@peekling/vite 0.1.0

package/AUTHORS

@@ -0,0 +1,8 @@
+Peekling Vite Integration was originally designed and developed by Prajwal S. Venkateshmurthy (https://prajwal.me).
+
+Other contributors are recorded in the repository history.
+
+This is a factual authorship record. Licensing terms and applicable
+notice-retention requirements are in LICENSE and NOTICE. Redistributions must
+comply with Section 4 of the Apache License 2.0, including its applicable
+notice-retention requirements.

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/LICENSING.md

@@ -0,0 +1,20 @@
+# Licensing and attribution
+
+The Peekling Vite integration code and documentation are licensed under
+Apache-2.0. The license allows personal and commercial use, modification,
+distribution, and sublicensing subject to its terms.
+
+Redistributions must comply with Section 4 of the Apache License 2.0, including
+its applicable notice-retention requirements. When a distribution includes a
+`NOTICE` file, Section 4 describes how readable copies of applicable NOTICE
+attributions may be provided. Apache-2.0 does not require every website using
+Peekling to display a visible attribution.
+
+`AUTHORS` is a factual authorship record and does not add a license condition.
+Character assets retain their declared Pack licenses. The Peekling name, logo,
+official mascot, and other distinctive brand identity are outside this code
+license except as allowed by applicable law or separate permission. See Section
+6 of Apache-2.0.
+
+The Apache License text controls if this summary conflicts with it. This summary
+is informational and is not legal advice.

package/NOTICE

@@ -0,0 +1,6 @@
+Peekling Vite Integration
+Copyright 2026 Prajwal S. Venkateshmurthy
+
+Original design and development by Prajwal S. Venkateshmurthy.
+Contact: https://prajwal.me
+Project: https://peekling.com/

