@omg-dev/vite-plugin 0.4.24

package/dist/index.mjs

@@ -0,0 +1,1087 @@
+import path from "node:path";
+import fs from "node:fs";
+import { schemaToCollections, schemaToDrizzle, schemaToZod } from "@omg-dev/schema";
+import { scanTriggers } from "@omg-dev/server/trigger-scan";
+//#region src/auth-bridge.ts
+const AUTH_RELAY_SKIP_HEADERS = new Set([
+	"set-cookie",
+	"content-encoding",
+	"content-length",
+	"transfer-encoding",
+	"connection",
+	"keep-alive"
+]);
+/** Relay an upstream auth response with sane framing for the buffered body. */
+async function relayAuthUpstream(res, upstream) {
+	const body = Buffer.from(await upstream.arrayBuffer());
+	res.statusCode = upstream.status;
+	upstream.headers.forEach((value, key) => {
+		if (AUTH_RELAY_SKIP_HEADERS.has(key.toLowerCase())) return;
+		res.setHeader(key, value);
+	});
+	res.setHeader("Content-Length", String(body.byteLength));
+	res.end(body);
+}
+/**
+* Fetch the auth upstream for the preview bridges.
+*
+* Prefers the host-side per-sandbox proxy (OMG_AI_URL, the same listener the
+* LLM proxy uses at 169.254.0.1:9090) when it advertises the auth route via
+* the `x-vibes-auth-proxy` marker: in-VM Bun fetch to the Cloudflare-proxied
+* auth host is the AAAA-first/no-IPv6-route hang class, while the host-side
+* Go client dials dual-stack. Falls back to a direct fetch when the proxy is
+* absent (local dev outside a sandbox) or predates the auth route.
+*/
+async function fetchAuthUpstream(kind, init, qs = "") {
+	const proxyBase = (process.env.OMG_AI_URL ?? "").trim().replace(/\/+$/, "");
+	if (proxyBase) {
+		const proxyUrl = kind === "token" ? `${proxyBase}/auth/token` : `${proxyBase}/auth/get-session${qs}`;
+		try {
+			const viaProxy = await fetch(proxyUrl, init);
+			if (viaProxy.headers.get("x-vibes-auth-proxy")) return viaProxy;
+			await viaProxy.arrayBuffer().catch(() => {});
+		} catch {}
+	}
+	const authUrl = (process.env.VIBES_AUTH_URL || process.env.VITE_AUTH_URL || "https://auth.omg.dev").replace(/\/+$/, "");
+	const directUrl = kind === "token" ? `${authUrl}/token` : `${authUrl}/api/auth/get-session${qs}`;
+	return fetch(directUrl, init);
+}
+//#endregion
+//#region src/scanner.ts
+const HTTP_METHODS = new Set([
+	"GET",
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE"
+]);
+function handlerToRoute(routePath, handlerName, modulePath) {
+	if (HTTP_METHODS.has(handlerName)) return {
+		method: handlerName,
+		path: routePath,
+		module: modulePath,
+		handler: handlerName,
+		style: "method"
+	};
+	switch (handlerName) {
+		case "list": return {
+			method: "GET",
+			path: routePath,
+			module: modulePath,
+			handler: handlerName,
+			style: "crud"
+		};
+		case "get": return {
+			method: "GET",
+			path: `${routePath}/:id`,
+			module: modulePath,
+			handler: handlerName,
+			style: "crud"
+		};
+		case "create": return {
+			method: "POST",
+			path: routePath,
+			module: modulePath,
+			handler: handlerName,
+			style: "crud"
+		};
+		case "update": return {
+			method: "PATCH",
+			path: `${routePath}/:id`,
+			module: modulePath,
+			handler: handlerName,
+			style: "crud"
+		};
+		case "remove": return {
+			method: "DELETE",
+			path: `${routePath}/:id`,
+			module: modulePath,
+			handler: handlerName,
+			style: "crud"
+		};
+		default: return {
+			method: "POST",
+			path: `${routePath}/${handlerName}`,
+			module: modulePath,
+			handler: handlerName,
+			style: "crud"
+		};
+	}
+}
+/**
+* Scans the `functions/` directory in `dir` and returns a list of routes.
+*
+* Layout:
+*   functions/<name>.ts        → routes mounted at /api/<name>
+*   functions/api/<name>.ts    → routes mounted at /api/<name>  (the `api/`
+*                                 subdir is treated as a no-op prefix so the
+*                                 path doesn't double up to /api/api/<name>;
+*                                 lets people group "raw HTTP" handlers
+*                                 alongside CRUD without an ugly URL).
+*
+* Uses regex to extract exported function names — no AST parser needed.
+*/
+async function scanFunctions(dir) {
+	const functionsDir = path.join(dir, "functions");
+	if (!fs.existsSync(functionsDir)) return [];
+	const routes = [];
+	walkDir(functionsDir, "/api", routes, "api");
+	const apiDir = path.join(functionsDir, "api");
+	if (fs.existsSync(apiDir) && fs.statSync(apiDir).isDirectory()) walkDir(apiDir, "/api", routes, null);
+	return routes;
+}
+function walkDir(fullDir, routePrefix, routes, skipDirName) {
+	const entries = fs.readdirSync(fullDir, { withFileTypes: true });
+	for (const entry of entries) {
+		if (entry.isDirectory()) continue;
+		if (skipDirName && entry.name === skipDirName) continue;
+		if (!entry.name.endsWith(".ts") || entry.name.endsWith(".d.ts")) continue;
+		const filePath = path.join(fullDir, entry.name);
+		const resource = path.basename(entry.name, ".ts");
+		const handlerNames = extractExports(fs.readFileSync(filePath, "utf-8"));
+		for (const handlerName of handlerNames) routes.push(handlerToRoute(`${routePrefix}/${resource}`, handlerName, filePath));
+	}
+}
+/**
+* Extracts exported function/const names from TypeScript source using regex.
