prelöoad experiment

scripts/dev.mjs

@@ -0,0 +1,45 @@
+/**
+ * Dev with full PWA precache: production build --watch + preview.
+ * Vite HMR cannot precache in-memory modules; use npm run dev:hmr for that.
+ */
+import { build, preview } from 'vite';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = path.dirname(fileURLToPath(import.meta.url));
+const configFile = path.resolve(root, '../vite.config.js');
+
+const watcher = await build({
+  configFile,
+  build: { watch: {} },
+});
+
+let previewServer;
+
+async function startPreview() {
+  if (previewServer) return;
+  previewServer = await preview({
+    configFile,
+    preview: { host: true },
+  });
+  previewServer.printUrls();
+  previewServer.bindCLIShortcuts({ print: true });
+}
+
+watcher.on('event', (event) => {
+  if (event.code === 'BUNDLE_END') {
+    void startPreview();
+  }
+  if (event.code === 'ERROR') {
+    console.error(event.error);
+  }
+});
+
+async function shutdown() {
+  await previewServer?.close();
+  await watcher.close();
+  process.exit(0);
+}
+
+process.on('SIGINT', shutdown);
+process.on('SIGTERM', shutdown);

scripts/generate-cert.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# Generate a self-signed TLS cert for local HTTPS (Vite on :4308).
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+CERT_DIR="${CERT_DIR:-$ROOT/certs}"
+DAYS="${CERT_DAYS:-825}"
+KEY="$CERT_DIR/key.pem"
+CERT="$CERT_DIR/cert.pem"
+CNF="$CERT_DIR/openssl.cnf"
+
+mkdir -p "$CERT_DIR"
+
+# Extra hostnames / IPs: ./scripts/generate-cert.sh 192.168.188.22 myhost.local
+EXTRA=("$@")
+
+SAN="DNS:localhost,IP:127.0.0.1"
+for entry in "${EXTRA[@]}"; do
+  if [[ "$entry" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+    SAN+=",IP:$entry"
+  else
+    SAN+=",DNS:$entry"
+  fi
+done
+
+# Include non-loopback IPv4 addresses so LAN / WebView origins work.
+while read -r ip; do
+  [[ -n "$ip" ]] || continue
+  [[ "$SAN" == *",$ip"* || "$SAN" == *"IP:$ip"* ]] && continue
+  SAN+=",IP:$ip"
+done < <(hostname -I 2>/dev/null | tr ' ' '\n' | grep -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$' || true)
+
+cat >"$CNF" <<EOF
+[req]
+default_bits = 2048
+prompt = no
+default_md = sha256
+distinguished_name = dn
+x509_extensions = v3_req
+
+[dn]
+CN = localhost
+
+[v3_req]
+subjectAltName = $SAN
+keyUsage = digitalSignature, keyEncipherment
+extendedKeyUsage = serverAuth
+EOF
+
+openssl req -x509 -newkey rsa:2048 -sha256 -days "$DAYS" -nodes \
+  -keyout "$KEY" \
+  -out "$CERT" \
+  -config "$CNF"
+
+chmod 600 "$KEY"
+rm -f "$CNF"
+
+# Base64(DER) — preferred QR payload (plain text, no JSON/URL/PEM wrappers).
+DER_B64="$(openssl x509 -in "$CERT" -outform DER | base64 -w0)"
+printf '%s\n' "$DER_B64" >"$CERT_DIR/cert.der.b64"
+
+echo "Wrote $CERT"
+echo "Wrote $KEY"
+echo "Wrote $CERT_DIR/cert.der.b64"
+echo "SAN: $SAN"
+echo "Valid for $DAYS days."
+echo
+echo "=== certificate ==="
+openssl x509 -in "$CERT" -noout -subject -issuer -dates -fingerprint -sha256 -ext subjectAltName
+echo
+echo "=== QR (base64 DER, raw payload) ==="
+printf '%s' "$DER_B64" | node "$ROOT/scripts/qr-cert.mjs"
+echo
+echo "Start HTTPS: npm run dev:https"
+echo "URL: https://localhost:4308/"

scripts/qr-cert.mjs

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+/** Print a terminal QR for stdin (or argv[2]) — raw payload only. */
+import qrcode from 'qrcode';
+
+const fromArg = process.argv[2];
+const payload = fromArg
+  ? fromArg
+  : (await new Response(process.stdin).text()).trim();
+
+if (!payload) {
+  console.error('usage: qr-cert.mjs <base64-der>   or pipe payload on stdin');
+  process.exit(1);
+}
+
+const out = await qrcode.toString(payload, {
+  type: 'terminal',
+  errorCorrectionLevel: 'L',
+  small: true,
+});
+process.stdout.write(out);