package/README.md

@@ -0,0 +1,176 @@
+# `@peekling/vite`
+
+Use the Peekling Vite plugin to validate declared Configuration and Pack JSON
+when Vite starts, when either file changes, and before a production build. The
+plugin runs in Node and does not add code or assets to the browser bundle.
+
+## Prerequisites and installation
+
+- Node.js 22.14.0 or newer
+- Vite 8
+- `@peekling/runtime` 0.1.0 in the application
+
+Install the runtime and the development plugin:
+
+```sh
+npm install @peekling/runtime@0.1.0
+npm install --save-dev @peekling/vite@0.1.0
+```
+
+Vite is a peer dependency. `@peekling/vite` depends on `@peekling/preflight`,
+which uses the exact matching runtime version for shared validation.
+
+## Configure the plugin
+
+This framework-neutral example validates two JSON files inside the Vite root:
+
+```js
+// vite.config.js
+import { defineConfig } from "vite";
+import { peekling } from "@peekling/vite";
+
+export default defineConfig({
+  plugins: [
+    peekling({
+      config: "src/peekling.json",
+      pack: "public/peekling/character.json",
+      baseUrl: "https://example.com/app/",
+    }),
+  ],
+});
+```
+
+One matching project layout is:
+
+```text
+project/
+  vite.config.js
+  src/
+    peekling.json
+  public/
+    peekling/
+      character.json
+      atlas.png
+```
+
+Expected result: Vite starts normally when both files pass Preflight. An invalid
+file reports the diagnostic code, data path, explanation, and suggested fix.
+During development, that invalid edit stops the affected hot update. During a
+production build, it fails through Vite's plugin error channel.
+
+Framework plugins can stay in the same `plugins` array. Peekling does not
+require React, Vue, or another framework plugin.
+
+## Options
+
+| Option    | Required | Meaning                                                                        |
+| --------- | -------- | ------------------------------------------------------------------------------ |
+| `config`  | Yes      | Configuration JSON path relative to the resolved Vite root                     |
+| `pack`    | No       | Pack JSON path relative to the resolved Vite root                              |
+| `baseUrl` | No       | Absolute HTTP or HTTPS page URL used to resolve relative serialized references |
+
+Pass `pack` whenever the Plan names Pack States or Capabilities. Without Pack
+context, Preflight cannot prove that those references exist.
+
+When `baseUrl` is omitted, the plugin resolves Vite's configured `base` against
+`https://peekling.invalid/`. That placeholder checks relative URL syntax without
+claiming a deployment origin. Pass the real page URL when validation should
+model an actual development or deployment path.
+
+`baseUrl` may use HTTP for local development. Absolute resource URLs stored in
+Configuration or Pack data must still use HTTPS.
+
+## When validation runs
+
+| Vite phase               | Plugin behavior                                           |
+| ------------------------ | --------------------------------------------------------- |
+| Configuration resolved   | Resolves the real Vite root and confined input paths      |
+| Build start              | Reads both files and fails the build on validation errors |
+| Development server start | Confirms both inputs and registers them with the watcher  |
+| Hot update               | Rechecks both inputs when either declared file changes    |
+
+A valid edit returns control to normal Vite hot module replacement. The plugin
+does not transform the JSON into a client module or fetch the resource URLs it
+contains.
+
+## Node and browser graphs stay separate
+
+```mermaid
+flowchart TD
+  subgraph node[Node and Vite process]
+    data[Configuration and Pack JSON] --> plugin[@peekling/vite]
+    plugin --> preflight[@peekling/preflight]
+    preflight --> tooling[@peekling/runtime tooling subpaths]
+  end
+
+  subgraph browser[Application browser graph]
+    app[Application code] --> runtime[@peekling/runtime]
+  end
+```
+
+In prose, the plugin and Preflight run only in Vite's Node process. Application
+code imports the runtime separately. There is no client edge from the plugin to
+the runtime, so the plugin does not inject Peekling JavaScript, CSS, CDN URLs,
+or framework adapters.
+
+Vite executes `vite.config.js` through its normal configuration boundary. Once
+Vite calls `peekling(...)`, this plugin treats the supplied paths as data
+locations and does not execute application source.
+
+## File safety
+
+Every declared input must resolve to a regular file inside the real Vite root.
+The plugin rejects:
+
+- symbolic links in the file or any parent path
+- paths that resolve outside the root
+- duplicate JSON object keys
+- invalid UTF-8 or non-data input
+- files larger than 64 KiB
+- files whose identity changes around the bounded read
+
+Watch registration applies the same path boundary before adding a file. Hot
+updates read through the bounded path instead of Vite's unrestricted convenience
+read.
+
+## Troubleshooting
+
+### Plan references cannot be checked
+
+Add the Pack file to the plugin options:
+
+```js
+peekling({
+  config: "src/peekling.json",
+  pack: "public/peekling/character.json",
+});
+```
+
+### A relative URL resolves against the wrong page
+
+Set `baseUrl` to the full page URL that will host the runtime:
+
+```js
+peekling({
+  config: "src/peekling.json",
+  pack: "public/peekling/character.json",
+  baseUrl: "https://example.com/docs/guide/",
+});
+```
+
+### A symlinked input is rejected
+
+Move or copy the JSON data into the real Vite root. The plugin deliberately does
+not follow a symbolic path outside that boundary.
+
+## Related documentation
+
+- [Configure Peekling](../../docs/configuration.md)
+- [`@peekling/preflight`](../preflight/README.md)
+- [`@peekling/cli`](../cli/README.md)
+- [`@peekling/runtime`](../runtime/README.md)
+
+## License
+
+Apache-2.0. See [licensing and attribution](LICENSING.md) for notice retention,
+authorship, and brand boundaries.

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+import type { Plugin } from "vite";
+export interface PeeklingViteOptions {
+    readonly config: string;
+    readonly pack?: string;
+    readonly baseUrl?: string;
+}
+/** Validate data-only Peekling inputs during Vite development and builds. */
+export declare function peekling(input: PeeklingViteOptions): Plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,MAAM,EAAkB,MAAM,MAAM,CAAC;AAInD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,6EAA6E;AAC7E,wBAAgB,QAAQ,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,CA6F3D"}

