@zhama/tego-plugin-sdk 1.36.2 → 1.37.0

package/dist/dev.cjs

@@ -1,4 +1,4 @@
-"use strict";var V=Object.defineProperty;var i=(e,t)=>V(e,"name",{value:t,configurable:!0});var chunkIMAVYQ4U_cjs=require("./chunk-IMAVYQ4U.cjs"),chunkPWSTCQRN_cjs=require("./chunk-PWSTCQRN.cjs");require("./chunk-W7C357A6.cjs");var chunkKMN5RHLX_cjs=require("./chunk-KMN5RHLX.cjs");require("./chunk-3WA3M347.cjs");var chunkROFUQLOZ_cjs=require("./chunk-ROFUQLOZ.cjs");require("./chunk-C2OCOPZQ.cjs");var chunkBN6TGHSB_cjs=require("./chunk-BN6TGHSB.cjs");require("./chunk-AJY7ZHXK.cjs"),require("./chunk-OP64Y4IN.cjs");var crypto=require("crypto"),fs=require("fs"),promises=require("fs/promises"),http=require("http"),module$1=require("module"),path=require("path"),child_process=require("child_process"),net=require("net"),DEV_USER_HEADER="x-tego-dev-user-id",DEV_ROLES_HEADER="x-tego-dev-roles",DEV_TENANT_ID="dev-tenant",DEFAULT_DEV_USER_ID="00000000-0000-4000-8000-000000000001";function devCallerOf(e){const t=i(r=>(Array.isArray(r)?r[0]:r)?.trim()??"","single"),n=t(e[DEV_USER_HEADER])||DEFAULT_DEV_USER_ID;let a=[];try{const r=JSON.parse(t(e[DEV_ROLES_HEADER])||"[]");Array.isArray(r)&&(a=r.filter(o=>typeof o=="string"))}catch{}return{userId:n,roles:a}}i(devCallerOf,"devCallerOf");function gatewayHeaders(e,t,n,a=Date.now()){const r={};for(const[s,c]of Object.entries(e)){const u=s.toLowerCase();c===void 0||u.startsWith("x-tego-")||u==="cookie"||u==="authorization"||u==="host"||u==="connection"||(r[u]=Array.isArray(c)?c.join(", "):c)}const o=JSON.stringify(t.roles),l=String(a);return r[chunkBN6TGHSB_cjs.PLUGIN_CONTEXT_HEADERS.userId]=t.userId,r[chunkBN6TGHSB_cjs.PLUGIN_CONTEXT_HEADERS.tenantId]=DEV_TENANT_ID,r[chunkBN6TGHSB_cjs.PLUGIN_CONTEXT_HEADERS.roles]=o,r[chunkBN6TGHSB_cjs.PLUGIN_CONTEXT_HEADERS.issuedAt]=l,r[chunkBN6TGHSB_cjs.PLUGIN_CONTEXT_HEADERS.signature]=chunkIMAVYQ4U_cjs.signPluginContext({userId:t.userId,tenantId:DEV_TENANT_ID,rolesHeader:o,avatarId:"",issuedAt:l},n),r}i(gatewayHeaders,"gatewayHeaders");var DEV_MIGRATIONS_TABLE="tego_dev_migrations";function devSchemaName(e){return`tego_dev_${e.toLowerCase().replace(/[^a-z0-9_]/g,"_")}`.slice(0,63)}i(devSchemaName,"devSchemaName");function devDatabaseUrl(e,t){const n=new URL(e);n.searchParams.delete("options");const a=n.search.replace(/^\?/,"");return n.search=`?${a?`${a}&`:""}options=${encodeURIComponent(`-c search_path=${t}`)}`,n.toString()}i(devDatabaseUrl,"devDatabaseUrl");async function connect(e){let t;try{t=await import("pg")}catch(r){throw new Error(`The local backend needs the "pg" driver; add it to the plugin's dependencies.`,{cause:r})}const n=t.default?.Client??t.Client;if(!n)throw new Error('The "pg" module has no Client constructor.');const a=new n({connectionString:e});try{await a.connect()}catch(r){throw new Error(`Cannot connect to DATABASE_URL (${redactUrl(e)}): ${r instanceof Error?r.message:String(r)}`,{cause:r})}return a}i(connect,"connect");function redactUrl(e){try{const t=new URL(e);return t.password&&(t.password="***"),t.toString()}catch{return"<unparseable DATABASE_URL>"}}i(redactUrl,"redactUrl");var quote=i(e=>`"${e.replace(/"/g,'""')}"`,"quote");async function applyDevMigrations(e){const t=await promises.readdir(e.migrationsDir).then(o=>o.filter(l=>l.endsWith(".sql")).sort(),o=>{if(o.code==="ENOENT")return[];throw o}),n=await connect(e.databaseUrl),a=quote(e.schema),r=`${a}.${quote(DEV_MIGRATIONS_TABLE)}`;try{await n.query(`CREATE SCHEMA IF NOT EXISTS ${a}`),await n.query(`CREATE TABLE IF NOT EXISTS ${r} (name text PRIMARY KEY, applied_at timestamptz NOT NULL DEFAULT now())`);const o=new Set((await n.query(`SELECT name FROM ${r}`)).rows.map(s=>String(s.name))),l=[];for(const s of t){if(o.has(s))continue;const c=await promises.readFile(path.join(e.migrationsDir,s),"utf8");await n.query("BEGIN");try{await n.query(`SET LOCAL search_path TO ${a}`),await n.query("SELECT set_config('app.tenant_id', $1, true)",[e.tenantId]),await n.query(c),await n.query(`INSERT INTO ${r} (name) VALUES ($1)`,[s]),await n.query("COMMIT")}catch(u){throw await n.query("ROLLBACK").catch(()=>{}),new Error(`Migration ${s} failed: ${u instanceof Error?u.message:String(u)}`,{cause:u})}l.push(s)}return l}finally{await n.end().catch(()=>{})}}i(applyDevMigrations,"applyDevMigrations");var REBUILD_DEBOUNCE_MS=250,STOP_TIMEOUT_MS=5e3;function freePort(){return new Promise((e,t)=>{const n=net.createServer();n.once("error",t),n.listen(0,"127.0.0.1",()=>{const a=n.address(),r=typeof a=="object"&&a?a.port:0;n.close(()=>e(r))})})}i(freePort,"freePort");function stopChild(e){return!e||e.exitCode!==null||e.signalCode!==null?Promise.resolve():new Promise(t=>{const n=setTimeout(()=>{e.kill("SIGKILL"),t()},STOP_TIMEOUT_MS);e.once("exit",()=>{clearTimeout(n),t()}),e.kill("SIGTERM")})}i(stopChild,"stopChild");async function startDevBackend(e){const{part:t,log:n}=e;if(t.runtime==="python")throw new Error("The local preview runs TypeScript backends only; a python backend runs through the platform.");const a=await freePort(),r=devSchemaName(e.pluginId),o=path.resolve(e.root,t.migrationsDirPath),l=path.join(e.outDir,t.entryPath),s={...process.env,NODE_ENV:"development",TEGO_PLUGIN_ID:e.pluginId,TEGO_PLUGIN_VERSION:e.version,TEGO_PLUGIN_INSTALL_ID:"dev-install",TEGO_TENANT_ID:DEV_TENANT_ID,TEGO_PLUGIN_PORT:String(a),TEGO_PLUGIN_HEALTH_PATH:t.healthPath,TEGO_PLUGIN_HOST_API_URL:e.hostApiUrl,TEGO_PLUGIN_HOST_API_TOKEN:e.hostApiToken,TEGO_PLUGIN_GATEWAY_KEY:e.gatewayKey,DATABASE_URL:devDatabaseUrl(e.databaseUrl,r)};let c=null,u=!1;async function p(){await promises.rm(e.outDir,{recursive:!0,force:!0}),await chunkPWSTCQRN_cjs.buildPluginBackend(t,{root:e.root,outDir:e.outDir});const f=await applyDevMigrations({databaseUrl:e.databaseUrl,schema:r,migrationsDir:o,tenantId:DEV_TENANT_ID});for(const y of f)n(`[backend] applied migration ${y}`)}i(p,"build");function m(){const f=child_process.spawn(process.execPath,[l],{env:s,stdio:["ignore","pipe","pipe"]});c=f,f.stdout?.on("data",y=>process.stdout.write(y)),f.stderr?.on("data",y=>process.stderr.write(y)),f.on("exit",y=>{c===f&&!u&&(c=null,n(`[backend] exited (code ${y??"null"}); it starts again on the next save`))})}i(m,"start"),await p(),m(),n(`[backend] ${e.pluginId} on 127.0.0.1:${a}, schema ${r} in ${redactUrl(e.databaseUrl)}`);let v=null,h=null,_=!1;const k=i(async()=>{if(h){_=!0;return}h=(async()=>{try{await p();const f=c;c=null,await stopChild(f),u||(m(),n("[backend] rebuilt and restarted"))}catch(f){n(`[backend] rebuild failed, the previous build keeps running: ${f instanceof Error?f.message:String(f)}`)}})(),await h,h=null,_&&!u&&(_=!1,await k())},"rebuild"),x=[];for(const f of[t.dir,"shared"]){const y=path.resolve(e.root,f);fs.existsSync(y)&&x.push(fs.watch(y,{recursive:!0},(I,S)=>{S&&/(^|[\\/])(node_modules|dist)([\\/]|$)/.test(String(S))||(v&&clearTimeout(v),v=setTimeout(()=>void k(),REBUILD_DEBOUNCE_MS))}))}return{port:a,schema:r,async close(){u=!0,v&&clearTimeout(v);for(const f of x)f.close();await h,await stopChild(c)}}}i(startDevBackend,"startDevBackend");var FAKE_HOST_PREFIX="/__tego/host",FAKE_FILES_PREFIX="/__tego/files",MAX_JSON_BYTES=1024*1024;async function readBody(e,t=1/0){const n=[];let a=0;for await(const r of e){if(a+=r.length,a>t)throw Object.assign(new Error("body too large"),{status:413});n.push(r)}return Buffer.concat(n)}i(readBody,"readBody");function send(e,t,n){if(n===void 0){e.writeHead(t),e.end();return}e.writeHead(t,{"content-type":"application/json"}),e.end(JSON.stringify(n))}i(send,"send");function storagePath(e,t){const n=path.resolve(e),a=path.resolve(n,t);if(!t||path.isAbsolute(t)||!a.startsWith(n+path.sep))throw Object.assign(new Error(`invalid storage key ${JSON.stringify(t)}`),{status:400});return a}i(storagePath,"storagePath");var metaOf=i(e=>`${e}.tego-meta.json`,"metaOf");async function head(e){const t=await promises.stat(e).catch(()=>null);if(!t?.isFile())return null;const n=await promises.readFile(metaOf(e),"utf8").then(a=>JSON.parse(a),()=>({}));return{size:t.size,contentType:n.contentType??null,versionTag:crypto.createHash("sha1").update(`${t.size}:${t.mtimeMs}`).digest("hex")}}i(head,"head");async function put(e,t,n){await promises.mkdir(path.dirname(e),{recursive:!0}),await promises.writeFile(e,t),await promises.writeFile(metaOf(e),JSON.stringify({contentType:n??null}))}i(put,"put");async function handleFakeHost(e,t,n){const a=new URL(e.url??"