@mudlet/mudlet-web 0.5.0 → 1.0.0

package/dist-lib/vault/vaultAccess.d.ts

@@ -16,7 +16,7 @@
  * the callers render nothing.
  */
 import type { ComponentType } from 'react';
-import type { CredentialVault, VaultSnapshot } from './CredentialVault';
+import type { CredentialVault, VaultSignIn, VaultSnapshot } from './CredentialVault';
 /** Props of the vault's modal. Declared here, not in the component, so this
  *  module can describe the UI it hands out without importing it. */
 export interface VaultUIProps {
@@ -54,5 +54,27 @@ export declare function vaultPassword(connectionId: string): string | undefined;
 /** Whether this profile has a stored password — true even while locked, which
  *  is what tells the app an unlock is worth offering. */
 export declare function vaultHasEntry(connectionId: string): boolean;
-/** Whether opening this profile should ask for an unlock first. */
+/** Whether opening this profile should ask for an unlock first — it has a
+ *  saved password or a saved GMCP sign-in token, and the vault is shut. */
 export declare function vaultNeedsUnlock(connectionId: string): boolean;
+/** The profile's saved GMCP `Char.Login` sign-in, or `undefined` when there is
+ *  no vault, no entry, or the vault is locked. */
+export declare function vaultSignIn(connectionId: string): VaultSignIn | undefined;
+/** Whether a vault could be set up here but none exists yet. False with no
+ *  vault installed (a branded build) or no crypto (an insecure context). */
+export declare function vaultMissing(): boolean;
+/** Whether a vault exists and is locked. */
+export declare function vaultLocked(): boolean;
+/** Whether this profile has a saved sign-in token — true even while locked. */
+export declare function vaultHasSignIn(connectionId: string): boolean;
+/**
+ * Whether a sign-in token handed to us right now would be kept — the honest
+ * answer to GMCP's `token_storage`. With no vault (a branded build, or a player
+ * who never set one up) or a locked one, a token would be thrown away, and the
+ * standard asks the client to say so up front, so the game does not offer the
+ * player a "remember me" that cannot happen.
+ */
+export declare function vaultCanStoreSignIn(): boolean;
+/** Save (or with `null` forget) a profile's sign-in. Resolves `false` when it
+ *  could not — no vault, locked, or the write failed. */
+export declare function saveVaultSignIn(connectionId: string, entry: VaultSignIn | null): Promise<boolean>;

package/dist-lib/vault/vaultHelpTopic.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The manual page for the credential vault.
+ *
+ * It lives here rather than in `ui/helpTopics.ts` for the same reason the vault
+ * itself does: a branded build ships for one game, has no vault, and must not
+ * carry a help topic explaining a feature its players cannot find. Registered
+ * from `main.tsx` at boot — the standalone app's entry, never the library's.
+ */
+export declare function installVaultHelpTopic(): void;

