@pix3/vite-plugin 0.0.0-stage → 2.0.0-alpha.1

package/dist/player/dev/editor-link.js

@@ -0,0 +1,125 @@
+/**
+ * The "Pix3 editor" link over the game in dev (`virtual:pix3/dev`; not on `?clean`, not in a
+ * frame, not in a build). A second editor tab would open read-only (the writer lock), so the link
+ * first asks over a `BroadcastChannel` whether an editor of this dev server is open: if one
+ * answers, the page says so and tries to bring its opener forward; if none does, this tab becomes
+ * the editor. The editor answers in `packages/editor-core/src/host/editor-presence.ts`.
+ */
+/** Keep in step with `editor-presence.ts` in editor-core. */
+export const EDITOR_PRESENCE_CHANNEL = 'pix3-editor-presence';
+const ANSWER_MS = 300;
+const HIDDEN_KEY = 'pix3:editor-link:hidden';
+/** True when an editor tab of this origin answers within {@link ANSWER_MS}. */
+export const isEditorOpen = (timeoutMs = ANSWER_MS) => new Promise(resolve => {
+    if (typeof BroadcastChannel === 'undefined') {
+        resolve(false);
+        return;
+    }
+    const channel = new BroadcastChannel(EDITOR_PRESENCE_CHANNEL);
+    const id = Math.random().toString(36).slice(2);
+    const done = (open) => {
+        clearTimeout(timer);
+        channel.close();
+        resolve(open);
+    };
+    const timer = setTimeout(() => done(false), timeoutMs);
+    channel.onmessage = event => {
+        const data = event.data;
+        if (data?.type === 'pong' && data.id === id)
+            done(true);
+    };
+    channel.postMessage({ type: 'ping', id });
+});
+/** Go to the editor: this tab becomes it, unless one is already open. */
+export const openEditor = async (editorUrl) => {
+    if (await isEditorOpen()) {
+        try {
+            // The editor opened this page (Play in Browser Tab / with Profiler): it is the opener.
+            window.opener?.focus();
+        }
+        catch {
+            // A cross-origin or severed opener: nothing to focus.
+        }
+        return 'already-open';
+    }
+    window.location.href = editorUrl;
+    return 'navigated';
+};
+const STYLE = `
+:host { all: initial; }
+.link {
+  position: fixed; left: 8px; bottom: 8px; z-index: 2147483646;
+  display: flex; align-items: center; gap: 2px;
+  font: 600 11px/1 ui-sans-serif, system-ui, -apple-system, "Segoe UI", sans-serif;
+  color: #e8e8e8; background: rgba(18, 18, 20, 0.72); border: 1px solid rgba(255,255,255,0.14);
+  border-radius: 999px; padding: 2px; opacity: 0.55; transition: opacity 120ms ease;
+}
+.link:hover, .link:focus-within { opacity: 1; }
+button { font: inherit; color: inherit; background: none; border: 0; cursor: pointer;
+  border-radius: 999px; display: inline-flex; align-items: center; gap: 5px; padding: 4px 8px; }
+button:hover { background: rgba(255,255,255,0.1); }
+button:focus-visible { outline: 2px solid rgba(255,207,51,0.6); }
+.close { padding: 4px; }
+svg { display: block; width: 12px; height: 12px; }
+.note { padding: 4px 8px 4px 4px; color: #ffcf33; font-weight: 500; }
+`;
+// Feather `edit-3` and `x`, inline: the player has no IconService.
+const EDIT_ICON = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M12 20h9"/><path d="M16.5 3.5a2.121 2.121 0 0 1 3 3L7 19l-4 1 1-4L16.5 3.5z"/></svg>';
+const CLOSE_ICON = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>';
+const isHidden = () => {
+    try {
+        return sessionStorage.getItem(HIDDEN_KEY) === '1';
+    }
+    catch {
+        return false;
+    }
+};
+/** Mount the link; returns the teardown. Hidden for the rest of the tab's session by its close button. */
+export function mountEditorLink(editorUrl) {
+    if (isHidden())
+        return () => undefined;
+    const host = document.createElement('div');
+    host.className = 'pix3-editor-link';
+    const root = host.attachShadow({ mode: 'open' });
+    root.innerHTML = `<style>${STYLE}</style>
+<div class="link" part="link">
+  <button type="button" data-action="open" title="Open this project in the Pix3 editor">${EDIT_ICON}<span>Pix3 editor</span></button>
+  <span class="note" hidden>Already open in another tab</span>
+  <button type="button" class="close" data-action="hide" title="Hide" aria-label="Hide the editor link">${CLOSE_ICON}</button>
+</div>`;
+    const link = root.querySelector('.link');
+    const note = root.querySelector('.note');
+    // Keep the game's own listeners out of the link's clicks.
+    for (const type of ['pointerdown', 'pointerup', 'touchstart', 'touchend', 'keydown']) {
+        link.addEventListener(type, event => event.stopPropagation());
+    }
+    let noteTimer;
+    root.addEventListener('click', event => {
+        const action = event.target
+            ?.closest('[data-action]')
+            ?.getAttribute('data-action');
+        if (action === 'hide') {
+            try {
+                sessionStorage.setItem(HIDDEN_KEY, '1');
+            }
+            catch {
+                // Hidden for this page only.
+            }
+            host.remove();
+        }
+        else if (action === 'open') {
+            void openEditor(editorUrl).then(outcome => {
+                if (outcome !== 'already-open')
+                    return;
+                note.hidden = false;
+                clearTimeout(noteTimer);
+                noteTimer = setTimeout(() => (note.hidden = true), 3000);
+            });
+        }
+    });
+    document.body.appendChild(host);
+    return () => {
+        clearTimeout(noteTimer);
+        host.remove();
+    };
+}

