@demiurgejs/core 0.1.0 → 0.1.1

package/dist/vite/index.js

@@ -1,53 +1,54 @@
-import { existsSync as A } from "node:fs";
-import { mkdir as L, writeFile as U, readdir as C, readFile as G } from "node:fs/promises";
-import { dirname as W, resolve as f, relative as y, sep as $, join as B } from "node:path";
+import { existsSync as U } from "node:fs";
+import { mkdir as tt, writeFile as et, readdir as B, readFile as rt } from "node:fs/promises";
+import { dirname as G, resolve as p, relative as g, sep as $, join as nt } from "node:path";
+import ot from "magic-string";
 import { parseAst as Y } from "vite";
-import { b as q, d as K } from "../chunks/ssr-O3d7Q73U.js";
-import { r as z, f as Q, h as X, c as Z } from "../chunks/testing-BBnJ5WUR.js";
+import { b as st, d as it } from "../chunks/ssr-BJejKlkZ.js";
+import { e as x, r as at, f as ct, h as ut, c as lt } from "../chunks/testing-DR3eQAvY.js";
 import "react";
 import "react-dom/server";
 import "react/jsx-runtime";
-import { t as S, U as N, w as x, b as F, c as tt } from "../chunks/streaming-27pwhjGC.js";
-const m = "@demiurgejs/core";
-async function et(t) {
-  const n = (await rt(t.routesDir)).map((o) => nt(t.routesDir, o)).filter((o) => !!o).sort((o, a) => o.pattern.localeCompare(a.pattern)), r = ot(n);
-  return await L(W(t.outputFile), { recursive: !0 }), await U(t.outputFile, r), {
+import { t as I, U as O, w as _, b as F, c as ft } from "../chunks/streaming-DN1DnbRE.js";
+const h = "@demiurgejs/core";
+async function dt(t) {
+  const n = (await pt(t.routesDir)).map((r) => mt(t.routesDir, r)).filter((r) => !!r).sort((r, s) => r.pattern.localeCompare(s.pattern)), o = yt(n);
+  return await tt(G(t.outputFile), { recursive: !0 }), await et(t.outputFile, o), {
     routes: n,
-    source: r
+    source: o
   };
 }
-async function rt(t) {
-  return (await C(t, {
+async function pt(t) {
+  return (await B(t, {
     recursive: !0,
     withFileTypes: !0
-  })).filter((n) => n.isFile() && /\.tsx?$/.test(n.name)).map((n) => f(n.parentPath, n.name));
+  })).filter((n) => n.isFile() && /\.tsx?$/.test(n.name)).map((n) => p(n.parentPath, n.name));
 }
-function nt(t, e) {
-  const r = y(t, e).split($).join("/").replace(/\.tsx?$/, "").split("/");
-  if (r.at(-1)?.startsWith("@"))
+function mt(t, e) {
+  const o = g(t, e).split($).join("/").replace(/\.tsx?$/, "").split("/");
+  if (o.at(-1)?.startsWith("@"))
     return null;
-  const a = r.flatMap((s) => O(s) ? [] : s === "index" ? [] : s.startsWith("[...") && s.endsWith("]") ? [s] : s.startsWith("[") && s.endsWith("]") ? [s] : [s]);
+  const s = o.flatMap((i) => P(i) ? [] : i === "index" ? [] : i.startsWith("[...") && i.endsWith("]") ? [i] : i.startsWith("[") && i.endsWith("]") ? [i] : [i]);
   return {
-    pathVars: r.flatMap((s) => O(s) ? [] : s.startsWith("[...") && s.endsWith("]") ? [s.slice(4, -1)] : s.startsWith("[") && s.endsWith("]") ? [s.slice(1, -1)] : []),
-    pattern: `/${a.join("/")}`.replace(/\/$/, "") || "/"
+    pathVars: o.flatMap((i) => P(i) ? [] : i.startsWith("[...") && i.endsWith("]") ? [i.slice(4, -1)] : i.startsWith("[") && i.endsWith("]") ? [i.slice(1, -1)] : []),
+    pattern: `/${s.join("/")}`.replace(/\/$/, "") || "/"
   };
 }
-function O(t) {
+function P(t) {
   return t.startsWith("(") && t.endsWith(")");
 }
-function ot(t) {
+function yt(t) {
   return `// Generated by Demiurge. Do not edit by hand.