package/dist-lib/vault/vaultRecord.d.ts

@@ -14,7 +14,7 @@
  * with a profile export.
  */
 import type { Ciphertext } from './vaultCrypto';
-export declare const VAULT_STORAGE_KEY = "mudix_vault_v1";
+export declare const VAULT_STORAGE_KEY = "mudlet_vault_v1";
 interface UnlockerBase {
     /** Stable local id, so the manage UI can remove one unambiguously. */
     id: string;
@@ -51,6 +51,38 @@ export interface VaultRecord {
     /** AES-GCM under the master key over `Record<connectionId, password>`.
      *  `null` before the first secret is stored. */
     payload: Ciphertext | null;
+    /** Profiles holding a saved GMCP `Char.Login` sign-in token (see
+     *  {@link VaultSignIn}). Plaintext for the same reason as `entryIds`: a
+     *  locked vault has to be able to say a profile has something worth
+     *  unlocking for. Absent in a record written before sign-ins existed. */
+    signInIds?: string[];
+    /** AES-GCM under the master key over `Record<connectionId, VaultSignIn>`.
+     *  A field of its own rather than more keys in `payload`, so a build from
+     *  before sign-ins existed still reads its passwords unchanged, and carries
+     *  this across its own writes untouched (it spreads the record). */
+    signInPayload?: Ciphertext | null;
+}
+/**
+ * A saved GMCP `Char.Login` v2 sign-in: the reconnect token a game issued with
+ * `Char.Login.Token`, the account it names, and what is needed to replay it
+ * safely — or to resume the same provider once it stops working.
+ *
+ * Mudlet keeps the same entry in the OS keychain (`GMCPAuthenticator`'s
+ * metadata + token keys). The token is a bearer secret — it signs the account
+ * in without a password — so it lives encrypted here or not at all.
+ */
+export interface VaultSignIn {
+    /** The account the token was issued for; `Char.Login.Reconnect` names it. */
+    account: string;
+    /** Provider id (`discord`, `google`, …) learned from `Char.Login.URL`, so a
+     *  dead token can turn into a resume of that provider's sign-in. */
+    provider?: string;
+    /** The bearer token. Absent in a resume hint left behind by a dead one. */
+    token?: string;
+    /** The token may only be replayed over an encrypted game connection — the
+     *  issuing server's requirement, stored because the connection that set it
+     *  is long gone by replay time. Missing reads as true, never widening. */
+    secureOnly?: boolean;
 }
 /** Parse defensively — a corrupt record must degrade to "no vault", never to a
  *  crash on boot that locks the user out of the app as well as the vault. */

package/dist-lib/vfs-sw.js

@@ -1,26 +1,233 @@
-// Service worker that serves ProfileVFS-backed assets at /__vfs/<connectionId>/<path>.
-// The page is the source of truth for VFS contents (the SW can't share folder
-// handles or always-open the same IDB store), so each request round-trips to
-// the client via MessageChannel.
+// The Mudlet Web service worker. Two jobs that share nothing but this file:
+//
+//  1. ProfileVFS-backed assets at /__vfs/<connectionId>/<path>. The page is the
+//     source of truth for VFS contents (the SW can't share folder handles or
+//     always-open the same IDB store), so each request round-trips to the client
+//     via MessageChannel.
+//
+//  2. The app shell — the built HTML, JS, CSS and WASM — cached so an installed
+//     Mudlet Web opens offline instead of the browser's error page. There is no
+//     game to play without a network, but profiles, scripts, triggers, maps and
+//     logs all live in browser storage, and reaching them shouldn't need one.
+//     The manifest has advertised `display: standalone` since day one; this is
+//     what backs the promise (issue #71).
 
-const CACHE_NAME = 'mudix-vfs-v1';
+const CACHE_NAME = 'mudlet-vfs-v1';
+const APP_CACHE = 'mudlet-app-v1';
 // Scope path always ends with '/'. On a root-served deploy this is '/'; on
 // GitHub Pages or any subpath deploy it's '/<repo>/'. The intercept prefix is
 // '<scope>__vfs/' so SW-controlled URLs stay inside scope.
 const SCOPE_PATH = new URL(self.registration.scope).pathname;
 const PREFIX = `${SCOPE_PATH}__vfs/`;
+// The one entry every navigation resolves to. Deep links (?profile=<id>) must
+// not each earn a cache entry of their own, and any of them is served by this
+// same document.
+const SHELL_URL = SCOPE_PATH;
+// Where the build id of the cached generation is kept — inside the cache it
+// describes, so it survives the SW being killed and restarted without a second
+// storage API. `__`-prefixed like `__vfs/`, which no real asset path uses.
+const BUILD_KEY = `${SCOPE_PATH}__app-build`;
 const READ_TIMEOUT_MS = 5000;
+// Whether this registration is allowed to cache the app at all. Set from the
+// script URL by the page (`vfs-sw.js?app-shell=1`), which only a built app asks
+// for — a dev server has no content-hashed assets to cache, and caching the
+// files it does serve under fixed names is cost with no offline to show for it.
+// It has to be known here, at evaluation time, because the first fetch event can
+// arrive long before any message from the page.
+const APP_SHELL = new URL(self.location.href).searchParams.get('app-shell') === '1';
 