package/dist/player/index.d.ts

@@ -0,0 +1,38 @@
+import { SceneRunner } from '@pix3/runtime';
+import 'virtual:pix3/spine';
+import 'virtual:pix3/postprocessing';
+/**
+ * `@pix3/vite-plugin/player` (plan §B.5): the game's entry. A project's `src/main.ts` is
+ * `import { startGame } from '@pix3/vite-plugin/player'; startGame('#app');` — in dev the scenes
+ * and assets are fetched from the dev server, in a build they are embedded (html) or sit beside
+ * `index.html` (zip). Port of the 1.x `runtime/src/main.ts` + `register-project-scripts.ts`.
+ *
+ * `window.__PIX3_PLAYER__` is the gate's witness: `status`, `frames` (loop iterations), `errors`.
+ * In dev (`virtual:pix3/dev`), `/?debug` adds the debug overlay (`player/debug/`) and
+ * `__PIX3_PLAYER__.debug.snapshot()`, a plain page gets the "Pix3 editor" link
+ * (`player/dev/`), and `?scene=<res path>` boots that scene.
+ */
+export interface Pix3PlayerState {
+    status: 'booting' | 'running' | 'failed';
+    /** Frames the runner's loop has run. */
+    frames: number;
+    errors: string[];
+    /** The scene the player booted into. */
+    scene: string | null;
+    runner: SceneRunner | null;
+    /** Debug mode only (`/?debug` in dev): the overlay's numbers, for an agent over CDP. */
+    debug?: {
+        snapshot(): unknown;
+    };
+}
+declare global {
+    interface Window {
+        __PIX3_PLAYER__?: Pix3PlayerState;
+    }
+}
+export interface StartGameOptions {
+    /** `res://`-relative scene to boot instead of the manifest's entry scene. */
+    readonly scene?: string;
+}
+/** Boot the game into `target` (a selector or an element; `#app` by default). */
+export declare function startGame(target?: string | HTMLElement, options?: StartGameOptions): Promise<SceneRunner>;

