sporades 0.6.3 → 0.6.5

package/CHANGES.md

@@ -1,179 +1,9 @@
 # Changes
 
-## Unreleased - 2026-08-03
+## Unreleased - 2026-08-04
 
-Changes since v0.6.1.
-
-### 🚀 Features
-
-- Add scriptable sealed env key management (742ac99).
-- Add Microsoft OpenID Connect sign-in (affeed9).
-- Complete SMTP runtime production parity (3237d21).
-- Add Sign in with Apple (11b22ff).
-- Add Facebook OAuth sign-in (3e166fc).
-- Support portable SMTP relay modes (59817d3).
-- Add multi-provider OAuth configuration (e9f388f).
-- Add Mailgun SMTP extensions (c71314c).
-- Add Postmark SMTP extensions (768b078).
-- Add generic SMTP mail runtime (420d8b0).
-- Add stable provider identities (2d5be36).
+Changes since v0.6.4.
 
 ### 🐛 Bug Fixes
 
-- Isolate SMTP transport error classification (279e629).
-- Guard SMTP error and close traps (203724b).
-- Harden SMTP failure and shutdown boundaries (2a77579).
-- Preserve Facebook body timeouts (bbbb5b5).
-- Harden Facebook OAuth transport (c8ddcc6).
-- Harden portable SMTP configuration (edaf97e).
-
-### 🔧 Improvements
-
-- Complete multi-provider OAuth implementation swarm (83217df).
-- Accept OAuth coexistence issue 07 (df102b9).
-- Final review for OAuth coexistence issue 07 (fa1c3e0).
-- Request Apple JWKS taxonomy fix for OAuth issue 07 (63328b1).
-- Re-review OAuth endpoint confinement (3a5f38a).
-- Request JWKS confinement rework for OAuth issue 07 (fbcc0e6).
-- Re-review OAuth coexistence issue 07 (609aa56).
-- Request rework for OAuth coexistence issue 07 (e03ef29).
-- Review OAuth coexistence issue 07 (81b8cb2).
-- Dispatch multi-provider OAuth issue 07 (2c54c36).
-- Complete Microsoft OAuth issue 04 (b18dae7).
-- Accept Microsoft OAuth issue 04 integration (6c6b7db).
-- Record SMTP swarm final verification (291cb7c).
-- Review three-provider OAuth integration (df527e8).
-- Accept Microsoft OAuth issue 04 candidate (b63b4b1).
-- Complete SMTP mail issue 05 (cedc452).
-- Accept SMTP mail issue 05 (39684a1).
-- Re-review Microsoft OAuth cache saturation (487686a).
-- Re-review third replacement for SMTP mail issue 05 (6f64f23).
-- Clean up Apple OAuth worktree (40ceac4).
-- Request saturation rework for Microsoft OAuth cache (9fb94d5).
-- Request third rework for SMTP mail issue 05 (cd611fd).
-- Re-review Microsoft OAuth cache lifecycle (c2d5a95).
-- Re-review second replacement for SMTP mail issue 05 (b2f455b).
-- Complete Apple OAuth issue 05 (ac9eacf).
-- Request second rework for SMTP mail issue 05 (f036856).
-- Accept Apple OAuth issue 05 integration (06d6af7).
-- Request lifecycle rework for Microsoft OAuth cache (5ec1cff).
-- Re-review SMTP mail issue 05 (137d31a).
-- Review Apple and Facebook OAuth integration (15408ad).
-- Re-review Microsoft OAuth cache handling (a2814b4).
-- Request rework for SMTP mail issue 05 (55876a9).
-- Complete Facebook OAuth issue 06 (49471f2).
-- Accept Facebook OAuth issue 06 (e73b98e).
-- Re-review Apple OAuth callback parser (b258d8f).
-- Re-review Facebook OAuth timeout handling (fc9d1e5).
-- Review SMTP mail issue 05 (ebc29e8).
-- Request cache rework for Microsoft OAuth issue 04 (2261ffc).
-- Request parser rework for Apple OAuth issue 05 (1a4af01).
-- Advance Microsoft and Facebook OAuth rework (9c488f6).
-- Re-review Apple OAuth issue 05 (d2cc161).
-- Re-review Facebook OAuth issue 06 (4a48c7e).
-- Dispatch SMTP mail issue 05 (3675858).
-- Complete SMTP mail issue 04 (630b589).
-- Accept SMTP mail issue 04 (1381dbd).
-- Re-review second replacement for SMTP mail issue 04 (3041f53).
-- Request second rework for SMTP mail issue 04 (e94dabd).
-- Request rework for Facebook OAuth issue 06 (a84fd43).
-- Re-review SMTP mail issue 04 (ea9df9e).
-- Request rework for Microsoft OAuth issue 04 (8a7b75e).
-- Review Facebook OAuth issue 06 (af9f4e8).
-- Request rework for SMTP mail issue 04 (8140e85).
-- Review Microsoft OAuth issue 04 (6a02358).
-- Request rework for Apple OAuth issue 05 (f60ad7b).
-- Review Apple OAuth issue 05 (274f085).
-- Review SMTP mail issue 04 (3d67ba2).
-- Dispatch provider OAuth implementation frontier (a53d2aa).
-- Complete multi-provider OAuth issue 03 (1dc0371).
-- Accept multi-provider OAuth issue 03 (32e289c).
-- Re-review invariant-safe OAuth issue 03 (4257dbb).
