@demiurgejs/core 0.2.0-beta.3 → 0.2.0-beta.4

package/dist/chunks/plugin-BQgMiHxa.js

@@ -0,0 +1,1827 @@
+import { existsSync as ae } from "node:fs";
+import { mkdir as Qe, writeFile as Xe, readdir as Ae, readFile as Fe } from "node:fs/promises";
+import { dirname as ce, resolve as x, relative as D, sep as j, join as Ze } from "node:path";
+import et from "magic-string";
+import { parseAst as Q, transformWithEsbuild as tt } from "vite";
+import { e as nt, f as rt } from "./index-BVk9zWbe.js";
+import { v as ot, k as it, i as F, n as st, s as G, o as fe, p as at, q as ee, t as ct, u as lt, w as ke, M as ut, x as ft, y as Y, z as de, A as dt, B as pt, C as mt, e as ht, f as yt, h as gt, D as vt } from "./testing-DueXbMo4.js";
+import "react";
+import "react-dom/server";
+import "react/jsx-runtime";
+import { c as wt, t as pe, U as me, w as he, b as J, d as bt, e as $t } from "./streaming-BEbPN7Uk.js";
+import { p as Rt } from "./images-BQ80950B.js";
+import { s as _e } from "./env-startup-DOBYWlZD.js";
+const M = "@demiurgejs/core";
+async function St(e) {
+  const t = await Et(e.routesDir), n = t.map((s) => Pt(e, s)).filter((s) => !!s), r = t.map((s) => Nt(e, s, n)).filter((s) => !!s).sort((s, i) => s.pattern.localeCompare(i.pattern));
+  xt(r, e.localeNamespaces ?? []);
+  const o = Ot(r, n, e.locales);
+  return await Qe(ce(e.outputFile), { recursive: !0 }), await Xe(e.outputFile, o), {
+    routes: r,
+    source: o
+  };
+}
+function xt(e, t) {
+  const n = new Set(t.map((r) => r.toLowerCase()));
+  for (const r of e) {
+    const [o] = r.pattern.slice(1).split("/");
+    if (o && !o.startsWith("[") && n.has(o.toLowerCase()))
+      throw new Error(
+        `Route "${r.pattern}" conflicts with the locale URL namespace "${o}". Move the route or change the locale label.`
+      );
+  }
+}
+async function Et(e) {
+  return (await Ae(e, {
+    recursive: !0,
+    withFileTypes: !0
+  })).filter((n) => n.isFile() && /\.tsx?$/.test(n.name)).map((n) => x(n.parentPath, n.name));
+}
+function Nt(e, t, n) {
+  const o = D(e.routesDir, t).split(j).join("/").replace(/\.tsx?$/, "").split("/");
+  if (o.at(-1)?.startsWith("@"))
+    return null;
+  const i = o.flatMap((c) => ye(c) ? [] : c === "index" ? [] : c.startsWith("[...") && c.endsWith("]") ? [c] : c.startsWith("[") && c.endsWith("]") ? [c] : [c]), a = o.flatMap((c) => ye(c) ? [] : c.startsWith("[...") && c.endsWith("]") ? [c.slice(4, -1)] : c.startsWith("[") && c.endsWith("]") ? [c.slice(1, -1)] : []);
+  return {
+    contextMiddleware: n.filter((c) => Dt(c.fileSegments, o)).map((c) => n.indexOf(c)),
+    fileSegments: o,
+    importPath: Le(e.outputFile, t),
+    pathVars: a,
+    pattern: `/${i.join("/")}`.replace(/\/$/, "") || "/"
+  };
+}
+function Pt(e, t) {
+  const r = D(e.routesDir, t).split(j).join("/").replace(/\.tsx?$/, "").split("/");
+  return r.at(-1) !== "@middleware" ? null : {
+    file: t,
+    fileSegments: r.slice(0, -1),
+    importPath: Le(e.outputFile, t)
+  };
+}
+function Le(e, t) {
+  let n = D(ce(e), t).split(j).join("/").replace(/\.tsx?$/, "");
+  return n.startsWith(".") || (n = `./${n}`), n;
+}
+function Dt(e, t) {
+  return e.every(
+    (n, r) => t[r] === n
+  );
+}
+function ye(e) {
+  return e.startsWith("(") && e.endsWith(")");
+}
+function Ot(e, t, n = []) {
+  return `// Generated by Demiurge. Do not edit by hand.
+import "${M}";
+import type { MiddlewareContextOf, MutationMethodsOf, PathValue } from "${M}";
+${t.map(Mt).join(`
+`)}
+
+${t.map((r, o) => jt(o)).join(`
+`)}
+
+declare module "${M}" {
+  interface RouteLocales {
+${n.map((r) => `    ${JSON.stringify(r)}: true;`).join(`
+`)}
+  }
+
+  interface RoutePathVars {
+${e.map(It).join(`
+`)}
+  }
+
+  interface RouteConcretePaths {
+${e.map(Tt).join(`
+`)}
+  }
+
+  interface RouteRequestContexts {
+${e.map(Ct).join(`
+`)}
+  }
+
+  interface RouteMutationMethods {
+${e.map(At).join(`
+`)}
+  }
+}
+
+export {};
+`;
+}
+function Mt(e, t) {
+  return `type __DemiurgeMiddleware${t} = typeof import(${JSON.stringify(e.importPath)}) extends { middleware?: infer T } ? T : never;`;
+}
+function jt(e) {
+  return `type __DemiurgeMiddlewareContext${e} = MiddlewareContextOf<__DemiurgeMiddleware${e}>;`;
+}
+function It(e) {
+  if (e.pathVars.length === 0)
+    return `    ${JSON.stringify(e.pattern)}: {};`;
+  const t = e.pathVars.map((n) => `${n}: PathValue`).join("; ");
+  return `    ${JSON.stringify(e.pattern)}: { ${t} };`;
+}
+function Tt(e) {
+  return `    ${JSON.stringify(e.pattern)}: ${Ft(e.pattern)};`;
+}
+function Ct(e) {
+  const t = e.contextMiddleware.map((r) => `__DemiurgeMiddlewareContext${r}`), n = t.length > 0 ? t.join(" & ") : "Record<never, never>";
+  return `    ${JSON.stringify(e.pattern)}: ${n};`;
+}
+function At(e) {
+  return `    ${JSON.stringify(e.pattern)}: MutationMethodsOf<typeof import(${JSON.stringify(e.importPath)})>;`;
+}
+function Ft(e) {
+  return e.includes("[") ? `\`${e.split(/(\[\.\.\.[^\]]+\]|\[[^\]]+\])/g).filter(Boolean).map((n) => n.startsWith("[") ? "${PathValue}" : kt(n)).join("")}\`` : JSON.stringify(e);
+}
+function kt(e) {
+  return e.replace(/[`$\\]/g, "\\$&");
+}
+function _t(e) {
+  const t = /* @__PURE__ */ new Map();
+  for (const [n, r] of Object.entries(e ?? {}))
+    r.client || t.set(n, { sensitive: r.sensitive });
+  return t;
+}
+function Lt(e, t) {
+  const n = new Set(t), r = /* @__PURE__ */ new Set();
+  return n.size ? [...n].some((o) => e.includes(o)) ? (Ve(Q(e), n, r), [...r].sort()) : [] : [];
+}
+function Vt(e, t, n) {
+  if (e === t) return [e];
+  const r = /* @__PURE__ */ new Set([e]), o = [[e]];
+  for (; o.length; ) {
+    const s = o.shift();
+    for (const i of n(s[s.length - 1]))
+      if (!r.has(i)) {
+        if (i === t) return [...s, i];
+        r.add(i), o.push([...s, i]);
+      }
+  }
+}
+function Wt(e) {
+  return [
+    "Demiurge stopped the build. Client code reads an environment variable that stays on the server.",
+    "",
+    ...e.flatMap(Jt)
+  ].join(`
+`);
+}
+function Jt(e) {
+  return [
+    `  variable: ${e.key}`,
+    `  module: ${e.module}`,
+    `  import path: ${e.importPath.join(" -> ")}`,
+    e.code === "client-secret" ? "  A secret variable never reaches the browser. Read the value on the server, then send the result through route data." : "  Declare the variable with client: true to put the value in the browser bundle.",
+    ""
+  ];
+}
+function Ve(e, t, n) {