+*/
+function extractExports(source) {
+	const names = [];
+	const seen = /* @__PURE__ */ new Set();
+	const fnRegex = /^export\s+(?:async\s+)?function\s+(\w+)/gm;
+	let match;
+	while ((match = fnRegex.exec(source)) !== null) {
+		const name = match[1];
+		if (!seen.has(name)) {
+			seen.add(name);
+			names.push(name);
+		}
+	}
+	const constRegex = /^export\s+const\s+(\w+)\s*(?::\s*[^=]+)?\s*=/gm;
+	while ((match = constRegex.exec(source)) !== null) {
+		const name = match[1];
+		if (!seen.has(name)) {
+			seen.add(name);
+			names.push(name);
+		}
+	}
+	const namedExportRegex = /^export\s*\{([^}]+)\}/gm;
+	while ((match = namedExportRegex.exec(source)) !== null) {
+		const exports = match[1].split(",").map((s) => s.trim().split(/\s+as\s+/).pop().trim());
+		for (const name of exports) if (name && !seen.has(name)) {
+			seen.add(name);
+			names.push(name);
+		}
+	}
+	return names;
+}
+//#endregion
+//#region src/scanner-workflows.ts
+const EXPORT_WORKFLOW_RE = /^export\s+const\s+(\w+)\s*(?::\s*[^=]+)?\s*=\s*workflow\s*\(\s*(.+?)\s*,/gm;
+const NAME_RE = /^[A-Za-z][A-Za-z0-9_]*$/;
+var WorkflowScanError = class extends Error {
+	constructor(file, detail) {
+		super(`[vibes:workflows] ${file}: ${detail}`);
+		this.file = file;
+		this.detail = detail;
+		this.name = "WorkflowScanError";
+	}
+};
+/** scanWorkflows walks `<root>/functions/` and returns every declared workflow. */
+async function scanWorkflows(root) {
+	const fnDir = path.join(root, "functions");
+	if (!fs.existsSync(fnDir)) return [];
+	const out = [];
+	walk(fnDir, out);
+	const apiDir = path.join(fnDir, "api");
+	if (fs.existsSync(apiDir) && fs.statSync(apiDir).isDirectory()) walk(apiDir, out);
+	const seen = /* @__PURE__ */ new Map();
+	for (const w of out) {
+		const prev = seen.get(w.name);
+		if (prev) throw new WorkflowScanError(w.module, `duplicate workflow name "${w.name}" (also declared by ${prev})`);
+		seen.set(w.name, w.handler);
+	}
+	return out;
+}
+function walk(dir, out) {
+	for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+		if (entry.isDirectory()) continue;
+		if (!entry.name.endsWith(".ts") || entry.name.endsWith(".d.ts")) continue;
+		const filePath = path.join(dir, entry.name);
+		const source = fs.readFileSync(filePath, "utf-8");
+		const basename = path.basename(entry.name, ".ts");
+		out.push(...extractWorkflows(source, filePath, basename));
+	}
+}
+function extractWorkflows(source, filePath, basename) {
+	const out = [];
+	const stripped = source.replace(/\/\/.*$/gm, "").replace(/\/\*[\s\S]*?\*\//g, "");
+	let m;
+	EXPORT_WORKFLOW_RE.lastIndex = 0;
+	while ((m = EXPORT_WORKFLOW_RE.exec(stripped)) !== null) {
+		const [, exportName, firstArg] = m;
+		const lit = parseStringLiteral(firstArg);
+		if (lit === null) throw new WorkflowScanError(filePath, `workflow() first arg must be a string literal — got: ${firstArg.slice(0, 60)}`);
+		if (!NAME_RE.test(lit)) throw new WorkflowScanError(filePath, `workflow name "${lit}" is invalid — use [A-Za-z][A-Za-z0-9_]* (no dashes; it becomes the engine handler name)`);
+		out.push({
+			name: lit,
+			handler: `${basename}.${exportName}`,
+			module: filePath,
+			exportName
+		});
+	}
+	return out;
+}
+function parseStringLiteral(raw) {
+	const trimmed = raw.trim();
+	if (trimmed.length < 2) return null;
+	const first = trimmed[0];
+	if ((first === "\"" || first === "'") && trimmed.endsWith(first)) {
+		const inner = trimmed.slice(1, -1);
+		if (inner.includes("${")) return null;
+		return inner.replace(/\\(.)/g, "$1");
+	}
+	return null;
+}
+//#endregion
+//#region src/codegen.ts
+async function generateAll(root) {
+	await regenerateSchema(root);
+	await regenerateRoutes(root);
+	await regenerateTriggers(root);
+	await regenerateWorkflows(root);
+}
+/**
+* Reads schema.ts from root, imports it dynamically, and writes:
+*   src/db.generated.ts  — TypeScript types + Zod schemas + collection configs
+*   src/db.drizzle.ts    — Drizzle table definitions for server-side helpers
+*/
+async function regenerateSchema(root) {
+	const schemaPath = path.join(root, "schema.ts");
+	if (!fs.existsSync(schemaPath)) {
+		console.warn(`[vibes:codegen] No schema.ts found at ${schemaPath}`);
+		return;
+	}
+	let schema;
+	try {
+		schema = (await import(schemaPath)).default;
