@multiplatform.one/platform 6.7.0 → 7.1.0

package/src/config/config.ts

@@ -1,3 +1,4 @@
+import { bakedPublicConfig, readRuntimePublicConfig } from "./runtimeConfig";
 import type { IConfig } from "./types";
 
 export class Config implements IConfig {
@@ -7,7 +8,11 @@ export class Config implements IConfig {
 
   private _lookupEnv(key: string): string | undefined {
     if (this._blacklist.has(key)) return undefined;
-    return process?.env?.[key];
+    // `process` is UNDECLARED in the browser, where `process?.env` throws a
+    // ReferenceError rather than short-circuiting — this is why env lookup
+    // could never be the browser's only path to config.
+    if (typeof process === "undefined") return undefined;
+    return process.env?.[key];
   }
 
   private _resolveConfig() {
@@ -29,14 +34,18 @@ export class Config implements IConfig {
   }
 
   constructor(config: Record<string, string | undefined> = {}) {
-    let viteConfig: Record<string, string | undefined> = {};
-    try {
-      // Read public config injected by Vite at build time via VITE_MP_CONFIG
-      const raw = typeof import.meta !== "undefined" && import.meta.env?.VITE_MP_CONFIG;
-      viteConfig = JSON.parse(raw || "{}");
-    } catch {}
     this._config = {
-      ...this._reduceConfig(typeof viteConfig === "object" ? viteConfig : {}),
+      // 1. BUILD time: public config baked into the bundle via VITE_MP_CONFIG.
+      //    Kept first (and kept working) so apps that bake their config in —
+      //    native, GNOME, static web — are unchanged.
+      ...this._reduceConfig(bakedPublicConfig()),
+      // 2. RUNTIME: the public payload the SSR document published into the
+      //    browser (see runtimeConfig.ts). Wins over the bake so a redeployed
+      //    container overrides a stale build-time value, and so an image built
+      //    with an EMPTY build environment can still be configured per
+      //    deployment. `process.env` is not reachable here.
+      ...this._reduceConfig(readRuntimePublicConfig()),
+      // 3. Explicit values handed to the constructor always win.
       ...this._reduceConfig(config),
     };
   }

package/src/config/index.ts

@@ -4,3 +4,4 @@ const config = new Config();
 
 export { config };
 export * from "./config";
+export * from "./runtimeConfig";

package/src/config/runtimeConfig.native.ts

@@ -0,0 +1,84 @@
+/**
+ * Native twin of `runtimeConfig.ts`.
+ *
+ * Identical API, minus `import.meta`: the vxrn/rolldown native bundle is a
+ * CLASSIC script for Hermes, where `import.meta` is a syntax error (the same
+ * reason `config.native.ts` exists as a hand-written twin of `config.ts`).
+ *
+ * Native has no SSR document, so `readRuntimePublicConfig` normally returns
+ * undefined and native keeps resolving through `expo-constants` +
+ * `process.env` exactly as before. The exports are kept so that shared code
+ * importing from `@multiplatform.one/platform` compiles on every target.
+ */
+
+export const runtimePublicConfigKey = "__mp_public_config__";
+export const publicConfigKeysEnvKey = "VITE_MP_PUBLIC_CONFIG_KEYS";
+export const bakedConfigEnvKey = "VITE_MP_CONFIG";
+
+function processEnv(): Record<string, string | undefined> {
+  try {
+    if (typeof process === "undefined") return {};
+    return (process.env || {}) as Record<string, string | undefined>;
+  } catch {
+    return {};
+  }
+}
+
+function parseJson(raw: string | undefined): unknown {
+  if (!raw) return undefined;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return undefined;
+  }
+}
+
+function stringifyValues(source: Record<string, unknown>): Record<string, string> {
+  return Object.entries(source).reduce<Record<string, string>>((acc, [key, value]) => {
+    if (typeof value !== "undefined" && value !== null) acc[key] = String(value);
+    return acc;
+  }, {});
+}
+
+export function publicConfigKeys(): string[] {
+  const parsed = parseJson(processEnv()[publicConfigKeysEnvKey]);
+  if (!Array.isArray(parsed)) return [];
+  return parsed.filter((key): key is string => typeof key === "string" && key.length > 0);
+}
+
+export function bakedPublicConfig(): Record<string, string> {
+  const parsed = parseJson(processEnv()[bakedConfigEnvKey]);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+  return stringifyValues(parsed as Record<string, unknown>);
+}
+
+export function resolvePublicConfig(
+  env: Record<string, string | undefined> = processEnv(),
+): Record<string, string> {
+  const baked = bakedPublicConfig();
+  return publicConfigKeys().reduce<Record<string, string>>((acc, key) => {
+    const value = env[key] ?? baked[key];
+    if (typeof value === "string" && value.length > 0) acc[key] = value;
+    return acc;
+  }, {});
+}
+
+export function readRuntimePublicConfig(): Record<string, string> | undefined {
+  const raw = (globalThis as unknown as Record<string, unknown>)[runtimePublicConfigKey];
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return undefined;
+  return stringifyValues(raw as Record<string, unknown>);
+}
+
+function safeJsonStringify(value: unknown): string {
+  return JSON.stringify(value ?? {})
+    .replace(/</g, "\\u003c")
+    .replace(/>/g, "\\u003e")
+    .replace(/\u2028/g, "\\u2028")
+    .replace(/\u2029/g, "\\u2029");
+}
+
+export function serializeRuntimePublicConfig(
+  config: Record<string, string> = resolvePublicConfig(),
+): string {
+  return `globalThis[${JSON.stringify(runtimePublicConfigKey)}]=${safeJsonStringify(config)};`;
+}