+  if (e.type !== "ImportDeclaration" && !(e.type === "ExportNamedDeclaration" && !e.declaration) && e.type !== "ExportAllDeclaration") {
+    if (e.type === "Identifier") {
+      re(e.name, t, n);
+      return;
+    }
+    if (e.type === "MemberExpression") {
+      k(e.object, t, n), ge(e.property, !!e.computed, t, n);
+      return;
+    }
+    if (e.type === "Property" || e.type === "PropertyDefinition") {
+      (e.computed || Ht(e)) && ge(e.key, !!e.computed, t, n), k(e.value, t, n);
+      return;
+    }
+    Ut(e, t, n);
+  }
+}
+function Ht(e) {
+  const t = le(e.value);
+  return t?.type === "Identifier" || t?.type === "ObjectPattern" || t?.type === "ArrayPattern" || t?.type === "AssignmentPattern";
+}
+function ge(e, t, n, r) {
+  const o = le(e);
+  if (o) {
+    if (o.type === "Literal") {
+      re(o.value, n, r);
+      return;
+    }
+    if (!t) {
+      o.type === "Identifier" && re(o.name, n, r);
+      return;
+    }
+    k(o, n, r);
+  }
+}
+function re(e, t, n) {
+  typeof e == "string" && t.has(e) && n.add(e);
+}
+function Ut(e, t, n) {
+  for (const [r, o] of Object.entries(e))
+    r === "end" || r === "loc" || r === "start" || r === "type" || k(o, t, n);
+}
+function k(e, t, n) {
+  if (!e || typeof e != "object") return;
+  if (Array.isArray(e)) {
+    for (const o of e) k(o, t, n);
+    return;
+  }
+  const r = le(e);
+  if (r) {
+    Ve(r, t, n);
+    return;
+  }
+  for (const o of Object.values(e))
+    k(o, t, n);
+}
+function le(e) {
+  return e && typeof e == "object" && "type" in e && typeof e.type == "string" ? e : void 0;
+}
+const zt = [
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "OPTIONS",
+  "HEAD"
+], Bt = /* @__PURE__ */ new Set([
+  "mutation",
+  "html",
+  "json",
+  "jsonl",
+  "notFound",
+  "redirect",
+  "response",
+  "sse",
+  "stream",
+  "text"
+]);
+async function Gt(e) {
+  const t = await Fe(e, "utf8");
+  return await qt(t, e);
+}
+async function qt(e, t) {
+  const n = t.endsWith(".tsx") ? "tsx" : "ts", r = await tt(e, t, {
+    format: "esm",
+    loader: n,
+    target: "esnext"
+  }), o = Kt(r.code);
+  return en(o, t);
+}
+function Kt(e) {
+  const t = Q(e), n = nn(t), r = rn(t), o = Yt(t), s = Qt(t), i = {}, a = /* @__PURE__ */ new Set();
+  let c;
+  for (const [l, u] of s) {
+    const d = o.get(u);
+    if (l === "policy") {
+      d && (c = We(d, n, r));
+      continue;
+    }
+    if (!on(l) || (a.add(l), !d)) continue;
+    const h = Xt(d, n, r);
+    h && (i[l] = h);
+  }
+  return { capabilities: i, declaredMethods: a, policy: c };
+}
+function Yt(e) {
+  const t = /* @__PURE__ */ new Map();
+  for (const n of y(e.body)) {
+    const r = n.type === "ExportNamedDeclaration" ? $(n.declaration) : n;
+    if (r?.type === "VariableDeclaration")
+      for (const o of y(r.declarations)) {
+        const s = T(o.id), i = $(o.init);
+        s && i && t.set(s, i);
+      }
+  }
+  return t;
+}
+function Qt(e) {
+  const t = /* @__PURE__ */ new Map();
+  for (const n of y(e.body)) {
+    if (n.type !== "ExportNamedDeclaration") continue;
+    const r = $(n.declaration);
+    if (r?.type === "VariableDeclaration")
+      for (const o of y(r.declarations)) {
+        const s = T(o.id);
+        s && t.set(s, s);
+      }
+    for (const o of y(n.specifiers)) {
+      const s = I(o.exported), i = I(o.local);
+      s && i && t.set(s, i);
+    }
+  }
+  return t;
+}
+function Xt(e, t, n) {
+  if (e.type !== "CallExpression") return;
+  const r = T(e.callee), o = r ? t.get(r) : void 0;
+  if (!o || !Bt.has(o)) return;
+  const s = y(e.arguments), i = o === "mutation" ? s[0] : s[1];
+  if (!i) return {};
+  const a = ve(i, "cors", n), c = ve(
+    i,
+    "security",
+    n
+  );
+  return {
+    cors: F(a) ? a : void 0,
+    security: F(c) ? c : void 0
+  };
+}
+function ve(e, t, n) {
+  if (e.type === "Identifier") {
+    const o = n.get(String(e.name));
+    return F(o) ? o[t] : b;
+  }
+  if (e.type !== "ObjectExpression") return b;
+  let r;
+  for (const o of y(e.properties)) {
+    if (o.type !== "Property" || o.computed) return b;
+    I(o.key) === t && (r = P($(o.value), n));
+  }
+  return r;
+}
+function We(e, t, n) {
+  if (e.type === "CallExpression") {
+    const o = T(e.callee);
+    if (o && t.get(o) === "defineRoutePolicy") {
+      const s = y(e.arguments)[0];
+      return s ? We(s, t, n) : void 0;
+    }
+  }
+  if (e.type !== "ObjectExpression") {
+    const o = P(e, n);
+    return F(o) ? o : void 0;
+  }
+  const r = {};
+  for (const o of y(e.properties)) {
+    if (o.type !== "Property" || o.computed) return;
+    const s = I(o.key), i = $(o.value);
+    if (!s || !i) return;
+    if (s === "document") {
+      const c = Zt(i, t, n);
+      if (!c) return;
+      r.document = c;
+      continue;
+    }
+    const a = P(i, n);
+    if (a === b) return;
+    r[s] = a;
+  }
+  return r;
+}
+function Zt(e, t, n) {
+  if (e.type !== "CallExpression") {
+    const a = P(e, n);
+    return F(a) ? a : void 0;
+  }
+  const r = $(e.callee);
+  if (r?.type !== "MemberExpression") return;
+  const o = T(r.object), s = I(r.property);
+  if (!o || t.get(o) !== "security" || !s)
+    return;
+  const i = P(y(e.arguments)[0], n);
+  if (i !== b && !(i !== void 0 && !F(i))) {
+    if (s === "api")
+      return G.api(i);
+    if (s === "crossOriginIsolated")
+      return G.crossOriginIsolated(i);
+    if (s === "static")
+      return G.static(i);
+    if (s === "strict")
+      return G.strict(i);
+  }
+}
+function en(e, t) {
+  const n = [], r = new Set(e.declaredMethods);
+  r.has("GET") && r.add("HEAD"), r.add("OPTIONS");
+  for (const [o, s] of Object.entries(
+    e.capabilities
+  )) {
+    if (s.cors) {
+      try {
+        ot(s.cors);
+      } catch (i) {
+        n.push(K(
+          "cors-invalid",
+          t,
+          oe(i, "The CORS policy is invalid."),
+          o
+        ));
+      }
+      for (const i of s.cors.methods ?? [])
+        r.has(i) || n.push(K(
+          "cors-method-unavailable",
+          t,
+          `CORS method ${i} is not available from this route.`,
+          o
+        ));
+    }
+    we(s.security, t, o, n);
+  }
+  if (we(e.policy?.security, t, void 0, n), e.policy?.document)
+    try {
+      it(tn(e.policy.document), {
+        nonce: "build-verification-nonce"
+      });
+    } catch (o) {
+      n.push(K(
+        "security-header-render-failed",
+        t,
+        oe(o, "The security headers are invalid.")