+	} catch (err) {
+		console.error(`[vibes:codegen] Failed to import schema.ts:`, err);
+		return;
+	}
+	const srcDir = path.join(root, "src");
+	if (!fs.existsSync(srcDir)) fs.mkdirSync(srcDir, { recursive: true });
+	const outputPath = path.join(srcDir, "db.generated.ts");
+	const lines = [
+		"// This file is auto-generated by @omg-dev/vite-plugin. Do not edit manually.",
+		"// To regenerate: restart the dev server or run `vp build`.",
+		"",
+		"// ── Zod schemas & types ─────────────────────────────────────────────────────────",
+		"",
+		schemaToZod(schema),
+		"",
+		"// ── Collection configs ─────────────────────────────────────────────────────────",
+		"",
+		schemaToCollections(schema)
+	];
+	fs.writeFileSync(outputPath, lines.join("\n"), "utf-8");
+	console.log(`[vibes:codegen] Generated ${outputPath}`);
+	const drizzlePath = path.join(srcDir, "db.drizzle.ts");
+	const drizzleLines = [
+		"// This file is auto-generated by @omg-dev/vite-plugin. Do not edit manually.",
+		"// To regenerate: restart the dev server or run `vp build`.",
+		"",
+		schemaToDrizzle(schema)
+	];
+	fs.writeFileSync(drizzlePath, drizzleLines.join("\n"), "utf-8");
+	console.log(`[vibes:codegen] Generated ${drizzlePath}`);
+}
+/**
+* Scans functions/ directory and writes .vibes/routes.json
+*/
+async function regenerateRoutes(root) {
+	const routes = await scanFunctions(root);
+	const vibesDir = path.join(root, ".vibes");
+	if (!fs.existsSync(vibesDir)) fs.mkdirSync(vibesDir, { recursive: true });
+	const routesPath = path.join(vibesDir, "routes.json");
+	fs.writeFileSync(routesPath, JSON.stringify(routes, null, 2), "utf-8");
+	console.log(`[vibes:codegen] Generated ${routesPath} with ${routes.length} route(s)`);
+}
+/**
+* Scans functions/ for `cron()` and `on()` calls and writes .vibes/triggers.json
+* consumed by @omg-dev/server's scheduler (dev) and by the orchestrator's queue
+* runtime (prod). Throws TriggerScanError on malformed declarations so the
+* user sees the failure at build / HMR time rather than silently losing a
+* trigger.
+*/
+async function regenerateTriggers(root) {
+	const triggers = await scanTriggers(root);
+	const vibesDir = path.join(root, ".vibes");
+	if (!fs.existsSync(vibesDir)) fs.mkdirSync(vibesDir, { recursive: true });
+	const triggersPath = path.join(vibesDir, "triggers.json");
+	fs.writeFileSync(triggersPath, JSON.stringify(triggers, null, 2), "utf-8");
+	console.log(`[vibes:codegen] Generated ${triggersPath} with ${triggers.length} trigger(s)`);
+}
+/**
+* Scans functions/ for `workflow()` declarations and writes
+* .vibes/workflows.json — consumed by @omg-dev/server's dev engine and the
+* prod Restate endpoint, and read by the orchestrator at publish to decide
+* whether to register a workflow deployment. Throws WorkflowScanError on
+* malformed declarations (non-literal name, duplicate names).
+*/
+async function regenerateWorkflows(root) {
+	const workflows = await scanWorkflows(root);
+	const vibesDir = path.join(root, ".vibes");
+	if (!fs.existsSync(vibesDir)) fs.mkdirSync(vibesDir, { recursive: true });
+	const workflowsPath = path.join(vibesDir, "workflows.json");
+	fs.writeFileSync(workflowsPath, JSON.stringify(workflows, null, 2), "utf-8");
+	if (workflows.length > 0) console.log(`[vibes:codegen] Generated ${workflowsPath} with ${workflows.length} workflow(s)`);
+}
+//#endregion
+//#region src/error-sink.ts
+/**
+* Error sink writer used by the vibes vite plugin in dev mode.
+*
+* Both server (Vite logger) and runtime (in-iframe reporter) errors get
+* appended as JSONL to <root>/.vibes/errors.jsonl. The agent-server
+* inside the sandbox tails this file between turns and splices new
+* entries into pi's user message.
+*
+* Pure helpers — no plugin/Vite types — so they can be unit-tested.
+*/
+const MAX_BYTES_BEFORE_ROTATE = 1048576;
+function errorsPathFor(root) {
+	return path.join(root, ".vibes", "errors.jsonl");
+}
+/**
+* Append one entry to the sink. The `at` timestamp is stamped here so
+* the file is the authoritative ordering — callers must not pre-stamp.
+*
+* Errors are logged but not rethrown — the dev server must keep running
+* even if the sink is broken. The previous version swallowed silently,
+* which made a failing writer indistinguishable from "no errors yet".