package/dist/index.js

@@ -0,0 +1,253 @@
+import { constants, realpathSync } from "node:fs";
+import { lstat, open, realpath } from "node:fs/promises";
+import path from "node:path";
+import { preflight } from "@peekling/preflight";
+import { parseDataText } from "@peekling/preflight/json";
+const MAX_INPUT_BYTES = 64 * 1024;
+/** Validate data-only Peekling inputs during Vite development and builds. */
+export function peekling(input) {
+    const options = snapshotOptions(input);
+    let viteConfig;
+    let viteRoot = "";
+    let configPath = "";
+    let packPath;
+    let configWatchPath = "";
+    let packWatchPath;
+    return {
+        name: "peekling:preflight",
+        enforce: "pre",
+        configResolved(config) {
+            viteConfig = config;
+            viteRoot = realpathSync(path.resolve(config.root));
+            configWatchPath = path.resolve(config.root, options.config);
+            packWatchPath = options.pack
+                ? path.resolve(config.root, options.pack)
+                : undefined;
+            configPath = resolveInput(viteRoot, options.config, "config");
+            packPath = options.pack
+                ? resolveInput(viteRoot, options.pack, "pack")
+                : undefined;
+        },
+        async buildStart() {
+            const report = await validateFiles();
+            for (const warning of report.warnings) {
+                this.warn(formatIssue("warning", warning));
+            }
+            if (!report.valid)
+                this.error(formatReport(report));
+        },
+        async configureServer(server) {
+            await Promise.all([
+                readJsonInput(configPath, viteRoot),
+                ...(packPath ? [readJsonInput(packPath, viteRoot)] : []),
+            ]);
+            server.watcher.add([configPath, ...(packPath ? [packPath] : [])]);
+        },
+        async handleHotUpdate(context) {
+            const candidate = path.resolve(context.file);
+            if (candidate !== configPath &&
+                candidate !== packPath &&
+                candidate !== configWatchPath &&
+                candidate !== packWatchPath) {
+                return;
+            }
+            let changed;
+            try {
+                changed = await canonicalCandidate(context.file, viteRoot);
+            }
+            catch (cause) {
+                if (cause.code !== "ENOENT")
+                    throw cause;
+                const label = candidate === configPath || candidate === configWatchPath
+                    ? "config"
+                    : "pack";
+                throw new Error(`Peekling ${label} input was removed during a hot update`);
+            }
+            const expected = candidate === packPath || candidate === packWatchPath
+                ? packPath
+                : configPath;
+            if (changed !== expected) {
+                throw new Error("Peekling input has a symbolic path component");
+            }
+            const report = await validateFiles();
+            for (const warning of report.warnings) {
+                viteConfig?.logger?.warn(formatIssue("warning", warning));
+            }
+            if (!report.valid)
+                throw new Error(formatReport(report));
+        },
+    };
+    async function validateFiles() {
+        if (!viteConfig)
+            throw new Error("Peekling Vite plugin is not configured");
+        const configuration = await readJsonInput(configPath, viteRoot);
+        const pack = packPath ? await readJsonInput(packPath, viteRoot) : undefined;
+        return preflight(configuration, {
+            ...(pack !== undefined ? { pack } : {}),
+            baseUrl: options.baseUrl ??
+                new URL(viteConfig.base, "https://peekling.invalid/").href,
+        });
+    }
+    function formatReport(report) {
+        return [
+            `Peekling validation failed for ${path.relative(viteConfig.root, configPath)}`,
+            ...report.errors.map((issue) => formatIssue("error", issue)),
+        ].join("\n");
+    }
+}
+async function readJsonInput(target, root) {
+    const label = path.basename(target);
+    const canonical = await canonicalCandidate(target, root);
+    if (canonical !== target) {
+        throw new Error(`${label} has a symbolic path component`);
+    }
+    const metadata = await lstat(target);
+    if (metadata.isSymbolicLink()) {
+        throw new Error(`${label} must not be a symbolic link`);
+    }
+    if (!metadata.isFile())
+        throw new Error(`${label} must be a regular file`);
+    if (metadata.size > MAX_INPUT_BYTES) {
+        throw new Error(`${label} exceeds 65536 bytes`);
+    }
+    const handle = await open(target, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+        const opened = await handle.stat();
+        if (!opened.isFile())
+            throw new Error(`${label} must be a regular file`);
+        if (opened.dev !== metadata.dev || opened.ino !== metadata.ino) {
+            throw new Error(`${label} changed before it could be read`);
+        }
+        if (opened.size > MAX_INPUT_BYTES) {
+            throw new Error(`${label} exceeds 65536 bytes`);
+        }
+        const confirmed = await canonicalCandidate(target, root);
+        const current = await lstat(target);
+        if (confirmed !== target ||
+            current.isSymbolicLink() ||
+            current.dev !== opened.dev ||
+            current.ino !== opened.ino) {
+            throw new Error(`${label} changed before it could be read`);
+        }
+        const bytes = Buffer.alloc(MAX_INPUT_BYTES + 1);
+        let offset = 0;
+        while (offset < bytes.byteLength) {
+            const { bytesRead } = await handle.read(bytes, offset, bytes.byteLength - offset, offset);