package/src/config/runtimeConfig.spec.ts

@@ -0,0 +1,128 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+  bakedConfigEnvKey,
+  publicConfigKeysEnvKey,
+  readRuntimePublicConfig,
+  resolvePublicConfig,
+  runtimePublicConfigKey,
+  serializeRuntimePublicConfig,
+} from "./runtimeConfig";
+
+function stubAllowlist(keys: string[]) {
+  vi.stubEnv(publicConfigKeysEnvKey, JSON.stringify(keys));
+}
+
+function stubBaked(config: Record<string, string>) {
+  vi.stubEnv(bakedConfigEnvKey, JSON.stringify(config));
+}
+
+function clearRuntimePayload() {
+  delete (globalThis as unknown as Record<string, unknown>)[runtimePublicConfigKey];
+}
+
+afterEach(() => {
+  vi.unstubAllEnvs();
+  clearRuntimePayload();
+});
+
+describe("resolvePublicConfig", () => {
+  it("resolves a public key from the RUNTIME environment, not the build", () => {
+    stubAllowlist(["MARKETPLACE_API_URL"]);
+    expect(
+      resolvePublicConfig({ MARKETPLACE_API_URL: "https://api.marketplace.example.org" }),
+    ).toEqual({
+      MARKETPLACE_API_URL: "https://api.marketplace.example.org",
+    });
+  });
+
+  it("lets the runtime environment override a stale baked value", () => {
+    stubAllowlist(["MARKETPLACE_API_URL"]);
+    stubBaked({ MARKETPLACE_API_URL: "https://stale.example.org" });
+    expect(resolvePublicConfig({ MARKETPLACE_API_URL: "https://fresh.example.org" })).toEqual({
+      MARKETPLACE_API_URL: "https://fresh.example.org",
+    });
+  });
+
+  it("falls back to the baked value when the runtime environment is empty", () => {
+    stubAllowlist(["MARKETPLACE_API_URL"]);
+    stubBaked({ MARKETPLACE_API_URL: "https://baked.example.org" });
+    expect(resolvePublicConfig({})).toEqual({
+      MARKETPLACE_API_URL: "https://baked.example.org",
+    });
+  });
+
+  it("resolves nothing when the build baked no public allowlist", () => {
+    expect(resolvePublicConfig({ MARKETPLACE_API_URL: "https://api.example.org" })).toEqual({});
+  });
+});
+
+describe("public allowlist enforcement", () => {
+  it("never resolves a key that is absent from the build-time public allowlist", () => {
+    stubAllowlist(["MARKETPLACE_API_URL"]);
+    const resolved = resolvePublicConfig({
+      MARKETPLACE_API_URL: "https://api.example.org",
+      SECRET: "hunter2",
+      DATABASE_PASSWORD: "hunter2",
+    });
+    expect(resolved).toEqual({ MARKETPLACE_API_URL: "https://api.example.org" });
+    expect(resolved).not.toHaveProperty("SECRET");
+    expect(resolved).not.toHaveProperty("DATABASE_PASSWORD");
+  });
+
+  it("never serializes a private key into the document payload", () => {
+    stubAllowlist(["MARKETPLACE_API_URL", "FRAPPE_ENABLED"]);
+    const payload = serializeRuntimePublicConfig(
+      resolvePublicConfig({
+        MARKETPLACE_API_URL: "https://api.example.org",
+        FRAPPE_ENABLED: "1",
+        SECRET: "hunter2",
+      }),
+    );
+    expect(payload).toContain("MARKETPLACE_API_URL");
+    expect(payload).toContain("FRAPPE_ENABLED");
+    expect(payload).not.toContain("SECRET");
+    expect(payload).not.toContain("hunter2");
+  });
+});
+
+describe("serializeRuntimePublicConfig", () => {
+  it("assigns the payload to the runtime global key", () => {
+    stubAllowlist(["FRAPPE_ENABLED"]);
+    expect(serializeRuntimePublicConfig(resolvePublicConfig({ FRAPPE_ENABLED: "1" }))).toBe(
+      `globalThis["${runtimePublicConfigKey}"]={"FRAPPE_ENABLED":"1"};`,
+    );
+  });
+
+  it("escapes characters that could break out of the inline script", () => {
+    stubAllowlist(["BASE_URL"]);
+    const payload = serializeRuntimePublicConfig(
+      resolvePublicConfig({ BASE_URL: "</script><script>alert(1)</script>" }),
+    );
+    expect(payload).not.toContain("</script>");
+    expect(payload).toContain("\\u003c");
+  });
+
+  it("emits an empty object rather than throwing when nothing resolves", () => {
+    expect(serializeRuntimePublicConfig({})).toBe(`globalThis["${runtimePublicConfigKey}"]={};`);
+  });
+});
+
+describe("readRuntimePublicConfig", () => {
+  it("reads the payload the SSR document published", () => {
+    (globalThis as unknown as Record<string, unknown>)[runtimePublicConfigKey] = {
+      MARKETPLACE_API_URL: "https://api.example.org",
+    };
+    expect(readRuntimePublicConfig()).toEqual({
+      MARKETPLACE_API_URL: "https://api.example.org",
+    });
+  });
+
+  it("returns undefined when no document published a payload", () => {
+    expect(readRuntimePublicConfig()).toBeUndefined();
+  });
+
+  it("ignores a payload that is not a plain object", () => {
+    (globalThis as unknown as Record<string, unknown>)[runtimePublicConfigKey] = ["nope"];
+    expect(readRuntimePublicConfig()).toBeUndefined();
+  });
+});