+*/
+function appendErrorEntry(errorsPath, entry) {
+	try {
+		fs.mkdirSync(path.dirname(errorsPath), { recursive: true });
+		const line = JSON.stringify({
+			at: Date.now(),
+			...entry
+		}) + "\n";
+		fs.appendFileSync(errorsPath, line);
+		if (fs.statSync(errorsPath).size > MAX_BYTES_BEFORE_ROTATE) fs.renameSync(errorsPath, errorsPath + ".1");
+	} catch (err) {
+		console.error(`[vibes:error-sink] failed to append to ${errorsPath}:`, err instanceof Error ? err.message : err);
+	}
+}
+/** Drop ANSI color codes from Vite's rendered logger output. */
+function stripAnsi(s) {
+	return s.replace(/\x1b\[[0-9;]*m/g, "");
+}
+//#endregion
+//#region src/pwa.ts
+/** Icon set contract shared with templates/react-ts/public/icons/. */
+const PWA_ICONS = [
+	{
+		file: "icons/pwa-192x192.png",
+		sizes: "192x192",
+		purpose: "any"
+	},
+	{
+		file: "icons/pwa-512x512.png",
+		sizes: "512x512",
+		purpose: "any"
+	},
+	{
+		file: "icons/pwa-512x512-maskable.png",
+		sizes: "512x512",
+		purpose: "maskable"
+	}
+];
+const APPLE_TOUCH_ICON = "icons/apple-touch-icon.png";
+const MANIFEST_FILE = "manifest.webmanifest";
+function resolvePwaConfig(opts, indexHtml) {
+	const title = /<title[^>]*>([^<]*)<\/title>/i.exec(indexHtml)?.[1]?.trim();
+	const metaTheme = /<meta[^>]+name=["']theme-color["'][^>]*content=["']([^"']+)["']/i.exec(indexHtml)?.[1] ?? /<meta[^>]+content=["']([^"']+)["'][^>]*name=["']theme-color["']/i.exec(indexHtml)?.[1];
+	const name = opts?.name ?? (title || "App");
+	const themeColor = opts?.themeColor ?? metaTheme ?? "#ffffff";
+	return {
+		name,
+		shortName: opts?.shortName ?? (name.length > 12 ? name.slice(0, 12).trimEnd() : name),
+		themeColor,
+		backgroundColor: opts?.backgroundColor ?? themeColor,
+		autoPrompt: opts?.autoPrompt !== false
+	};
+}
+function buildWebManifest(cfg, availableIconFiles) {
+	const available = new Set(availableIconFiles);
+	const icons = PWA_ICONS.filter((i) => available.has(i.file)).map((i) => ({
+		src: `/${i.file}`,
+		sizes: i.sizes,
+		type: "image/png",
+		...i.purpose === "maskable" ? { purpose: "maskable" } : {}
+	}));
+	return JSON.stringify({
+		name: cfg.name,
+		short_name: cfg.shortName,
+		start_url: "/",
+		scope: "/",
+		display: "standalone",
+		background_color: cfg.backgroundColor,
+		theme_color: cfg.themeColor,
+		icons
+	}, null, 2);
+}
+function escapeAttr(value) {
+	return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+/** Inject PWA tags into built index.html. Idempotent: an app that already
+* declares a manifest link (hand-rolled PWA) is left entirely alone. */
+function injectPwaTags(html, cfg, opts) {
+	if (/rel=["']manifest["']/i.test(html)) return html;
+	const tags = [`<link rel="manifest" href="${opts.manifestHref ?? `/manifest.webmanifest`}">`, `<meta name="mobile-web-app-capable" content="yes">`];
+	if (!/name=["']apple-mobile-web-app-capable["']/i.test(html)) tags.push(`<meta name="apple-mobile-web-app-capable" content="yes">`);
+	if (!/name=["']apple-mobile-web-app-title["']/i.test(html)) tags.push(`<meta name="apple-mobile-web-app-title" content="${escapeAttr(cfg.shortName)}">`);
+	if (opts.hasAppleIcon && !/rel=["']apple-touch-icon["']/i.test(html)) tags.push(`<link rel="apple-touch-icon" href="/${APPLE_TOUCH_ICON}">`);
+	if (!/name=["']theme-color["']/i.test(html)) tags.push(`<meta name="theme-color" content="${escapeAttr(cfg.themeColor)}">`);
+	const block = `\n    ${tags.join("\n    ")}`;
+	return /<\/head>/i.test(html) ? html.replace(/<\/head>/i, `${block}\n  </head>`) : block + html;
+}
+/** True when `id` is the app's client entry (src/main.*) — the injection
+* point for the auto install prompt import. */
+function isAppEntry(id, root) {
+	const clean = id.split("?")[0];
+	if (!clean.startsWith(root)) return false;
+	if (clean.includes("node_modules")) return false;
+	return /[\\/]src[\\/]main\.(tsx|ts|jsx|js)$/.test(clean);
+}
+//#endregion
+//#region src/index.ts
+async function pwaDeclaresSubpathExport(resolve, importer, subpath) {
+	try {
+		const rootEntry = await resolve("@omg-dev/pwa", importer);
+		if (!rootEntry?.id) return false;
+		let dir = path.dirname(rootEntry.id.split("?")[0]);
+		for (let i = 0; i < 12; i++) {
+			const pkgPath = path.join(dir, "package.json");
+			if (fs.existsSync(pkgPath)) try {
+				const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+				if (pkg.name === "@omg-dev/pwa") {
+					const exp = pkg.exports;
+					return !!exp && typeof exp === "object" && subpath in exp;
+				}
+			} catch {}
+			const parent = path.dirname(dir);
+			if (parent === dir) break;
+			dir = parent;
+		}
+		return false;
+	} catch {
+		return false;
+	}
+}
+function vibes(opts = {}) {
+	let resolvedRoot;
+	let config;
+	let serverInstance = null;
+	const pwaEnabled = opts.pwa !== false;
+	const pwaOpts = typeof opts.pwa === "object" ? opts.pwa : {};
+	let pwaAutoInjected = false;
+	let remixCtaInjected = false;
+	const feedbackEnabled = opts.feedback !== false;
+	let feedbackInjected = false;
+	const brandBadgeEnabled = opts.brandBadge !== false;
+	let brandBadgeInjected = false;
+	function existingIconFiles() {
+		const publicDir = config?.publicDir;
+		if (!publicDir) return [];
+		return [...PWA_ICONS.map((i) => i.file), APPLE_TOUCH_ICON].filter((f) => fs.existsSync(path.join(publicDir, f)));
+	}
+	function userManifestHref() {