-import "${m}";
-import type { PathValue } from "${m}";
+import "${h}";
+import type { PathValue } from "${h}";
 
-declare module "${m}" {
+declare module "${h}" {
   interface RoutePathVars {
-${t.map(st).join(`
+${t.map(ht).join(`
 `)}
   }
 
   interface RouteConcretePaths {
-${t.map(at).join(`
+${t.map(gt).join(`
 `)}
   }
 }
@@ -55,61 +56,64 @@ ${t.map(at).join(`
 export {};
 `;
 }
-function st(t) {
+function ht(t) {
   if (t.pathVars.length === 0)
     return `    ${JSON.stringify(t.pattern)}: {};`;
   const e = t.pathVars.map((n) => `${n}: PathValue`).join("; ");
   return `    ${JSON.stringify(t.pattern)}: { ${e} };`;
 }
-function at(t) {
-  return `    ${JSON.stringify(t.pattern)}: ${it(t.pattern)};`;
+function gt(t) {
+  return `    ${JSON.stringify(t.pattern)}: ${Rt(t.pattern)};`;
 }
-function it(t) {
-  return t.includes("[") ? `\`${t.split(/(\[\.\.\.[^\]]+\]|\[[^\]]+\])/g).filter(Boolean).map((n) => n.startsWith("[") ? "${PathValue}" : ut(n)).join("")}\`` : JSON.stringify(t);
+function Rt(t) {
+  return t.includes("[") ? `\`${t.split(/(\[\.\.\.[^\]]+\]|\[[^\]]+\])/g).filter(Boolean).map((n) => n.startsWith("[") ? "${PathValue}" : wt(n)).join("")}\`` : JSON.stringify(t);
 }
-function ut(t) {
+function wt(t) {
   return t.replace(/[`$\\]/g, "\\$&");
 }
-const g = "virtual:demiurge/client-entry", E = `\0${g}`, V = "virtual:demiurge/server-entry", P = `\0${V}`, I = ".demiurge/route-manifest.d.ts";
-function Yt(t = {}) {
+const E = "virtual:demiurge/client-entry", v = `/@id/${E}`, D = `\0${E}`, q = "virtual:demiurge/server-entry", M = `\0${q}`, C = ".demiurge/route-manifest.d.ts";
+function ue(t = {}) {
   let e = process.cwd(), n = !1;
+  const o = `demiurge-${x()}`;
   return {
     enforce: "post",
     name: "demiurge",
-    config(r) {
-      return gt(r);
+    config(r, s) {
+      return It(r, s, o);
     },
     configResolved(r) {
       e = r.root, n = r.command === "build";
     },
     resolveId(r) {
-      return r === g ? E : r === V ? P : null;
+      return r === E ? D : r === q ? M : null;
     },
     load(r) {
-      return r === E ? Rt(e, t) : r === P ? $t(e, t) : null;
+      return r === D ? Ot(e, t) : r === M ? _t(e, t) : null;
     },
     transform: {
       order: "post",
-      handler(r, o, a) {
-        if (a?.ssr || !ft(e, t, o))
+      handler(r, s, a) {
+        if (!Et(e, t, s))
           return null;
-        const i = ct(r);
+        if (a?.ssr)
+          return n ? null : $t(r, s);
+        const i = bt(r);
         return i === r ? null : { code: i, map: null };
       }
     },
-    generateBundle(r, o) {
-      const a = Object.values(o).find(
-        (u) => u.type === "chunk" && u.isEntry && u.facadeModuleId === E
+    generateBundle(r, s) {
+      const a = Object.values(s).find(
+        (c) => c.type === "chunk" && c.isEntry && c.facadeModuleId === D
       );
       if (!a)
         return;
-      const i = Object.values(o).filter(
-        (u) => u.type === "asset" && u.fileName.endsWith(".css")
-      ).map((u) => `/${u.fileName}`), s = `/${a.fileName}`;
+      const i = Object.values(s).filter(
+        (c) => c.type === "asset" && c.fileName.endsWith(".css")
+      ).map((c) => `/${c.fileName}`), u = `/${a.fileName}`;
       this.emitFile({
         fileName: "index.html",
-        source: vt({
-          entrySrc: s,
+        source: qt({
+          entrySrc: u,
           lang: t.document?.lang,
           styles: i,
           title: t.document?.title
@@ -117,221 +121,262 @@ function Yt(t = {}) {
         type: "asset"
       }), this.emitFile({
         fileName: "demiurge-manifest.json",
-        source: JSON.stringify({ clientEntry: s, styles: i }, null, 2),
+        source: JSON.stringify({ clientEntry: u, styles: i }, null, 2),
         type: "asset"
       });
     },
     async buildStart() {
-      n && await Ft(e, t), t.typedRoutes && await R(e, t);
+      n && await Ht(e, t), t.typedRoutes && await w(e, t);
     },
     configureServer(r) {
       if (t.typedRoutes) {
-        const o = f(
+        const s = p(
           r.config.root,
           t.routesDir ?? "src/routes"
         );
-        R(r.config.root, t), r.watcher.add(o), r.watcher.on("add", (a) => {
-          D(o, a) && R(r.config.root, t);
+        w(r.config.root, t), r.watcher.add(s), r.watcher.on("add", (a) => {
+          N(s, a) && w(r.config.root, t);
         }), r.watcher.on("change", (a) => {
-          D(o, a) && R(r.config.root, t);
+          N(s, a) && w(r.config.root, t);
         }), r.watcher.on("unlink", (a) => {
-          D(o, a) && R(r.config.root, t);
+          N(s, a) && w(r.config.root, t);
         });
       }
-      return r.middlewares.use(async (o, a, i) => {
+      return r.middlewares.use(async (s, a, i) => {
         try {
-          let s;
+          let u;
           try {
-            s = S(o, {
+            u = I(s, {
               // Vite performs its own configured host allowlist check before
               // Demiurge's middleware runs. Production Node listeners require
               // an explicit application allowlist instead.