-- Dispatch SMTP mail issue 04 (ff61b3e).
-- Complete SMTP mail issue 03 (f7e9916).
-- Accept SMTP mail issue 03 (54ab22c).
-- Re-review third replacement for SMTP mail issue 03 (50495c8).
-- Request invariant rework for multi-provider OAuth issue 03 (ad54e22).
-- Request third rework for SMTP mail issue 03 (31da8bc).
-- Re-review atomic multi-provider OAuth issue 03 (cb94846).
-- Re-review second replacement for SMTP mail issue 03 (a4614cd).
-- Request second rework for SMTP mail issue 03 (53b0d36).
-- Re-review SMTP mail issue 03 (ec21ea5).
-- Request atomic rework for multi-provider OAuth issue 03 (15a9336).
-- Re-review multi-provider OAuth issue 03 (c58107a).
-- Request rework for SMTP mail issue 03 (fbf0fc2).
-- Review SMTP mail issue 03 (7f8623a).
-- Request rework for multi-provider OAuth issue 03 (8295165).
-- Dispatch SMTP mail issue 03 (239f016).
-- Complete SMTP mail issue 02 (912a1ac).
-- Review multi-provider OAuth issue 03 (fe44a93).
-- Accept SMTP mail issue 02 (8e91a6e).
-- Re-review SMTP mail issue 02 (9944346).
-- Request rework for SMTP mail issue 02 (855ecbf).
-- Review SMTP mail issue 02 (2708b4f).
-- Dispatch SMTP mail issue 02 (9339ad0).
-- Complete SMTP mail issue 01 (6b0d35f).
-- Accept SMTP mail issue 01 (86c590c).
-- Re-review encoded address fix for SMTP mail issue 01 (fc30f8f).
-- Request third rework for SMTP mail issue 01 (8befa61).
-- Re-review RFC 2047 fix for SMTP mail issue 01 (99dd6ac).
-- Request second rework for SMTP mail issue 01 (f864623).
-- Dispatch multi-provider OAuth issue 03 (7d345e9).
-- Complete multi-provider OAuth issue 02 (c3da4ab).
-- Accept multi-provider OAuth issue 02 (cc6d385).
-- Re-review SMTP mail issue 01 (486fed4).
-- Re-review multi-provider OAuth issue 02 (2e632ae).
-- Request rework for SMTP mail issue 01 (075813f).
-- Request rework for multi-provider OAuth issue 02 (dbffa22).
-- Dispatch review for SMTP mail issue 01 (34d9960).
-- Review SMTP mail issue 01 (4271868).
-- Review multi-provider OAuth issue 02 (bb0292c).
-- Dispatch SMTP mail issue 01 (a51c647).
-- Initialize SMTP mail swarm ledger (ac20cf1).
-- Clean up multi-provider OAuth issue 01 worktree (4297774).
-- Dispatch multi-provider OAuth issue 02 (d059d44).
-- Complete multi-provider OAuth issue 01 (da7602c).
-- Accept multi-provider OAuth issue 01 (e925fa0).
-- Re-review multi-provider OAuth issue 01 (6595fa4).
-- Re-review multi-provider OAuth issue 01 (33decb6).
-- Plan SMTP mail support (35e1519).
-- Request rework for multi-provider OAuth issue 01 (0f08d69).
-- Review multi-provider OAuth issue 01 (b4f5d58).
-- Dispatch multi-provider OAuth issue 01 (ab58692).
-- Initialize multi-provider OAuth swarm ledger (716075b).
-- Plan multi-provider OAuth expansion (1cc5f60).
-
-### 📝 Documentation
-
-- Contract provider-neutral OAuth runtime (df4901f).
-- Fail closed on Microsoft OIDC cache saturation (5889257).
-- Bound Microsoft OIDC cache lifecycle (9e3aeff).
-- Coalesce Microsoft OIDC cache refreshes (7b54d69).
-- Harden Microsoft OIDC network and token parsing (13774fe).
-- Reject malformed OAuth form callbacks (1817519).
-- Harden Sign in with Apple boundaries (301ff15).
-- Reject duplicate file transaction targets (3cabaf0).
-- Make OAuth configuration updates failure-atomic (b94bb52).
-- Harden multi-provider OAuth configuration (56a1f14).
-- Make Mailgun header boundaries exact (378ca69).
-- Validate Mailgun headers before delivery (66080b0).
-- Harden Mailgun SMTP header encoding (9436714).
-- Update generated SMTP API docs (0cf6139).
-- Harden SMTP MIME and TLS errors (89536c1).
-- Harden OAuth state and identity validation (6ef5d6a).
-- Deepen runtime OAuth provider seam (210aeb2).
-- Harden legacy provider identity claims (39e9e7a).
-
-### 🧪 Tests
-
-- Integrate Microsoft OAuth with sibling providers (11bf24e).
-- Prove implicit TLS fails closed (24f10b2).
-- Define portable SMTP security contract (81698b3).
-- Harden Postmark provider data objects (3940fd5).
-- Fold encoded address headers at 76 columns (ab731ed).
-- Bound MIME encoded-word lines (b78ca71).
-
-### 📦 Packaging
-
-- Release v0.6.2 (3d21e1a).
-- Align esbuild script approval version (613f597).
+- Password reset and logout for email/password accounts (1cbe35f).