+		const publicDir = config?.publicDir;
+		if (!publicDir) return null;
+		if (fs.existsSync(path.join(publicDir, "manifest.webmanifest"))) return `/${MANIFEST_FILE}`;
+		if (fs.existsSync(path.join(publicDir, "manifest.json"))) return "/manifest.json";
+		return null;
+	}
+	return {
+		name: "vibes",
+		enforce: "pre",
+		config() {
+			return {
+				define: { __VIBES_BRAND_FEEDBACK__: JSON.stringify(brandBadgeEnabled && feedbackEnabled) },
+				server: { watch: { ignored: ["**/.vibes/**"] } }
+			};
+		},
+		configResolved(resolvedConfig) {
+			config = resolvedConfig;
+			resolvedRoot = opts.root ?? resolvedConfig.root;
+		},
+		transformIndexHtml: {
+			order: "pre",
+			handler(html) {
+				if (config?.command === "build") {
+					const websiteId = process.env.VIBES_ANALYTICS_WEBSITE_ID;
+					if (websiteId) {
+						const src = process.env.VIBES_ANALYTICS_SRC || "https://analytics.omg.dev/script.js";
+						if (!html.includes(src)) {
+							const tag = `<script defer src="${src}" data-website-id="${websiteId}"><\/script>`;
+							html = /<\/head>/i.test(html) ? html.replace(/<\/head>/i, `${tag}</head>`) : tag + html;
+						}
+					}
+					if (pwaEnabled) html = injectPwaTags(html, resolvePwaConfig(pwaOpts, html), {
+						hasAppleIcon: existingIconFiles().includes(APPLE_TOUCH_ICON),
+						manifestHref: userManifestHref() ?? void 0
+					});
+					return html;
+				}
+				if (config?.command !== "serve") return html;
+				const appId = readPreviewAppId(resolvedRoot);
+				const authBootstrap = appId ? `
+<script>
+window.__VIBES_APP_ID = ${JSON.stringify(appId)};
+window.__VIBES_AUTH_TOKEN_URL = "/__vibes/auth/token";
+window.__VIBES_AUTH_SESSION_URL = "/__vibes/auth/session";
+<\/script>` : "";
+				const reporter = `
+<script>
+(function(){
+  if (window.__vibesReporterInstalled) return;
+  window.__vibesReporterInstalled = true;
+  function send(payload){
+    var msg = Object.assign({ kind: "runtime", at: Date.now() }, payload);
+    // POST into the dev server so it lands in .vibes/errors.jsonl. Use
+    // keepalive so errors thrown right before navigation still flush.
+    // Surface the response status to the parent so a 404/CORS/etc on
+    // the sink endpoint is diagnosable without looking at sandbox logs.
+    try {
+      fetch("/__vibes/runtime-error", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(msg),
+        keepalive: true,
+      }).then(function(r){
+        if (!r.ok) {
+          try { window.parent && window.parent.postMessage(
+            { type: "vibes:reporter-fetch", status: r.status, ok: false }, "*"); } catch (_) {}
+        }
+      }).catch(function(err){
+        try { window.parent && window.parent.postMessage(
+          { type: "vibes:reporter-fetch", error: String(err && err.message || err), ok: false }, "*"); } catch (_) {}
+      });
+    } catch (e) {}
+    // Also notify the parent shell for UI surfacing.
+    try {
+      window.parent && window.parent.postMessage(
+        Object.assign({ type: "vibes:runtime-error" }, msg), "*");
+    } catch (e) {}
+  }
+  window.addEventListener("error", function(ev){
+    var err = ev.error;
+    send({
+      message: (err && err.message) || ev.message || "Error",
+      stack: (err && err.stack) || null,
+      source: ev.filename || null,
+      line: ev.lineno || null,
+      col: ev.colno || null,
+    });
+  });
+  window.addEventListener("unhandledrejection", function(ev){
+    var r = ev.reason;
+    send({
+      message: (r && (r.message || String(r))) || "Unhandled rejection",
+      stack: (r && r.stack) || null,
+      rejection: true,
+    });
+  });
+  var origErr = console.error;
+  console.error = function(){
+    try {
+      var args = Array.prototype.slice.call(arguments);
+      var msg = args.map(function(a){
+        if (a instanceof Error) return a.message;
+        if (typeof a === "string") return a;
+        try { return JSON.stringify(a); } catch (e) { return String(a); }
+      }).join(" ");
+      send({ message: msg, viaConsole: true });
+    } catch (e) {}
+    origErr.apply(console, arguments);
+  };
+})();
+<\/script>`;
+				if (/<head[^>]*>/i.test(html)) return html.replace(/<head[^>]*>/i, function(m) {
+					return m + authBootstrap + reporter;
+				});
+				return authBootstrap + reporter + html;
+			}
+		},
+		async configureServer(server) {
+			const errorsPath = errorsPathFor(resolvedRoot);
+			const logger = server.config.logger;
+			const origErr = logger.error.bind(logger);
+			logger.error = (msg, opts) => {
+				try {
+					const text = typeof msg === "string" ? msg : String(msg);
+					if (!text.includes("__vibes-self")) appendErrorEntry(errorsPath, {
+						kind: "server",
+						source: "vite",
+						message: stripAnsi(text).slice(0, 4e3)
+					});
+				} catch {}
+				return origErr(msg, opts);
+			};
+			server.middlewares.use((req, res, next) => {
+				if (req.url !== "/__vibes/runtime-error" || req.method !== "POST") return next();
+				const chunks = [];
+				req.on("data", (c) => chunks.push(c));
+				req.on("end", () => {
+					try {
+						const body = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
+						appendErrorEntry(errorsPath, {
+							kind: "runtime",
+							source: "browser",
+							message: String(body.message ?? "").slice(0, 4e3),
+							stack: body.stack ? String(body.stack).slice(0, 4e3) : void 0,