-self.addEventListener('install', () => self.skipWaiting());
-self.addEventListener('activate', (e) => e.waitUntil(self.clients.claim()));
+// What may be cached as part of the app. Deliberately narrow rather than
+// "anything same-origin": it admits Vite's content-hashed output and the static
+// files index.html names, and nothing else. That is also what keeps `yarn dev`
+// honest — a dev server serves modules from /src/, /@vite/ and /node_modules/,
+// none of which match, so hot reload never races a cached copy.
+const HASHED_ASSET = /\/assets\/[^/]+-[A-Za-z0-9_-]{8,}\.[^/]+$/;
+// The handful of app files that keep a fixed name: the icons and manifest
+// index.html points at, and the WASM the plugin emits at the scope root
+// (libpcre2.wasm) rather than into assets/.
+const STATIC_FILE = /\/(?:manifest\.webmanifest|icon[a-z0-9-]*\.(?:svg|png)|favicon\.ico|[^/]+\.wasm)$/;
+
+// Every app-cache lookup ignores Vary, and it is not an optimisation — without
+// it the app does not load offline at all. Static hosts answer these files with
+// `Vary: Origin` (vite preview and GitHub Pages both do), and Vite's built HTML
+// asks for its bundle with `crossorigin`, so the parser's request carries an
+// `Origin` header that the copy stored by `cache.add()` does not. Cache matching
+// then declares them different requests, the cache misses, and the fetch behind
+// it fails with the network gone — a blank page, from a cache holding exactly
+// the right bytes under exactly the right URL. None of these responses actually
+// differ by origin: they are static files on one origin.
+const MATCH = { ignoreVary: true };
+
+function inScope(url) {
+    return url.origin === self.location.origin
+        && url.pathname.startsWith(SCOPE_PATH)
+        && !url.pathname.startsWith(PREFIX);
+}
+
+function isAppAsset(url) {
+    return inScope(url) && (HASHED_ASSET.test(url.pathname) || STATIC_FILE.test(url.pathname));
+}
+
+self.addEventListener('install', (event) => {
+    self.skipWaiting();
+    if (APP_SHELL) event.waitUntil(cacheShell());
+});
+
+self.addEventListener('activate', (event) => event.waitUntil((async () => {
+    // Anything left by an older worker of ours under a name this one no longer
+    // uses. Both prefixes: these caches were named `mudlet-*` before the storage
+    // rename, and an old worker's leftovers should be reclaimed rather than left
+    // to sit against the origin's quota forever. Scoped to our own prefixes
+    // rather than "every cache on the
+    // origin": a branded build embeds this worker in somebody else's site, and
+    // their caches are none of our business.
+    const names = await caches.keys();
+    await Promise.all(names
+        .filter((n) => (n.startsWith('mudlet-') || n.startsWith('mudix-'))
+            && n !== CACHE_NAME && n !== APP_CACHE)
+        .map((n) => caches.delete(n)));
+    await self.clients.claim();
+})()));
 
 self.addEventListener('fetch', (event) => {
-    const url = new URL(event.request.url);
+    const request = event.request;
+    if (request.method !== 'GET') return;
+    const url = new URL(request.url);
     if (url.origin !== self.location.origin) return;
-    if (!url.pathname.startsWith(PREFIX)) return;
-    event.respondWith(handle(event, url));
+    if (url.pathname.startsWith(PREFIX)) {
+        event.respondWith(handle(event, url));
+        return;
+    }
+    if (!APP_SHELL) return;
+    // Navigations revalidate against the server, so a deploy is picked up on the
+    // next load rather than whenever the cache happens to turn over; the cached
+    // shell is strictly the offline answer. See shellFirst for why "network
+    // first" is not enough on its own here.
+    if (request.mode === 'navigate' && url.pathname.startsWith(SCOPE_PATH)) {
+        event.respondWith(shellFirst(request));
+        return;
+    }
+    if (!inScope(url)) return;
+    // Hashed filenames are immutable by construction: a changed file is a
+    // changed URL, so a hit is never stale and revalidating one would be a
+    // round-trip spent to be told nothing.
+    if (HASHED_ASSET.test(url.pathname)) event.respondWith(cacheFirst(request));
+    // The fixed-name files can change under the same URL, so they are answered
+    // from the cache and refreshed behind it — offline-proof without ever
+    // pinning a stale icon or an old libpcre2.wasm to a dev server.
+    else if (STATIC_FILE.test(url.pathname)) event.respondWith(staleWhileRevalidate(request));
 });
 