package/bin/sporades-host-helper.js

@@ -391,7 +391,7 @@ function writeEnvelope(result, failed = false) {
 }
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.6.3";
+var CLI_VERSION = "0.6.5";
 
 // src/cli/schedule-inspection-envelope.ts
 function sanitizeScheduleInspectionEnvelope(envelope, invalid) {

package/bin/sporades.js

@@ -82,6 +82,9 @@ export const auth = {
   signOut() {
     return connect().signOut();
   },
+  setPassword(email, newPassword) {
+    return connect().setPassword(email, newPassword);
+  },
 };
 
 export const files = {
@@ -162,6 +165,9 @@ export function createHooks(primitives) {
       signOut() {
         return connect().signOut();
       },
+      setPassword(email, newPassword) {
+        return connect().setPassword(email, newPassword);
+      },
     };
   }
 
@@ -217,6 +223,7 @@ export function createVueComposables(primitives) {
     state.signUp = (provider, credentials) => connect().signUp(provider, credentials);
     state.signIn = (provider, credentials) => connect().signIn(provider, credentials);
     state.signOut = () => connect().signOut();
+    state.setPassword = (email, newPassword) => connect().setPassword(email, newPassword);
     return state;
   }
 
@@ -268,6 +275,7 @@ export function createSolidPrimitives(primitives) {
       signUp: (provider, credentials) => connect().signUp(provider, credentials),
       signIn: (provider, credentials) => connect().signIn(provider, credentials),
       signOut: () => connect().signOut(),
+      setPassword: (email, newPassword) => connect().setPassword(email, newPassword),
     };
   }
 
@@ -365,6 +373,7 @@ export function createLitControllers() {
     controller.signUp = (provider, credentials) => connect().signUp(provider, credentials);
     controller.signIn = (provider, credentials) => connect().signIn(provider, credentials);
     controller.signOut = () => connect().signOut();
+    controller.setPassword = (email, newPassword) => connect().setPassword(email, newPassword);
     return controller;
   }
 
@@ -437,6 +446,7 @@ export function createInfernoAdapters() {
     adapter.signUp = (provider, credentials) => connect().signUp(provider, credentials);
     adapter.signIn = (provider, credentials) => connect().signIn(provider, credentials);
     adapter.signOut = () => connect().signOut();
+    adapter.setPassword = (email, newPassword) => connect().setPassword(email, newPassword);
     return adapter;
   }
   return { queryAdapter, mutationAdapter, authAdapter };
@@ -486,6 +496,7 @@ export function createSvelteStores() {
       signUp: (provider, credentials) => connect().signUp(provider, credentials),
       signIn: (provider, credentials) => connect().signIn(provider, credentials),
       signOut: () => connect().signOut(),
+      setPassword: (email, newPassword) => connect().setPassword(email, newPassword),
     };
   }
 