+							file: body.source,
+							line: body.line,
+							col: body.col,
+							viaConsole: body.viaConsole,
+							rejection: body.rejection
+						});
+					} catch {}
+					res.statusCode = 204;
+					res.end();
+				});
+				req.on("error", () => {
+					res.statusCode = 400;
+					res.end();
+				});
+			});
+			server.middlewares.use((req, res, next) => {
+				if (req.url !== "/__vibes/auth/token") return next();
+				if (req.method === "OPTIONS") {
+					res.statusCode = 204;
+					res.end();
+					return;
+				}
+				if (req.method !== "POST") {
+					res.statusCode = 405;
+					res.setHeader("Content-Type", "application/json");
+					res.end(JSON.stringify({ error: "method not allowed" }));
+					return;
+				}
+				const appId = readPreviewAppId(resolvedRoot);
+				if (!appId) {
+					res.statusCode = 404;
+					res.setHeader("Content-Type", "application/json");
+					res.end(JSON.stringify({ error: "preview app id not configured" }));
+					return;
+				}
+				req.on("data", () => {});
+				req.on("end", async () => {
+					try {
+						await relayAuthUpstream(res, await fetchAuthUpstream("token", {
+							method: "POST",
+							headers: {
+								"Content-Type": "application/json",
+								Origin: "https://omg.dev",
+								...req.headers.cookie ? { Cookie: req.headers.cookie } : {}
+							},
+							body: JSON.stringify({ appId })
+						}));
+					} catch (err) {
+						res.statusCode = 502;
+						res.setHeader("Content-Type", "application/json");
+						res.end(JSON.stringify({ error: err instanceof Error ? err.message : "auth token proxy failed" }));
+					}
+				});
+				req.on("error", () => {
+					res.statusCode = 400;
+					res.end();
+				});
+			});
+			server.middlewares.use((req, res, next) => {
+				if ((req.url ?? "").split("?")[0] !== "/__vibes/auth/session") return next();
+				if (req.method === "OPTIONS") {
+					res.statusCode = 204;
+					res.end();
+					return;
+				}
+				if (req.method !== "GET") {
+					res.statusCode = 405;
+					res.setHeader("Content-Type", "application/json");
+					res.end(JSON.stringify({ error: "method not allowed" }));
+					return;
+				}
+				(async () => {
+					try {
+						const qs = (req.url ?? "").includes("?") ? (req.url ?? "").slice((req.url ?? "").indexOf("?")) : "";
+						await relayAuthUpstream(res, await fetchAuthUpstream("session", {
+							method: "GET",
+							headers: {
+								Origin: "https://omg.dev",
+								...req.headers.cookie ? { Cookie: req.headers.cookie } : {}
+							}
+						}, qs));
+					} catch (err) {
+						res.statusCode = 502;
+						res.setHeader("Content-Type", "application/json");
+						res.end(JSON.stringify({ error: err instanceof Error ? err.message : "auth session proxy failed" }));
+					}
+				})();
+			});
+			await generateAll(resolvedRoot);
+			const schema = await loadSchema(resolvedRoot);
+			process.env.VIBES_MODE = "dev";
+			const { createVibesServer } = await import("@omg-dev/server");
+			const dbPath = opts.db ?? ".vibes/data.db";
+			serverInstance = await createVibesServer({
+				root: resolvedRoot,
+				db: dbPath,
+				auth: opts.auth ?? "vibes",
+				schema: schema ?? void 0
+			});
+			const { addClient, removeClient } = await import("@omg-dev/server");
+			const { addSubClient, removeSubClient, handleSubMessage } = await import("@omg-dev/server");
+			const HEARTBEAT_MS = 25e3;
+			server.middlewares.use((req, res, next) => {
+				if (req.url !== "/__vibes_events") return next();
+				res.writeHead(200, {
+					"Content-Type": "text/event-stream",
+					"Cache-Control": "no-cache",
+					Connection: "keep-alive",
+					"Access-Control-Allow-Origin": "*",
+					"X-Accel-Buffering": "no"
+				});
+				res.write(":\n\n");
+				const client = {
+					readyState: 1,
+					send(data) {
+						res.write(`data: ${data}\n\n`);
+					}
+				};
+				addClient(client);
+				const cleanup = () => {
+					if (client.readyState === 3) return;
+					client.readyState = 3;
+					clearInterval(hb);
+					removeClient(client);
+				};
+				const hb = setInterval(() => {
+					try {
+						if (!res.write(":hb\n\n")) cleanup();
+					} catch {
+						cleanup();
+					}
+				}, HEARTBEAT_MS);
+				req.on("close", cleanup);
+			});
+			const { WebSocketServer } = await import("ws");
+			const wss = new WebSocketServer({
+				noServer: true,
+				handleProtocols: (protocols) => {
+					for (const p of protocols) if (p.startsWith("vibes-bearer.")) return p;
+					return protocols.values().next().value ?? false;
+				}
+			});
+			const { createAuthMiddleware } = await import("@omg-dev/auth");
+			const subAuthMW = createAuthMiddleware(opts.auth ?? "vibes");
+			const httpServer = server.httpServer;
+			if (httpServer) httpServer.on("upgrade", async (req, socket, head) => {
+				try {
+					if (new URL(req.url ?? "/", "http://localhost").pathname !== "/__vibes_sub") return;
+					const bearerProto = (req.headers["sec-websocket-protocol"] ?? "").split(",").map((s) => s.trim()).filter(Boolean).find((p) => p.startsWith("vibes-bearer."));
+					let userId = null;
+					if (bearerProto) {
+						const token = bearerProto.slice(13);
+						try {
+							userId = (await subAuthMW(new Request("http://localhost/__vibes_sub", { headers: { authorization: `Bearer ${token}` } })))?.userId ?? null;
+						} catch {}
+					}