+async function cacheShell() {
+    try {
+        const cache = await caches.open(APP_CACHE);
+        // `reload` so an install triggered by a reload of a stale page doesn't
+        // seed the cache from the HTTP cache's copy of the old document.
+        await cache.put(SHELL_URL, await fetch(new Request(SHELL_URL, { cache: 'reload' })));
+    } catch {
+        // Installed while offline, or the shell 404s under this scope. The first
+        // successful navigation fills it in.
+    }
+}
+
+async function shellFirst(request) {
+    const cache = await caches.open(APP_CACHE);
+    try {
+        // Revalidate rather than `fetch(request)`. A navigation request carries
+        // cache mode `default`, so the plain form is answered from the browser
+        // HTTP cache — and GitHub Pages stamps every file it serves, index.html
+        // included, with `max-age=600`. That turned this "network first" branch
+        // into "ten-minute-old document first": the shell it returned could name
+        // content-hashed assets that the deploy had already deleted, so the entry
+        // module 404'd and the page came up blank. `no-cache` means revalidate,
+        // not refetch — the usual answer is a 304 on a 4KB document — and a
+        // server that cannot be reached still throws, so the offline path below
+        // is unchanged.
+        const response = await fetch(new Request(request, { cache: 'no-cache' }));
+        if (response.ok && response.type === 'basic') {
+            cache.put(SHELL_URL, response.clone()).catch(() => {});
+        }
+        return response;
+    } catch {
+        return (await cache.match(SHELL_URL, MATCH)) ?? Response.error();
+    }
+}
+
+async function cacheFirst(request) {
+    const cache = await caches.open(APP_CACHE);
+    const hit = await cache.match(request, MATCH);
+    if (hit) return hit;
+    try {
+        const response = await fetch(request);
+        if (response.ok && response.type === 'basic') {
+            cache.put(request, response.clone()).catch(() => {});
+        }
+        return response;
+    } catch {
+        return Response.error();
+    }
+}
+
+async function staleWhileRevalidate(request) {
+    const cache = await caches.open(APP_CACHE);
+    const hit = await cache.match(request, MATCH);
+    const network = fetch(request).then((response) => {
+        if (response.ok && response.type === 'basic') {
+            cache.put(request, response.clone()).catch(() => {});
+        }
+        return response;
+    });
+    if (hit) {
+        // Let the refresh finish after the response has gone out.
+        network.catch(() => {});
+        return hit;
+    }
+    try {
+        return await network;
+    } catch {
+        return Response.error();
+    }
+}
+
+/**
+ * Cache everything the page has already loaded, on the page's say-so.
+ *
+ * A first visit is not controlled by the worker until it claims, by which time
+ * the bundle has been fetched uncached — so without this, offline would only
+ * work from the *second* visit. The page sends the resource list it actually
+ * loaded (chunks and WASM included), which is more than this file could guess.
+ * Chunks loaded lazily later in an uncontrolled first session are the one gap,
+ * and they are picked up by `cacheFirst` on the next visit.
+ */
+async function precacheApp({ build, urls }) {
+    let cache = await caches.open(APP_CACHE);
+    const wanted = (Array.isArray(urls) ? urls : []).filter((raw) => {
+        try { return isAppAsset(new URL(raw, self.location.href)); } catch { return false; }
+    });
+    // A deploy renames every hashed asset, so the previous generation's entries
+    // are unreachable dead weight — drop the lot rather than grow forever.
+    // Keyed off the *app's* build id, not a constant in this file: this file
+    // changes about once a year, so a version bumped here would never fire.
+    //
+    // Only ever on a list with something in it. An empty one means the page
+    // could not enumerate what it loaded, and emptying a working cache on the
+    // strength of that would leave the app less able to open offline than
+    // before, which is the opposite of the point.
+    const stamped = await cache.match(BUILD_KEY, MATCH);
+    if (wanted.length > 0 && (stamped ? await stamped.text() : null) !== build) {
+        await caches.delete(APP_CACHE);
+        cache = await caches.open(APP_CACHE);
+        await cache.put(BUILD_KEY, new Response(build));
+        await cacheShell();
+    }
+    await Promise.all(wanted.map(async (url) => {
+        if (await cache.match(url, MATCH)) return;
+        // One asset that has since 404'd must not take the rest with it, which
+        // is what cache.addAll() would do.
+        try { await cache.add(url); } catch { /* keep going */ }
+    }));
+}
+
 async function handle(event, url) {
     const rest = url.pathname.slice(PREFIX.length).split('/').filter(Boolean);
     if (rest.length < 2) return new Response('Bad request', { status: 400 });
@@ -35,7 +242,7 @@ async function handle(event, url) {
     if (!client) {
         // Either there's no app tab loaded (direct URL hit in fresh tab) or
         // the only candidate is the tab currently navigating to this URL.
-        return new Response('No app tab loaded; open mudix first', { status: 503 });
+        return new Response('No app tab loaded; open Mudlet Web first', { status: 503 });
     }
 