@@ -990,6 +1001,9 @@ function createConnection() {
         return result;
       });
     },
+    setPassword(email, newPassword) {
+      return request("auth.setPassword", { email, newPassword });
+    },
     subscribeQuery(name, listener) {
       if (typeof name !== "string" || !name) throw new TypeError("queries.subscribe requires a query name.");
       if (typeof listener !== "function") throw new TypeError("queries.subscribe requires a listener function.");
@@ -1311,6 +1325,8 @@ async function buildVite(options) {
   let projectRoot = path.resolve(options.projectDir);
   try {
     projectRoot = await realpath(options.projectDir);
+    const canonicalIndexHtmlPath = path.join(projectRoot, path.basename(options.indexHtmlPath));
+    const projectConfigFile = await findProjectViteConfig(projectRoot);
     if (options.frameworkConfig.framework === "vue") {
       const { plugin, compiler } = await loadProjectVueToolchain(projectRoot);
       frameworkPlugins.push(plugin({ compiler }));
@@ -1327,9 +1343,10 @@ async function buildVite(options) {
       root: projectRoot,
       base: "/",
       publicDir: false,
-      configFile: false,
+      configFile: projectConfigFile,
       envFile: false,
       envPrefix: "\0",
+      mode: "production",
       define: {
         "import.meta.env": JSON.stringify({ BASE_URL: "/", MODE: "production", DEV: false, PROD: true, SSR: false })
       },
@@ -1338,14 +1355,25 @@ async function buildVite(options) {
       logLevel: "silent",
       esbuild: options.frameworkConfig.framework === "inferno" ? { jsx: "transform", jsxFactory: "createElement" } : { jsx: "automatic", jsxImportSource: options.frameworkConfig.jsxImportSource ?? void 0 },
       css: { postcss: { plugins: [] } },
-      plugins: [...frameworkPlugins, sporadesViteClientPlugin(options.devRefresh === true)],
+      plugins: [
+        ...frameworkPlugins,
+        sporadesViteClientPlugin(options.devRefresh === true),
+        sporadesViteBuildInvariants(canonicalIndexHtmlPath, options.frameworkConfig)
+      ],
       build: {
         write: false,
         emptyOutDir: false,
         sourcemap: true,
         cssCodeSplit: true,
         assetsInlineLimit: 0,
+        watch: null,
+        lib: false,
+        ssr: false,
+        manifest: false,
+        ssrManifest: false,
         rollupOptions: {
+          input: canonicalIndexHtmlPath,
+          external: [],
           output: {
             entryFileNames: "assets/[name]-[hash].js",
             chunkFileNames: "assets/[name]-[hash].js",
@@ -1378,6 +1406,40 @@ async function buildVite(options) {
     throw viteBuildError(error, [options.projectDir, projectRoot], options.frameworkConfig.framework);
   }
 }
+var VITE_CONFIG_NAMES = [
+  "vite.config.js",
+  "vite.config.mjs",
+  "vite.config.ts",
+  "vite.config.cjs",
+  "vite.config.mts",
+  "vite.config.cts"
+];
+async function findProjectViteConfig(projectRoot) {
+  for (const name of VITE_CONFIG_NAMES) {
+    const candidate = path.join(projectRoot, name);
+    try {
+      const metadata = await lstat(candidate);
+      if (!metadata.isFile() || metadata.isSymbolicLink()) {
+        throw clientToolchainError(
+          `Vite configuration must be a regular file inside the Capsule: ${name}.`,
+          `Replace ${name} with a regular project-owned file, then retry.`
+        );
+      }
+      const canonical = await realpath(candidate);
+      if (!isCanonicalDescendant(projectRoot, canonical)) {
+        throw clientToolchainError(
+          `Vite configuration escaped the Capsule project: ${name}.`,
+          `Move ${name} inside the Capsule project, then retry.`
+        );
+      }