/","http://preview.local");try{if(a.pathname.startsWith(FAKE_FILES_PREFIX)){const s=storagePath(n.storageDir,a.searchParams.get("key")??""),c=await head(s);if(!c)return send(t,404);t.writeHead(200,{"content-type":c.contentType??"application/octet-stream"}),t.end(await promises.readFile(s));return}if(e.headers.authorization!==`Bearer ${n.token}`)return send(t,401,{error:"bad host API token"});const r=a.pathname.slice(FAKE_HOST_PREFIX.length)||"/",o=i(async()=>JSON.parse((await readBody(e,MAX_JSON_BYTES)).toString("utf8")||"{}"),"json"),l=i(s=>storagePath(n.storageDir,String(s??"")),"keyFile");switch(r){case"/config":return send(t,200,{data:{values:n.config()}});case"/log":{const{level:s,message:c,fields:u}=await o();return n.log(`[backend ${String(s??"info")}] ${String(c??"")}${u?` ${JSON.stringify(u)}`:""}`),send(t,200,{data:{}})}case"/events":{const{name:s,payload:c}=await o();return n.log(`[event] ${String(s)} ${JSON.stringify(c??null)}`),send(t,200,{data:{}})}case"/notifications":return n.log(`[notification] ${JSON.stringify(await o())}`),send(t,200,{data:{id:crypto.randomUUID()}});case"/directory/identity":{const{userId:s}=await o(),c=n.users().get(String(s));return send(t,200,{data:{active:!!c,roleNames:c??[],memberships:[],checkedAt:new Date().toISOString()}})}case"/directory/list":{const{kind:s,search:c,ids:u}=await o(),p=typeof c=="string"?c.toLowerCase():"",m=Array.isArray(u)?new Set(u.map(String)):void 0,v=s==="users"?[...n.users().keys()].filter(h=>(!m||m.has(h))&&h.toLowerCase().includes(p)).map(h=>({id:h,displayName:h,active:!0})):[];return send(t,200,{data:{items:v,hasMore:!1}})}case"/directory/match":{const{userId:s,principals:c}=await o(),u=Array.isArray(c)?c:[];return send(t,200,{data:{active:n.users().has(String(s)),matched:u.flatMap((p,m)=>p.kind==="user"&&p.id===s?[m]:[]),checkedAt:new Date().toISOString()}})}case"/directory/validate":{const{principals:s}=await o(),c=Array.isArray(s)?s:[],u=n.users();return send(t,200,{data:{invalid:c.flatMap((p,m)=>p.kind==="user"&&u.has(String(p.id))?[]:[m])}})}case"/storage/get":case"/storage/stream":{const s=l(a.searchParams.get("key"));if(e.method==="POST"&&r==="/storage/stream")return await put(s,await readBody(e),e.headers["content-type"]),send(t,200,{data:{}});const c=await head(s);if(!c)return send(t,404);let u=await promises.readFile(s);const p=Number(a.searchParams.get("bytes"));Number.isFinite(p)&&p>0&&(u=u.subarray(0,p)),t.writeHead(200,{"content-type":c.contentType??"application/octet-stream"}),t.end(u);return}case"/storage/put":return await put(l(a.searchParams.get("key")),await readBody(e),e.headers["content-type"]),send(t,200,{data:{}});case"/storage/head":{const s=await head(l((await o()).key));return s?send(t,200,{data:s}):send(t,404)}case"/storage/delete":{const s=l((await o()).key);return await promises.rm(s,{force:!0}),await promises.rm(metaOf(s),{force:!0}),send(t,200,{data:{}})}case"/storage/copy":{const{sourceKey:s,destinationKey:c}=await o(),u=l(s),p=l(c);return await head(u)?(await promises.mkdir(path.dirname(p),{recursive:!0}),await promises.copyFile(u,p),await promises.copyFile(metaOf(u),metaOf(p)).catch(()=>{}),send(t,200,{data:await head(p)})):send(t,404)}case"/storage/signed-url":{const{key:s}=await o();l(s);const c=`${FAKE_FILES_PREFIX}?key=${encodeURIComponent(String(s))}`;return send(t,200,{data:{url:`${n.origin()}${c}`,path:c}})}default:return n.log(`[host] ${r} is not available in local preview`),send(t,501,{error:{code:"not_available_in_preview",message:`${r} is not available in local preview`}})}}catch(r){const o=r.status??500;send(t,o,{error:{message:r instanceof Error?r.message:String(r)}})}}i(handleFakeHost,"handleFakeHost");var SDK_PACKAGE="@tego/plugin-sdk",SDK_IMPORT=JSON.stringify(SDK_PACKAGE),SDK_FRONTEND_IMPORT=JSON.stringify(`${SDK_PACKAGE}/frontend`);function shellFiles(e){return[{path:"index.html",contents:indexHtml(e)},{path:"main.tsx",contents:mainTsx(e)},{path:"shell.css",contents:SHELL_CSS},{path:"plugin-surface.tsx",contents:PLUGIN_SURFACE_STUB}]}i(shellFiles,"shellFiles");var escapeHtml=i(e=>e.replace(/[&<>"]/g,t=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;"})[t]),"escapeHtml");function indexHtml({displayName:e}){return`<!doctype html>
+"use strict";var W=Object.defineProperty;var o=(e,t)=>W(e,"name",{value:t,configurable:!0});var chunkIMAVYQ4U_cjs=require("./chunk-IMAVYQ4U.cjs"),chunk4LKRXDYY_cjs=require("./chunk-4LKRXDYY.cjs");require("./chunk-HZ4YWRYX.cjs");var chunkMWMGJJ74_cjs=require("./chunk-MWMGJJ74.cjs");require("./chunk-SKNPNPJP.cjs"),require("./chunk-45Y4CR4R.cjs");var chunk2P6UEAPV_cjs=require("./chunk-2P6UEAPV.cjs");require("./chunk-N4SXZZPY.cjs"),require("./chunk-6HNG5OZI.cjs");var chunkBN6TGHSB_cjs=require("./chunk-BN6TGHSB.cjs");require("./chunk-AJY7ZHXK.cjs"),require("./chunk-OP64Y4IN.cjs");var crypto=require("crypto"),fs=require("fs"),promises=require("fs/promises"),http=require("http"),module$1=require("module"),path=require("path"),child_process=require("child_process"),net=require("net"),DEV_USER_HEADER="x-tego-dev-user-id",DEV_ROLES_HEADER="x-tego-dev-roles",DEV_TENANT_ID="dev-tenant",DEFAULT_DEV_USER_ID="00000000-0000-4000-8000-000000000001";function devCallerOf(e){const t=o(n=>(Array.isArray(n)?n[0]:n)?.trim()??"","single"),r=t(e[DEV_USER_HEADER])||DEFAULT_DEV_USER_ID;let a=[];try{const n=JSON.parse(t(e[DEV_ROLES_HEADER])||"[]");Array.isArray(n)&&(a=n.filter(i=>typeof i=="string"))}catch{}return{userId:r,roles:a}}o(devCallerOf,"devCallerOf");function gatewayHeaders(e,t,r,a=Date.now()){const n={};for(const[s,l]of Object.entries(e)){const d=s.toLowerCase();l===void 0||d.startsWith("x-tego-")||d==="cookie"||d==="authorization"||d==="host"||d==="connection"||(n[d]=Array.isArray(l)?l.join(", "):l)}const i=JSON.stringify(t.roles),u=String(a);return n[chunkBN6TGHSB_cjs.PLUGIN_CONTEXT_HEADERS.userId]=t.userId,n[chunkBN6TGHSB_cjs.PLUGIN_CONTEXT_HEADERS.tenantId]=DEV_TENANT_ID,n[chunkBN6TGHSB_cjs.PLUGIN_CONTEXT_HEADERS.roles]=i,n[chunkBN6TGHSB_cjs.PLUGIN_CONTEXT_HEADERS.issuedAt]=u,n[chunkBN6TGHSB_cjs.PLUGIN_CONTEXT_HEADERS.signature]=chunkIMAVYQ4U_cjs.signPluginContext({userId:t.userId,tenantId:DEV_TENANT_ID,rolesHeader:i,avatarId:"",issuedAt:u},r),n}o(gatewayHeaders,"gatewayHeaders");var DEV_MIGRATIONS_TABLE="tego_dev_migrations";function devSchemaName(e){return`tego_dev_${e.toLowerCase().replace(/[^a-z0-9_]/g,"_")}`.slice(0,63)}o(devSchemaName,"devSchemaName");function devDatabaseUrl(e,t){const r=new URL(e);r.searchParams.delete("options");const a=r.search.replace(/^\?/,"");return r.search=`?${a?`${a}&`:""}options=${encodeURIComponent(`-c search_path=${t}`)}`,r.toString()}o(devDatabaseUrl,"devDatabaseUrl");async function connect(e){let t;try{t=await import("pg")}catch(n){throw new Error(`The local backend needs the "pg" driver; add it to the plugin's dependencies.`,{cause:n})}const r=t.default?.Client??t.Client;if(!r)throw new Error('The "pg" module has no Client constructor.');const a=new r({connectionString:e});try{await a.connect()}catch(n){throw new Error(`Cannot connect to DATABASE_URL (${redactUrl(e)}): ${n instanceof Error?n.message:String(n)}`,{cause:n})}return a}o(connect,"connect");function redactUrl(e){try{const t=new URL(e);return t.password&&(t.password="***"),t.toString()}catch{return"<unparseable DATABASE_URL>"}}o(redactUrl,"redactUrl");var quote=o(e=>`"${e.replace(/"/g,'""')}"`,"quote");async function applyDevMigrations(e){const t=await promises.readdir(e.migrationsDir).then(i=>i.filter(u=>u.endsWith(".sql")).sort(),i=>{if(i.code==="ENOENT")return[];throw i}),r=await connect(e.databaseUrl),a=quote(e.schema),n=`${a}.${quote(DEV_MIGRATIONS_TABLE)}`;try{await r.query(`CREATE SCHEMA IF NOT EXISTS ${a}`),await r.query(`CREATE TABLE IF NOT EXISTS ${n} (name text PRIMARY KEY, applied_at timestamptz NOT NULL DEFAULT now())`);const i=new Set((await r.query(`SELECT name FROM ${n}`)).rows.map(s=>String(s.name))),u=[];for(const s of t){if(i.has(s))continue;const l=await promises.readFile(path.join(e.migrationsDir,s),"utf8");await r.query("BEGIN");try{await r.query(`SET LOCAL search_path TO ${a}`),await r.query("SELECT set_config('app.tenant_id', $1, true)",[e.tenantId]),await r.query(l),await r.query(`INSERT INTO ${n} (name) VALUES ($1)`,[s]),await r.query("COMMIT")}catch(d){throw await r.query("ROLLBACK").catch(()=>{}),new Error(`Migration ${s} failed: ${d instanceof Error?d.message:String(d)}`,{cause:d})}u.push(s)}return u}finally{await r.end().catch(()=>{})}}o(applyDevMigrations,"applyDevMigrations");var REBUILD_DEBOUNCE_MS=250,STOP_TIMEOUT_MS=5e3;function freePort(){return new Promise((e,t)=>{const r=net.createServer();r.once("error",t),r.listen(0,"127.0.0.1",()=>{const a=r.address(),n=typeof a=="object"&&a?a.port:0;r.close(()=>e(n))})})}o(freePort,"freePort");function stopChild(e){return!e||e.exitCode!