package/src/config/runtimeConfig.ts

@@ -0,0 +1,159 @@
+/**
+ * RUNTIME public-config seam: SSR document -> browser.
+ *
+ * Why this exists: `VITE_MP_CONFIG` is resolved by `@multiplatform.one/config`
+ * at BUILD time (createViteConfig sets `process.env.VITE_MP_CONFIG` from the
+ * build environment, and vite bakes it into `import.meta.env`). A container
+ * image built by CI therefore ships whatever the CI job happened to export —
+ * usually nothing — and no amount of runtime container env reaches the
+ * browser, because `Config._lookupEnv` reads `process.env`, which does not
+ * exist there. The measured failure: the marketplace storefront had
+ * MARKETPLACE_API_URL on its container and still rendered "MARKETPLACE_API_URL
+ * is not configured", issuing ZERO catalog requests.
+ *
+ * The fix keeps the image environment-agnostic: the BUILD bakes only the
+ * NAMES of the public keys (`VITE_MP_PUBLIC_CONFIG_KEYS`), and the SSR node
+ * process resolves their VALUES from its own `process.env` at request time and
+ * publishes them into the served document.
+ *
+ * Transport: one inline `<script>` in `<head>` assigning a `globalThis` key —
+ * the SAME mechanism one uses for `__one_server_context__` (see one's
+ * `server/ServerContextScript`), deliberately sitting ALONGSIDE it rather
+ * than being a second, differently-shaped invention.
+ *
+ * Safety: `resolvePublicConfig` walks the BUILD-TIME PUBLIC ALLOWLIST, never
+ * the environment. A key that is not on `config.json`'s `public` list can not
+ * be serialized even if it is present in the SSR process env, so server-only
+ * secrets never reach the document.
+ */
+
+/**
+ * Global key the SSR document assigns the resolved public config to.
+ * Sibling of one's `__one_server_context__`.
+ */
+export const runtimePublicConfigKey = "__mp_public_config__";
+
+/**
+ * Build-time env key carrying the JSON array of PUBLIC config key names
+ * (written by `createViteConfig` in `@multiplatform.one/config/vite`).
+ * Only the NAMES are baked — values stay environment-agnostic.
+ */
+export const publicConfigKeysEnvKey = "VITE_MP_PUBLIC_CONFIG_KEYS";
+
+/**
+ * Build-time env key carrying the JSON object of public config values
+ * resolved from the BUILD environment. Still honored so apps that bake their
+ * config in (native, GNOME, static web) keep working unchanged.
+ */
+export const bakedConfigEnvKey = "VITE_MP_CONFIG";
+
+function importMetaEnv(): Record<string, string | undefined> {
+  try {
+    if (typeof import.meta === "undefined") return {};
+    return (import.meta.env || {}) as Record<string, string | undefined>;
+  } catch {
+    return {};
+  }
+}
+
+function processEnv(): Record<string, string | undefined> {
+  try {
+    // `process` is undefined in the browser; a bare `process?.env` would
+    // still throw ReferenceError on an undeclared identifier.
+    if (typeof process === "undefined") return {};
+    return (process.env || {}) as Record<string, string | undefined>;
+  } catch {
+    return {};
+  }
+}
+
+function readBuildEnv(key: string): string | undefined {
+  return importMetaEnv()[key] ?? processEnv()[key];
+}
+
+function parseJson(raw: string | undefined): unknown {