-              allowedHosts: [o.headers.host ?? "localhost"]
+              allowedHosts: [s.headers.host ?? "localhost"]
             });
-          } catch (l) {
-            if (l instanceof N) {
-              x(a);
+          } catch (R) {
+            if (R instanceof O) {
+              _(a);
               return;
             }
-            throw l;
+            throw R;
           }
-          const u = f(
+          const c = p(
             r.config.root,
             t.routesDir ?? "src/routes"
-          ), c = await v(r, o, u), p = await Tt(
-            c,
-            s,
-            St(r, t)
+          ), l = await k(r, s, c), d = j(
+            r,
+            o
+          ), y = await zt(
+            l,
+            u,
+            Tt(t, d.transform)
           );
-          if (p === "next") {
+          if (y === "next") {
             i();
             return;
           }
-          await F(a, p);
-        } catch (s) {
-          i(s);
+          W(y, d.nonce), await F(a, y);
+        } catch (u) {
+          i(u);
         }
       }), () => {
-        r.middlewares.use(async (o, a, i) => {
+        r.middlewares.use(async (s, a, i) => {
           try {
-            let s;
+            let u;
             try {
-              s = S(o, {
-                allowedHosts: [o.headers.host ?? "localhost"]
+              u = I(s, {
+                allowedHosts: [s.headers.host ?? "localhost"]
               });
-            } catch (p) {
-              if (p instanceof N) {
-                x(a);
+            } catch (R) {
+              if (R instanceof O) {
+                _(a);
                 return;
               }
-              throw p;
+              throw R;
             }
-            const u = f(
+            const c = p(
               r.config.root,
               t.routesDir ?? "src/routes"
-            ), c = await v(r, o, u);
-            xt(c, u), await F(
-              a,
-              await z(
-                c,
-                s,
-                Nt(r, t)
-              )
+            ), l = await k(r, s, c);
+            kt(l, c);
+            const d = j(
+              r,
+              o
+            ), y = await at(
+              l,
+              u,
+              Lt(t, d.transform)
             );
-          } catch (s) {
-            i(s);
+            W(
+              y,
+              d.nonce
+            ), await F(a, y);
+          } catch (u) {
+            i(u);
           }
         });
       };
     }
   };
 }
-function ct(t) {
-  const e = Y(t), n = [], r = lt(e), o = [];
-  w(e, (s) => {
-    if (s.type === "ImportDeclaration" && pt(s)) {
-      o.push(s);
+function $t(t, e) {
+  if (!t.includes("import.meta"))
+    return null;
+  const n = Y(t), o = m(n.body).find(
+    (c) => c.type === "ImportDeclaration" && m(c.specifiers).some(
+      (l) => f(l.local)?.type === "Identifier" && f(l.local)?.name === "meta"
+    )
+  ), r = o && m(o.specifiers).find(
+    (c) => f(c.local)?.type === "Identifier" && f(c.local)?.name === "meta"
+  ), s = r && f(r.local);
+  if (!o || !r || !s)
+    return null;
+  let a = "__demiurge_imported_meta__";
+  for (; new RegExp(`\\b${a}\\b`).test(t); )
+    a += "_";
+  const i = new ot(t), u = f(r.imported);
+  return i.overwrite(
+    s.start,
+    s.end,
+    u?.start === s.start ? `meta as ${a}` : a
+  ), i.appendLeft(o.end, `
+const meta = ${a};`), {
+    code: i.toString(),
+    map: i.generateMap({
+      hires: "boundary",
+      includeContent: !0,
+      source: e
+    })
+  };
+}
+function bt(t) {
+  const e = Y(t), n = [], o = St(e), r = [];
+  b(e, (i) => {
+    if (i.type === "ImportDeclaration" && Nt(i)) {
+      r.push(i);
       return;
     }
-    if (s.type !== "CallExpression" || !dt(s.callee))
+    if (i.type !== "CallExpression" || !Dt(i.callee))
       return;
-    const u = h(s.arguments)[0];
+    const u = m(i.arguments)[0];
     if (u?.type === "ObjectExpression")
-      for (const c of h(u.properties))