     const reply = await ask(client, { type: 'vfs:read', connectionId, path: filePath });
@@ -102,6 +309,8 @@ self.addEventListener('message', (event) => {
     if (!data) return;
     if (data.type === 'vfs:invalidate') {
         event.waitUntil(invalidate(data));
+    } else if (data.type === 'app:precache' && APP_SHELL) {
+        event.waitUntil(precacheApp(data));
     }
 });
 

package/dist-lib/vite.d.ts

@@ -1,2 +1,2 @@
 import type { PluginOption } from 'vite';
-export default function mudix(): PluginOption[];
+export default function mudlet(): PluginOption[];

package/dist-lib/vite.js

@@ -3,6 +3,7 @@ import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 import { nodePolyfills } from 'vite-plugin-node-polyfills';
+import { patchLibpcre2Wasm } from './pcre2Wasm.js';
 /**
  * The `@mudlet/mudlet-web/vite` companion plugin. The library leaves all of its
  * heavyweight dependencies external, so the consumer's Vite processes them —
@@ -19,10 +20,11 @@ import { nodePolyfills } from 'vite-plugin-node-polyfills';
  */
 const require = createRequire(import.meta.url);
 const POLYFILLS = ['buffer', 'stream', 'events', 'util'];
-/** vfs-sw.js ships next to the compiled plugin in dist-lib (consumers) and in
- *  public/ when running from the mudix repo itself (source import). */
-function resolveVfsSwPath() {
-    for (const rel of ['./vfs-sw.js', '../public/vfs-sw.js']) {
+/** The static files the app needs at its root (vfs-sw.js, oauth-callback.html)
+ *  ship next to the compiled plugin in dist-lib (consumers) and in public/ when
+ *  running from the Mudlet Web repo itself (source import). */
+function resolveStaticPath(name) {
+    for (const rel of [`./${name}`, `../public/${name}`]) {
         const p = fileURLToPath(new URL(rel, import.meta.url));
         if (existsSync(p))
             return p;
@@ -31,18 +33,28 @@ function resolveVfsSwPath() {
 }
 /** Serves libpcre2.wasm at the root URL in dev (where emscripten looks for it
  *  when document.currentScript is null) and emits it to the build output.
- *  Resolved from wherever pcre2-wasm-universal lives relative to mudix. */
+ *  Resolved from wherever pcre2-wasm-universal lives relative to mudlet, and
+ *  patched on the way out so `_match` takes an options argument — without it a
+ *  trigger's match-all is quadratic in the line's length (see pcre2Wasm.ts).
+ *  A binary the patch doesn't recognise goes out as shipped: slower, not wrong.
+ *  That fallback is silent here on purpose (a consumer's build shouldn't break
+ *  over speed); tests/triggers/pcreMatchAllLinear.test.ts is what turns a
+ *  pcre2-wasm-universal bump the patch no longer fits into a red CI run. */
 function pcre2WasmPlugin() {
     // The wasm file isn't in the package's exports map — resolve the exported
     // ./libpcre2 entry (dist/libpcre2.js) and take its sibling.
     const wasmPath = join(dirname(require.resolve('pcre2-wasm-universal/libpcre2')), 'libpcre2.wasm');
+    const wasm = () => {
+        const shipped = readFileSync(wasmPath);
+        return patchLibpcre2Wasm(shipped) ?? shipped;
+    };
     return {
-        name: 'mudix:pcre2-wasm',
+        name: 'mudlet:pcre2-wasm',
         configureServer(server) {
             server.middlewares.use((req, res, next) => {
                 if (req.url === '/libpcre2.wasm') {
                     res.setHeader('Content-Type', 'application/wasm');
-                    res.end(readFileSync(wasmPath));
+                    res.end(wasm());
                     return;
                 }
                 next();