==null||e.signalCode!==null?Promise.resolve():new Promise(t=>{const r=setTimeout(()=>{e.kill("SIGKILL"),t()},STOP_TIMEOUT_MS);e.once("exit",()=>{clearTimeout(r),t()}),e.kill("SIGTERM")})}o(stopChild,"stopChild");async function startDevBackend(e){const{part:t,log:r}=e;if(t.runtime==="python")throw new Error("The local preview runs TypeScript backends only; a python backend runs through the platform.");const a=await freePort(),n=devSchemaName(e.pluginId),i=path.resolve(e.root,t.migrationsDirPath),u=path.join(e.outDir,t.entryPath),s={...process.env,NODE_ENV:"development",TEGO_PLUGIN_ID:e.pluginId,TEGO_PLUGIN_VERSION:e.version,TEGO_PLUGIN_INSTALL_ID:"dev-install",TEGO_TENANT_ID:DEV_TENANT_ID,TEGO_PLUGIN_PORT:String(a),TEGO_PLUGIN_HEALTH_PATH:t.healthPath,TEGO_PLUGIN_HOST_API_URL:e.hostApiUrl,TEGO_PLUGIN_HOST_API_TOKEN:e.hostApiToken,TEGO_PLUGIN_GATEWAY_KEY:e.gatewayKey,DATABASE_URL:devDatabaseUrl(e.databaseUrl,n)};let l=null,d=!1;async function f(){await promises.rm(e.outDir,{recursive:!0,force:!0}),await chunk4LKRXDYY_cjs.buildPluginBackend(t,{root:e.root,outDir:e.outDir});const g=await applyDevMigrations({databaseUrl:e.databaseUrl,schema:n,migrationsDir:i,tenantId:DEV_TENANT_ID});for(const E of g)r(`[backend] applied migration ${E}`)}o(f,"build");function v(){const g=child_process.spawn(process.execPath,[u],{env:s,stdio:["ignore","pipe","pipe"]});l=g,g.stdout?.on("data",E=>process.stdout.write(E)),g.stderr?.on("data",E=>process.stderr.write(E)),g.on("exit",E=>{l===g&&!d&&(l=null,r(`[backend] exited (code ${E??"null"}); it starts again on the next save`))})}o(v,"start"),await f(),v(),r(`[backend] ${e.pluginId} on 127.0.0.1:${a}, schema ${n} in ${redactUrl(e.databaseUrl)}`);let y=null,m=null,D=!1;const A=o(async()=>{if(m){D=!0;return}m=(async()=>{try{await f();const g=l;l=null,await stopChild(g),d||(v(),r("[backend] rebuilt and restarted"))}catch(g){r(`[backend] rebuild failed, the previous build keeps running: ${g instanceof Error?g.message:String(g)}`)}})(),await m,m=null,D&&!d&&(D=!1,await A())},"rebuild"),N=[];for(const g of[t.dir,"shared"]){const E=path.resolve(e.root,g);fs.existsSync(E)&&N.push(fs.watch(E,{recursive:!0},(_,k)=>{k&&/(^|[\\/])(node_modules|dist)([\\/]|$)/.test(String(k))||(y&&clearTimeout(y),y=setTimeout(()=>void A(),REBUILD_DEBOUNCE_MS))}))}return{port:a,schema:n,async close(){d=!0,y&&clearTimeout(y);for(const g of N)g.close();await m,await stopChild(l)}}}o(startDevBackend,"startDevBackend");var FAKE_HOST_PREFIX="/__tego/host",FAKE_FILES_PREFIX="/__tego/files",MAX_JSON_BYTES=1024*1024;async function readBody(e,t=1/0){const r=[];let a=0;for await(const n of e){if(a+=n.length,a>t)throw Object.assign(new Error("body too large"),{status:413});r.push(n)}return Buffer.concat(r)}o(readBody,"readBody");function send(e,t,r){if(r===void 0){e.writeHead(t),e.end();return}e.writeHead(t,{"content-type":"application/json"}),e.end(JSON.stringify(r))}o(send,"send");function storagePath(e,t){const r=path.resolve(e),a=path.resolve(r,t);if(!t||path.isAbsolute(t)||!a.startsWith(r+path.sep))throw Object.assign(new Error(`invalid storage key ${JSON.stringify(t)}`),{status:400});return a}o(storagePath,"storagePath");var metaOf=o(e=>`${e}.tego-meta.json`,"metaOf");async function head(e){const t=await promises.stat(e).catch(()=>null);if(!t?.isFile())return null;const r=await promises.readFile(metaOf(e),"utf8").then(a=>JSON.parse(a),()=>({}));return{size:t.size,contentType:r.contentType??null,versionTag:crypto.createHash("sha1").update(`${t.size}:${t.mtimeMs}`).digest("hex")}}o(head,"head");async function put(e,t,r){await promises.mkdir(path.dirname(e),{recursive:!0}),await promises.writeFile(e,t),await promises.writeFile(metaOf(e),JSON.stringify({contentType:r??null}))}o(put,"put");async function handleFakeHost(e,t,r){const a=new URL(e.url??"/","http://preview.local");try{if(a.pathname.startsWith(FAKE_FILES_PREFIX)){const s=storagePath(r.storageDir,a.searchParams.get("key")??""),l=await head(s);if(!l)return send(t,404);t.writeHead(200,{"content-type":l.contentType??"application/octet-stream"}),t.end(await promises.readFile(s));return}if(e.headers.authorization!==`Bearer ${r.token}`)return send(t,401,{error:"bad host API token"});const n=a.pathname.slice(FAKE_HOST_PREFIX.length)||"/",i=o(async()=>JSON.parse((await readBody(e,MAX_JSON_BYTES)).toString("utf8")||"{}"),"json"),u=o(s=>storagePath(r.storageDir,String(s??"")),"keyFile");switch(n){case"/config":return send(t,200,{data:{values:r.config()}});case"/log":{const{level:s,message:l,fields:d}=await i();return r.log(`[backend ${String(s??"info")}] ${String(l??"")}${d?` ${JSON.stringify(d)}`:""}`),send(t,200,{data:{}})}case"/events":{const{name:s,payload:l}=await i();return r.log(`[event] ${String(s)} ${JSON.stringify(l??null)}`),send(t,200,{data:{}})}case"/notifications":return r.log(`[notification] ${JSON.stringify(await i())}`),send(t,200,{data:{id:crypto.randomUUID()}});case"/directory/identity":{const{userId:s}=await i(),l=r.users().get(String(s));return send(t,200,{data:{active:!!l,roleNames:l??[],memberships:[],checkedAt:new Date().toISOString()}})}case"/directory/list":{const{kind:s,search:l,ids:d}=await i(),f=typeof l=="string"?l.toLowerCase():"",v=Array.isArray(d)?new Set(d.map(String)):void 0,y=s==="users"?[...r.users().keys()].filter(m=>(!v||v.has(m))&&m.toLowerCase().includes(f)).map(m=>({id:m,displayName:m,active:!0})):[];return send(t,200,{data:{items:y,hasMore:!1}})}case"/directory/match":{const{userId:s,principals:l}=await i(),d=Array.isArray(l)?l:[];return send(t,200,{data:{active:r.users().has(String(s)),matched:d.flatMap((f,v)=>f.kind==="user"&&f.id===s?[v]:[]),checkedAt:new Date().toISOString()}})}case"/directory/validate":{const{principals:s}=await i(),l=Array.isArray(s)?s:[],d=r.users();return send(t,200,{data:{invalid:l.flatMap((f,v)=>f.kind==="user"&&d.has(String(f.id))?[]:[v])}})}case"/storage/get":case"/storage/stream":{const s=u(a.searchParams.get("key"));if(e.method==="POST"&&n==="/storage/stream")return await put(s,await readBody(e),e.headers["content-type"]),send(t,200,{data:{}});const l=await head(s);if(!l)return send(t,404);let d=await promises.readFile(s);const f=Number(a.searchParams.get("bytes"));Number.isFinite(f)&&f>0&&(d=d.subarray(0,f)),t.writeHead(200,{"content-type":l.contentType??"application/octet-stream"}),t.end(d);return}case"/storage/put":return await put(u(a.searchParams.get("key")),await readBody(e),e.headers["content-type"]),send(t,200,{data:{}});case"/storage/head":{const s=await head(u((await i()).key));return s?send(t,200,{data:s}):send(t,404)}case"/storage/delete":{const s=u((await i()).key);return await promises.rm(s,{force:!0}),await promises.rm(metaOf(s),{force:!0}),send(t,200,{data:{}})}case"/storage/copy":{const{sourceKey:s,destinationKey:l}=await i(),d=u(s),f=u(l);return await head(d)?(await promises.mkdir(path.dirname(f),{recursive:!0}),await promises.copyFile(d,f),await promises.copyFile(metaOf(d),metaOf(f)).catch(()=>{}),send(t,200,{data:await head(f)})):send(t,404)}case"/storage/signed-url":{const{key:s}=await i();u(s);const l=`${FAKE_FILES_PREFIX}?key=${encodeURIComponent(String(s))}`;return send(t,200,{data:{url:`${r.origin()}${l}`,path:l}})}default:return r.log(`[host] ${n} is not available in local preview`),send(t,501,{error:{code:"not_available_in_preview",message:`${n} is not available in local preview`}})}}catch(n){const i=n.status??500;send(t,i,{error:{message:n instanceof Error?n.message:String(n)}})}}o(handleFakeHost,"handleFakeHost");var SDK_PACKAGE="@tego/plugin-sdk",SDK_IMPORT=JSON.stringify(SDK_PACKAGE),SDK_FRONTEND_IMPORT=JSON.stringify(`${SDK_PACKAGE}/frontend`);function shellFiles(e){return[{path:"index.html",contents:indexHtml(e)},{path:"main.tsx",contents:mainTsx(e)},{path:"shell.css",contents:SHELL_CSS},{path:"plugin-surface.tsx",contents:PLUGIN_SURFACE_STUB}]}o(shellFiles,"shellFiles");var escapeHtml=o(e=>e.replace(/[&<>"]/g,t=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;"})[t]),"escapeHtml");function indexHtml({displayName:e}){return`<!doctype html>
 <html lang="en" class="h-full">
   <head>
     <meta charset="UTF-8" />
@@ -11,7 +11,7 @@
     <script type="module" src="/main.tsx"><\/script>
   </body>
 </html>
-`}i(indexHtml,"indexHtml");var SHELL_CSS=`@tailwind base;
+`}o(indexHtml,"indexHtml");var SHELL_CSS=`@tailwind base;
 @tailwind components;
 @tailwind utilities;
 
