@playcademy/vite-plugin 1.1.3-beta.3 → 1.1.3-beta.4

package/dist/config/proxy.d.ts

@@ -9,4 +9,4 @@ export interface ProxyConfig {
 /**
  * Create proxy configuration for backend API and reserved runtime routes.
  */
-export declare function createProxyConfig(existingProxy: Record<string, string | ProxyOptions>, backendPort: number): Record<string, string | ProxyOptions>;
+export declare function createProxyConfig(existingProxy: Record<string, string | ProxyOptions>, gameBackendPort: number): Record<string, string | ProxyOptions>;

package/dist/config/vite-config.d.ts

@@ -5,4 +5,4 @@ import type { UserConfig } from 'vite';
 /**
  * Create Vite configuration with Playcademy-specific settings
  */
-export declare function createViteConfig(userConfig: UserConfig, backendPort: number): UserConfig;
+export declare function createViteConfig(userConfig: UserConfig, gameBackendPort: number): UserConfig;

package/dist/dashboard/middleware.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Local dashboard proxies
+ *
+ * Dashboard mode runs the REAL composed dashboard worker (platform auth
+ * layer + the app's own api/ routes) under Miniflare, and this middleware
+ * proxies `/api/*` to it with a synthetic session cookie attached. The
+ * session gate, same-origin check, and role policy all execute exactly as
+ * deployed; the browser just never sees a login page.
+ *
+ * The one exception is `GET /api/dash/game`: deployed, the worker fetches
+ * the game from the platform — locally there is no platform, so the plugin
+ * serves it from playcademy.config.
+ *
+ * The sealed-page proxy is the inverse: it forwards navigations WITHOUT a
+ * session, so the worker serves its login/invite/reset pages on this
+ * origin — see createSealedPageProxy.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { PlaycademyDashboardLocalGameInfo } from 'playcademy/utils';
+import type { DashboardUserRole } from '@playcademy/constants';
+export declare function json(res: ServerResponse, status: number, body: unknown): void;
+export interface DashboardProxyOptions {
+    /** Base URL of the local dashboard worker */
+    workerUrl: string;
+    /** Mint a session cookie for the current role */
+    mintCookie: (role: DashboardUserRole) => Promise<string>;
+    /** Read the current role (toggled at runtime via hotkey) */
+    currentRole: () => DashboardUserRole;
+    /**
+     * Local stand-in for the platform-backed /api/dash/game endpoint —
+     * a getter so config reloads serve fresh data.
+     */
+    localGame: () => PlaycademyDashboardLocalGameInfo;
+    /** Injectable for tests */
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Connect handler proxying `/api/*` to the local dashboard worker with the
+ * synthetic session attached. Mount at '/api'; uses `originalUrl` so the
+ * full path reaches the worker regardless of Connect's prefix stripping.
+ */
+export declare function createDashboardApiProxy(options: DashboardProxyOptions): (req: IncomingMessage & {
+    originalUrl?: string;
+}, res: ServerResponse) => Promise<void>;
+/**
+ * Dev-only door to the login screen. Deployed, the login page appears at
+ * any path when signed out — locally the API proxy keeps the browser
+ * permanently signed in, so the login state needs one explicit path. The
+ * `__` prefix keeps it out of any SPA route space.
+ */
+export declare const DASHBOARD_LOGIN_PREVIEW_PATH = "/__login";
+export interface SealedPageProxyOptions {
+    /** Base URL of the local dashboard worker */
+    workerUrl: string;
+    /** Injectable for tests */
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Connect handler serving the worker's sealed pages on the dev origin.
+ *
+ * Deployed, `/invite/<token>` and `/reset/<token>` are runtime-reserved:
+ * the worker intercepts them before any SPA byte is served. Mounting this
+ * on the same paths gives local dev that exact behavior — a pasted invite
+ * link renders the real themed credential page instead of falling through
+ * to the SPA. Requests are forwarded WITHOUT a session cookie, which is
+ * precisely what makes the worker serve the sealed page.
+ *
+ * Navigations only: non-GET/HEAD falls through to the next middleware.
+ */
+export declare function createSealedPageProxy(options: SealedPageProxyOptions): (req: IncomingMessage & {
+    originalUrl?: string;
+}, res: ServerResponse, next: (err?: unknown) => void) => Promise<void>;

package/dist/dashboard/plugin.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Dashboard plugin variant
+ *
+ * A dashboard app is a plain SPA the platform serves behind its auth
+ * layer. In dev, this variant runs the real composed dashboard worker
+ * (auth layer + the app's api/ routes) under Miniflare with the game's
+ * local data, and proxies `/api/*` to it holding a synthetic session —
+ * see middleware.ts. Builds pass through Vite untouched, exactly what
+ * `dashboard deploy` expects to zip.
+ */
+import type { Plugin } from 'vite';
+import type { PlaycademyPluginOptions } from '../types/options';
+export declare function createDashboardPlugin(options: PlaycademyPluginOptions): Plugin;

package/dist/dashboard/test-harness.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Shared harness for dashboard middleware tests: a Connect-style mount
+ * stack plus fake request/response objects shaped like Node's.
+ */
+export interface FakeRequest {
+    method: string;
+    url: string;
+    originalUrl?: string;
+    headers: Record<string, string>;
+    [Symbol.asyncIterator](): AsyncIterator<Buffer>;
+}
+export declare function makeRequest(method: string, url: string, headers?: Record<string, string>, body?: string): FakeRequest;
+export declare function makeResponse(): {
+    statusCode: number;
+    headers: Record<string, string | string[]>;
+    body: string;
+    ended: Promise<void>;
+    setHeader(name: string, value: string | string[]): void;
+    end(chunk?: unknown): void;
+};
+/**
+ * Connect-style middleware stack: layers match by mount-path prefix
+ * (segment-aware) in registration order, and the mount prefix is stripped
+ * from `url` while `originalUrl` keeps the full path — the behavior the
+ * real `server.middlewares` has, so tests exercise mounting for real
+ * instead of capturing a single handler.
+ */
+export declare function makeStack(): {
+    use(path: string, handler: (req: unknown, res: unknown) => unknown): void;
+    dispatch(req: FakeRequest, res: ReturnType<typeof makeResponse>): Promise<boolean>;
+};

package/dist/index.d.ts

@@ -1,7 +1,8 @@
 /**
  * Playcademy Vite Plugin
  *
- * Entry point - exports plugin and types
+ * Entry point — exports the plugin and its public options types.
+ * Internal manager/context types stay behind ./types for in-package use.
  */
 export { playcademy } from './plugin';
-export type * from './types';
+export type * from './types/options';