+      return canonical;
+    } catch (error) {
+      if (errorDetails(error).code === "ENOENT") continue;
+      throw error;
+    }
+  }
+  return false;
+}
 async function loadProjectVueToolchain(projectRoot) {
   const loaded = await loadProjectCompilerToolchain(projectRoot, {
     framework: "Vue",
@@ -1547,6 +1609,66 @@ function sporadesViteClientPlugin(devRefresh = false) {
     }
   };
 }
+function sporadesViteBuildInvariants(indexHtmlPath, frameworkConfig) {
+  return {
+    name: "sporades-build-invariants",
+    enforce: "post",
+    config() {
+      return {
+        root: path.dirname(indexHtmlPath),
+        base: "/",
+        publicDir: false,
+        envFile: false,
+        envPrefix: "\0",
+        mode: "production",
+        define: {
+          "import.meta.env": JSON.stringify({ BASE_URL: "/", MODE: "production", DEV: false, PROD: true, SSR: false })
+        },
+        appType: "mpa",
+        clearScreen: false,
+        logLevel: "silent",
+        esbuild: frameworkConfig.framework === "inferno" ? { jsx: "transform", jsxFactory: "createElement" } : { jsx: "automatic", jsxImportSource: frameworkConfig.jsxImportSource ?? void 0 },
+        css: { postcss: { plugins: [] } },
+        build: {
+          write: false,
+          emptyOutDir: false,
+          sourcemap: true,
+          cssCodeSplit: true,
+          assetsInlineLimit: 0,
+          watch: null,
+          lib: false,
+          ssr: false,
+          manifest: false,
+          ssrManifest: false,
+          rollupOptions: {
+            input: indexHtmlPath,
+            external: [],
+            output: {
+              entryFileNames: "assets/[name]-[hash].js",
+              chunkFileNames: "assets/[name]-[hash].js",
+              assetFileNames: "assets/[name]-[hash][extname]"
+            }
+          }
+        }
+      };
+    },
+    configResolved(config) {
+      const pluginNames = new Set(config.plugins.map((plugin) => plugin.name));
+      if (!pluginNames.has("sporades-client-runtime") || !pluginNames.has("sporades-build-invariants")) {
+        throw new Error("Sporades mandatory Vite plugins were not preserved.");
+      }
+      const requiredFrameworkPlugin = {
+        vue: "vite:vue",
+        svelte: "vite-plugin-svelte",
+        solid: "solid",
+        inferno: "sporades-inferno-project-jsx"
+      }[frameworkConfig.framework];
+      if (requiredFrameworkPlugin && !pluginNames.has(requiredFrameworkPlugin)) {
+        throw new Error(`Sporades mandatory ${frameworkConfig.framework} Vite plugin was not preserved.`);
+      }
+    }
+  };
+}
 function referencesLegacyClientShell(html) {
   return /<script\b[^>]*\bsrc\s*=\s*["']\/?client\.js(?:\?[^"']*)?["'][^>]*>/i.test(html);
 }
@@ -5172,6 +5294,11 @@ async function createSqliteDatabaseAdapter(databasePath, options = {}) {
         "INSERT INTO sporades_auth_email_credentials (email, userId, passwordHash, passwordSalt, createdAt) VALUES (?, ?, ?, ?, ?)"
       ).run(row.email, row.userId, row.passwordHash, row.passwordSalt, row.createdAt);
     },
+    updateEmailCredentialPassword(email, passwordHash, passwordSalt) {
+      return this.prepare(
+        "UPDATE sporades_auth_email_credentials SET passwordHash = ?, passwordSalt = ? WHERE email = ?"
+      ).run(passwordHash, passwordSalt, email);
+    },
     findEmailCredentialWithUser(email) {
       const row = this.prepare(
         "SELECT c.email, c.userId, c.passwordHash, c.passwordSalt, u.displayName, u.picture, u.isAuthenticated, u.isGuest FROM sporades_auth_email_credentials c JOIN sporades_auth_users u ON u.id = c.userId WHERE c.email = ?"
@@ -8764,8 +8891,9 @@ async function readEndpointRequest(database, requestUrl, request) {