@@ -46,7 +46,7 @@ export const ChatPanel = Unavailable;
 export function useTopic() {
   return { topic: undefined, topics: [], loading: false };
 }
-`;function mainTsx(e){const t=JSON.stringify({pluginId:e.pluginId,displayName:e.displayName,nav:e.nav.map(a=>({key:a.key,labelKey:a.labelKey,path:a.path??"/"})),config:e.config,locales:e.locales,userHeader:DEV_USER_HEADER,rolesHeader:DEV_ROLES_HEADER,defaultUser:DEFAULT_DEV_USER_ID},null,2),n=e.entry?`import plugin from ${JSON.stringify(e.entry)};`:"const plugin = undefined;";return`// Generated by \`tego-plugin dev\` on every start; edits here are overwritten.
+`;function mainTsx(e){const t=JSON.stringify({pluginId:e.pluginId,displayName:e.displayName,nav:e.nav.map(a=>({key:a.key,labelKey:a.labelKey,path:a.path??"/"})),config:e.config,locales:e.locales,defaultTarget:e.defaultTarget??"web",userHeader:DEV_USER_HEADER,rolesHeader:DEV_ROLES_HEADER,defaultUser:DEFAULT_DEV_USER_ID},null,2),r=e.entry?`import plugin from ${JSON.stringify(e.entry)};`:"const plugin = undefined;";return`// Generated by \`tego-plugin dev\` on every start; edits here are overwritten.
 import '@tego/ui/styles/tokens.css';
 import './shell.css';
 