+      ));
+    }
+  return n;
+}
+function tn(e) {
+  const t = e.headers?.reportingEndpoints, n = !!(t && Object.keys(t).length), r = e.csp === !1 ? void 0 : e.csp?.reportTo;
+  return n || !r ? e : {
+    ...e,
+    csp: { ...e.csp, reportTo: void 0 },
+    headers: t ? { ...e.headers, reportingEndpoints: void 0 } : e.headers
+  };
+}
+function we(e, t, n, r) {
+  if (e?.rateLimit)
+    try {
+      st(e.rateLimit);
+    } catch (o) {
+      r.push(K(
+        "rate-limit-invalid",
+        t,
+        oe(o, "The rate limit policy is invalid."),
+        n
+      ));
+    }
+}
+function K(e, t, n, r) {
+  return { code: e, exportName: r, file: t, message: n, severity: "error" };
+}
+function nn(e) {
+  const t = /* @__PURE__ */ new Map();
+  for (const n of y(e.body))
+    if (!(n.type !== "ImportDeclaration" || $(n.source)?.value !== "@demiurgejs/core"))
+      for (const r of y(n.specifiers)) {
+        if (r.type !== "ImportSpecifier") continue;
+        const o = T(r.local), s = I(r.imported);
+        o && s && t.set(o, s);
+      }
+  return t;
+}
+function rn(e) {
+  const t = /* @__PURE__ */ new Map();
+  for (const n of y(e.body)) {
+    const r = n.type === "ExportNamedDeclaration" ? $(n.declaration) : n;
+    if (r?.type === "VariableDeclaration")
+      for (const o of y(r.declarations)) {
+        const s = T(o.id), i = $(o.init);
+        if (!s || !i) continue;
+        const a = P(i, t);
+        a !== b && t.set(s, a);
+      }
+  }
+  return t;
+}
+const b = Symbol("unresolved");
+function P(e, t) {
+  if (e) {
+    if (e.type === "Literal") return e.value;
+    if (e.type === "Identifier")
+      return e.name === "undefined" ? void 0 : t.has(String(e.name)) ? t.get(String(e.name)) : b;
+    if (e.type === "TemplateLiteral")
+      return y(e.expressions).length ? b : y(e.quasis).map((n) => $(n.value)?.cooked ?? "").join("");
+    if (e.type === "UnaryExpression") {
+      const n = P($(e.argument), t);
+      return typeof n != "number" ? b : e.operator === "-" ? -n : e.operator === "+" ? n : b;
+    }
+    if (e.type === "ArrayExpression") {
+      const n = [];
+      for (const r of y(e.elements)) {
+        const o = P(r, t);
+        if (o === b) return b;
+        n.push(o);
+      }
+      return n;
+    }
+    if (e.type === "ObjectExpression") {
+      const n = {};
+      for (const r of y(e.properties)) {
+        if (r.type !== "Property" || r.computed) return b;
+        const o = I(r.key), s = P($(r.value), t);
+        if (!o || s === b) return b;
+        n[o] = s;
+      }
+      return n;
+    }
+    return b;
+  }
+}
+function on(e) {
+  return zt.includes(e);
+}
+function oe(e, t) {
+  return e instanceof Error ? e.message : t;
+}
+function $(e) {
+  return e && typeof e == "object" && "type" in e ? e : void 0;
+}
+function y(e) {
+  return Array.isArray(e) ? e.map($).filter((t) => !!t) : [];
+}
+function T(e) {
+  const t = $(e);
+  return t?.type === "Identifier" ? String(t.name) : void 0;
+}
+function I(e) {
+  const t = $(e);
+  return t?.type === "Identifier" || t?.type === "Literal" ? String(t.name ?? t.value) : void 0;
+}
+const Je = "/_demiurge/audit", He = [
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "OPTIONS",
+  "HEAD"
+];
+function sn(e) {
+  return new URL(e.url).pathname === Je;
+}
+async function an(e, t) {
+  const n = new URL(t.url), r = await cn(
+    e,
+    n.searchParams.get("path") || "/",
+    t
+  ), o = n.searchParams.get("format") === "json";
+  return new Response(
+    o ? JSON.stringify(r, null, 2) : dn(r),
+    {
+      headers: {
+        "cache-control": "no-store",
+        // The panel is a side channel. It declares its own policy, so the
+        // policy of the application stays unchanged. The panel runs no script.
+        "content-security-policy": "default-src 'none'; base-uri 'none'; form-action 'self'; style-src 'unsafe-inline'",
+        "content-type": o ? "application/json; charset=utf-8" : "text/html; charset=utf-8",
+        "x-robots-tag": "noindex"
+      }
+    }
+  );
+}
+async function cn(e, t, n) {
+  const r = new URL(n.url).origin, o = new URL(t, r), s = o.pathname, i = new Request(o, { headers: n.headers }), a = ln(e, s);
+  if (!a) {
+    const f = await fe(
+      e,
+      { fileSegments: [] },
+      {},
+      void 0
+    );
+    return be({
+      cacheReads: [],
+      kind: "unmatched",
+      method: "GET",
+      pathname: s,
+      policy: f,
+      request: i,
+      scripts: []
+    });
+  }
+  const c = await a.route.load(), l = un(c), u = c[l], d = await fe(
+    e,
+    a.route,
+    c,
+    u
+  ), h = [], v = u?.kind === "page" ? await at(
+    e,
+    s,
+    i,
+    void 0,
+    fn(h)
+  ) : void 0, _ = v?.status === "ready" ? v.match : void 0;
+  return be({
+    cacheReads: h,
+    cors: u && u.kind !== "page" ? u.cors : void 0,
+    kind: u?.kind === "page" ? "page" : "resource",
+    metadata: _?.metadata,
+    method: l,
+    pathname: s,
+    policy: d,
+    request: i,
+    route: {
+      file: a.route.file,
+      groups: a.route.fileSegments.filter(lt),
+      layouts: e.layouts.filter((f) => ee(f.fileSegments, a.route.fileSegments)).map((f) => f.file),
+      methods: He.filter((f) => c[f]),
+      middlewares: e.middlewares.filter((f) => ee(f.fileSegments, a.route.fileSegments)).map((f) => f.file),
+      params: a.path,
+      pattern: ct(a.route.segments),
+      policies: e.policies.filter((f) => ee(f.fileSegments, a.route.fileSegments)).map((f) => f.file),
+      render: _?.render.mode
+    },
+    scripts: _?.scripts ?? []
+  });
+}
+function be(e) {
+  const t = e.kind === "page", n = t && ft(e.policy.document) ? Y() : void 0, r = e.scripts.map((i) => ({
+    ...i,
+    nonce: i.nonce ?? n
+  })), o = {
+    headers: { nonce: n, request: e.request },
+    policy: e.policy.document ?? {},
+    scriptDependencies: !0
+  };
+  return {
+    audit: de({
+      document: t ? { ...o, scripts: r } : void 0,
+      route: {
+        cors: e.cors,
+        method: e.method,
+        security: e.policy.security
+      }
+    }),
+    // A nonce makes a document unique for each response. The request handler
+    // therefore replaces the cache directives of the application.