-        c.type === "Property" && b(c.key) === "data" && n.push({ end: c.end, start: c.start });
+      for (const c of m(u.properties))
+        c.type === "Property" && S(c.key) === "data" && n.push({ end: c.end, start: c.start });
   });
-  const a = [...n, ...r];
-  if (a.length === 0)
+  const s = [...n, ...o];
+  if (s.length === 0)
     return t;
-  const i = [...a];
-  for (const s of o) {
-    const u = h(s.specifiers).map((l) => d(l.local)).filter((l) => l?.type === "Identifier").map((l) => String(l.name)), c = mt(t, [
-      ...a,
-      { end: s.end, start: s.start }
-    ]), p = u.find(
-      (l) => new RegExp(`\\b${yt(l)}\\b`).test(c)
+  const a = [...s];
+  for (const i of r) {
+    const u = m(i.specifiers).map((d) => f(d.local)).filter((d) => d?.type === "Identifier").map((d) => String(d.name)), c = xt(t, [
+      ...s,
+      { end: i.end, start: i.start }
+    ]), l = u.find(
+      (d) => new RegExp(`\\b${K(d)}\\b`).test(c)
     );
-    if (p)
+    if (l)
       throw new Error(
-        `Server-only import ${JSON.stringify(p)} is used by client route code. Move that use into page data, a document contribution, or a client-safe module.`
+        `Server-only import ${JSON.stringify(l)} is used by client route code. Move that use into page data, a document contribution, or a client-safe module.`
       );
-    i.push({ end: s.end, start: s.start });
+    a.push({ end: i.end, start: i.start });
   }
-  return ht(
+  return vt(
     t,
-    i,
-    (s) => n.includes(s) ? "data: undefined" : r.includes(s) ? "undefined" : ""
+    a,
+    (i) => n.includes(i) ? "data: undefined" : o.includes(i) ? "undefined" : ""
   );
 }
-const M = /* @__PURE__ */ new Set(["links", "metadata", "scripts"]);
-function lt(t) {
+const T = /* @__PURE__ */ new Set(["links", "metadata", "scripts"]);
+function St(t) {
   const e = /* @__PURE__ */ new Set();
-  for (const r of h(t.body)) {
-    if (r.type !== "ExportNamedDeclaration") continue;
-    const o = d(r.declaration);
-    if (o?.type === "VariableDeclaration")
-      for (const a of h(o.declarations)) {
-        const i = d(a.id);
-        i?.type === "Identifier" && M.has(String(i.name)) && e.add(String(i.name));
+  for (const o of m(t.body)) {
+    if (o.type !== "ExportNamedDeclaration") continue;
+    const r = f(o.declaration);
+    if (r?.type === "VariableDeclaration")
+      for (const s of m(r.declarations)) {
+        const a = f(s.id);
+        a?.type === "Identifier" && T.has(String(a.name)) && e.add(String(a.name));
       }
-    for (const a of h(r.specifiers)) {
-      const i = b(a.exported), s = b(a.local);
-      i && s && M.has(i) && e.add(s);
+    for (const s of m(o.specifiers)) {
+      const a = S(s.exported), i = S(s.local);
+      a && i && T.has(a) && e.add(i);
     }
   }
   const n = [];
-  return w(t, (r) => {
-    if (r.type !== "VariableDeclarator") return;
-    const o = d(r.id), a = d(r.init);
-    o?.type === "Identifier" && e.has(String(o.name)) && a && n.push({ end: a.end, start: a.start });
+  return b(t, (o) => {
+    if (o.type !== "VariableDeclarator") return;
+    const r = f(o.id), s = f(o.init);
+    r?.type === "Identifier" && e.has(String(r.name)) && s && n.push({ end: s.end, start: s.start });
   }), n;
 }
-function ft(t, e, n) {
-  const r = n.split("?", 1)[0] ?? n, o = f(t, e.routesDir ?? "src/routes"), a = y(o, r);
-  return a !== "" && a !== ".." && !a.startsWith(`..${$}`);
+function Et(t, e, n) {
+  const o = n.split("?", 1)[0] ?? n, r = p(t, e.routesDir ?? "src/routes"), s = g(r, o);
+  return s !== "" && s !== ".." && !s.startsWith(`..${$}`);
 }
-function w(t, e) {
+function b(t, e) {
   if (!t || typeof t != "object") return;
   if (Array.isArray(t)) {
-    for (const r of t) w(r, e);
+    for (const o of t) b(o, e);
     return;
   }
   const n = t;
   if (typeof n.type == "string") {
     e(n);
-    for (const [r, o] of Object.entries(n))
-      (/* @__PURE__ */ new Set(["end", "loc", "start", "type"])).has(r) || w(o, e);