@@ -68,9 +68,14 @@ import { useState, useSyncExternalStore } from 'react';
 import { createRoot } from 'react-dom/client';
 import { initReactI18next } from 'react-i18next';
 
-${n}
+${r}
 
 const DEV = ${t};
+const TARGET: 'web' | 'desktop' = /(?:^|;\\s*)tego-dev-target=desktop(?:;|$)/.test(document.cookie)
+  ? 'desktop'
+  : /(?:^|;\\s*)tego-dev-target=web(?:;|$)/.test(document.cookie)
+    ? 'web'
+    : DEV.defaultTarget;
 const BASE = '/p/' + DEV.pluginId;
 const NAMESPACE = pluginI18nNamespace(DEV.pluginId);
 
@@ -168,8 +173,59 @@ const context: PluginHostContext = {
   config: DEV.config,
   navigate,
   can: navKey => navKeys.includes(navKey),
+  // Host API 1.37, as the shells provide it: the preview prints what a plugin
+  // asked for, then does the browser equivalent.
+  platform: TARGET,
+  openExternal: async url => {
+    if (!/^https?:\\/\\//i.test(url)) throw new Error('openExternal takes an http(s) URL');
+    console.info('[preview] openExternal', url);
+    window.open(url, '_blank', 'noopener');
+  },
+  download: async request => {
+    const anchor = document.createElement('a');
+    let revoke: string | undefined;
+    if ('blob' in request) {
+      revoke = URL.createObjectURL(request.blob);
+      anchor.href = revoke;
+      anchor.download = request.fileName;
+    } else {
+      if (!request.path.startsWith('/')) throw new Error('download takes a root-relative host path');
+      anchor.href = context.hostUrl(request.path);
+      if (request.fileName) anchor.download = request.fileName;
+    }
+    console.info('[preview] download', 'blob' in request ? request.fileName : request.path);
+    document.body.append(anchor);
+    anchor.click();
+    anchor.remove();
+    if (revoke) setTimeout(() => URL.revokeObjectURL(revoke), 30_000);
+  },
+  copyText: async text => {
+    try {
+      await navigator.clipboard.writeText(text);
+      return true;
+    } catch {
+      return false;
+    }
+  },
 };
 