package/dist/player/index.js

@@ -0,0 +1,119 @@
+import { AssetLoader, AudioService, registerBuiltInScripts, registerProjectScriptExports, ResourceManager, RuntimeRenderer, SceneLoader, SceneManager, SceneRunner, ScriptRegistry, } from '@pix3/runtime';
+import { devSceneOverride, installDevTools } from 'virtual:pix3/dev';
+import { embeddedAssets } from 'virtual:pix3/embedded-assets';
+import { installNetworkService } from 'virtual:pix3/network';
+import { modules as projectScriptModules } from 'virtual:pix3/project-scripts';
+import { activeScenePath, resourceBase, runtimeAutoloads, runtimeFonts, runtimeLocalization, runtimeQuality, runtimeViewportBaseSize, scenePaths, } from 'virtual:pix3/scene-manifest';
+// Registers the optional Spine runtime (lazily in dev, statically in a build that uses it).
+// Must run before the first scene load.
+import 'virtual:pix3/spine';
+// Same arrangement for `postprocessing`: registered statically when a single-file build places
+// a PostProcess node, the runtime's own code-split import otherwise.
+import 'virtual:pix3/postprocessing';
+const describe = (error) => error instanceof Error ? `${error.name}: ${error.message}` : String(error);
+const installState = () => {
+    const existing = window.__PIX3_PLAYER__;
+    if (existing)
+        return existing;
+    const state = {
+        status: 'booting',
+        frames: 0,
+        errors: [],
+        scene: null,
+        runner: null,
+    };
+    window.__PIX3_PLAYER__ = state;
+    window.addEventListener('error', event => {
+        state.errors.push(event.message || describe(event.error));
+    });
+    window.addEventListener('unhandledrejection', event => {
+        state.errors.push(`unhandledrejection: ${describe(event.reason)}`);
+    });
+    return state;
+};
+/**
+ * Dev only: the `?scene=` the editor's Play in Browser Tab / with Profiler asks for, when it is one
+ * of the project's scenes (a prefab or a typo falls back to the entry scene, with a warning).
+ */
+const requestedScene = () => {
+    const scene = devSceneOverride();
+    if (!scene)
+        return null;
+    if (scenePaths.includes(scene))
+        return scene;
+    console.warn(`[pix3] ?scene=${scene} is not one of the project's scenes; starting the entry scene.`);
+    return null;
+};
+/** Boot the game into `target` (a selector or an element; `#app` by default). */
+export async function startGame(target = '#app', options = {}) {
+    const state = installState();
+    try {
+        const app = typeof target === 'string' ? document.querySelector(target) : target;
+        if (!app)
+            throw new Error(`Missing ${typeof target === 'string' ? target : 'mount'} container`);
+        const resourceManager = new ResourceManager(resourceBase, embeddedAssets);
+        const audioService = new AudioService();
+        const scriptRegistry = new ScriptRegistry();
+        registerBuiltInScripts(scriptRegistry);
+        for (const [file, exports] of Object.entries(projectScriptModules)) {
+            registerProjectScriptExports(scriptRegistry, exports, file.replace(/^\/+/, ''));
+        }
+        const assetLoader = new AssetLoader(resourceManager, audioService);
+        const sceneLoader = new SceneLoader(assetLoader, scriptRegistry, resourceManager);
+        // No SceneSaver: a player never writes scenes back out, and one would pin every node class
+        // and `yaml.stringify` into the bundle (CLAUDE.md «Playable export size»).
+        const sceneManager = new SceneManager(sceneLoader);
+        const scenePath = options.scene || requestedScene() || activeScenePath || scenePaths[0];
+        if (!scenePath)
+            throw new Error('No scenes found in this project.');
+        state.scene = scenePath;
+        const renderer = new RuntimeRenderer({
+            antialias: runtimeQuality.antialias,
+            shadows: runtimeQuality.shadows,
+            pixelRatio: Math.min(window.devicePixelRatio || 1, runtimeQuality.maxPixelRatio),
+        });
+        renderer.attach(app);
+        const runner = new SceneRunner(sceneManager, renderer, audioService, assetLoader, runtimeViewportBaseSize);
+        state.runner = runner;
+        // Project autoloads: built once when the first scene starts, kept across `changeScene` —
+        // the same runtime code the editor's play mode runs.
+        runner.setAutoloads(runtimeAutoloads, scriptRegistry);
+        // The loop runs on rAF; counting its iterations here is what `__PIX3_PLAYER__.frames` reports.
+        runner.setFrameScheduler({
+            request: callback => requestAnimationFrame(time => {
+                state.frames++;
+                callback(time);
+            }),
+            cancel: handle => cancelAnimationFrame(handle),
+        });
+        // Multiplayer (D5): owned by the runner, inert until a script connects; the generated module
+        // is a no-op when nothing in the project mentions the network.
+        installNetworkService(runner);
+        // Debug mode (`/?debug`, dev only): the overlay subscribes before the scene loads, so a
+        // failed boot still shows its errors there.
+        installDevTools({ runner, renderer, audio: audioService, state });
+        runner.setBatching2DEnabled(true);
+        runner.setProjectFonts(runtimeFonts.length > 0 ? runtimeFonts : null);
+        if (runtimeLocalization) {
+            runner.setLocalizationConfig({
+                defaultLocale: runtimeLocalization.defaultLocale,
+                fallbackLocale: runtimeLocalization.fallbackLocale,
+                locales: runtimeLocalization.locales,
+            });
+        }
+        // No pre-packed atlas: nothing in 2.x writes `assets/.atlas/atlas-manifest.json` (the editor
+        // packs into IndexedDB for its own play mode), so the player does not probe for one
+        // (.plans/player-build.md P26).
+        // `loadAndStartScene` reads, parses and runs the graph directly; `startScene` would clone it
+        // through the serializer, which a player does not need (and must not bundle).
+        await runner.loadAndStartScene(scenePath);
+        state.status = 'running';
+        return runner;
+    }
+    catch (error) {
+        state.status = 'failed';
+        state.errors.push(describe(error));
+        console.error('[pix3] Failed to start the game:', error);
+        throw error;
+    }
+}