@@ -52,80 +64,90 @@ function pcre2WasmPlugin() {
             this.emitFile({
                 type: 'asset',
                 fileName: 'libpcre2.wasm',
-                source: readFileSync(wasmPath),
+                source: wasm(),
             });
         },
     };
 }
-/** Serves/emits the VFS service worker at the site root so
- *  `registerVfsServiceWorker()` (called by MudletWebApp) finds it. Skipped when
- *  the consumer already ships its own copy in public/ — as the standalone
- *  mudix app does. */
-function vfsServiceWorkerPlugin() {
-    const swPath = resolveVfsSwPath();
+/** Serves/emits a static file at the site root. Used for the VFS service
+ *  worker, so `registerVfsServiceWorker()` (called by MudletWebApp) finds it,
+ *  and for `oauth-callback.html`, the redirect target of the client-driven GMCP
+ *  `Char.Login` browser sign-in (see oauthClientFlow.ts). Skipped when the
+ *  consumer already ships its own copy in public/ — as the standalone Mudlet
+ *  Web app does. */
+function rootStaticFilePlugin(name, contentType) {
+    const filePath = resolveStaticPath(name);
     let skip = false;
     return {
-        name: 'mudix:vfs-sw',
+        name: `mudlet:static:${name}`,
         configResolved(config) {
-            skip = !swPath || (!!config.publicDir && existsSync(join(config.publicDir, 'vfs-sw.js')));
+            skip = !filePath || (!!config.publicDir && existsSync(join(config.publicDir, name)));
         },
         configureServer(server) {
             server.middlewares.use((req, res, next) => {
-                if (!skip && swPath && req.url?.split('?')[0] === '/vfs-sw.js') {
-                    res.setHeader('Content-Type', 'text/javascript');
-                    res.end(readFileSync(swPath));
+                if (!skip && filePath && req.url?.split('?')[0] === `/${name}`) {
+                    res.setHeader('Content-Type', contentType);
+                    res.end(readFileSync(filePath));
                     return;
                 }
                 next();
             });
         },
         generateBundle() {
-            if (skip || !swPath)
+            if (skip || !filePath)
                 return;
             this.emitFile({
                 type: 'asset',
-                fileName: 'vfs-sw.js',
-                source: readFileSync(swPath, 'utf8'),
+                fileName: name,
+                source: readFileSync(filePath, 'utf8'),
             });
         },
     };
 }
-export default function mudix() {
+export default function mudlet() {
     return [
         {
-            name: 'mudix:config',
+            name: 'mudlet:config',
             config: () => ({
                 resolve: {
-                    // Exactly one React instance, always. `mudlet-map-editor`
-                    // declares react/react-dom as plain *dependencies* (not
-                    // peers), so the moment its range outruns the range the
-                    // app resolved, the package manager nests a second copy
-                    // under the editor. The editor's `App` is then rendered by
-                    // mudix's React while its hooks come from the nested one,
-                    // whose dispatcher is null — "Invalid hook call", and with
-                    // no error boundary above the lazy boundary the throw
+                    // Exactly one instance of each, always. `mudlet-map-editor`
+                    // used to declare these as plain *dependencies*, so the
+                    // moment its range outran the range the app resolved, the
