,IAAX2F,EACX,CAAA,EAEAA,GAGZ,CACLzD,aAAcyC,EACdkB,eAAgBzD,EAAGM,KAAOC,QAAQC,IAAIC,eACtCiD,MAAOvD,EAAIe,GACXoB,eACAJ,YACAC,oBACAwB,iBAAkB7B,EAAM8B,QAAS,EACjCC,cAAe/B,EAAMgC,UAAY,IACjCC,qBAAsBjC,EAAMkC,KAAKC,kBAAmB,EACpDd,iBACAL,OAAQf,EAAMe,QAAU,OACxBL,UACAG,gBACAsB,eAAgBvD,EAAKwD,YAAc,UACnCC,eAAgBzD,EAAKD,WACrB2D,mBAAoB1D,EAAKI,eACzBuD,WAAYlE,GAAc,EAC1BmE,oBAAqBvE,EAAGwE,OAASjE,QAAQC,IAAIiE,gBAC7CC,iBAAkB1C,EAAUqB,UAAW,EACvCsB,mBAAoB3C,EAAU4C,WAAa,WAC3CC,sBAAuB7C,EAAU8C,cAAgB,SACjDC,iBAAkB5D,EAASC,UAAY,eACvC4D,eAAgB7D,EAAS8D,SAAU,EACnCC,iBAAkB/D,EAASgE,WAAY,EACvCC,aAAcnD,EAAMoD,UAAW,EAC/B/D,cAC0B,IAAxBC,EAAOD,eAAgCC,EAAOD,cAAgB,IAAIgE,IAAK3D,GAASA,EAAKC,OAAO2D,eAElG,sFCtYMC,EAAe,IAAIC,IAAI,CAAC,MAAO,OAAQ,YA2EvC,SAAUC,EAAkBpE,GAChC,OAAwB,IAAjBA,EAAwB,GAAKA,EAAaqE,OAAQhE,IAAUA,EAAKpC,WAAW,KACrF,UAwCgBqG,EAAkBC,EAAsBvE,EAA6B,IACnF,MAAMwE,EAASD,EAAIE,QAAQD,OACrBnE,EAAOkE,EAAIE,QAAQpE,KAEzB,GAAsB,iBAAXmE,EAAqB,CAC9B,GAAe,SAAXA,EACF,MAAO,8CAGT,IAAIE,EAEJ,IACEA,EAAY,IAAI1J,IAAIwJ,EACtB,CAAE,MACA,MAAO,sBAAsBA,IAC/B,CAEA,GA3Ca,eAFQG,EA6CDD,EAAUC,WA1C9BA,EAASC,SAAS,eACL,UAAbD,GACA,wBAAwBE,KAAKF,IAwCcP,EAAkBpE,GAAczC,SAASmH,EAAUC,UAC5F,OAAO,KAGT,MAAMG,EAAczE,EA1DxB,SAAuB0E,EAAgB1E,GACrC,IACE,OAAO,IAAIrF,IAAI,GAAG+J,MAAW1E,KAAQA,IACvC,CAAE,MACA,MACF,CACF,CAoD+B2E,CAAcN,EAAUO,SAAU5E,QAAQ/D,EAErE,OAAKwI,GAAeJ,EAAUrE,OAASyE,EAIhC,KAHE,UAAUJ,EAAUF,sCAAsCnE,GAAQ,6BAI7E,CAxDF,IAAyBsE,EA0DvB,MAAMO,EAAYX,EAAIE,QAAQ,kBAE9B,OAAKP,EAAaiB,KAAKZ,EAAIa,QAAU,OAAOtK,gBAAgC,eAAdoK,EAIvD,KAHE,6BAIX,CC5IA,MAAMG,EACIC,MAAmB,CACzBC,iBAAiB,EACjBC,cAAc,GAGRC,UAA6C,IAAItB,IAKzD,QAAAuB,GACE,MAAO,IAAKC,KAAKL,MACnB,CAKA,eAAAC,GACE,OAAOI,KAAKL,MAAMC,eACpB,CAKA,YAAAC,GACE,OAAOG,KAAKL,MAAME,YACpB,CAKA,gBAAAI,CAAiBC,GACfF,KAAKL,MAAMC,gBAAkBM,EAC7BF,KAAKG,iBACP,CAKA,aAAAC,CAAcC,GACZL,KAAKL,MAAME,aAAeQ,EAC1BL,KAAKG,iBACP,CAKA,WAAAG,CAAYC,QACsB5J,IAA5B4J,EAAQX,kBACVI,KAAKL,MAAMC,gBAAkBW,EAAQX,sBAGVjJ,IAAzB4J,EAAQV,eACVG,KAAKL,MAAME,aAAeU,EAAQV,cAGpCG,KAAKG,iBACP,CAKA,KAAAK,GACER,KAAKL,MAAQ,CACXC,iBAAiB,EACjBC,cAAc,GAEhBG,KAAKG,iBACP,CAKA,SAAAM,CAAUC,GAIR,OAHAV,KAAKF,UAAUa,IAAID,GAGZ,KACLV,KAAKF,UAAUc,OAAOF,GAE1B,CAKQ,eAAAP,GACNH,KAAKF,UAAUe,QAASH,IACtB,IACEA,EAASV,KAAKD,WAChB,CAAE,MAAO9I,GAEPP,IAAeO,MACb,iCAAiCA,aAAiBiB,MAASjB,EAAM6J,OAAS7J,EAAM8J,QAAWC,OAAO/J,KAEtG,GAEJ,EAIK,MAAMgK,EAAe,IAAIvB,yENzFA,wCAEU,mCADN,gEAkBD,CACjC,oBACA,qBACA,qBACA,oBACA,qBACA,qBACA,sBACA,mBACA,oBACA,oBACA,mBACA,oBACA,oBACA,iEAhBgD,+DAPT,+LKyHnC,SAA4BrF,EAA6B,IAC7D,MAAO,CAACuE,EAAKsC,EAAKC,KAChB,MAAMC,EAASzC,EAAkBC,EAAKvE,GAEjC+G,EAMLF,EAAIG,OAAO,KAAKC,KAAK,CAAErK,MAAO,sBAAsBmK,OALlDD,IAON,wFAxGM,SAAgCzG,GACpC,MAAMsE,EAAWnJ,KAAKgE,WAAWa,GAAQ,IAAIrC,QAAQ,QAAS,KAE9D,MAAO,iCAAiC2G,uCAA8CA,gDACxF,wBAzBM,SAAwBtE,EAA0BL,GACtD,QAAa1D,IAAT+D,IAAuC,IAAjBL,EACxB,OAAO,EAGT,MAAMkH,EAvCR,SAAwB7G,GACtB,MAAM8G,EAAU9G,EAAKC,OAAO2D,cAE5B,GAAIkD,EAAQlJ,WAAW,KAAM,CAC3B,MAAMmJ,EAAMD,EAAQE,QAAQ,KAE5B,OAAOD,EAAM,GAAqC,IAAhCE,OAAKH,EAAQI,MAAM,EAAGH,IAAc,CAAEI,IAAI,QAASlL,CACvE,CAEA,MAAMqI,EAAWwC,EAAQnJ,QAAQ,QAAS,IAE1C,GAAK2G,IAAYA,EAASpH,SAAS,KAInC,OAA0B,IAAnB+J,EAAAA,KAAK3C,GAAkB,CAAE6C,IAAI,GAAS,CAAE7C,WACjD,CAuBgB8C,CAAepH,GAE7B,QAAc/D,IAAV4K,EACF,OAAO,EAGT,GAAI,OAAQA,EACV,OAAO,EAGT,MAAMvC,SAAEA,GAAauC,EAErB,MAAoB,cAAbvC,GAA4BA,EAASC,SAAS,eAjCvD,SAA4BD,EAAkB3E,GAC5C,OAAOA,EAAa0H,KACjBC,GACCA,IAAYhD,GACXgD,EAAQ1J,WAAW,OAAS0J,EAAQJ,MAAM,KAAO5C,GAAYA,EAASC,SAAS+C,IAEtF,CA2BwEC,CAAmBjD,EAAU3E,EACrG,oIFxBsC6H,EAAmBpG,EAAkBnE,GACzE,MAAMwK,EAAmB1K,EAA4BqE,EAAUnE,GACzDyK,EAAoBvK,EAAKnD,QAAQwN,GACjCG,EAAexK,EAAKnD,QAAQ0N,KAAsBD,EAAiBG,MAAM,MACzEC,EAAsB1K,EAAK2K,SAASJ,EAAmBC,GAE7D,GAC0B,OAAxBE,GACAA,EAAoBjK,WAAW,KAAKT,EAAK4K,QACzC5K,EAAKE,WAAWwK,GAEhB,MAAM,IAAIrK,MAAM,YAAYP,+CAG9B,OAAO0K,CACT,uCAnBoCK,EAAqB7G,EAAgBE,GACvE,OAAOlE,EAAKnD,QAAQgO,EAAa3G,GAASF,EAC5C"}