+    for (const [o, r] of Object.entries(n))
+      (/* @__PURE__ */ new Set(["end", "loc", "start", "type"])).has(o) || b(r, e);
   }
 }
-function d(t) {
+function f(t) {
   return t && typeof t == "object" && "type" in t ? t : void 0;
 }
-function h(t) {
-  return Array.isArray(t) ? t.map(d).filter((e) => !!e) : [];
+function m(t) {
+  return Array.isArray(t) ? t.map(f).filter((e) => !!e) : [];
 }
-function dt(t) {
-  const e = d(t);
-  return e?.type === "Identifier" ? e.name === "page" : e?.type === "MemberExpression" && b(e.property) === "page";
+function Dt(t) {
+  const e = f(t);
+  return e?.type === "Identifier" ? e.name === "page" : e?.type === "MemberExpression" && S(e.property) === "page";
 }
-function b(t) {
-  const e = d(t);
+function S(t) {
+  const e = f(t);
   return e?.type === "Identifier" || e?.type === "Literal" ? String(e.name ?? e.value) : void 0;
 }
-function pt(t) {
-  const e = d(t.source)?.value;
+function Nt(t) {
+  const e = f(t.source)?.value;
   return typeof e == "string" && /(?:^|[/.-])server(?:[/.-]|$)/.test(e);
 }
-function mt(t, e) {
+function xt(t, e) {
   const n = [...t];
-  for (const { end: r, start: o } of e)
-    n.fill(" ", o, r);
+  for (const { end: o, start: r } of e)
+    n.fill(" ", r, o);
   return n.join("");
 }
-function ht(t, e, n) {
-  return [...e].sort((r, o) => o.start - r.start).reduce(
-    (r, o) => `${r.slice(0, o.start)}${n(o)}${r.slice(o.end)}`,
+function vt(t, e, n) {
+  return [...e].sort((o, r) => r.start - o.start).reduce(
+    (o, r) => `${o.slice(0, r.start)}${n(r)}${o.slice(r.end)}`,
     t
   );
 }
-function yt(t) {
+function K(t) {
   return t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function gt(t) {
+function It(t, e, n) {
   return {
     appType: "custom",
     build: {
+      assetsInlineLimit: t.build?.assetsInlineLimit ?? 0,
+      ...e.isSsrBuild && t.build?.target === void 0 && t.ssr?.target !== "webworker" ? { target: "node22.13" } : {},
       rollupOptions: {
-        input: t.build?.rollupOptions?.input ?? g
+        input: t.build?.rollupOptions?.input ?? E
       }
-    }
+    },
+    ...e.command === "serve" ? { html: { cspNonce: n } } : {}
   };
 }
-function Rt(t, e = {}) {
-  const n = e.routesDir ?? "src/routes", r = Dt(t, e);
-  return `import { hydrateFileRouter } from "${m}";
-${r}
+function Ot(t, e = {}) {
+  const n = e.routesDir ?? "src/routes", o = Ct(t, e);
+  return `import { hydrateFileRouter } from "${h}";
+${o}
 
-${k(n, {
+${z(n, {
     exportRoutes: !1,
     includeServerOnly: !1
   })}
@@ -339,11 +384,11 @@ ${k(n, {
 void hydrateFileRouter({ routes });
 `;
 }
-function $t(t, e = {}) {
+function _t(t, e = {}) {
   const n = e.routesDir ?? "src/routes";
-  return `import { createRequestHandler } from "${m}";
+  return `import { createRequestHandler } from "${h}";
 
-${k(n, {
+${z(n, {
     exportRoutes: !0,
     includeServerOnly: !0
   })}
@@ -364,13 +409,13 @@ export function createHandler(options = {}) {
 }
 `;
 }
-function k(t, {
+function z(t, {
   exportRoutes: e,
   includeServerOnly: n
 }) {
-  const r = bt(t, n), o = Et(t);
-  return `const routeModules = import.meta.glob(${JSON.stringify(r)});
-const routePrefix = ${JSON.stringify(o)};
+  const o = Pt(t, n), r = Mt(t);
+  return `const routeModules = import.meta.glob(${JSON.stringify(o)});
+const routePrefix = ${JSON.stringify(r)};
 ${e ? "export " : ""}const routes = Object.fromEntries(
   Object.entries(routeModules).map(([file, load]) => [
     \`./routes/\${file.slice(routePrefix.length)}\`,
@@ -378,120 +423,241 @@ ${e ? "export " : ""}const routes = Object.fromEntries(
   ]),
 );`;
 }
-const wt = ["@middleware.ts", "@policy.ts"];
-function bt(t, e) {
-  const n = `/${t.replace(/^\/|\/$/g, "")}`, r = [`${n}/**/*.{ts,tsx}`];
-  return e || r.push(
-    ...wt.flatMap((o) => [
-      `!${n}/${o}`,
-      `!${n}/**/${o}`
+const Ft = ["@middleware.ts", "@policy.ts"];
+function Pt(t, e) {