+            if (bytesRead === 0)
+                break;
+            offset += bytesRead;
+        }
+        if (offset > MAX_INPUT_BYTES) {
+            throw new Error(`${label} exceeds 65536 bytes`);
+        }
+        const after = await canonicalCandidate(target, root);
+        const final = await lstat(target);
+        if (after !== target ||
+            final.isSymbolicLink() ||
+            final.dev !== opened.dev ||
+            final.ino !== opened.ino) {
+            throw new Error(`${label} changed while it was read`);
+        }
+        let text;
+        try {
+            text = new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, offset));
+        }
+        catch (cause) {
+            throw new Error(`${label} must be valid UTF-8`, { cause });
+        }
+        return parseDataText(text, label);
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function canonicalCandidate(target, root) {
+    const canonical = await realpath(path.resolve(target));
+    const relative = path.relative(root, canonical);
+    if (relative === ".." ||
+        relative.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(relative)) {
+        throw new Error("Peekling input must stay inside the real Vite root");
+    }
+    return canonical;
+}
+function snapshotOptions(input) {
+    try {
+        if (!input ||
+            typeof input !== "object" ||
+            Array.isArray(input) ||
+            (Object.getPrototypeOf(input) !== Object.prototype &&
+                Object.getPrototypeOf(input) !== null)) {
+            throw new TypeError();
+        }
+        const descriptors = Object.getOwnPropertyDescriptors(input);
+        if (Object.getOwnPropertySymbols(input).length > 0)
+            throw new TypeError();
+        const output = Object.create(null);
+        for (const [key, descriptor] of Object.entries(descriptors)) {
+            if (!("value" in descriptor))
+                throw new TypeError();
+            output[key] = descriptor.value;
+        }
+        for (const key of Object.keys(output)) {
+            if (key !== "config" && key !== "pack" && key !== "baseUrl") {
+                throw new TypeError(`Unknown Peekling Vite option ${key}`);
+            }
+        }
+        for (const key of ["config", "pack"]) {
+            const value = output[key];
+            if ((key === "config" || value !== undefined) &&
+                (typeof value !== "string" ||
+                    value.length < 1 ||
+                    value.length > 4_096 ||
+                    /[\0\r\n]/.test(value))) {
+                throw new TypeError(`Peekling Vite ${key} must be a bounded path`);
+            }
+        }
+        if (output.baseUrl !== undefined &&
+            (typeof output.baseUrl !== "string" || !absoluteHttpUrl(output.baseUrl))) {
+            throw new TypeError("Peekling Vite baseUrl must be an absolute HTTP or HTTPS URL");
+        }
+        return output;
+    }
+    catch (cause) {
+        if (cause instanceof TypeError && cause.message.includes("Peekling Vite"))
+            throw cause;
+        throw new TypeError("Peekling Vite options must be a plain object with own data properties");
+    }
+}
+function absoluteHttpUrl(value) {
+    try {
+        const parsed = new URL(value);
+        return parsed.protocol === "http:" || parsed.protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+function resolveInput(root, input, label) {
+    const resolved = path.resolve(root, input);
+    const relative = path.relative(path.resolve(root), resolved);
+    if (relative === ".." ||
+        relative.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(relative)) {
+        throw new Error(`Peekling ${label} input must stay inside the Vite root`);
+    }
+    if (path.extname(resolved).toLowerCase() !== ".json") {
+        throw new Error(`Peekling ${label} input must be a JSON data file`);
+    }
+    const canonical = realpathSync(resolved);
+    const canonicalRelative = path.relative(root, canonical);
+    if (canonicalRelative === ".." ||
+        canonicalRelative.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(canonicalRelative)) {
+        throw new Error(`Peekling ${label} input must stay inside the real Vite root`);
+    }
+    if (canonical !== resolved) {
+        throw new Error(`Peekling ${label} input has a symbolic path component`);
+    }
+    return canonical;
+}
+function formatIssue(severity, issue) {
+    return `${severity.toUpperCase()} ${issue.code} at ${issue.path}\n  ${issue.message}\n  Fix: ${issue.fix}`;
+}

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "@peekling/vite",
+  "version": "0.1.0",
+  "description": "Development-time Peekling validation for Vite projects",
+  "license": "Apache-2.0",
+  "author": {
+    "name": "Prajwal S. Venkateshmurthy",
+    "url": "https://prajwal.me"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/peekling/peekling-engine.git"
+  },
+  "homepage": "https://github.com/peekling/peekling-engine#readme",
+  "bugs": {
+    "url": "https://github.com/peekling/peekling-engine/issues"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=22.14.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "files": [
+    "dist/**/*.js",
+    "dist/**/*.d.ts",
+    "dist/**/*.d.ts.map",
+    "README.md",
+    "LICENSE",
+    "NOTICE",
+    "AUTHORS",
+    "LICENSING.md"
+  ],
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "@peekling/preflight": "0.1.0"
+  },
+  "peerDependencies": {
+    "vite": "^8.0.0"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "prepack": "npm --prefix ../.. run build",
+    "test": "npm run build && node --test test/*.test.mjs",
+    "typecheck": "tsc -b --pretty false"
+  },
+  "devDependencies": {
+    "typescript": "^7.0.2",
+    "vite": "^8.2.2"
+  }
+}