+    cacheControl: n ? "private, no-store" : void 0,
+    cacheReads: e.cacheReads,
+    kind: e.kind,
+    metadata: e.metadata,
+    method: e.method,
+    nonce: n,
+    pathname: e.pathname,
+    policy: e.policy,
+    route: e.route,
+    scripts: r.map((i) => ({
+      // One audit for each script gives the status of that script alone. The
+      // panel reads the same code path that the complete audit reads.
+      findings: de({
+        document: { ...o, scripts: [i] }
+      }).findings,
+      integrity: i.integrity,
+      nonce: i.nonce,
+      purpose: i.purpose,
+      src: i.src,
+      strategy: i.strategy
+    }))
+  };
+}
+function ln(e, t) {
+  try {
+    return ke(e.routes, t);
+  } catch (n) {
+    if (n instanceof ut)
+      return null;
+    throw n;
+  }
+}
+function un(e) {
+  return He.find((t) => e[t]) ?? "GET";
+}
+function fn(e) {
+  const t = dt();
+  return {
+    get: async (n) => (e.push({
+      key: mt(n.key),
+      scope: n.scope ?? "request",
+      staleWhileRevalidate: $e(n.staleWhileRevalidate),
+      tags: (n.tags ?? []).map(pt),
+      ttl: $e(n.ttl)
+    }), await t.get(n)),
+    invalidateKey: t.invalidateKey,
+    invalidateTags: t.invalidateTags
+  };
+}
+function $e(e) {
+  return e === void 0 ? void 0 : String(e);
+}
+function dn(e) {
+  return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Demiurge route audit</title>
+    <style>${pn}</style>
+  </head>
+  <body>
+    <h1>Demiurge route audit</h1>
+    <form method="get" action="${Je}">
+      <label for="path">Path</label>
+      <input id="path" name="path" value="${p(e.pathname)}" />
+      <button type="submit">Audit</button>
+    </form>
+${mn(e)}
+${hn(e.audit.findings)}
+${yn(e.audit.headers)}
+${gn(e)}
+${vn(e.metadata)}
+${wn(e.scripts)}
+${bn(e)}
+    <p class="footer">
+      The development server serves this panel. A production build and a static
+      export do not contain it.
+    </p>
+  </body>
+</html>
+`;
+}
+const pn = `
+  :root { color-scheme: light dark; }
+  body {
+    font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+    line-height: 1.5;
+    margin: 0 auto;
+    max-width: 60rem;
+    padding: 2rem 1rem;
+  }
+  h1 { font-size: 1.25rem; }
+  h2 { font-size: 1rem; margin-bottom: 0.25rem; }
+  form { display: flex; gap: 0.5rem; margin-bottom: 1.5rem; }
+  input { flex: 1; padding: 0.25rem 0.5rem; }
+  section { border-top: 1px solid currentColor; padding: 0.75rem 0; }
+  table { border-collapse: collapse; width: 100%; }
+  td, th { padding: 0.25rem 0.5rem 0.25rem 0; text-align: left; vertical-align: top; }
+  th { white-space: nowrap; width: 12rem; }
+  ul { margin: 0; padding-left: 1.25rem; }
+  .empty { opacity: 0.7; }
+  .error { font-weight: 700; }
+  .footer { opacity: 0.7; }
+`;
+function mn(e) {
+  if (!e.route)
+    return E(
+      "Route",
+      `<p class="empty">No route matches ${p(e.pathname)}.</p>`
+    );
+  const t = e.route;
+  return E(
+    "Route",
+    A([
+      ["Pathname", p(e.pathname)],
+      ["Pattern", p(t.pattern)],
+      ["File", p(t.file)],
+      ["Kind", p(e.kind)],
+      ["Method", p(e.method)],
+      ["Methods", p(t.methods.join(", "))],
+      ["Render mode", t.render ? p(t.render) : N()],
+      ["Path values", $n(t.params)],
+      ["Route groups", C(t.groups)],
+      ["Layouts", C(t.layouts)],
+      ["Policies", C(t.policies)],
+      ["Middleware", C(t.middlewares)]
+    ])
+  );
+}
+function hn(e) {
+  return e.length === 0 ? E("Findings", '<p class="empty">No findings.</p>') : E(
+    "Findings",
+    `<ul>${e.map(Ue).join("")}</ul>`
+  );
+}
+function Ue(e) {
+  return `<li${e.severity === "error" ? ' class="error"' : ""}>${p(e.severity)}: ${p(e.message)} <code>${p(e.code)}</code></li>`;
+}
+function yn(e) {
+  const t = Object.keys(e).sort();
+  return t.length === 0 ? E(
+    "Response headers",
+    '<p class="empty">The response carries no document header.</p>'
+  ) : E(
+    "Response headers",
+    A(t.map((n) => [n, p(e[n])]))
+  );
+}
+function gn(e) {
+  const t = {
+    cors: e.audit.route?.cors,
+    document: e.policy.document,
+    security: e.policy.security
+  };
+  return E(
+    "Effective policy",
+    `<pre>${p(JSON.stringify(t, null, 2))}</pre>`
+  );
+}
+function vn(e) {
+  return e ? E(
+    "Metadata",
+    `<pre>${p(JSON.stringify(e, null, 2))}</pre>`
+  ) : E("Metadata", '<p class="empty">No document metadata.</p>');
+}
+function wn(e) {
+  return e.length === 0 ? E("Scripts", '<p class="empty">No contributed scripts.</p>') : E(
+    "Scripts",
+    e.map(
+      (t) => A([
+        ["Source", p(t.src)],
+        ["Strategy", p(t.strategy)],
+        ["Purpose", t.purpose ? p(t.purpose) : N()],
+        ["Integrity", t.integrity ? p(t.integrity) : N()],
+        ["Nonce", t.nonce ? "applied" : N()],
+        [
+          "Policy status",
+          t.findings.length === 0 ? "allowed" : `<ul>${t.findings.map(Ue).join("")}</ul>`
+        ]
+      ])
+    ).join("")
+  );
+}
+function bn(e) {
+  const t = [
+    [
+      "Response cache-control",
+      e.cacheControl ? p(e.cacheControl) : N()
+    ],
+    ["Nonce", e.nonce ? "required" : N()]
+  ];
+  return e.cacheReads.length === 0 ? E(
+    "Cache behavior",
+    `${A(t)}<p class="empty">The request read no cache entry.</p>`
+  ) : E(
+    "Cache behavior",
+    `${A(t)}${e.cacheReads.map(
+      (n) => A([
+        ["Key", p(n.key)],
+        ["Scope", p(n.scope)],
+        ["Time to live", n.ttl ? p(n.ttl) : N()],
+        [
+          "Stale while revalidate",
+          n.staleWhileRevalidate ? p(n.staleWhileRevalidate) : N()
+        ],
+        ["Tags", C(n.tags)]
+      ])
+    ).join("")}`
+  );
+}
+function E(e, t) {
+  return `    <section>
+      <h2>${p(e)}</h2>
+      ${t}
+    </section>`;
+}
+function A(e) {
+  return `<table><tbody>${e.map(
+    ([t, n]) => `<tr><th scope="row">${p(t)}</th><td>${n}</td></tr>`
+  ).join("")}</tbody></table>`;
+}
+function C(e) {
+  return e.length === 0 ? N() : `<ul>${e.map((t) => `<li>${p(t)}</li>`).join("")}</ul>`;
+}
+function $n(e) {
+  return C(
+    Object.entries(e).map(([t, n]) => `${t} = ${String(n)}`)
+  );
+}
+function N() {
+  return '<span class="empty">none</span>';
+}
+function p(e) {
+  return e.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+}
+const X = "virtual:demiurge/client-entry", ie = `/@id/${X}`, te = `\0${X}`, ze = "virtual:demiurge/server-entry", Re = `\0${ze}`, Se = ".demiurge/route-manifest.d.ts";
+function xr(e = {}) {
+  e.locales && (e = { ...e, locales: ht(e.locales) });
+  let t = process.cwd(), n = !1;
+  const r = _t(e.env), o = /* @__PURE__ */ new Map(), s = `demiurge-${Y()}`;
+  return {
+    api: {
+      demiurge: !0,
+      fonts: e.fonts,
+      images: e.images,
+      staticDeployment: e.static?.deployment,
+      staticFileHeaders: e.static?.headers
+    },
+    enforce: "post",
+    name: "demiurge",
+    config(i, a) {
+      return In(i, a, s);