+  const n = `/${t.replace(/^\/|\/$/g, "")}`, o = [`${n}/**/*.{ts,tsx}`];
+  return e || o.push(
+    ...Ft.flatMap((r) => [
+      `!${n}/${r}`,
+      `!${n}/**/${r}`
     ])
-  ), r;
+  ), o;
 }
-function Et(t) {
+function Mt(t) {
   return `/${t.replace(/^\/|\/$/g, "")}/`;
 }
-function Dt(t, e) {
+function Ct(t, e) {
   if (e.styles === !1)
     return "";
-  const n = e.styles ?? "src/styles.css", r = f(t, n);
-  return A(r) ? `import ${JSON.stringify(`/${n.replace(/^\/+/, "")}`)};` : "";
+  const n = e.styles ?? "src/styles.css", o = p(t, n);
+  return U(o) ? `import ${JSON.stringify(`/${n.replace(/^\/+/, "")}`)};` : "";
 }
-function St(t, e) {
+function Tt(t, e) {
   return {
     dev: !0,
-    ssr: H(e),
-    transformDocument: (n) => t.transformIndexHtml("/", n),
-    renderPage: async (n, r) => {
+    ssr: X(t),
+    transformDocument: e,
+    renderPage: async (n, o) => {
       if (n.render.mode === "streaming")
-        return await tt(n, {
-          ...r,
-          clientEntry: `/${g}`,
-          transformDocument: (a) => t.transformIndexHtml("/", a)
+        return await ft(n, {
+          ...o,
+          clientEntry: v,
+          transformDocument: e
         });
-      const o = await t.transformIndexHtml(
-        "/",
-        K(n, {
-          ...r,
-          clientEntry: `/${g}`
+      const r = await e(
+        it(n, {
+          ...o,
+          clientEntry: v
         })
       );
-      return new Response(o, {
+      return new Response(r, {
         headers: { "content-type": "text/html; charset=utf-8" }
       });
     }
   };
 }
-const _ = Symbol.for("demiurge.devManifest");
-async function v(t, e, n) {
-  const r = e, o = r[_];
-  if (o)
-    return o;
-  const a = Z(
-    await jt(t, n)
+function j(t, e) {
+  const n = x(), o = x();
+  return {
+    nonce: n,
+    transform: async (r) => {
+      const s = jt(r, o), a = await t.transformIndexHtml("/", s);
+      return A(
+        A(a, o),
+        e,
+        n
+      );
+    }
+  };
+}
+function jt(t, e) {
+  const n = t.toLowerCase();
+  let o = 0, r = "";
+  for (; o < t.length; ) {
+    const s = t.indexOf("<", o);
+    if (s === -1)
+      return r + t.slice(o);
+    if (r += t.slice(o, s), n.startsWith("<!--", s)) {
+      const c = n.indexOf("-->", s + 4), l = c === -1 ? t.length : c + 3;
+      r += t.slice(s, l), o = l;
+      continue;
+    }
+    const a = n.slice(s).match(/^<\s*(script|style|link)\b/)?.[1];
+    if (!a) {
+      r += "<", o = s + 1;
+      continue;
+    }
+    const i = At(t, s);
+    if (i === -1)
+      return r + t.slice(s);
+    const u = t.slice(s, i + 1);
+    if (r += /(?:^|\s)nonce(?:\s|=|>)/i.test(u) ? u : Wt(u, e), o = i + 1, a === "script" || a === "style") {
+      const c = n.indexOf(`</${a}`, o);
+      if (c === -1)
+        return r + t.slice(o);
+      r += t.slice(o, c), o = c;
+    }
+  }
+  return r;
+}
+function At(t, e) {
+  let n;
+  for (let o = e + 1; o < t.length; o++) {
+    const r = t[o];
+    if (n) {
+      r === n && (n = void 0);
+      continue;
+    }
+    if (r === '"' || r === "'")
+      n = r;
+    else if (r === ">")
+      return o;
+  }
+  return -1;
+}
+function Wt(t, e) {
+  const n = /\/\s*>$/.test(t) ? t.lastIndexOf("/") : t.length - 1;
+  return `${t.slice(0, n)} nonce="${e}"${t.slice(n)}`;
+}
+function A(t, e, n) {
+  const o = new RegExp(
+    `(\\snonce\\s*=\\s*)(["'])${K(e)}\\2`,
+    "g"
+  );
+  return t.replace(
+    o,
+    n ? `$1"${n}"` : ""
   );
-  return r[_] = a, a;
 }
-function H(t) {
+function W(t, e) {
+  const n = t.headers.get("content-type"), o = t.headers.get("content-security-policy");
+  if (!n?.toLowerCase().startsWith("text/html") || !o)
+    return;
+  const r = `'nonce-${e}'`, s = V(
+    o,
+    ["script-src-elem", "script-src"],
+    "script-src",
+    r
+  ), a = Vt(
+    s,
+    ["style-src-elem", "style-src"]
+  ) ? s : V(
+    s,
+    ["style-src-elem", "style-src"],
+    "style-src",
+    r
+  );