package/dist/server/editor-socket.d.ts

@@ -0,0 +1,53 @@
+import type { IncomingMessage } from 'node:http';
+import type { Duplex } from 'node:stream';
+/**
+ * The editor's own WebSocket, `/__pix3/ws` (plan §B.2, variant B): the editor page carries no
+ * `/@vite/client`, so neither Vite's `full-reload` nor its reload-after-reconnect ever reaches
+ * it. Everything the plugin tells the page — file changes, "re-import your scripts", "flush" —
+ * goes over this socket.
+ *
+ * Client → plugin: `{type:'hello', tabId}` once, then `{type:'reply', id, ...}` answers.
+ * Plugin → client: `{type:'welcome', ...}`, broadcast frames (`pix3:fs`, `pix3:writer`,
+ * `pix3:scripts`), and requests `{type:'request', id, kind, ...}` that the tab answers by `id`.
+ */
+export interface EditorTab {
+    readonly tabId: string;
+    readonly connectedAt: number;
+    /** The page's `Origin` (the address the browser reached the server at), when it sent one. */
+    readonly origin?: string;
+}
+export type RequestReply = Record<string, unknown> & {
+    readonly ok: boolean;
+};
+export interface EditorSocketOptions {
+    /** URL path of the socket (`<base>__pix3/ws`). */
+    readonly path: string;
+    /** Throws to refuse the upgrade (host, peer address, origin — `RequestGuard`). */
+    readonly accept: (req: IncomingMessage) => void;
+    /** First frame a tab gets after its `hello`. */
+    readonly welcome: (tab: EditorTab) => Record<string, unknown>;
+    readonly log?: (line: string) => void;
+    readonly onTabsChanged?: () => void;
+}
+export declare class EditorSocket {
+    private readonly options;
+    private readonly wss;
+    private readonly connections;
+    private readonly pending;
+    constructor(options: EditorSocketOptions);
+    /** `httpServer.on('upgrade')` handler; returns false for upgrades that are not ours. */
+    handleUpgrade(req: IncomingMessage, socket: Duplex, head: Buffer): boolean;
+    /** Connected editor tabs, oldest first. */
+    tabs(): EditorTab[];
+    hasTab(tabId: string): boolean;
+    broadcast(frame: Record<string, unknown>): void;
+    /**
+     * Ask one tab to do something and wait for its answer. Never rejects: a missing tab, a closed
+     * socket or silence become `{ok:false, reason:'no_tab'|'tab_closed'|'timeout'}`.
+     */
+    request(tabId: string, kind: string, payload: Record<string, unknown>, timeoutMs: number): Promise<RequestReply>;
+    close(): void;
+    private adopt;
+    private drop;
+    private onMessage;
+}