+// What the imitated shell's CSP refused on this page (the server prints them too).
+const violations: string[] = [];
+const violationListeners = new Set<() => void>();
+document.addEventListener('securitypolicyviolation', event => {
+  violations.push(event.effectiveDirective + ': ' + (event.blockedURI || 'inline'));
+  for (const listener of violationListeners) listener();
+});
+function useViolations(): number {
+  return useSyncExternalStore(
+    listener => {
+      violationListeners.add(listener);
+      return () => violationListeners.delete(listener);
+    },
+    () => violations.length
+  );
+}
+
 function useRoute(): PluginRoute {
   return useSyncExternalStore(context.route.subscribe, context.route.current);
 }
@@ -180,6 +236,12 @@ function DevBar() {
   const [dark, setDark] = useState(document.documentElement.classList.contains('dark'));
   const [userId, setUserId] = useState(user.userId);
   const [roles, setRoles] = useState(user.roles.join(', '));
+  const blocked = useViolations();
+  const switchTarget = (next: 'web' | 'desktop') => {
+    const url = new URL(location.href);
+    url.searchParams.set('target', next);
+    location.assign(url.toString());
+  };
   const switchUser = () => {
     store('userId', userId.trim() || DEV.defaultUser);
     store('roles', roles);
@@ -221,6 +283,27 @@ function DevBar() {
           ))}
         </SelectContent>
       </Select>
+      <div className='flex shrink-0 items-center rounded-control border border-border p-0.5' role='group' aria-label='Shell'>
+        {(['web', 'desktop'] as const).map(target => (
+          <Button
+            key={target}
+            size='sm'
+            variant={TARGET === target ? 'secondary' : 'ghost'}
+            aria-pressed={TARGET === target}
+            onClick={() => TARGET !== target && switchTarget(target)}
+          >
+            {target === 'web' ? 'Web' : 'Desktop'}
+          </Button>
+        ))}
+      </div>
+      {blocked > 0 && (
+        <span
+          className='shrink-0 rounded-control bg-destructive-soft px-1.5 py-0.5 text-xs text-destructive'
+          title={violations.join('\\n')}
+        >
+          CSP blocked {blocked}
+        </span>
+      )}
       <Button
         size='sm'
         variant='ghost'
@@ -272,4 +355,4 @@ if (frontend) {
     DEV.pluginId +
     '/</p>';
 }
-`}i(mainTsx,"mainTsx");var DEFAULT_DEV_PORT=5280,PORT_ATTEMPTS=20,DEV_READY_PREFIX="TEGO_DEV_READY ",DEV_DIR=".tego-dev",PLUGIN_API_PREFIX="/api/v1/tego-os/plugin-api/";function displayNameOf(e){const{displayName:t}=e;return typeof t=="string"?t:t.en??t["zh-CN"]??Object.values(t)[0]??e.id}i(displayNameOf,"displayNameOf");function packageDir(e,t){for(let n=path.resolve(e);;n=path.dirname(n)){const a=path.join(n,"node_modules",...t.split("/"));if(fs.existsSync(path.join(a,"package.json")))return fs.realpathSync(a);if(path.dirname(n)===n)return}}i(packageDir,"packageDir");function sendJson(e,t,n){e.writeHead(t,{"content-type":"application/json"}),e.end(JSON.stringify(n))}i(sendJson,"sendJson");function listen(e,t,n){return new Promise((a,r)=>{const o=i(s=>{e.off("listening",l),r(s)},"onError"),l=i(()=>{e.off("error",o);const s=e.address();a(typeof s=="object"&&s?s.port:t)},"onListening");e.once("error",o),e.once("listening",l),e.listen(t,n)})}i(listen,"listen");async function shellTailwind(e,t){const n=module$1.createRequire(path.join(e,"vite.config.ts"));let a,r;try{a=n("@tego/ui/tailwind-preset"),r=path.dirname(n.resolve("@tego/ui"))}catch(l){throw new Error(`The preview cannot load @tego/ui's Tailwind preset from ${e}: ${l instanceof Error?l.message:String(l)}. Install the plugin's dependencies.`,{cause:l})}const o=(await import("tailwindcss")).default;return o({presets:[a],content:[path.join(r,"**/*.{js,cjs}"),path.join(t,"*.tsx")]})}i(shellTailwind,"shellTailwind");function perStylesheet(e,t,n){return{postcssPlugin:"tego-dev-stylesheets",async Once(a,r){const o=a.source?.input.file,l=o&&path.resolve(o)===e?[t]:n;if(l.length===0)return;const s=await r.postcss(l).process(a,{from:o});r.result.messages.push(...s.messages)}}}i(perStylesheet,"perStylesheet");function servePlugins(e){return Array.isArray(e)?e.flat(1/0).map(t=>{if(!t||typeof t!="object")return t;const{buildStart:n}=t;return typeof n!="function"?t:{...t,buildStart(...a){const r=new Proxy(this,{get(o,l){if(l==="emitFile")return()=>"";const s=Reflect.get(o,l);return typeof s=="function"?s.bind(o):s}});return n.apply(r,a)}}}):e}i(servePlugins,"servePlugins");async function startDevServer(e){const t=path.resolve(e.root),n=e.log??(d=>console.log(d)),a=await chunkPWSTCQRN_cjs.readManifest(t),r=chunkROFUQLOZ_cjs.resolvePluginParts(a),o=path.join(t,DEV_DIR),l=path.join(o,"shell"),s=crypto.randomBytes(32).toString("hex"),c=crypto.randomBytes(24).toString("hex");let u="";const p=new Map;let m,v={};const h=r.frontend?path.resolve(t,r.frontend.dir):t,{loadConfigFromFile:_,createServer:k,mergeConfig:x}=await import("vite");if(r.frontend){const d=path.join(h,"vite.config.ts");fs.existsSync(d)&&(v=(await _({command:"serve",mode:"development"},d,t))?.config??{});const g=v.build?.rollupOptions?.input,w=path.resolve(t,typeof g=="string"?g:`${r.frontend.dir}/src/index.tsx`);if(!fs.existsSync(w))throw new Error(`The frontend entry ${path.relative(t,w)} does not exist.`);m=path.relative(l,w).split(path.sep).join("/"),m.startsWith(".")||(m=`./${m}`)}const f=i(()=>r.frontend?chunkPWSTCQRN_cjs.readPluginLocales(t,a,r.frontend.i18nDirPath):Promise.resolve(new Map),"localeFiles"),y=[...(await f()).keys()].map(d=>d.replace(/\.json$/,""));await promises.mkdir(l,{recursive:!0});for(const d of shellFiles({pluginId:a.id,displayName:displayNameOf(a),nav:r.frontend?.nav??[],config:r.frontend?.config?chunkKMN5RHLX_cjs.applyConfigDefaults(r.frontend.config.schema,{}):{},entry:m,locales:y}))await promises.writeFile(path.join(l,d.path),d.contents);let I,S;const C=i(()=>r.backend?.config?chunkKMN5RHLX_cjs.applyConfigDefaults(r.backend.config.schema,{}):{},"backendConfig"),D=http.createServer((d,g)=>void j(d,g));async function j(d,g){const w=(d.url??"/").split("?")[0];try{if(w.startsWith(FAKE_HOST_PREFIX)||w.startsWith(FAKE_FILES_PREFIX)){await handleFakeHost(d,g,{token:c,storageDir:path.join(o,"storage"),config:C,origin:i(()=>u,"origin"),users:i(()=>p,"users"),log:n});return}const E=/^\/i18n\/([A-Za-z-]+)\.json$/.exec(w);if(E){const T=(await f()).get(`${E[1]}.json`);if(T===void 0)return sendJson(g,404,{error:`no ${E[1]}.json`});g.writeHead(200,{"content-type":"application/json"}),g.end(T);return}const b=`${PLUGIN_API_PREFIX}${a.id}`;if(w===b||w.startsWith(`${b}/`)){H(d,g,(d.url??"/").slice(b.length)||"/");return}$.middlewares(d,g,()=>sendJson(g,404,{error:`${w} not found`}))}catch(E){sendJson(g,500,{error:E instanceof Error?E.message:String(E)})}}i(j,"route");function H(d,g,w){if(!I){sendJson(g,503,{error:S??"The plugin has no backend part."});return}const E=devCallerOf(d.headers);p.set(E.userId,E.roles);const b=http.request({host:"127.0.0.1",port:I.port,method:d.method,path:w,headers:gatewayHeaders(d.headers,E,s)},T=>{g.writeHead(T.statusCode??502,T.headers),T.pipe(g)});b.on("error",T=>{g.headersSent?g.destroy():sendJson(g,502,{error:`The backend is not answering (${T.message}); see the terminal.`})}),d.pipe(b)}i(H,"proxy");const B=path.join(l,"shell.css"),F=(()=>{const d=v.css?.postcss;return d&&typeof d=="object"?d.plugins??[]:[]})(),A=(()=>{const d=packageDir(h,"react-i18next");return(d&&packageDir(d,"i18next"))??packageDir(h,"i18next")})(),{css:M,mode:G,build:K,...P}=v;P.plugins=servePlugins(P.plugins);const $=await k(x(P,{configFile:!1,root:l,mode:"development",appType:"spa",clearScreen:!1,logLevel:"info",esbuild:{jsx:"automatic",jsxDev:!1},css:{postcss:{plugins:[perStylesheet(B,await shellTailwind(h,l),F)]}},resolve:{alias:[{find:"@tego/chat/plugin-surface",replacement:path.join(l,"plugin-surface.tsx")},...A?[{find:/^i18next$/,replacement:A}]:[]]},server:{middlewareMode:!0,hmr:{server:D},fs:{allow:[t,l,...A?[A]:[]]}},optimizeDeps:{entries:[path.join(l,"index.html")]}})),N=e.host??"127.0.0.1";let R;const O=e.port??DEFAULT_DEV_PORT;for(let d=0;R===void 0;d++)try{R=await listen(D,O===0?0:O+d,N)}catch(g){if(g.code!=="EADDRINUSE"||O===0||d>=PORT_ATTEMPTS)throw await $.close(),g}const L=N==="0.0.0.0"||N==="::"?"127.0.0.1":N;if(u=`http://${L.includes(":")?`[${L}]`:L}:${R}`,!r.backend)S="The plugin has no backend part.";else if(e.backend===!1)S="The backend is off (--no-backend).";else if(!e.databaseUrl)S="The backend needs a PostgreSQL: start the preview with DATABASE_URL=postgres://\u2026 (each plugin gets its own schema).";else try{I=await startDevBackend({root:t,pluginId:a.id,version:a.version,part:r.backend,databaseUrl:e.databaseUrl,outDir:path.join(o,"backend"),hostApiUrl:`${u}${FAKE_HOST_PREFIX}`,hostApiToken:c,gatewayKey:s,log:n})}catch(d){S=`The backend did not start: ${d instanceof Error?d.message:String(d)}`}S&&r.backend&&n(`[backend] ${S}`);const U=`${u}/p/${a.id}/`;return n(`${a.id} ${a.version}: local preview at ${U}`),e.databaseUrl&&I&&n(`  database ${redactUrl(e.databaseUrl)}, schema ${I.schema}`),n(`${DEV_READY_PREFIX}${JSON.stringify({url:U})}`),{url:U,async close(){await I?.close(),await $.close(),D.closeAllConnections(),await new Promise(d=>D.close(()=>d()))}}}i(startDevServer,"startDevServer"),exports.DEFAULT_DEV_PORT=DEFAULT_DEV_PORT,exports.DEV_DIR=DEV_DIR,exports.DEV_READY_PREFIX=DEV_READY_PREFIX,exports.DEV_ROLES_HEADER=DEV_ROLES_HEADER,exports.DEV_TENANT_ID=DEV_TENANT_ID,exports.DEV_USER_HEADER=DEV_USER_HEADER,exports.applyDevMigrations=applyDevMigrations,exports.devCallerOf=devCallerOf,exports.devDatabaseUrl=devDatabaseUrl,exports.devSchemaName=devSchemaName,exports.gatewayHeaders=gatewayHeaders,exports.handleFakeHost=handleFakeHost,exports.shellFiles=shellFiles,exports.startDevServer=startDevServer,exports.storagePath=storagePath;