+  t.headers.set("content-security-policy", a), t.headers.set("cache-control", "private, no-store");
+}
+function V(t, e, n, o) {
+  const r = t.split(";").map((l) => l.trim()), s = Q(r, e), a = r.find(
+    (l) => l.split(/\s+/, 1)[0]?.toLowerCase() === "default-src"
+  );
+  if (s === -1 && !a) return t;
+  const [i, ...u] = (s === -1 ? a : r[s]).split(/\s+/), c = [
+    s === -1 ? n : i,
+    .../* @__PURE__ */ new Set([
+      ...u.filter((l) => l !== "'none'"),
+      o
+    ])
+  ].join(" ");
+  return s === -1 ? r.push(c) : r[s] = c, r.join("; ");
+}
+function Vt(t, e) {
+  const n = t.split(";").map((a) => a.trim()), o = Q(n, e), s = (o === -1 ? n.find(
+    (a) => a.split(/\s+/, 1)[0]?.toLowerCase() === "default-src"
+  ) : n[o])?.split(/\s+/).slice(1) ?? [];
+  return s.includes("'unsafe-inline'") && !s.some((a) => /^'(?:nonce-|sha(?:256|384|512)-)/i.test(a));
+}
+function Q(t, e) {
+  for (const n of e) {
+    const o = t.findIndex(
+      (r) => r.split(/\s+/, 1)[0]?.toLowerCase() === n
+    );
+    if (o !== -1) return o;
+  }
+  return -1;
+}
+const L = Symbol.for("demiurge.devManifest");
+async function k(t, e, n) {
+  const o = e, r = o[L];
+  if (r)
+    return r;
+  const s = lt(
+    await Kt(t, n)
+  );
+  return o[L] = s, s;
+}
+function X(t) {
   return {
-    clientEntry: `/${g}`,
+    clientEntry: v,
     lang: t.document?.lang,
     title: t.document?.title
   };
 }
-function Nt(t, e) {
+function Lt(t, e) {
   return {
-    ...H(e),
+    ...X(t),
     dev: !0,
-    transformDocument: (n) => t.transformIndexHtml("/", n)
+    transformDocument: e
   };
 }
-const j = /* @__PURE__ */ new Set();
-function xt(t, e) {
-  j.has(e) || t.fallbacks.notFound.some(
+const H = /* @__PURE__ */ new Set();
+function kt(t, e) {
+  H.has(e) || t.fallbacks.notFound.some(
     (n) => n.fileSegments.length === 0
-  ) || (j.add(e), console.warn(_t(B(e, "@not-found.tsx"))));
+  ) || (H.add(e), console.warn(Yt(nt(e, "@not-found.tsx"))));
 }
-async function Ft(t, e = {}) {
-  const n = e.routesDir ?? "src/routes", r = f(t, n);
-  if (!A(r))
+async function Ht(t, e = {}) {
+  const n = e.routesDir ?? "src/routes", o = p(t, n);
+  if (!U(o))
     return;
-  const o = await J(r);
-  if (o.map(
-    (s) => y(r, s).split($).join("/")
-  ).some((s) => /^@not-found\.tsx?$/.test(s)))
+  const r = await Z(o);
+  if (r.map(
+    (i) => g(o, i).split($).join("/")
+  ).some((i) => /^@not-found\.tsx?$/.test(i)))
     return;
-  const i = await Ot(o);
-  if (i)
+  const a = await Jt(r);
+  if (a)
     throw new Error(
-      Mt(
+      Gt(
         n,
-        y(r, i).split($).join("/")
+        g(o, a).split($).join("/")
       )
     );
 }
-async function Ot(t) {
+async function Jt(t) {
   for (const e of t)
-    if (!y(W(e), e).startsWith("@") && It(await G(e, "utf8")))
+    if (!g(G(e), e).startsWith("@") && Bt(await rt(e, "utf8")))
       return e;
 }
-const Pt = m.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), T = new RegExp(
-  `import\\s*\\{([^}]*)\\}\\s*from\\s*["']${Pt}["']`,
+const Ut = h.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), J = new RegExp(
+  `import\\s*\\{([^}]*)\\}\\s*from\\s*["']${Ut}["']`,
   "g"
 );
-function It(t) {
-  const e = [...t.matchAll(T)].flatMap(
-    (r) => r[1].split(",").flatMap((o) => {
-      const [a, i] = o.trim().split(/\s+as\s+/);
-      return a.replace(/^type\s+/, "") === "page" ? [i ?? a] : [];
+function Bt(t) {
+  const e = [...t.matchAll(J)].flatMap(
+    (o) => o[1].split(",").flatMap((r) => {
+      const [s, a] = r.trim().split(/\s+as\s+/);
+      return s.replace(/^type\s+/, "") === "page" ? [a ?? s] : [];
     })
   );
   if (e.length === 0)
     return !1;
-  const n = t.replace(T, "");
-  return e.some((r) => new RegExp(`\\b${r}\\s*\\(`).test(n));
+  const n = t.replace(J, "");
+  return e.some((o) => new RegExp(`\\b${o}\\s*\\(`).test(n));
 }
-function Mt(t, e) {
+function Gt(t, e) {
   return `Demiurge will not build an app with page routes and no ${t}/@not-found.tsx.