package/dist/server/editor-socket.js

@@ -0,0 +1,134 @@
+import { randomUUID } from 'node:crypto';
+import { WebSocketServer } from 'ws';
+import { isRecord } from "./http.js";
+const TAB_ID_PATTERN = /^[A-Za-z0-9_.:-]{1,128}$/;
+export class EditorSocket {
+    options;
+    wss = new WebSocketServer({ noServer: true });
+    connections = new Set();
+    pending = new Map();
+    constructor(options) {
+        this.options = options;
+    }
+    /** `httpServer.on('upgrade')` handler; returns false for upgrades that are not ours. */
+    handleUpgrade(req, socket, head) {
+        const path = (req.url ?? '').split('?')[0];
+        if (path !== this.options.path)
+            return false;
+        try {
+            this.options.accept(req);
+        }
+        catch {
+            socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
+            socket.destroy();
+            return true;
+        }
+        const origin = typeof req.headers.origin === 'string' ? req.headers.origin : null;
+        this.wss.handleUpgrade(req, socket, head, ws => this.adopt(ws, origin));
+        return true;
+    }
+    /** Connected editor tabs, oldest first. */
+    tabs() {
+        const out = [];
+        for (const connection of this.connections)
+            if (connection.tab)
+                out.push(connection.tab);
+        return out.sort((a, b) => a.connectedAt - b.connectedAt);
+    }
+    hasTab(tabId) {
+        return this.tabs().some(tab => tab.tabId === tabId);
+    }
+    broadcast(frame) {
+        const text = JSON.stringify(frame);
+        for (const connection of this.connections) {
+            if (connection.tab)
+                connection.socket.send(text);
+        }
+    }
+    /**
+     * Ask one tab to do something and wait for its answer. Never rejects: a missing tab, a closed
+     * socket or silence become `{ok:false, reason:'no_tab'|'tab_closed'|'timeout'}`.
+     */
+    request(tabId, kind, payload, timeoutMs) {
+        const connection = [...this.connections].find(c => c.tab?.tabId === tabId);
+        if (!connection)
+            return Promise.resolve({ ok: false, reason: 'no_tab', tabId });
+        const id = randomUUID();
+        return new Promise(resolve => {
+            const timer = setTimeout(() => {
+                this.pending.delete(id);
+                resolve({ ok: false, reason: 'timeout', tabId });
+            }, timeoutMs);
+            this.pending.set(id, { tabId, resolve, timer });
+            connection.socket.send(JSON.stringify({ type: 'request', id, kind, ...payload }));
+        });
+    }
+    close() {
+        for (const [id, pending] of this.pending) {
+            clearTimeout(pending.timer);
+            pending.resolve({ ok: false, reason: 'tab_closed', tabId: pending.tabId });
+            this.pending.delete(id);
+        }
+        for (const connection of this.connections)
+            connection.socket.terminate();
+        this.connections.clear();
+        this.wss.close();
+    }
+    adopt(socket, origin) {
+        const connection = { socket, origin, tab: null };
+        this.connections.add(connection);
+        socket.on('message', (raw) => this.onMessage(connection, raw));
+        socket.on('close', () => this.drop(connection));
+        socket.on('error', () => this.drop(connection));
+    }
+    drop(connection) {
+        if (!this.connections.delete(connection))
+            return;
+        const tabId = connection.tab?.tabId;
+        if (!tabId)
+            return;
+        for (const [id, pending] of this.pending) {
+            if (pending.tabId !== tabId)
+                continue;
+            clearTimeout(pending.timer);
+            this.pending.delete(id);
+            pending.resolve({ ok: false, reason: 'tab_closed', tabId });
+        }
+        this.options.log?.(`editor tab ${tabId} disconnected`);
+        this.options.onTabsChanged?.();
+    }
+    onMessage(connection, raw) {
+        let message;
+        try {
+            message = JSON.parse(String(raw));
+        }
+        catch {
+            return;
+        }
+        if (!isRecord(message))
+            return;
+        if (message.type === 'hello') {
+            const tabId = message.tabId;
+            if (connection.tab || typeof tabId !== 'string' || !TAB_ID_PATTERN.test(tabId))
+                return;
+            connection.tab = {
+                tabId,
+                connectedAt: Date.now(),
+                ...(connection.origin ? { origin: connection.origin } : {}),
+            };
+            connection.socket.send(JSON.stringify({ type: 'welcome', ...this.options.welcome(connection.tab) }));
+            this.options.log?.(`editor tab ${tabId} connected`);
+            this.options.onTabsChanged?.();
+            return;
+        }
+        if (message.type === 'reply' && typeof message.id === 'string') {
+            const pending = this.pending.get(message.id);
+            if (!pending || pending.tabId !== connection.tab?.tabId)
+                return;
+            clearTimeout(pending.timer);
+            this.pending.delete(message.id);
+            const { type: _type, id: _id, ...rest } = message;
+            pending.resolve({ ...rest, ok: rest.ok === true });
+        }
+    }
+}