+    },
+    configResolved(i) {
+      t = i.root, n = i.command === "build";
+    },
+    resolveId(i) {
+      return i === X ? te : i === ze ? Re : null;
+    },
+    load(i) {
+      return i === te ? Fn(t, e) : i === Re ? kn(t, e) : null;
+    },
+    transform: {
+      order: "post",
+      handler(i, a, c) {
+        if (n && !c?.ssr && Tn(o, r, i, a), !Pn(t, e, a))
+          return null;
+        if (c?.ssr)
+          return n ? null : Rn(i, a);
+        const l = Sn(i);
+        return l === i ? null : { code: l, map: null };
+      }
+    },
+    generateBundle(i, a) {
+      const c = Object.values(a).find(
+        (d) => d.type === "chunk" && d.isEntry && d.facadeModuleId === te
+      );
+      if (!c)
+        return;
+      const l = Object.values(a).filter(
+        (d) => d.type === "asset" && d.fileName.endsWith(".css")
+      ).map((d) => `/${d.fileName}`), u = `/${c.fileName}`;
+      this.emitFile({
+        fileName: "index.html",
+        source: rr({
+          entrySrc: u,
+          lang: e.document?.lang,
+          styles: l,
+          title: e.document?.title
+        }),
+        type: "asset"
+      }), this.emitFile({
+        fileName: "demiurge-manifest.json",
+        source: JSON.stringify({ clientEntry: u, styles: l }, null, 2),
+        type: "asset"
+      });
+    },
+    buildEnd() {
+      const i = Cn({
+        moduleIds: [...this.getModuleIds()],
+        moduleInfo: (a) => this.getModuleInfo(a),
+        references: o,
+        root: t,
+        serverEnvKeys: r
+      });
+      i.length && this.error(Wt(i));
+    },
+    async buildStart() {
+      if (o.clear(), n) {
+        await Qn(t, e);
+        const i = await Ce(t, e);
+        if (i.length)
+          throw new Error(lr(i));
+      }
+      e.typedRoutes && await Te(t, e);
+    },
+    configureServer(i) {
+      const a = async () => {
+        const f = await Ce(i.config.root, e);
+        for (const g of f)
+          i.config.logger.warn(Ye(g));
+      };
+      let c, l = Promise.resolve();
+      const u = () => {
+        l = l.then(a).catch(() => {
+        });
+      }, d = () => {
+        c && clearTimeout(c), c = setTimeout(() => {
+          c = void 0, u();
+        }, ar), c.unref?.();
+      };
+      if (i.httpServer?.once("close", () => {
+        c && (clearTimeout(c), c = void 0);
+      }), u(), e.typedRoutes) {
+        const f = x(
+          i.config.root,
+          e.routesDir ?? "src/routes"
+        ), g = () => {
+          Te(i.config.root, e).catch(
+            (w) => {
+              i.config.logger.error(
+                w instanceof Error ? w.message : String(w)
+              );
+            }
+          );
+        };
+        g(), i.watcher.add(f), i.watcher.on("add", (w) => {
+          q(f, w) && (g(), d());
+        }), i.watcher.on("change", (w) => {
+          q(f, w) && (g(), d());
+        }), i.watcher.on("unlink", (w) => {
+          q(f, w) && (g(), d());
+        });
+      } else {
+        const f = x(
+          i.config.root,
+          e.routesDir ?? "src/routes"
+        );
+        i.watcher.add(f);
+        for (const g of ["add", "change", "unlink"])
+          i.watcher.on(g, (w) => {
+            q(f, w) && d();
+          });
+      }
+      const h = Jn(e), v = Hn(i, e), _ = wt({
+        fonts: e.fonts,
+        root: i.config.root
+      });
+      return i.middlewares.use(async (f, g, w) => {
+        try {
+          let S;
+          try {
+            S = pe(f, {
+              // Vite performs its own configured host allowlist check before
+              // Demiurge's middleware runs. Production Node listeners require
+              // an explicit application allowlist instead.
+              allowedHosts: [f.headers.host ?? "localhost"]
+            });
+          } catch (B) {
+            if (B instanceof me) {
+              he(g);
+              return;
+            }
+            throw B;
+          }
+          if (h && sn(S)) {
+            const B = await ne(
+              i,
+              f,
+              x(i.config.root, e.routesDir ?? "src/routes")
+            );
+            await J(
+              g,
+              await an(B, S)
+            );
+            return;
+          }
+          const L = await _(S);
+          if (L) {
+            await J(g, L);
+            return;
+          }
+          const V = await v(S);
+          if (V) {
+            await J(g, V);
+            return;
+          }
+          const U = x(
+            i.config.root,
+            e.routesDir ?? "src/routes"
+          ), z = await ne(i, f, U), W = Ne(
+            i,
+            s
+          ), Z = await ir(
+            z,
+            S,
+            Un(e, W.transform)
+          );
+          if (Z === "next") {
+            w();
+            return;
+          }
+          De(Z, W.nonce), await J(g, Z);
+        } catch (S) {
+          w(S);
+        }
+      }), () => {
+        i.middlewares.use(async (f, g, w) => {
+          try {
+            let S;
+            try {
+              S = pe(f, {
+                allowedHosts: [f.headers.host ?? "localhost"]
+              });
+            } catch (W) {
+              if (W instanceof me) {
+                he(g);
+                return;
+              }
+              throw W;
+            }
+            const L = x(
+              i.config.root,
+              e.routesDir ?? "src/routes"
+            ), V = await ne(i, f, L);
+            Yn(V, L);
+            const U = Ne(
+              i,
+              s
+            ), z = await yt(
+              V,
+              S,
+              Kn(e, U.transform)
+            );
+            De(
+              z,
+              U.nonce
+            ), await J(g, z);
+          } catch (S) {
+            w(S);
+          }
+        });
+      };
+    }
+  };
+}
+function Rn(e, t) {
+  if (!e.includes("import.meta"))
+    return null;
+  const n = Q(e), r = R(n.body).find(
+    (l) => l.type === "ImportDeclaration" && R(l.specifiers).some(
+      (u) => m(u.local)?.type === "Identifier" && m(u.local)?.name === "meta"
+    )
+  ), o = r && R(r.specifiers).find(
+    (l) => m(l.local)?.type === "Identifier" && m(l.local)?.name === "meta"
+  ), s = o && m(o.local);
+  if (!r || !o || !s)
+    return null;
+  let i = "__demiurge_imported_meta__";
+  for (; new RegExp(`\\b${i}\\b`).test(e); )
+    i += "_";
+  const a = new et(e), c = m(o.imported);
+  return a.overwrite(
+    s.start,
+    s.end,
+    c?.start === s.start ? `meta as ${i}` : i
+  ), a.appendLeft(r.end, `
+const meta = ${i};`), {
+    code: a.toString(),
+    map: a.generateMap({
+      hires: "boundary",
+      includeContent: !0,
+      source: t
+    })
+  };
+}
+function Sn(e) {
+  const t = Q(e), n = [], r = Nn(t), o = xn(t), s = En(t), i = [];
+  H(t, (l) => {
+    if (l.type === "ImportDeclaration" && On(l)) {
+      i.push(l);
+      return;
+    }