+                    // package manager nested a second copy under the editor.
+                    // The editor's `App` was then rendered by Mudlet Web's React
+                    // while its hooks came from the nested one, whose
+                    // dispatcher is null — "Invalid hook call", and with no
+                    // error boundary above the lazy boundary the throw
                     // unmounts the whole root, so opening the map editor
                     // blanked the entire UI in dev and in production alike.
-                    // Deduping is the structural fix: it survives the next
-                    // version skew, and consumers of the library (which
-                    // externalizes react) get it through this plugin too.
-                    dedupe: ['react', 'react-dom'],
+                    // Editor 2.0.0 makes all of them peer dependencies, which
+                    // is the fix at the source; this stays as the backstop that
+                    // does not depend on the package manager hoisting correctly
+                    // — and consumers of the library (which externalizes react)
+                    // get it through this plugin too. Konva and the renderer
+                    // are here for the same reason and not only for symmetry:
+                    // two Konvas split the stage registry, and two renderers
+                    // disagree on scene structure, both silently.
+                    dedupe: ['react', 'react-dom', 'konva', 'mudlet-map-renderer'],
                 },
                 // A Mudlet package archive is a zip, not source. `?url` imports
                 // get away without this (the explicit query short-circuits
                 // import analysis), but `?inline` — which the busted fixtures
                 // use to carry an archive into the VFS — reaches the asset
                 // pipeline and needs the extension declared.
-                assetsInclude: ['**/*.mpackage'],
+                // The map fixtures are plain `.zip` and binary `.dat`, and scoping
+                // those to the fixture tree keeps a bare import of either anywhere
+                // else meaning what it means today.
+                assetsInclude: ['**/*.mpackage', '**/specs/fixtures/**/*.zip', '**/specs/fixtures/**/*.dat'],
                 optimizeDeps: {
-                    // 'mudix': the library entry carries relative `?url` asset
+                    // 'Mudlet Web': the library entry carries relative `?url` asset
                     // imports (external in the lib build); the dep optimizer's
                     // scanner treats the query as part of a filesystem path and
-                    // dies on Windows (os error 123). Excluded, mudix is served
+                    // dies on Windows (os error 123). Excluded, Mudlet Web is served
                     // through Vite's transform pipeline in dev, where `?url`
-                    // works. Harmless in mudix's own repo (not a dep there).
+                    // works. Harmless in Mudlet Web's own repo (not a dep there).
                     exclude: ['pcre2-wasm-universal', '@mudlet/mudlet-web'],
-                    // CJS deps reached from the excluded mudix entry must be
+                    // CJS deps reached from the excluded Mudlet Web entry must be
                     // pre-bundled explicitly (Vite doesn't interop CJS served
                     // raw). Extend this list if dev mode reports "does not
                     // provide an export named ..." for another dependency.