+`}o(mainTsx,"mainTsx");var CSP_REPORT_PATH="/__tego/csp-report",CSP_REPORT_PREFIX="TEGO_DEV_CSP ",TARGET_COOKIE="tego-dev-target",DESKTOP_MAX_RESPONSE_BYTES=100*1024*1024,SHARED=["default-src 'self'","object-src 'none'","base-uri 'self'"],PREVIEW_CSP={web:[...SHARED,"script-src 'self' 'wasm-unsafe-eval'","style-src 'self' 'unsafe-inline'","img-src 'self' data: blob: https:","font-src 'self' data:","connect-src 'self' wss: ws:","frame-src 'self'","worker-src 'self' blob:"].join("; "),desktop:[...SHARED,"script-src 'self' 'wasm-unsafe-eval'","style-src 'self' 'unsafe-inline' https:","img-src 'self' data: blob: http: https:","font-src 'self' data: blob: https:","media-src 'self' data: blob:","worker-src 'self' blob:","connect-src 'self' http: https: ws: wss:","frame-src 'self'"].join("; ")};function isPreviewTarget(e){return e==="web"||e==="desktop"}o(isPreviewTarget,"isPreviewTarget");function targetOf(e,t){const r=new URL(e.url??"/","http://preview.local").searchParams.get("target");if(isPreviewTarget(r))return r;const a=/(?:^|;\s*)tego-dev-target=(web|desktop)(?:;|$)/.exec(String(e.headers.cookie??""))?.[1];return isPreviewTarget(a)?a:t}o(targetOf,"targetOf");function parseCspReport(e){try{const t=JSON.parse(e)["csp-report"];if(!t)return;const r=String(t["effective-directive"]??t["violated-directive"]??""),a=String(t["blocked-uri"]??"");if(!r)return;const n=typeof t["source-file"]=="string"?t["source-file"]:void 0,i=typeof t["line-number"]=="number"?t["line-number"]:void 0;return{directive:r,blocked:a,...n?{source:n}:{},...i?{line:i}:{}}}catch{return}}o(parseCspReport,"parseCspReport");var DEFAULT_DEV_PORT=5280,PORT_ATTEMPTS=20,DEV_READY_PREFIX="TEGO_DEV_READY ",DEV_DIR=".tego-dev",PLUGIN_API_PREFIX="/api/v1/tego-os/plugin-api/";function displayNameOf(e){const{displayName:t}=e;return typeof t=="string"?t:t.en??t["zh-CN"]??Object.values(t)[0]??e.id}o(displayNameOf,"displayNameOf");function packageDir(e,t){for(let r=path.resolve(e);;r=path.dirname(r)){const a=path.join(r,"node_modules",...t.split("/"));if(fs.existsSync(path.join(a,"package.json")))return fs.realpathSync(a);if(path.dirname(r)===r)return}}o(packageDir,"packageDir");function sendJson(e,t,r){e.writeHead(t,{"content-type":"application/json"}),e.end(JSON.stringify(r))}o(sendJson,"sendJson");function listen(e,t,r){return new Promise((a,n)=>{const i=o(s=>{e.off("listening",u),n(s)},"onError"),u=o(()=>{e.off("error",i);const s=e.address();a(typeof s=="object"&&s?s.port:t)},"onListening");e.once("error",i),e.once("listening",u),e.listen(t,r)})}o(listen,"listen");async function shellTailwind(e,t){const r=module$1.createRequire(path.join(e,"vite.config.ts"));let a,n;try{a=r("@tego/ui/tailwind-preset"),n=path.dirname(r.resolve("@tego/ui"))}catch(u){throw new Error(`The preview cannot load @tego/ui's Tailwind preset from ${e}: ${u instanceof Error?u.message:String(u)}. Install the plugin's dependencies.`,{cause:u})}const i=(await import("tailwindcss")).default;return i({presets:[a],content:[path.join(n,"**/*.{js,cjs}"),path.join(t,"*.tsx")]})}o(shellTailwind,"shellTailwind");function perStylesheet(e,t,r){return{postcssPlugin:"tego-dev-stylesheets",async Once(a,n){const i=a.source?.input.file,u=i&&path.resolve(i)===e?[t]:r;if(u.length===0)return;const s=await n.postcss(u).process(a,{from:i});n.result.messages.push(...s.messages)}}}o(perStylesheet,"perStylesheet");function servePlugins(e){return Array.isArray(e)?e.flat(1/0).map(t=>{if(!t||typeof t!="object")return t;const{buildStart:r}=t;return typeof r!="function"?t:{...t,buildStart(...a){const n=new Proxy(this,{get(i,u){if(u==="emitFile")return()=>"";const s=Reflect.get(i,u);return typeof s=="function"?s.bind(i):s}});return r.apply(n,a)}}}):e}o(servePlugins,"servePlugins");async function startDevServer(e){const t=path.resolve(e.root),r=e.log??(c=>console.log(c)),a=await chunk4LKRXDYY_cjs.readManifest(t),n=chunk2P6UEAPV_cjs.resolvePluginParts(a),i=path.join(t,DEV_DIR),u=path.join(i,"shell"),s=crypto.randomBytes(32).toString("hex"),l=crypto.randomBytes(24).toString("hex");let d="";const f=new Map;let v,y={};const m=n.frontend?path.resolve(t,n.frontend.dir):t,{loadConfigFromFile:D,createServer:A,mergeConfig:N}=await import("vite");if(n.frontend){const c=path.join(m,"vite.config.ts");fs.existsSync(c)&&(y=(await D({command:"serve",mode:"development"},c,t))?.config??{});const p=y.build?.rollupOptions?.input,w=path.resolve(t,typeof p=="string"?p:`${n.frontend.dir}/src/index.tsx`);if(!fs.existsSync(w))throw new Error(`The frontend entry ${path.relative(t,w)} does not exist.`);v=path.relative(u,w).split(path.sep).join("/"),v.startsWith(".")||(v=`./${v}`)}const g=o(()=>n.frontend?chunk4LKRXDYY_cjs.readPluginLocales(t,a,n.frontend.i18nDirPath):Promise.resolve(new Map),"localeFiles"),E=[...(await g()).keys()].map(c=>c.replace(/\.json$/,""));await promises.mkdir(u,{recursive:!0});for(const c of shellFiles({pluginId:a.id,displayName:displayNameOf(a),nav:n.frontend?.nav??[],config:n.frontend?.config?chunkMWMGJJ74_cjs.applyConfigDefaults(n.frontend.config.schema,{}):{},entry:v,locales:E,defaultTarget:e.target??"web"}))await promises.writeFile(path.join(u,c.path),c.contents);let _,k;const F=o(()=>n.backend?.config?chunkMWMGJJ74_cjs.applyConfigDefaults(n.backend.config.schema,{}):{},"backendConfig"),R=http.createServer((c,p)=>void M(c,p));async function M(c,p){const w=(c.url??"/").split("?")[0],T=targetOf(c,e.target??"web");try{if(w==="/favicon.ico"){p.writeHead(204),p.end();return}if(w===CSP_REPORT_PATH){const h=await new Promise(L=>{let P="";c.setEncoding("utf8"),c.on("data",x=>P+=x),c.on("end",()=>L(P))}),b=parseCspReport(h);b&&(r(`[csp:${T}] blocked ${b.blocked||"(inline)"} by ${b.directive}${b.source?` in ${b.source}${b.line?`:${b.line}`:""}`:""}`),r(`${CSP_REPORT_PREFIX}${JSON.stringify({target:T,...b})}`)),p.writeHead(204),p.end();return}if(w.startsWith(FAKE_HOST_PREFIX)||w.startsWith(FAKE_FILES_PREFIX)){await handleFakeHost(c,p,{token:l,storageDir:path.join(i,"storage"),config:F,origin:o(()=>d,"origin"),users:o(()=>f,"users"),log:r});return}const S=/^\/i18n\/([A-Za-z-]+)\.json$/.exec(w);if(S){const h=(await g()).get(`${S[1]}.json`);if(h===void 0)return sendJson(p,404,{error:`no ${S[1]}.json`});p.writeHead(200,{"content-type":"application/json"}),p.end(h);return}const I=`${PLUGIN_API_PREFIX}${a.id}`;if(w===I||w.startsWith(`${I}/`)){q(c,p,(c.url??"/").slice(I.length)||"/",T);return}if(String(c.headers.accept??"").includes("text/html")){p.setHeader("Content-Security-Policy",`${PREVIEW_CSP[T]}; report-uri ${CSP_REPORT_PATH}`);const h=new URL(c.url??"/","http://preview.local").searchParams.get("target");isPreviewTarget(h)&&p.setHeader("Set-Cookie",`${TARGET_COOKIE}=${h}; Path=/; SameSite=Lax`)}C.middlewares(c,p,()=>sendJson(p,404,{error:`${w} not found`}))}catch(S){sendJson(p,500,{error:S instanceof Error?S.message:String(S)})}}o(M,"route");function q(c,p,w,T){if(!_){sendJson(p,503,{error:k??"The plugin has no backend part."});return}const S=devCallerOf(c.headers);f.set(S.userId,S.roles);const I=http.request({host:"127.0.0.1",port:_.port,method:c.method,path:w,headers:{...gatewayHeaders(c.headers,S,s),...T==="desktop"?{"accept-encoding":"identity"}:{}}},h=>{if(T!=="desktop"){p.writeHead(h.statusCode??502,h.headers),h.pipe(p);return}const b=[];let L=0,P=!1;h.on("data",x=>{if(!P){if(L+=x.length,L>DESKTOP_MAX_RESPONSE_BYTES){P=!0,h.destroy(),r(`[desktop] ${c.method} ${w}: response over 100 MB refused (413)`),sendJson(p,413,{error:"Response over 100 MB: the desktop app refuses it. Serve large files through storage paths."});return}b.push(x)}}),h.on("end",()=>{if(P)return;const x=Buffer.concat(b),G={...h.headers};delete G["transfer-encoding"],G["content-length"]=String(x.length),p.writeHead(h.statusCode??502,G),p.end(x)})});I.on("error",h=>{p.headersSent?p.destroy():sendJson(p,502,{error:`The backend is not answering (${h.message}); see the terminal.`})}),c.pipe(I)}o(q,"proxy");const K=path.join(u,"shell.css"),J=(()=>{const c=y.css?.postcss;return c&&typeof c=="object"?c.plugins??[]:[]})(),$=(()=>{const c=packageDir(m,"react-i18next");return(c&&packageDir(c,"i18next"))??packageDir(m,"i18next")})(),{css:X,mode:Y,build:z,...U}=y;U.plugins=servePlugins(U.plugins);const C=await A(N(U,{configFile:!1,root:u,mode:"development",appType:"spa",clearScreen:!1,logLevel:"info",esbuild:{jsx:"automatic",jsxDev:!1},css:{postcss:{plugins:[perStylesheet(K,await shellTailwind(m,u),J)]}},resolve:{alias:[{find:"@tego/chat/plugin-surface",replacement:path.join(u,"plugin-surface.tsx")},...$?[{find:/^i18next$/,replacement:$}]:[]]},server:{middlewareMode:!0,hmr:{server:R},fs:{allow:[t,u,...$?[$]:[]]}},optimizeDeps:{entries:[path.join(u,"index.html")]}})),O=e.host??"127.0.0.1";let j;const H=e.port??DEFAULT_DEV_PORT;for(let c=0;j===void 0;c++)try{j=await listen(R,H===0?0:H+c,O)}catch(p){if(p.code!=="EADDRINUSE"||H===0||c>=PORT_ATTEMPTS)throw await C.close(),p}const V=O==="0.0.0.0"||O==="::"?"127.0.0.1":O;if(d=`http://${V.includes(":")?`[${V}]`:V}:${j}`,!n.backend)k="The plugin has no backend part.";else if(e.backend===!1)k="The backend is off (--no-backend).";else if(!e.databaseUrl)k="The backend needs a PostgreSQL: start the preview with DATABASE_URL=postgres://\u2026 (each plugin gets its own schema).";else try{_=await startDevBackend({root:t,pluginId:a.id,version:a.version,part:n.backend,databaseUrl:e.databaseUrl,outDir:path.join(i,"backend"),hostApiUrl:`${d}${FAKE_HOST_PREFIX}`,hostApiToken:l,gatewayKey:s,log:r})}catch(c){k=`The backend did not start: ${c instanceof Error?c.message:String(c)}`}k&&n.backend&&r(`[backend] ${k}`);const B=`${d}/p/${a.id}/`;return r(`${a.id} ${a.version}: local preview at ${B}`),e.databaseUrl&&_&&r(`  database ${redactUrl(e.databaseUrl)}, schema ${_.schema}`),r(`${DEV_READY_PREFIX}${JSON.stringify({url:B})}`),{url:B,async close(){await _?.close(),await C.close(),R.closeAllConnections(),await new Promise(c=>R.close(()=>c()))}}}o(startDevServer,"startDevServer"),exports.CSP_REPORT_PREFIX=CSP_REPORT_PREFIX,exports.DEFAULT_DEV_PORT=DEFAULT_DEV_PORT,exports.DEV_DIR=DEV_DIR,exports.DEV_READY_PREFIX=DEV_READY_PREFIX,exports.DEV_ROLES_HEADER=DEV_ROLES_HEADER,exports.DEV_TENANT_ID=DEV_TENANT_ID,exports.DEV_USER_HEADER=DEV_USER_HEADER,exports.PREVIEW_CSP=PREVIEW_CSP,exports.applyDevMigrations=applyDevMigrations,exports.devCallerOf=devCallerOf,exports.devDatabaseUrl=devDatabaseUrl,exports.devSchemaName=devSchemaName,exports.gatewayHeaders=gatewayHeaders,exports.handleFakeHost=handleFakeHost,exports.parseCspReport=parseCspReport,exports.shellFiles=shellFiles,exports.startDevServer=startDevServer,exports.storagePath=storagePath,exports.targetOf=targetOf;