   };
 }
 function createEndpointContext(database, endpointRequest, session) {
+  const auth = session.auth;
   const context = {
-    auth: session.auth,
+    auth,
     env: database.serverEnv,
     log: createEndpointLogger(database, {
       request: {
@@ -8786,6 +8914,12 @@ function createEndpointContext(database, endpointRequest, session) {
   context.privileged = createContextPrivilegedApi(database, () => holder.current);
   context.jobs = createCurrentUserJobApi(database, () => holder.current);
   context.mail = database.mail;
+  context.serverAuth = {
+    async setEmailPassword(email, newPassword) {
+      const result = await setEmailPassword(database, { auth }, email, newPassword);
+      if (!result.ok) throw new Error(result.error?.message ?? "Could not set password.");
+    }
+  };
   return context;
 }
 function createContextHolder(context) {
@@ -10355,6 +10489,16 @@ function createWebSocketHub(getDatabase, trustedRefresh = null) {
       });
       return;
     }
+    if (message.type === "auth.setPassword") {
+      const result = await setEmailPassword(database, client.session, message.email ?? "", message.newPassword ?? "");
+      sendJson(client, {
+        id: message.id ?? null,
+        type: result.ok ? "auth.setPassword.result" : "error",
+        data: result.ok ? { ok: true } : null,
+        error: result.error ?? null
+      });
+      return;
+    }
     if (message.type === "auth.signUp") {
       const result = await signUpWithEmail(database, client.session, message.provider, message.credentials ?? {});
       if (result.ok) {
@@ -12474,6 +12618,25 @@ function writeRedirect(response, location) {
   response.writeHead(302, { location });
   response.end();
 }
+async function setEmailPassword(database, _session, email, newPassword) {
+  if (!database.authConfig.providers.email.enabled) {
+    return { ok: false, error: emailAuthDisabledError() };
+  }
+  const cleanEmail = typeof email === "string" ? email.trim().toLowerCase() : "";
+  if (!cleanEmail) {
+    return { ok: false, error: { message: "Email is required.", hint: "Provide the email address for the account whose password is being changed." } };
+  }
+  if (typeof newPassword !== "string" || newPassword.length < 8) {
+    return { ok: false, error: { message: "Password is too short.", hint: "Use a password with at least 8 characters." } };
+  }
+  const existing = await database.sqlite.findEmailCredentialWithUser(cleanEmail);
+  if (!existing) {
+    return { ok: false, error: { message: "No email account found for that address.", hint: "Check the email address or register a new account." } };
+  }
+  const password = hashEmailPassword(newPassword);
+  await database.sqlite.updateEmailCredentialPassword(cleanEmail, password.hash, password.salt);
+  return { ok: true };
+}
 async function signUpWithEmail(database, session, provider, credentials) {
   if (provider !== "email") {
     return {
@@ -13411,6 +13574,12 @@ function createMutationContext(database, auth) {
   context.privileged = createContextPrivilegedApi(database, () => holder.current);
   context.jobs = createCurrentUserJobApi(database, () => holder.current);
   context.mail = database.mail;
+  context.serverAuth = {
+    async setEmailPassword(email, newPassword) {
+      const result = await setEmailPassword(database, { auth }, email, newPassword);
+      if (!result.ok) throw new Error(result.error?.message ?? "Could not set password.");
+    }
+  };
   return context;
 }
 function createCurrentUserJobApi(database, contextGetter) {
@@ -21737,7 +21906,7 @@ jobs:
 }
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.6.3";
+var CLI_VERSION = "0.6.5";
 