 
 "${e}" declares a page, so a browser can reach a path this app does not serve. Decide what that looks like rather than shipping the framework built-in.
@@ -504,7 +670,7 @@ Create ${t}/@not-found.tsx:
 
 It renders inside the layouts above the requested path. Opt out with "export const layout = false".`;
 }
-function _t(t) {
+function Yt(t) {
   return `Demiurge is serving its built-in 404 because ${t} does not exist.
 
 Create it before building for production:
@@ -514,67 +680,67 @@ Create it before building for production:
   }
 `;
 }
-function vt({
+function qt({
   entrySrc: t,
   lang: e,
   links: n,
-  metadata: r,
-  nonce: o,
-  scripts: a,
-  styles: i,
-  title: s
+  metadata: o,
+  nonce: r,
+  scripts: s,
+  styles: a,
+  title: i
 }) {
-  return q({
+  return st({
     entrySrc: t,
     lang: e,
     links: n,
-    metadata: r,
-    nonce: o,
-    scripts: a,
-    styles: i,
-    title: s
+    metadata: o,
+    nonce: r,
+    scripts: s,
+    styles: a,
+    title: i
   });
 }
-async function R(t, e) {
-  const n = f(t, e.routesDir ?? "src/routes"), r = f(
+async function w(t, e) {
+  const n = p(t, e.routesDir ?? "src/routes"), o = p(
     t,
-    typeof e.typedRoutes == "object" ? e.typedRoutes.outputFile ?? I : I
+    typeof e.typedRoutes == "object" ? e.typedRoutes.outputFile ?? C : C
   );
-  await et({ outputFile: r, routesDir: n });
+  await dt({ outputFile: o, routesDir: n });
 }
-function D(t, e) {
+function N(t, e) {
   return e.startsWith(t) && /\.tsx?$/.test(e);
 }
-async function jt(t, e) {
-  const n = await J(e), r = {};
-  for (const o of n) {
-    const a = At(e, o);
-    r[a] = async () => await t.ssrLoadModule(o);
+async function Kt(t, e) {
+  const n = await Z(e), o = {};
+  for (const r of n) {
+    const s = Qt(e, r);
+    o[s] = async () => await t.ssrLoadModule(r);
   }
-  return r;
+  return o;
 }
-async function Tt(t, e, n = {}) {
-  const r = new URL(e.url);
-  return Q(t.routes, r.pathname) ? await X(t, e, n) : "next";
+async function zt(t, e, n = {}) {
+  const o = new URL(e.url);
+  return ct(t.routes, o.pathname) ? await ut(t, e, n) : "next";
 }
-async function J(t) {
-  return (await C(t, {
+async function Z(t) {
+  return (await B(t, {
     recursive: !0,
     withFileTypes: !0
-  })).filter((n) => n.isFile() && /\.tsx?$/.test(n.name)).map((n) => f(n.parentPath, n.name));
+  })).filter((n) => n.isFile() && /\.tsx?$/.test(n.name)).map((n) => p(n.parentPath, n.name));
 }
-function At(t, e) {
-  return `./routes/${y(t, e).split($).join("/")}`;
+function Qt(t, e) {
+  return `./routes/${g(t, e).split($).join("/")}`;
 }
 export {
-  Yt as demiurge,
-  Ft as unstable_assertRootNotFoundRoute,
-  Rt as unstable_createClientEntrySource,
-  jt as unstable_createDevRouteImporters,
-  vt as unstable_createDocumentHtml,
-  $t as unstable_createServerEntrySource,
-  It as unstable_declaresPageRoute,
-  Tt as unstable_handleDevRequest,
-  ct as unstable_stripClientPageData
+  ue as demiurge,
+  Ht as unstable_assertRootNotFoundRoute,
+  Ot as unstable_createClientEntrySource,
+  Kt as unstable_createDevRouteImporters,
+  qt as unstable_createDocumentHtml,
+  _t as unstable_createServerEntrySource,
+  Bt as unstable_declaresPageRoute,
+  zt as unstable_handleDevRequest,
+  bt as unstable_stripClientPageData
 };
 //# sourceMappingURL=index.js.map