package/dist/dev.d.cts

@@ -1,6 +1,38 @@
 import { IncomingMessage, ServerResponse } from 'node:http';
 import { P as PluginNavEntry } from './manifest-types-CUTNfJTa.cjs';
 
+/**
+ * The two shells a plugin page runs in, as the local preview imitates them.
+ *
+ * - `web`: the platform's nginx CSP (`docker/ai-studio/nginx.conf`) — the page
+ *   may connect to the platform only. Its per-request nonce is left out: Vite's
+ *   dev scripts cannot carry one, and what the nonce guards (injected inline
+ *   scripts, `eval`) is refused here the same way.
+ * - `desktop`: the Tauri app's CSP (`apps/ai-studio/src-tauri/tauri.conf.json`)
+ *   — no `eval`/`new Function`, no `blob:` scripts — and its protocol proxy,
+ *   which buffers every `ctx.api` response whole, refuses one over 100 MB, and
+ *   strips `accept-encoding`.
+ *
+ * Both report violations to the preview, which prints them, so a dependency
+ * that compiles strings or a call to a third-party URL shows up while
+ * developing instead of after release.
+ */
+
+type PreviewTarget = 'web' | 'desktop';
+/** The machine-readable line tools watch for (`TEGO_DEV_CSP {"target",…}`). */
+declare const CSP_REPORT_PREFIX = "TEGO_DEV_CSP ";
+declare const PREVIEW_CSP: Record<PreviewTarget, string>;
+/** `?target=` wins, then the cookie the shell's switch sets, then the default. */
+declare function targetOf(req: Pick<IncomingMessage, 'url' | 'headers'>, fallback: PreviewTarget): PreviewTarget;
+interface CspViolation {
+    directive: string;
+    blocked: string;
+    source?: string;
+    line?: number;
+}
+/** A browser's `application/csp-report` body; `undefined` when it is not one. */
+declare function parseCspReport(body: string): CspViolation | undefined;
+
 /** `tego_dev_<id>` with every character Postgres would need quoted folded to `_`. */
 declare function devSchemaName(pluginId: string): string;
 /**
@@ -76,6 +108,8 @@ interface ShellOptions {
     entry?: string | undefined;
     /** Locales the plugin ships (`en.json` → `en`). */
     locales: string[];
+    /** The shell imitated when the page has not chosen one. */
+    defaultTarget?: 'web' | 'desktop';
 }
 interface ShellFile {
     path: string;
@@ -96,6 +130,8 @@ interface DevServerOptions {
     host?: string;
     /** Run the backend part (needs `databaseUrl`); default true. */
     backend?: boolean;
+    /** Which shell to imitate by default (CSP, network proxy); the page can switch. Default `web`. */
+    target?: PreviewTarget;
     databaseUrl?: string;
     log?(line: string): void;
 }
@@ -105,4 +141,4 @@ interface DevServer {
 }
 declare function startDevServer(options: DevServerOptions): Promise<DevServer>;
 
-export { DEFAULT_DEV_PORT, DEV_DIR, DEV_READY_PREFIX, DEV_ROLES_HEADER, DEV_TENANT_ID, DEV_USER_HEADER, type DevServer, type DevServerOptions, applyDevMigrations, devCallerOf, devDatabaseUrl, devSchemaName, gatewayHeaders, handleFakeHost, shellFiles, startDevServer, storagePath };
+export { CSP_REPORT_PREFIX, type CspViolation, DEFAULT_DEV_PORT, DEV_DIR, DEV_READY_PREFIX, DEV_ROLES_HEADER, DEV_TENANT_ID, DEV_USER_HEADER, type DevServer, type DevServerOptions, PREVIEW_CSP, type PreviewTarget, applyDevMigrations, devCallerOf, devDatabaseUrl, devSchemaName, gatewayHeaders, handleFakeHost, parseCspReport, shellFiles, startDevServer, storagePath, targetOf };

package/dist/dev.d.ts

@@ -1,6 +1,38 @@
 import { IncomingMessage, ServerResponse } from 'node:http';
 import { P as PluginNavEntry } from './manifest-types-CUTNfJTa.js';
 
+/**
+ * The two shells a plugin page runs in, as the local preview imitates them.
+ *
+ * - `web`: the platform's nginx CSP (`docker/ai-studio/nginx.conf`) — the page
+ *   may connect to the platform only. Its per-request nonce is left out: Vite's
+ *   dev scripts cannot carry one, and what the nonce guards (injected inline
+ *   scripts, `eval`) is refused here the same way.
+ * - `desktop`: the Tauri app's CSP (`apps/ai-studio/src-tauri/tauri.conf.json`)
+ *   — no `eval`/`new Function`, no `blob:` scripts — and its protocol proxy,
+ *   which buffers every `ctx.api` response whole, refuses one over 100 MB, and
+ *   strips `accept-encoding`.
+ *
+ * Both report violations to the preview, which prints them, so a dependency
+ * that compiles strings or a call to a third-party URL shows up while
+ * developing instead of after release.
+ */
+
+type PreviewTarget = 'web' | 'desktop';
+/** The machine-readable line tools watch for (`TEGO_DEV_CSP {"target",…}`). */
+declare const CSP_REPORT_PREFIX = "TEGO_DEV_CSP ";
+declare const PREVIEW_CSP: Record<PreviewTarget, string>;
+/** `?target=` wins, then the cookie the shell's switch sets, then the default. */
+declare function targetOf(req: Pick<IncomingMessage, 'url' | 'headers'>, fallback: PreviewTarget): PreviewTarget;
+interface CspViolation {
+    directive: string;
+    blocked: string;
+    source?: string;
+    line?: number;
+}
+/** A browser's `application/csp-report` body; `undefined` when it is not one. */
+declare function parseCspReport(body: string): CspViolation | undefined;
+
 /** `tego_dev_<id>` with every character Postgres would need quoted folded to `_`. */
 declare function devSchemaName(pluginId: string): string;
 /**
@@ -76,6 +108,8 @@ interface ShellOptions {
     entry?: string | undefined;
     /** Locales the plugin ships (`en.json` → `en`). */
     locales: string[];
+    /** The shell imitated when the page has not chosen one. */
+    defaultTarget?: 'web' | 'desktop';
 }
 interface ShellFile {
     path: string;
@@ -96,6 +130,8 @@ interface DevServerOptions {
     host?: string;
     /** Run the backend part (needs `databaseUrl`); default true. */
     backend?: boolean;
+    /** Which shell to imitate by default (CSP, network proxy); the page can switch. Default `web`. */
+    target?: PreviewTarget;
     databaseUrl?: string;
     log?(line: string): void;
 }
@@ -105,4 +141,4 @@ interface DevServer {
 }
 declare function startDevServer(options: DevServerOptions): Promise<DevServer>;
 
-export { DEFAULT_DEV_PORT, DEV_DIR, DEV_READY_PREFIX, DEV_ROLES_HEADER, DEV_TENANT_ID, DEV_USER_HEADER, type DevServer, type DevServerOptions, applyDevMigrations, devCallerOf, devDatabaseUrl, devSchemaName, gatewayHeaders, handleFakeHost, shellFiles, startDevServer, storagePath };
+export { CSP_REPORT_PREFIX, type CspViolation, DEFAULT_DEV_PORT, DEV_DIR, DEV_READY_PREFIX, DEV_ROLES_HEADER, DEV_TENANT_ID, DEV_USER_HEADER, type DevServer, type DevServerOptions, PREVIEW_CSP, type PreviewTarget, applyDevMigrations, devCallerOf, devDatabaseUrl, devSchemaName, gatewayHeaders, handleFakeHost, parseCspReport, shellFiles, startDevServer, storagePath, targetOf };