 // src/cli/sporades.ts
 var SUPPORTED_TEMPLATES = new Set(CLIENT_TEMPLATES);

package/dist/cli/cli-version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.6.3";
+export declare const CLI_VERSION = "0.6.5";
 //# sourceMappingURL=cli-version.d.ts.map

package/dist/cli/cli-version.js

@@ -1,3 +1,3 @@
 // Generated by `npm run build` from package.json. Do not edit by hand.
-export const CLI_VERSION = "0.6.3";
+export const CLI_VERSION = "0.6.5";
 //# sourceMappingURL=cli-version.js.map

package/dist/client-toolchain.js

@@ -96,6 +96,8 @@ async function buildVite(options) {
     let projectRoot = path.resolve(options.projectDir);
     try {
         projectRoot = await realpath(options.projectDir);
+        const canonicalIndexHtmlPath = path.join(projectRoot, path.basename(options.indexHtmlPath));
+        const projectConfigFile = await findProjectViteConfig(projectRoot);
         if (options.frameworkConfig.framework === "vue") {
             const { plugin, compiler } = await loadProjectVueToolchain(projectRoot);
             frameworkPlugins.push(plugin({ compiler }));
@@ -115,9 +117,10 @@ async function buildVite(options) {
             root: projectRoot,
             base: "/",
             publicDir: false,
-            configFile: false,
+            configFile: projectConfigFile,
             envFile: false,
             envPrefix: "\0",
+            mode: "production",
             define: {
                 "import.meta.env": JSON.stringify({ BASE_URL: "/", MODE: "production", DEV: false, PROD: true, SSR: false }),
             },
@@ -128,14 +131,25 @@ async function buildVite(options) {
                 ? { jsx: "transform", jsxFactory: "createElement" }
                 : { jsx: "automatic", jsxImportSource: options.frameworkConfig.jsxImportSource ?? undefined },
             css: { postcss: { plugins: [] } },
-            plugins: [...frameworkPlugins, sporadesViteClientPlugin(options.devRefresh === true)],
+            plugins: [
+                ...frameworkPlugins,
+                sporadesViteClientPlugin(options.devRefresh === true),
+                sporadesViteBuildInvariants(canonicalIndexHtmlPath, options.frameworkConfig),
+            ],
             build: {
                 write: false,
                 emptyOutDir: false,
                 sourcemap: true,
                 cssCodeSplit: true,
                 assetsInlineLimit: 0,
+                watch: null,
+                lib: false,
+                ssr: false,
+                manifest: false,
+                ssrManifest: false,
                 rollupOptions: {
+                    input: canonicalIndexHtmlPath,
+                    external: [],
                     output: {
                         entryFileNames: "assets/[name]-[hash].js",
                         chunkFileNames: "assets/[name]-[hash].js",
@@ -173,6 +187,31 @@ async function buildVite(options) {
         throw viteBuildError(error, [options.projectDir, projectRoot], options.frameworkConfig.framework);
     }
 }
+const VITE_CONFIG_NAMES = [
+    "vite.config.js", "vite.config.mjs", "vite.config.ts", "vite.config.cjs", "vite.config.mts", "vite.config.cts",
+];
+async function findProjectViteConfig(projectRoot) {
+    for (const name of VITE_CONFIG_NAMES) {
+        const candidate = path.join(projectRoot, name);
+        try {
+            const metadata = await lstat(candidate);
+            if (!metadata.isFile() || metadata.isSymbolicLink()) {
+                throw clientToolchainError(`Vite configuration must be a regular file inside the Capsule: ${name}.`, `Replace ${name} with a regular project-owned file, then retry.`);
+            }
+            const canonical = await realpath(candidate);