+    if (l.type !== "CallExpression" || !Dn(l.callee))
+      return;
+    const u = R(l.arguments)[0];
+    if (u?.type === "ObjectExpression")
+      for (const d of R(u.properties))
+        d.type === "Property" && O(d.key) === "data" && n.push({ end: d.end, start: d.start });
+  });
+  const a = [
+    ...n,
+    ...r,
+    ...o,
+    ...s
+  ];
+  if (a.length === 0)
+    return e;
+  const c = [...a];
+  for (const l of i) {
+    const u = R(l.specifiers).map((v) => m(v.local)).filter((v) => v?.type === "Identifier").map((v) => String(v.name)), d = Mn(e, [
+      ...a,
+      { end: l.end, start: l.start }
+    ]), h = u.find(
+      (v) => new RegExp(`\\b${Be(v)}\\b`).test(d)
+    );
+    if (h)
+      throw new Error(
+        `Server-only import ${JSON.stringify(h)} is used by client route code. Move that use into page data, a document contribution, or a client-safe module.`
+      );
+    c.push({ end: l.end, start: l.start });
+  }
+  return jn(e, c, (l) => n.includes(l) ? "data: undefined" : r.includes(l) || o.includes(l) ? "undefined" : s.find((u) => u === l)?.replacement ?? "");
+}
+const se = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+function xn(e) {
+  const t = [], n = /* @__PURE__ */ new Set();
+  for (const r of R(e.body)) {
+    if (r.type !== "ExportNamedDeclaration") continue;
+    const o = m(r.declaration);
+    if (o?.type === "VariableDeclaration")
+      for (const s of R(o.declarations)) {
+        const i = m(s.id);
+        i?.type === "Identifier" && se.has(String(i.name)) && n.add(String(i.name));
+      }
+    for (const s of R(r.specifiers)) {
+      const i = O(s.exported), a = O(s.local);
+      i && a && se.has(i) && n.add(a);
+    }
+  }
+  return H(e, (r) => {
+    if (r.type !== "VariableDeclarator") return;
+    const o = m(r.id), s = m(r.init);
+    o?.type === "Identifier" && n.has(String(o.name)) && s && t.push({ end: s.end, start: s.start });
+  }), t;
+}
+function En(e) {
+  const t = [];
+  for (const n of R(e.body)) {
+    if (n.type !== "ExportNamedDeclaration") continue;
+    const r = m(n.source)?.value;
+    if (typeof r != "string") continue;
+    const o = [], s = [];
+    for (const c of R(n.specifiers)) {
+      const l = O(c.exported), u = O(c.local);
+      !l || !u || (se.has(l) ? s.push(l) : o.push(u === l ? u : `${u} as ${l}`));
+    }
+    if (s.length === 0) continue;
+    const i = o.length > 0 ? `export { ${o.join(", ")} } from ${JSON.stringify(r)};
+` : "", a = s.map((c) => `export const ${c} = undefined;`).join(`
+`);
+    t.push({
+      end: n.end,
+      replacement: `${i}${a}`,
+      start: n.start
+    });
+  }
+  return t;
+}
+const xe = /* @__PURE__ */ new Set(["links", "metadata", "scripts"]);
+function Nn(e) {
+  const t = /* @__PURE__ */ new Set();
+  for (const r of R(e.body)) {
+    if (r.type !== "ExportNamedDeclaration") continue;
+    const o = m(r.declaration);
+    if (o?.type === "VariableDeclaration")
+      for (const s of R(o.declarations)) {
+        const i = m(s.id);
+        i?.type === "Identifier" && xe.has(String(i.name)) && t.add(String(i.name));
+      }
+    for (const s of R(r.specifiers)) {
+      const i = O(s.exported), a = O(s.local);
+      i && a && xe.has(i) && t.add(a);
+    }
+  }
+  const n = [];
+  return H(e, (r) => {
+    if (r.type !== "VariableDeclarator") return;
+    const o = m(r.id), s = m(r.init);
+    o?.type === "Identifier" && t.has(String(o.name)) && s && n.push({ end: s.end, start: s.start });
+  }), n;
+}
+function Pn(e, t, n) {
+  const r = n.split("?", 1)[0] ?? n, o = x(e, t.routesDir ?? "src/routes"), s = D(o, r);
+  return s !== "" && s !== ".." && !s.startsWith(`..${j}`);
+}
+function H(e, t) {
+  if (!e || typeof e != "object") return;
+  if (Array.isArray(e)) {
+    for (const r of e) H(r, t);
+    return;
+  }
+  const n = e;
+  if (typeof n.type == "string") {
+    t(n);
+    for (const [r, o] of Object.entries(n))
+      (/* @__PURE__ */ new Set(["end", "loc", "start", "type"])).has(r) || H(o, t);
+  }
+}
+function m(e) {
+  return e && typeof e == "object" && "type" in e ? e : void 0;
+}
+function R(e) {
+  return Array.isArray(e) ? e.map(m).filter((t) => !!t) : [];
+}
+function Dn(e) {
+  const t = m(e);
+  return t?.type === "Identifier" ? t.name === "page" : t?.type === "MemberExpression" && O(t.property) === "page";
+}
+function O(e) {
+  const t = m(e);
+  return t?.type === "Identifier" || t?.type === "Literal" ? String(t.name ?? t.value) : void 0;
+}
+function On(e) {
+  const t = m(e.source)?.value;
+  return typeof t == "string" && /(?:^|[/.-])server(?:[/.-]|$)/.test(t);
+}
+function Mn(e, t) {
+  const n = [...e];
+  for (const { end: r, start: o } of t)
+    n.fill(" ", o, r);
+  return n.join("");
+}
+function jn(e, t, n) {
+  return [...t].sort((r, o) => o.start - r.start).reduce(
+    (r, o) => `${r.slice(0, o.start)}${n(o)}${r.slice(o.end)}`,
+    e
+  );
+}
+function Be(e) {
+  return e.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function In(e, t, n) {
+  return {
+    appType: "custom",
+    build: {
+      assetsInlineLimit: e.build?.assetsInlineLimit ?? 0,
+      ...t.isSsrBuild && e.build?.target === void 0 && e.ssr?.target !== "webworker" ? { target: "node22.13" } : {},
+      rollupOptions: {
+        input: e.build?.rollupOptions?.input ?? X
+      }
+    },
+    ...t.command === "serve" ? {
+      html: { cspNonce: n },
+      ssr: { external: [M] }
+    } : {}
+  };
+}
+function Tn(e, t, n, r) {
+  if (!t.size || r.includes("/node_modules/") || r.startsWith("\0")) return;
+  const o = Lt(n, t.keys());
+  o.length && e.set(r, o);
+}
+function Cn(e) {
+  const { moduleIds: t, moduleInfo: n, references: r, root: o, serverEnvKeys: s } = e;
+  if (!r.size) return [];
+  const i = t.filter((l) => n(l)?.isEntry), a = (l) => {
+    const u = n(l);
+    return u ? [...u.importedIds, ...u.dynamicallyImportedIds] : [];
+  }, c = [];
+  for (const l of [...r.keys()].sort()) {
+    const d = i.map((h) => Vt(h, l, a)).filter((h) => !!h).sort((h, v) => h.length - v.length)[0];
+    if (d)
+      for (const h of r.get(l) ?? [])
+        c.push({
+          code: s.get(h)?.sensitive ? "client-secret" : "client-server-only",
+          importPath: d.map((v) => Ee(o, v)),
+          key: h,
+          module: Ee(o, l)
+        });
+  }
+  return c;
+}
+function Ee(e, t) {
+  const n = t.startsWith("\0") ? t.slice(1) : t;
+  return n.startsWith(e) && D(e, n) || n;
+}
+function An(e = {}, t = process.env) {
+  const n = Object.entries(e.env ?? {}).filter(([, i]) => i.client);
+  if (!n.length) return "";
+  const r = n.filter(
+    ([i, a]) => a.critical && !t[i]
+  );
+  if (r.length)
+    throw new Error(
+      [
+        "Demiurge stopped the build. The environment of the build does not have a critical client variable.",
+        ...r.map(([i]) => `  variable: ${i}`),
+        "  The build inlines the value of a client variable. Give the value to the build."