+  if (!raw) return undefined;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return undefined;
+  }
+}
+
+function stringifyValues(source: Record<string, unknown>): Record<string, string> {
+  return Object.entries(source).reduce<Record<string, string>>((acc, [key, value]) => {
+    if (typeof value !== "undefined" && value !== null) acc[key] = String(value);
+    return acc;
+  }, {});
+}
+
+/**
+ * The PUBLIC key allowlist baked at build time. Empty when the app was not
+ * built through `createViteConfig` (tests, storybook, plain node) — in which
+ * case nothing is publishable and the payload stays empty, which is the safe
+ * direction to fail.
+ */
+export function publicConfigKeys(): string[] {
+  const parsed = parseJson(readBuildEnv(publicConfigKeysEnvKey));
+  if (!Array.isArray(parsed)) return [];
+  return parsed.filter((key): key is string => typeof key === "string" && key.length > 0);
+}
+
+/** Public config values baked into the bundle at BUILD time. */
+export function bakedPublicConfig(): Record<string, string> {
+  const parsed = parseJson(readBuildEnv(bakedConfigEnvKey));
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+  return stringifyValues(parsed as Record<string, unknown>);
+}
+
+/**
+ * Resolve the public config the SSR document should publish.
+ *
+ * Iterates the ALLOWLIST — never the environment — so a private key present
+ * in `env` can not reach the returned object. Runtime env wins over the
+ * build-time bake, so a redeployed container overrides a stale baked value.
+ */
+export function resolvePublicConfig(
+  env: Record<string, string | undefined> = processEnv(),
+): Record<string, string> {
+  const baked = bakedPublicConfig();
+  return publicConfigKeys().reduce<Record<string, string>>((acc, key) => {
+    const value = env[key] ?? baked[key];
+    if (typeof value === "string" && value.length > 0) acc[key] = value;
+    return acc;
+  }, {});
+}
+
+/**
+ * Read the payload the SSR document published. Returns undefined anywhere the
+ * document never ran (native, SSR itself, tests).
+ */
+export function readRuntimePublicConfig(): Record<string, string> | undefined {
+  const raw = (globalThis as unknown as Record<string, unknown>)[runtimePublicConfigKey];
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return undefined;
+  return stringifyValues(raw as Record<string, unknown>);
+}
+
+/**
+ * HTML-safe JSON: an inline `<script>` body must not be able to close its own
+ * tag, and U+2028/U+2029 are line terminators to a JS parser but legal inside
+ * a JSON string.
+ */
+function safeJsonStringify(value: unknown): string {
+  return JSON.stringify(value ?? {})
+    .replace(/</g, "\\u003c")
+    .replace(/>/g, "\\u003e")
+    .replace(/\u2028/g, "\\u2028")
+    .replace(/\u2029/g, "\\u2029");
+}
+
+/**
+ * The inline `<script>` body that publishes the public config to the browser.
+ * Runs during document parse, so it lands before the deferred app bundle
+ * constructs its `Config`.
+ */
+export function serializeRuntimePublicConfig(
+  config: Record<string, string> = resolvePublicConfig(),
+): string {
+  return `globalThis[${JSON.stringify(runtimePublicConfigKey)}]=${safeJsonStringify(config)};`;
+}