+            if (!isCanonicalDescendant(projectRoot, canonical)) {
+                throw clientToolchainError(`Vite configuration escaped the Capsule project: ${name}.`, `Move ${name} inside the Capsule project, then retry.`);
+            }
+            return canonical;
+        }
+        catch (error) {
+            if (errorDetails(error).code === "ENOENT")
+                continue;
+            throw error;
+        }
+    }
+    return false;
+}
 async function loadProjectVueToolchain(projectRoot) {
     const loaded = await loadProjectCompilerToolchain(projectRoot, {
         framework: "Vue",
@@ -340,6 +379,68 @@ function sporadesViteClientPlugin(devRefresh = false) {
         load(id) { return id === runtimeId ? createClientRuntimeSource({ devRefresh }) : null; },
     };
 }
+function sporadesViteBuildInvariants(indexHtmlPath, frameworkConfig) {
+    return {
+        name: "sporades-build-invariants",
+        enforce: "post",
+        config() {
+            return {
+                root: path.dirname(indexHtmlPath),
+                base: "/",
+                publicDir: false,
+                envFile: false,
+                envPrefix: "\0",
+                mode: "production",
+                define: {
+                    "import.meta.env": JSON.stringify({ BASE_URL: "/", MODE: "production", DEV: false, PROD: true, SSR: false }),
+                },
+                appType: "mpa",
+                clearScreen: false,
+                logLevel: "silent",
+                esbuild: frameworkConfig.framework === "inferno"
+                    ? { jsx: "transform", jsxFactory: "createElement" }
+                    : { jsx: "automatic", jsxImportSource: frameworkConfig.jsxImportSource ?? undefined },
+                css: { postcss: { plugins: [] } },
+                build: {
+                    write: false,
+                    emptyOutDir: false,
+                    sourcemap: true,
+                    cssCodeSplit: true,
+                    assetsInlineLimit: 0,
+                    watch: null,
+                    lib: false,
+                    ssr: false,
+                    manifest: false,
+                    ssrManifest: false,
+                    rollupOptions: {
+                        input: indexHtmlPath,
+                        external: [],
+                        output: {
+                            entryFileNames: "assets/[name]-[hash].js",
+                            chunkFileNames: "assets/[name]-[hash].js",
+                            assetFileNames: "assets/[name]-[hash][extname]",
+                        },
+                    },
+                },
+            };
+        },
+        configResolved(config) {
+            const pluginNames = new Set(config.plugins.map((plugin) => plugin.name));
+            if (!pluginNames.has("sporades-client-runtime") || !pluginNames.has("sporades-build-invariants")) {
+                throw new Error("Sporades mandatory Vite plugins were not preserved.");
+            }
+            const requiredFrameworkPlugin = {
+                vue: "vite:vue",
+                svelte: "vite-plugin-svelte",
+                solid: "solid",
+                inferno: "sporades-inferno-project-jsx",
+            }[frameworkConfig.framework];
+            if (requiredFrameworkPlugin && !pluginNames.has(requiredFrameworkPlugin)) {
+                throw new Error(`Sporades mandatory ${frameworkConfig.framework} Vite plugin was not preserved.`);
+            }
+        },
+    };
+}
 function referencesLegacyClientShell(html) {
     return /<script\b[^>]*\bsrc\s*=\s*["']\/?client\.js(?:\?[^"']*)?["'][^>]*>/i.test(html);
 }