+      ].join(`
+`)
+    );
+  const o = _e(Object.fromEntries(n)), s = Object.fromEntries(
+    n.map(([i]) => [i, t[i]]).filter(([, i]) => i !== void 0)
+  );
+  return `
+// The build put these values in the browser bundle. The schema declares each
+// one as a client variable.
+unstable_startEnvironment(${JSON.stringify(o)}, { source: ${JSON.stringify(s)} });
+`;
+}
+function Fn(e, t = {}, n = process.env) {
+  const r = t.routesDir ?? "src/routes", o = Wn(e, t), s = An(t, n);
+  return `import { hydrateFileRouter${s ? ", unstable_startEnvironment" : ""} } from "${M}";
+${o}
+${s}
+${Ge(r, {
+    exportRoutes: !1,
+    includeServerOnly: !1
+  })}
+
+void hydrateFileRouter({ routes${t.locales ? `, locales: ${JSON.stringify(t.locales)}` : ""} });
+`;
+}
+function kn(e, t = {}) {
+  const n = t.routesDir ?? "src/routes", r = !!(t.env && Object.keys(t.env).length), o = r ? ", unstable_startEnvironment" : "", s = r ? `
+// The framework validates the declared environment before the server accepts
+// traffic. A critical variable that is absent or invalid stops the start.
+export const env = unstable_startEnvironment(${JSON.stringify(_e(t.env ?? {}))}).values;
+` : "";
+  return `import { createRequestHandler${o} } from "${M}";
+${s}
+${Ge(n, {
+    exportRoutes: !0,
+    includeServerOnly: !0,
+    eagerModules: !0
+  })}
+
+export function createHandler(options = {}) {
+  const { clientEntry, lang, locales, styles, title, ...handlerOptions } = options;
+
+  return createRequestHandler({
+    ...handlerOptions,
+    routes,
+    routeModules,
+    locales: locales ?? ${JSON.stringify(t.locales)},
+    ssr: {
+      clientEntry,
+      lang: lang ?? ${JSON.stringify(t.document?.lang)},
+      styles,
+      title: title ?? ${JSON.stringify(t.document?.title)},
+    },
+  });
+}
+`;
+}
+function Ge(e, {
+  exportRoutes: t,
+  eagerModules: n = !1,
+  includeServerOnly: r
+}) {
+  const o = Ln(e, r), s = Vn(e);
+  return n ? `const eagerRouteModules = import.meta.glob(${JSON.stringify(o)}, { eager: true });
+const routePrefix = ${JSON.stringify(s)};
+export const routeModules = Object.fromEntries(
+  Object.entries(eagerRouteModules).map(([file, module]) => [
+    \`./routes/\${file.slice(routePrefix.length)}\`,
+    module,
+  ]),
+);
+${t ? "export " : ""}const routes = Object.fromEntries(
+  Object.entries(routeModules).map(([file, module]) => [
+    file,
+    async () => module,
+  ]),
+);` : `const routeModules = import.meta.glob(${JSON.stringify(o)});
+const routePrefix = ${JSON.stringify(s)};
+${t ? "export " : ""}const routes = Object.fromEntries(
+  Object.entries(routeModules).map(([file, load]) => [
+    \`./routes/\${file.slice(routePrefix.length)}\`,
+    load,
+  ]),
+);`;
+}
+const _n = ["@middleware.ts", "@policy.ts"];
+function Ln(e, t) {
+  const n = `/${e.replace(/^\/|\/$/g, "")}`, r = [`${n}/**/*.{ts,tsx}`];
+  return t || r.push(
+    ..._n.flatMap((o) => [
+      `!${n}/${o}`,
+      `!${n}/**/${o}`
+    ])
+  ), r;
+}
+function Vn(e) {
+  return `/${e.replace(/^\/|\/$/g, "")}/`;
+}
+function Wn(e, t) {
+  if (t.styles === !1)
+    return "";
+  const n = t.styles ?? "src/styles.css", r = x(e, n);
+  return ae(r) ? `import ${JSON.stringify(`/${n.replace(/^\/+/, "")}`)};` : "";
+}
+function Jn(e) {
+  return e.devtools !== !1 && process.env.NODE_ENV !== "production";
+}
+function Hn(e, t) {
+  const n = e.config.publicDir, r = t.images?.optimizerPath ?? "/_demiurge/image";
+  return n ? bt({
+    policy: t.images,
+    resolveVariant: (o) => Rt(o, r),
+    root: n
+  }) : async () => null;
+}
+function Un(e, t) {
+  return {
+    dev: !0,
+    ssr: Ke(e),
+    transformDocument: t,
+    renderPage: async (n, r) => {
+      if (n.render.mode === "streaming")
+        return await $t(n, {
+          ...r,
+          clientEntry: ie,
+          transformDocument: t
+        });
+      const o = await t(
+        rt(n, {
+          ...r,
+          clientEntry: ie
+        })
+      );
+      return new Response(o, {
+        headers: { "content-type": "text/html; charset=utf-8" }
+      });
+    }
+  };
+}
+function Ne(e, t) {
+  const n = Y(), r = Y();
+  return {
+    nonce: n,
+    transform: async (o) => {
+      const s = zn(o, r), i = await e.transformIndexHtml("/", s);
+      return Pe(
+        Pe(i, r),
+        t,
+        n
+      );
+    }
+  };
+}
+function zn(e, t) {
+  const n = e.toLowerCase();
+  let r = 0, o = "";
+  for (; r < e.length; ) {
+    const s = e.indexOf("<", r);
+    if (s === -1)
+      return o + e.slice(r);
+    if (o += e.slice(r, s), n.startsWith("<!--", s)) {
+      const l = n.indexOf("-->", s + 4), u = l === -1 ? e.length : l + 3;
+      o += e.slice(s, u), r = u;
+      continue;
+    }
+    const i = n.slice(s).match(/^<\s*(script|style|link)\b/)?.[1];
+    if (!i) {
+      o += "<", r = s + 1;
+      continue;
+    }
+    const a = Bn(e, s);
+    if (a === -1)
+      return o + e.slice(s);
+    const c = e.slice(s, a + 1);
+    if (o += /(?:^|\s)nonce(?:\s|=|>)/i.test(c) ? c : Gn(c, t), r = a + 1, i === "script" || i === "style") {
+      const l = n.indexOf(`</${i}`, r);
+      if (l === -1)
+        return o + e.slice(r);
+      o += e.slice(r, l), r = l;
+    }
+  }
+  return o;
+}
+function Bn(e, t) {
+  let n;
+  for (let r = t + 1; r < e.length; r++) {
+    const o = e[r];
+    if (n) {
+      o === n && (n = void 0);
+      continue;
+    }
+    if (o === '"' || o === "'")
+      n = o;
+    else if (o === ">")
+      return r;
+  }
+  return -1;
+}
+function Gn(e, t) {
+  const n = /\/\s*>$/.test(e) ? e.lastIndexOf("/") : e.length - 1;
+  return `${e.slice(0, n)} nonce="${t}"${e.slice(n)}`;
+}
+function Pe(e, t, n) {
+  const r = new RegExp(
+    `(\\snonce\\s*=\\s*)(["'])${Be(t)}\\2`,
+    "g"
+  );
+  return e.replace(
+    r,
+    n ? `$1"${n}"` : ""
+  );
+}
+function De(e, t) {
+  const n = e.headers.get("content-type"), r = e.headers.get("content-security-policy");
+  if (!n?.toLowerCase().startsWith("text/html") || !r)
+    return;