package/src/index.ts

@@ -9,6 +9,7 @@ export const {
   isExpo,
   isFirefox,
   isFirefoxExtension,
+  isGnome,
   isIframe,
   isIos,
   isNative,

package/src/platform/index.gnome.spec.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from "vitest";
+import { platform } from "./index.gnome";
+import { platform as webPlatform } from "./index";
+
+describe("the gnome platform entry", () => {
+  it("sets isGnome, which is the whole point of the file existing", () => {
+    expect(platform.isGnome).toBe(true);
+  });
+
+  it('resolves preciseName to "gnome" rather than "native"', () => {
+    expect(platform.preciseName).toBe("gnome");
+  });
+
+  it('resolves broadName to "client"', () => {
+    expect(platform.broadName).toBe("client");
+  });
+
+  it("reports a desktop that is not a browser", () => {
+    expect(platform.isDesktop).toBe(true);
+    expect(platform.isNative).toBe(true);
+    expect(platform.isWeb).toBe(false);
+    expect(platform.isBrowser).toBe(false);
+  });
+
+  it("does not claim a usable window, since GJS's is a polyfill stub", () => {
+    expect(platform.isWindowDefined).toBe(false);
+  });
+
+  it("claims no other platform", () => {
+    expect(platform.isIos).toBe(false);
+    expect(platform.isAndroid).toBe(false);
+    expect(platform.isExpo).toBe(false);
+    expect(platform.isNext).toBe(false);
+    expect(platform.isServer).toBe(false);
+    expect(platform.isWebExtension).toBe(false);
+    expect(platform.isStorybook).toBe(false);
+  });
+
+  it("answers every key the default entry does, so the flag set cannot drift", () => {
+    expect(Object.keys(platform).sort()).toEqual(Object.keys(webPlatform).sort());
+  });
+});

package/src/platform/index.gnome.ts

@@ -0,0 +1,51 @@
+// Platform flags for the GNOME (GTK4 / GJS / libadwaita) target.
+//
+// Resolved the same way `index.ios.ts` and `index.android.ts` are: the
+// bundler picks this file over `index.ts` by extension. Metro does that for
+// `.ios`/`.android` out of the box; on GNOME it is Vite, and the `.gnome.*`
+// entries come ahead of the `.native.*` ones in `resolve.extensions` —
+// `gnomePlatformExtensions` from @multiplatform.one/vite-plugin-gnome, wired
+// into apps/one/vite.config.gnome.ts. Without that registration this file is
+// inert and every consumer sees the base `isGnome: false`.
+//
+// Every value is stated rather than inherited from @tamagui/constants,
+// because those are inferred from `document`/`window` and GJS's window is a
+// polyfill stub — inference would answer questions about a fake DOM instead
+// of about GTK.
+
+import { type Platform, getBroadName, getPreciseName, platformBase } from "./platformBase";
+
+export const platform: Platform = {
+  ...platformBase,
+  isGnome: true,
+  // GTK is a desktop, and it is not a browser — so `isNative` too, which is
+  // exactly why Gnome sits ahead of Native in the precision order.
+  isDesktop: true,
+  isNative: true,
+  isClient: true,
+  isServer: false,
+  isWeb: false,
+  isBrowser: false,
+  isChrome: false,
+  isFirefox: false,
+  isIframe: false,
+  isStorybook: false,
+  isWebExtension: false,
+  isChromeExtension: false,
+  isFirefoxExtension: false,
+  isExpo: false,
+  isNext: false,
+  // A GTK pointer desktop. Touch exists on some hardware but is not the
+  // interaction model the layout should assume.
+  isTouchable: false,
+  isWebTouchable: false,
+  // There is a `window` under the react-gnome polyfills, but it is a stub
+  // with no layout, no events and no document. Callers branching on this are
+  // asking "can I touch the DOM", and the answer is no.
+  isWindowDefined: false,
+};
+platform.preciseName = getPreciseName(platform);
+platform.broadName = getBroadName(platform);
+
+export type { Platform };
+export type { PlatformName } from "./platformBase";