@@ -136,7 +158,7 @@ export default function mudix() {
                     // html-parse-stringify > void-elements) are CJS, and which
                     // of them trips first depends on evaluation order. Listing
                     // the editor pre-bundles the lot in one go — and mirrors
-                    // mudix's own dev server, where the scanner finds the
+                    // Mudlet Web's own dev server, where the scanner finds the
                     // `import('mudlet-map-editor')` in MapEditorModal and
                     // pre-bundles it anyway. Bare package names only, no
                     // subpaths: `mudlet-map-renderer/bigmap` and friends only
@@ -171,6 +193,7 @@ export default function mudix() {
         },
         nodePolyfills({ include: POLYFILLS }),
         pcre2WasmPlugin(),
-        vfsServiceWorkerPlugin(),
+        rootStaticFilePlugin('vfs-sw.js', 'text/javascript'),
+        rootStaticFilePlugin('oauth-callback.html', 'text/html; charset=utf-8'),
     ];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mudlet/mudlet-web",
-  "version": "0.5.0",
+  "version": "1.0.0",
   "type": "module",
   "description": "Mudlet Web — Mudlet in the browser, usable standalone or as a library for branded builds",
   "license": "GPL-2.0-or-later",
@@ -49,7 +49,9 @@
     "busted:failures": "playwright test -c playwright.failures.config.ts",
     "sync:mudlet-specs": "node scripts/sync-mudlet-specs.mjs",
     "sync:mudlet-lua": "node scripts/sync-mudlet-lua.mjs",
-    "sync:mudlet-games": "node scripts/sync-mudlet-games.mjs"
+    "sync:mudlet-games": "node scripts/sync-mudlet-games.mjs",
+    "check:vendored": "node scripts/check-vendored-paths.mjs",
+    "test:e2e:upgrade": "playwright test -c playwright.upgrade.config.ts"
   },
   "dependencies": {
     "@codemirror/autocomplete": "^6.20.1",
@@ -57,25 +59,29 @@
     "@codemirror/lang-json": "^6.0.2",
     "@codemirror/language": "^6.12.3",
     "@codemirror/legacy-modes": "^6.5.2",
-    "@codemirror/state": "^6.6.0",
+    "@codemirror/search": "^6.7.2",
+    "@codemirror/state": "^6.7.4",
     "@codemirror/theme-one-dark": "^6.1.3",
-    "@codemirror/view": "^6.41.1",
+    "@codemirror/view": "^6.43.11",
     "@lezer/highlight": "^1.2.3",
     "@sqlite.org/sqlite-wasm": "^3.53.0-build1",
     "@zenfs/core": "^2.5.6",
     "@zenfs/dom": "^1.2.9",
     "dompurify": "^3.4.14",
     "fflate": "^0.8.2",
+    "i18next": "^26.3.6",
+    "konva": "^10.3.0",
     "lucide-react": "^1.14.0",
     "marked": "^18.0.4",
-    "mudlet-map-binary-reader": "^1.2.0",
-    "mudlet-map-editor": "^1.3.2",
-    "mudlet-map-renderer": "^2.6.1",
+    "mudlet-map-binary-reader": "^1.3.0",
+    "mudlet-map-editor": "^2.0.0",
+    "mudlet-map-renderer": "^3.0.0",
     "pako": "^2.1.0",
     "pcre2-wasm-universal": "^1.0.0",
-    "react": "^19.2.0",
-    "react-dom": "^19.2.0",
-    "vite-plugin-node-polyfills": "^0.26.0",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
+    "react-i18next": "^17.0.11",
+    "vite-plugin-node-polyfills": "^0.28.0",
     "wasmoon-lua5.1": "^1.18.10",
     "zustand": "^5.0.12"
   },
@@ -86,12 +92,14 @@
     "@types/react": "^19.2.0",
     "@types/react-dom": "^19.2.0",
     "@vitejs/plugin-react": "^6.0.1",
-    "happy-dom": "^20.9.0",
+    "happy-dom": "^21.0.4",
     "typescript": "^5.0.0",
-    "vite": "8.0.16",
-    "vitest": "^4.1.7"
+    "vite": "8.1.6",
+    "vitest": "^4.1.12"
   },
   "resolutions": {
-    "dompurify": "^3.4.14"
+    "dompurify": "^3.4.14",
+    "@codemirror/state": "^6.7.4",
+    "@codemirror/view": "^6.43.11"
   }
 }