+					wss.handleUpgrade(req, socket, head, (ws) => {
+						const subClient = {
+							readyState: 1,
+							send(data) {
+								try {
+									ws.send(data);
+								} catch {}
+							},
+							ctx: { userId }
+						};
+						addSubClient(subClient);
+						ws.on("message", (data) => {
+							handleSubMessage(subClient, typeof data === "string" ? data : Buffer.isBuffer(data) ? data.toString("utf8") : Array.isArray(data) ? Buffer.concat(data).toString("utf8") : Buffer.from(data).toString("utf8"));
+						});
+						const closeOut = () => {
+							if (subClient.readyState === 3) return;
+							subClient.readyState = 3;
+							removeSubClient(subClient);
+						};
+						ws.on("close", closeOut);
+						ws.on("error", closeOut);
+					});
+				} catch {
+					try {
+						socket.destroy();
+					} catch {}
+				}
+			});
+			const storageMod = await import("@omg-dev/server");
+			server.middlewares.use(async (req, res, next) => {
+				if (!req.url) return next();
+				if (!req.url.startsWith("/_vibes_storage/")) return next();
+				try {
+					const qIdx = req.url.indexOf("?");
+					const rawPath = qIdx === -1 ? req.url : req.url.slice(0, qIdx);
+					const queryStr = qIdx === -1 ? "" : req.url.slice(qIdx + 1);
+					const rel = decodeURIComponent(rawPath.slice(16));
+					const token = new URLSearchParams(queryStr).get("t") ?? "";
+					if (!rel || rel.includes("..") || rel.includes("//")) {
+						res.statusCode = 400;
+						return res.end(JSON.stringify({ error: "invalid path" }));
+					}
+					let scope;
+					let userId = "";
+					let key = "";
+					if (rel.startsWith("users/")) {
+						const rest = rel.slice(6);
+						const slash = rest.indexOf("/");
+						if (slash <= 0) {
+							res.statusCode = 400;
+							return res.end(JSON.stringify({ error: "invalid path" }));
+						}
+						scope = "user";
+						userId = rest.slice(0, slash);
+						key = rest.slice(slash + 1);
+					} else if (rel.startsWith("app/")) {
+						scope = "app";
+						key = rel.slice(4);
+					} else {
+						res.statusCode = 400;
+						return res.end(JSON.stringify({ error: "invalid scope prefix" }));
+					}
+					const method = (req.method ?? "GET").toUpperCase();
+					if (method === "PUT") {
+						if (!storageMod._verifyDevStorageToken(rel, "put", token)) {
+							res.statusCode = 403;
+							return res.end(JSON.stringify({ error: "invalid or expired token" }));
+						}
+						const chunks = [];
+						let size = 0;
+						const MAX = 25 * 1024 * 1024;
+						req.on("data", (c) => {
+							size += c.length;
+							if (size > MAX) {
+								req.destroy();
+								res.statusCode = 413;
+								res.end(JSON.stringify({ error: "exceeds 25MB" }));
+								return;
+							}
+							chunks.push(c);
+						});
+						req.on("end", () => {
+							try {
+								storageMod._devStorageWrite(scope, userId, key, Buffer.concat(chunks));
+								res.statusCode = 200;
+								res.setHeader("Content-Type", "application/json");
+								res.end(JSON.stringify({
+									ok: true,
+									size
+								}));
+							} catch (err) {
+								res.statusCode = 500;
+								res.end(JSON.stringify({ error: String(err.message) }));
+							}
+						});
+						req.on("error", () => {
+							res.statusCode = 400;
+							res.end();
+						});
+						return;
+					}
+					if (method === "GET" || method === "HEAD") {
+						if (!storageMod._verifyDevStorageToken(rel, "get", token)) {
+							res.statusCode = 403;
+							return res.end(JSON.stringify({ error: "invalid or expired token" }));
+						}
+						const abs = storageMod._devStorageRead(scope, userId, key);
+						if (!abs) {
+							res.statusCode = 404;
+							return res.end(JSON.stringify({ error: "not found" }));
+						}
+						const stat = fs.statSync(abs);
+						res.setHeader("Content-Length", String(stat.size));
+						const ext = path.extname(key).toLowerCase();
+						res.setHeader("Content-Type", {
+							".png": "image/png",
+							".jpg": "image/jpeg",
+							".jpeg": "image/jpeg",
+							".gif": "image/gif",
+							".webp": "image/webp",
+							".svg": "image/svg+xml",
+							".json": "application/json",
+							".pdf": "application/pdf",
+							".mp4": "video/mp4",
+							".webm": "video/webm",
+							".txt": "text/plain"
+						}[ext] ?? "application/octet-stream");
+						res.statusCode = 200;
+						if (method === "HEAD") return res.end();
+						fs.createReadStream(abs).pipe(res);
+						return;
+					}
+					if (method === "OPTIONS") {
+						res.statusCode = 204;
+						res.setHeader("Access-Control-Allow-Origin", "*");
+						res.setHeader("Access-Control-Allow-Methods", "PUT,GET,HEAD,OPTIONS");
+						res.setHeader("Access-Control-Allow-Headers", "Content-Type,Authorization");
+						return res.end();
+					}
+					res.statusCode = 405;
+					res.end(JSON.stringify({ error: "method not allowed" }));
+				} catch (err) {
+					res.statusCode = 500;
+					res.end(JSON.stringify({ error: String(err.message) }));
+				}
+			});
+			server.middlewares.use(async (req, res, next) => {
+				const isApi = req.url?.startsWith("/api/");
+				const isVibesInternal = req.url?.startsWith("/_vibes/");
+				if (!isApi && !isVibesInternal) return next();
+				try {
+					const url = `http://localhost${req.url}`;
+					const headers = {};
+					for (const [key, value] of Object.entries(req.headers)) if (typeof value === "string") headers[key] = value;