package/src/platform/platformBase.spec.ts

@@ -12,6 +12,7 @@ function makePlatform(overrides: Partial<Platform> = {}): Platform {
     isExpo: false,
     isFirefox: false,
     isFirefoxExtension: false,
+    isGnome: false,
     isIframe: false,
     isIos: false,
     isNative: false,
@@ -45,6 +46,12 @@ describe("getPreciseName", () => {
     expect(getPreciseName(makePlatform({ isAndroid: true, isNative: true }))).toBe("android");
   });
 
+  it('returns "gnome" for the GTK desktop target', () => {
+    expect(getPreciseName(makePlatform({ isGnome: true, isDesktop: true, isNative: true }))).toBe(
+      "gnome",
+    );
+  });
+
   it('returns "tauri" for desktop Tauri apps', () => {
     expect(getPreciseName(makePlatform({ isTauri: true, isDesktop: true, isWeb: true }))).toBe(
       "tauri",

package/src/platform/platformBase.ts

@@ -17,7 +17,12 @@ declare global {
 const platformOrder = [
   "Ios",
   "Android",
+  // Gnome outranks Native: the GTK target reports isNative (it is not a
+  // browser) but "gnome" is the precise answer callers want.
+  "Gnome",
   "Native",
+  // Tauri outranks Desktop/Web the same way: the webview host reports isWeb
+  // and isDesktop, but "tauri" is the precise answer.
   "Tauri",
   "Desktop",
   "ChromeExtension",
@@ -38,6 +43,7 @@ const platformOrder = [
 export type PlatformName =
   | "ios"
   | "android"
+  | "gnome"
   | "native"
   | "tauri"
   | "desktop"
@@ -66,6 +72,7 @@ export const platformBase = {
   isExpo: false,
   isFirefox: false,
   isFirefoxExtension: false,
+  isGnome: false,
   isIframe: false,
   isIos: false,
   isNative: false,
@@ -112,6 +119,7 @@ export interface Platform {
   isExpo: boolean;
   isFirefox: boolean;
   isFirefoxExtension: boolean;
+  isGnome: boolean;
   isIframe: boolean;
   isIos: boolean;
   isNative: boolean;

package/types/config/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,qBAAa,MAAO,YAAW,OAAO;IACpC,OAAO,CAAC,OAAO,CAA8B;IAE7C,OAAO,CAAC,UAAU,CAA4B;IAE9C,OAAO,CAAC,UAAU;IAKlB,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,aAAa;gBAUT,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAM;IAa3D,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAC7B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IACpC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAO9C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;IAK9B,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAQjC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAKxC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,qBAAa,MAAO,YAAW,OAAO;IACpC,OAAO,CAAC,OAAO,CAA8B;IAE7C,OAAO,CAAC,UAAU,CAA4B;IAE9C,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,aAAa;gBAUT,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAM;IAiB3D,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAC7B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IACpC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAO9C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;IAK9B,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAQjC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAKxC"}

package/types/config/index.d.ts

@@ -2,4 +2,5 @@ import { Config } from "./config";
 declare const config: Config;
 export { config };
 export * from "./config";
+export * from "./runtimeConfig";
 //# sourceMappingURL=index.d.ts.map