package/dist/server/guard.d.ts

@@ -0,0 +1,61 @@
+import type { IncomingMessage } from 'node:http';
+/**
+ * Who may talk to `/__pix3/*` (plan §B.1 «Защита записи»).
+ *
+ * The plugin's middleware runs before Vite's own host validation (it is a pre-middleware), so it
+ * checks the `Host` itself:
+ * - **Host** — `localhost`, a literal loopback address (127.0.0.0/8, ::1) or one of
+ *   `server.allowedHosts` (DNS rebinding: a page on an attacker's domain that resolves to
+ *   127.0.0.1 still sends its own name — and `127.evil.com` is a name, not an address); under
+ *   `allowRemote` any IP literal too, as Vite allows (a rebinding page never has one);
+ * - **peer address** — loopback unless `allowRemote` (a dev server started with `--host` must not
+ *   hand the project's files to the LAN);
+ * - **mutations and the WebSocket** — `X-Pix3: 1` (mutations) and, when the request carries an
+ *   `Origin`, the page's own origin. A cross-site page cannot add the header without a CORS
+ *   preflight, which this server never answers; a WebSocket has no preflight at all, so its
+ *   `Origin` is the only thing that keeps another site's tab from opening the event stream.
+ *   Local processes (the CLI) send no `Origin`.
+ */
+export type AllowedHosts = readonly string[] | true;
+export interface GuardOptions {
+    readonly allowRemote: boolean;
+    /** Vite's `server.allowedHosts` (`true` = any). */
+    readonly allowedHosts: () => AllowedHosts;
+}
+/** `Host` header → lower-cased name (`[::1]` keeps its brackets), or null when malformed. */
+export declare const hostNameOf: (hostHeader: string | undefined) => string | null;
+export declare const isAllowedHost: (hostHeader: string | undefined, allowed: AllowedHosts, options?: {
+    readonly allowRemote?: boolean;
+}) => boolean;
+export declare const isLoopbackAddress: (address: string | undefined) => boolean;
+export declare class RequestGuard {
+    private readonly options;
+    constructor(options: GuardOptions);
+    /** Every `/__pix3/*` request, reads included. */
+    checkPeer(req: IncomingMessage): void;
+    /** The editor's WebSocket upgrade: no preflight exists, so its `Origin` is the only fence. */
+    checkSocket(req: IncomingMessage): void;
+    private checkSameOrigin;
+    /** Anything that is not GET/HEAD. */
+    checkMutation(req: IncomingMessage): void;
+    /**
+     * Routes only the editor page may use, reads included: the image-generation keys and proxy
+     * (plan §B.1). On top of {@link checkMutation}:
+     * - `Sec-Fetch-Site`, when the browser sends it, is `same-origin`;
+     * - `Referer`, when sent, is a page under `editorPrefix` (`<base>__pix3/`) — the game at `/` is
+     *   the same origin, so the origin alone cannot tell the two apart;
+     * - `X-Pix3-Session` is the token the plugin hands only to a top-level navigation of the editor
+     *   page ({@link editorSessionFor}). A `Referer` is the page's to choose within its origin
+     *   (`fetch(url, {referrer})`), the token is not.
+     * Same-origin isolation has limits a header cannot fix (a service worker the game registers on
+     * `/` sees the editor's traffic); the key itself never reaches any page.
+     */
+    checkEditorOnly(req: IncomingMessage, editorPrefix: string, sessionToken: string): void;
+}
+/**
+ * The session token for an editor-page request, or null when this request must not get it: the
+ * page fetched by script (`Sec-Fetch-Dest: empty`) or framed (`iframe`) — the game at `/` can do
+ * both. Browsers send `Sec-Fetch-*` only to secure origins (https, localhost); without them (a
+ * plain-http LAN address under `allowRemote`, a non-browser client) the token is handed out.
+ */
+export declare const editorSessionFor: (req: IncomingMessage, token: string) => string | null;