+					else if (Array.isArray(value)) headers[key] = value.join(", ");
+					const body = await new Promise((resolve, reject) => {
+						const chunks = [];
+						req.on("data", (chunk) => chunks.push(chunk));
+						req.on("end", () => resolve(Buffer.concat(chunks)));
+						req.on("error", reject);
+					});
+					const fetchReq = new Request(url, {
+						method: req.method,
+						headers,
+						body: body.length > 0 ? body : void 0
+					});
+					const response = isVibesInternal ? await serverInstance.fetch(fetchReq) : await serverInstance.apiHandler(fetchReq);
+					res.statusCode = response.status;
+					response.headers.forEach((value, key) => {
+						res.setHeader(key, value);
+					});
+					const responseBody = await response.arrayBuffer();
+					res.end(Buffer.from(responseBody));
+				} catch (err) {
+					console.error("[vibes] API handler error:", err);
+					res.statusCode = 500;
+					res.end(JSON.stringify({ error: "Internal server error" }));
+				}
+			});
+			console.log("[vibes] Dev server ready (with realtime).");
+		},
+		async handleHotUpdate({ file }) {
+			const rel = path.relative(resolvedRoot, file);
+			if (rel === "schema.ts") {
+				console.log("[vibes] schema.ts changed — regenerating...");
+				await regenerateSchema(resolvedRoot);
+				if (serverInstance) {
+					const newSchema = await loadSchema(resolvedRoot);
+					if (newSchema) serverInstance.migrate(newSchema);
+				}
+				return [];
+			}
+			if (rel.startsWith("functions/") && rel.endsWith(".ts")) {
+				console.log(`[vibes] functions/${path.basename(file)} changed — rescanning routes + triggers...`);
+				await regenerateRoutes(resolvedRoot);
+				try {
+					await regenerateTriggers(resolvedRoot);
+					await serverInstance?.reloadTriggers();
+				} catch (err) {
+					console.error(`[vibes] trigger scan failed:`, err);
+				}
+				try {
+					await regenerateWorkflows(resolvedRoot);
+					await serverInstance?.reloadWorkflows();
+				} catch (err) {
+					console.error(`[vibes] workflow scan failed:`, err);
+				}
+				serverInstance?.reloadFunctions();
+				return [];
+			}
+		},
+		async buildStart() {
+			await generateAll(resolvedRoot);
+		},
+		async transform(code, id) {
+			if (config?.command !== "build") return null;
+			if (!pwaEnabled && !feedbackEnabled && !brandBadgeEnabled) return null;
+			if (!isAppEntry(id, resolvedRoot)) return null;
+			const imports = [];
+			if (brandBadgeEnabled && !brandBadgeInjected) if (!await this.resolve("@omg-dev/sdk/brand/auto", id)) this.warn("[vibes] brand badge: @omg-dev/sdk/brand/auto is not available — badge skipped. Update @omg-dev/sdk, or silence this with vibes({ brandBadge: false }).");
+			else {
+				brandBadgeInjected = true;
+				imports.push(`import "@omg-dev/sdk/brand/auto";`);
+			}
+			if (feedbackEnabled && !brandBadgeEnabled && !feedbackInjected) if (!await this.resolve("@omg-dev/sdk/feedback/auto", id)) this.warn("[vibes] feedback: @omg-dev/sdk is not installed — shake-to-report skipped. Add @omg-dev/sdk to dependencies, or silence this with vibes({ feedback: false }).");
+			else {
+				feedbackInjected = true;
+				imports.push(`import "@omg-dev/sdk/feedback/auto";`);
+			}
+			if (pwaEnabled && pwaOpts.autoPrompt !== false && !pwaAutoInjected) if (!await this.resolve("@omg-dev/pwa/auto", id)) this.warn("[vibes] pwa: @omg-dev/pwa is not installed — soft install prompt skipped. Add @omg-dev/pwa to dependencies, or silence this with vibes({ pwa: { autoPrompt: false } }).");
+			else {
+				pwaAutoInjected = true;
+				imports.push(`import "@omg-dev/pwa/auto";`);
+			}
+			if (pwaEnabled && !brandBadgeEnabled && !remixCtaInjected) {
+				if (await pwaDeclaresSubpathExport((source, importer) => this.resolve(source, importer), id, "./remix-cta")) {
+					remixCtaInjected = true;
+					imports.push(`import "@omg-dev/pwa/remix-cta";`);
+				}
+			}
+			if (imports.length === 0) return null;
+			return {
+				code: `${code}\n${imports.join("\n")}\n`,
+				map: null
+			};
+		},
+		generateBundle() {
+			if (!pwaEnabled) return;
+			if (userManifestHref()) return;
+			const indexPath = path.join(resolvedRoot, "index.html");
+			const cfg = resolvePwaConfig(pwaOpts, fs.existsSync(indexPath) ? fs.readFileSync(indexPath, "utf-8") : "");
+			this.emitFile({
+				type: "asset",
+				fileName: MANIFEST_FILE,
+				source: buildWebManifest(cfg, existingIconFiles())
+			});
+		},
+		closeBundle() {
+			serverInstance?.close();
+			serverInstance = null;
+		}
+	};
+}
+async function loadSchema(root) {
+	const schemaPath = path.join(root, "schema.ts");
+	if (!fs.existsSync(schemaPath)) return null;
+	try {
+		return (await import(`${schemaPath}?t=${Date.now()}`)).default;
+	} catch (err) {
+		console.error("[vibes] Failed to load schema.ts:", err);
+		return null;
+	}
+}
+function readPreviewAppId(root) {
+	const fromEnv = process.env.VIBES_APP_ID?.trim();
+	if (fromEnv && /^[a-z0-9-]+$/.test(fromEnv)) return fromEnv;
+	const metaPath = path.join(root, ".vibes", "app.json");
+	if (!fs.existsSync(metaPath)) return null;
+	try {
+		const meta = JSON.parse(fs.readFileSync(metaPath, "utf-8"));
+		return typeof meta.appId === "string" && /^[a-z0-9-]+$/.test(meta.appId) ? meta.appId : null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
+export { vibes as default };