package/types/config/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAElC,QAAA,MAAM,MAAM,QAAe,CAAC;AAE5B,OAAO,EAAE,MAAM,EAAE,CAAC;AAClB,cAAc,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAElC,QAAA,MAAM,MAAM,QAAe,CAAC;AAE5B,OAAO,EAAE,MAAM,EAAE,CAAC;AAClB,cAAc,UAAU,CAAC;AACzB,cAAc,iBAAiB,CAAC"}

package/types/config/runtimeConfig.d.ts

@@ -0,0 +1,74 @@
+/**
+ * RUNTIME public-config seam: SSR document -> browser.
+ *
+ * Why this exists: `VITE_MP_CONFIG` is resolved by `@multiplatform.one/config`
+ * at BUILD time (createViteConfig sets `process.env.VITE_MP_CONFIG` from the
+ * build environment, and vite bakes it into `import.meta.env`). A container
+ * image built by CI therefore ships whatever the CI job happened to export —
+ * usually nothing — and no amount of runtime container env reaches the
+ * browser, because `Config._lookupEnv` reads `process.env`, which does not
+ * exist there. The measured failure: the marketplace storefront had
+ * MARKETPLACE_API_URL on its container and still rendered "MARKETPLACE_API_URL
+ * is not configured", issuing ZERO catalog requests.
+ *
+ * The fix keeps the image environment-agnostic: the BUILD bakes only the
+ * NAMES of the public keys (`VITE_MP_PUBLIC_CONFIG_KEYS`), and the SSR node
+ * process resolves their VALUES from its own `process.env` at request time and
+ * publishes them into the served document.
+ *
+ * Transport: one inline `<script>` in `<head>` assigning a `globalThis` key —
+ * the SAME mechanism one uses for `__one_server_context__` (see one's
+ * `server/ServerContextScript`), deliberately sitting ALONGSIDE it rather
+ * than being a second, differently-shaped invention.
+ *
+ * Safety: `resolvePublicConfig` walks the BUILD-TIME PUBLIC ALLOWLIST, never
+ * the environment. A key that is not on `config.json`'s `public` list can not
+ * be serialized even if it is present in the SSR process env, so server-only
+ * secrets never reach the document.
+ */
+/**
+ * Global key the SSR document assigns the resolved public config to.
+ * Sibling of one's `__one_server_context__`.
+ */
+export declare const runtimePublicConfigKey = "__mp_public_config__";
+/**
+ * Build-time env key carrying the JSON array of PUBLIC config key names
+ * (written by `createViteConfig` in `@multiplatform.one/config/vite`).
+ * Only the NAMES are baked — values stay environment-agnostic.
+ */
+export declare const publicConfigKeysEnvKey = "VITE_MP_PUBLIC_CONFIG_KEYS";
+/**
+ * Build-time env key carrying the JSON object of public config values
+ * resolved from the BUILD environment. Still honored so apps that bake their
+ * config in (native, GNOME, static web) keep working unchanged.
+ */
+export declare const bakedConfigEnvKey = "VITE_MP_CONFIG";
+/**
+ * The PUBLIC key allowlist baked at build time. Empty when the app was not
+ * built through `createViteConfig` (tests, storybook, plain node) — in which
+ * case nothing is publishable and the payload stays empty, which is the safe
+ * direction to fail.
+ */
+export declare function publicConfigKeys(): string[];
+/** Public config values baked into the bundle at BUILD time. */
+export declare function bakedPublicConfig(): Record<string, string>;
+/**
+ * Resolve the public config the SSR document should publish.
+ *
+ * Iterates the ALLOWLIST — never the environment — so a private key present
+ * in `env` can not reach the returned object. Runtime env wins over the
+ * build-time bake, so a redeployed container overrides a stale baked value.
+ */
+export declare function resolvePublicConfig(env?: Record<string, string | undefined>): Record<string, string>;
+/**
+ * Read the payload the SSR document published. Returns undefined anywhere the
+ * document never ran (native, SSR itself, tests).
+ */
+export declare function readRuntimePublicConfig(): Record<string, string> | undefined;
+/**
+ * The inline `<script>` body that publishes the public config to the browser.
+ * Runs during document parse, so it lands before the deferred app bundle
+ * constructs its `Config`.
+ */
+export declare function serializeRuntimePublicConfig(config?: Record<string, string>): string;
+//# sourceMappingURL=runtimeConfig.d.ts.map