Vite Plugin Reference — @rep-protocol/vite

npm install -D @rep-protocol/vite

import { defineConfig } from 'vite';
import { repPlugin } from '@rep-protocol/vite';

export default defineConfig({
  plugins: [repPlugin()],
});

`repPlugin(options?)`

interface RepPluginOptions {
  env?: string;
  strict?: boolean;
}

function repPlugin(options?: RepPluginOptions): Plugin;

Option	Type	Default	Description
`env`	`string`	`'.env.local'`	Path to the env file, relative to the project root. Classified the same way as the gateway: `REP_PUBLIC_`, `REP_SENSITIVE_`, `REP_SERVER_*` prefixes.
`strict`	`boolean`	`false`	Turn guardrail warnings into thrown errors instead of console warnings.

repPlugin({
  env: '.env.development',
  strict: true,
})

Dev only. The plugin only runs during vite dev (configureServer hook). It does nothing during vite build — production HTML ships with no __rep__ script tag, and the gateway injects it at serve time instead.
Injects <script id="__rep__"> into every HTML response via transformIndexHtml, using the same JSON shape, HMAC integrity token, and SRI hash format as the Go gateway. rep.get(), rep.getSecure(), and rep.verify() behave identically whether the payload came from the plugin or the gateway.
Watches the env file. Changes to the file at env trigger a full page reload (server.ws.send({ type: 'full-reload' })) — no restart needed.
Serves GET /rep/session-key as dev middleware, so rep.getSecure() works without a separate gateway process. Unlike the gateway’s endpoint, this dev version has no rate limiting or single-use enforcement — it’s not meant to run in production.
Runs guardrails (entropy + known secret-format scanning) on every REP_PUBLIC_* value at each rebuild, logging warnings through the Vite server logger. Unlike the gateway, it scans csv values whole.
Ephemeral keys per dev-server start. A fresh AES key and HMAC secret are generated when the dev server boots and again on every env-file change — matching the gateway’s “new keys on every restart” behavior.