+  const o = `'nonce-${t}'`, s = Oe(
+    r,
+    ["script-src-elem", "script-src"],
+    "script-src",
+    o
+  ), i = qn(
+    s,
+    ["style-src-elem", "style-src"]
+  ) ? s : Oe(
+    s,
+    ["style-src-elem", "style-src"],
+    "style-src",
+    o
+  );
+  e.headers.set("content-security-policy", i), e.headers.set("cache-control", "private, no-store");
+}
+function Oe(e, t, n, r) {
+  const o = e.split(";").map((u) => u.trim()), s = qe(o, t), i = o.find(
+    (u) => u.split(/\s+/, 1)[0]?.toLowerCase() === "default-src"
+  );
+  if (s === -1 && !i) return e;
+  const [a, ...c] = (s === -1 ? i : o[s]).split(/\s+/), l = [
+    s === -1 ? n : a,
+    .../* @__PURE__ */ new Set([
+      ...c.filter((u) => u !== "'none'"),
+      r
+    ])
+  ].join(" ");
+  return s === -1 ? o.push(l) : o[s] = l, o.join("; ");
+}
+function qn(e, t) {
+  const n = e.split(";").map((i) => i.trim()), r = qe(n, t), s = (r === -1 ? n.find(
+    (i) => i.split(/\s+/, 1)[0]?.toLowerCase() === "default-src"
+  ) : n[r])?.split(/\s+/).slice(1) ?? [];
+  return s.includes("'unsafe-inline'") && !s.some((i) => /^'(?:nonce-|sha(?:256|384|512)-)/i.test(i));
+}
+function qe(e, t) {
+  for (const n of t) {
+    const r = e.findIndex(
+      (o) => o.split(/\s+/, 1)[0]?.toLowerCase() === n
+    );
+    if (r !== -1) return r;
+  }
+  return -1;
+}
+const Me = Symbol.for("demiurge.devManifest");
+async function ne(e, t, n) {
+  const r = t, o = r[Me];
+  if (o)
+    return o;
+  const s = vt(
+    await or(e, n)
+  );
+  return r[Me] = s, s;
+}
+function Ke(e) {
+  return {
+    clientEntry: ie,
+    lang: e.document?.lang,
+    title: e.document?.title
+  };
+}
+function Kn(e, t) {
+  return {
+    ...Ke(e),
+    dev: !0,
+    transformDocument: t
+  };
+}
+const je = /* @__PURE__ */ new Set();
+function Yn(e, t) {
+  je.has(t) || e.fallbacks.notFound.some(
+    (n) => n.fileSegments.length === 0
+  ) || (je.add(t), console.warn(nr(Ze(t, "@not-found.tsx"))));
+}
+async function Qn(e, t = {}) {
+  const n = t.routesDir ?? "src/routes", r = x(e, n);
+  if (!ae(r))
+    return;
+  const o = await ue(r);
+  if (o.map(
+    (a) => D(r, a).split(j).join("/")
+  ).some((a) => /^@not-found\.tsx?$/.test(a)))
+    return;
+  const i = await Xn(o);
+  if (i)
+    throw new Error(
+      tr(
+        n,
+        D(r, i).split(j).join("/")
+      )
+    );
+}
+async function Xn(e) {
+  for (const t of e)
+    if (!D(ce(t), t).startsWith("@") && er(await Fe(t, "utf8")))
+      return t;
+}
+const Zn = M.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), Ie = new RegExp(
+  `import\\s*\\{([^}]*)\\}\\s*from\\s*["']${Zn}["']`,
+  "g"
+);
+function er(e) {
+  const t = [...e.matchAll(Ie)].flatMap(
+    (r) => r[1].split(",").flatMap((o) => {
+      const [s, i] = o.trim().split(/\s+as\s+/);
+      return s.replace(/^type\s+/, "") === "page" ? [i ?? s] : [];
+    })
+  );
+  if (t.length === 0)
+    return !1;
+  const n = e.replace(Ie, "");
+  return t.some((r) => new RegExp(`\\b${r}\\s*\\(`).test(n));
+}
+function tr(e, t) {
+  return `Demiurge will not build an app with page routes and no ${e}/@not-found.tsx.
+
+"${t}" declares a page, so a browser can reach a path this app does not serve. Decide what that looks like rather than shipping the framework built-in.
+
+Create ${e}/@not-found.tsx:
+
+  export default function NotFound({ pathname }: { pathname: string }) {
+    return <h1>Nothing at {pathname}</h1>;
+  }
+
+It renders inside the layouts above the requested path. Opt out with "export const layout = false".`;
+}
+function nr(e) {
+  return `Demiurge is serving its built-in 404 because ${e} does not exist.
+
+Create it before building for production:
+
+  export default function NotFound({ pathname }: { pathname: string }) {
+    return <h1>Nothing at {pathname}</h1>;
+  }
+`;
+}
+function rr({
+  entrySrc: e,
+  lang: t,
+  links: n,
+  metadata: r,
+  nonce: o,
+  scripts: s,
+  styles: i,
+  title: a
+}) {
+  return nt({
+    entrySrc: e,
+    lang: t,
+    links: n,
+    metadata: r,
+    nonce: o,
+    scripts: s,
+    styles: i,
+    title: a
+  });
+}
+async function Te(e, t) {
+  const n = x(e, t.routesDir ?? "src/routes"), r = x(
+    e,
+    typeof t.typedRoutes == "object" ? t.typedRoutes.outputFile ?? Se : Se
+  );
+  await St({
+    outputFile: r,
+    routesDir: n,
+    locales: t.locales?.supportedLocales,
+    localeNamespaces: [
+      ...Object.values(t.locales?.path?.labels ?? {}),
+      ...Object.keys(t.locales?.aliases ?? {}),
+      ...t.locales?.path?.reserved ?? []
+    ]
+  });
+}
+function q(e, t) {
+  return t.startsWith(e) && /\.tsx?$/.test(t);
+}
+async function or(e, t) {
+  const n = await ue(t), r = {};
+  for (const o of n) {
+    const s = ur(t, o);
+    r[s] = async () => await e.ssrLoadModule(o);
+  }
+  return r;
+}
+async function ir(e, t, n = {}) {
+  const r = new URL(t.url);
+  return ke(e.routes, r.pathname) ? await gt(e, t, n) : "next";
+}
+async function ue(e) {
+  return (await Ae(e, {
+    recursive: !0,
+    withFileTypes: !0
+  })).filter((n) => n.isFile() && /\.tsx?$/.test(n.name)).map((n) => x(n.parentPath, n.name));
+}
+const sr = 8, ar = 50;
+async function cr(e, t, n) {
+  const r = new Array(e.length);
+  let o = 0;
+  const s = Array.from(
+    { length: Math.min(t, e.length) },
+    async () => {
+      for (; o < e.length; ) {
+        const i = o++;
+        r[i] = await n(e[i]);
+      }
+    }
+  );
+  return await Promise.all(s), r;
+}
+async function Ce(e, t = {}) {
+  const n = x(e, t.routesDir ?? "src/routes");
+  return ae(n) ? (await cr(
+    await ue(n),
+    sr,
+    Gt
+  )).flat().sort(
+    (o, s) => o.file.localeCompare(s.file) || (o.exportName ?? "").localeCompare(s.exportName ?? "") || o.code.localeCompare(s.code)
+  ) : [];
+}
+function lr(e) {
+  return [
+    "Demiurge found invalid static route policy:",
+    ...e.map(Ye)
+  ].join(`
+`);
+}
+function Ye(e) {
+  return `${e.exportName ? `${e.file} export ${e.exportName}` : e.file}: [${e.code}] ${e.message}`;
+}
+function ur(e, t) {
+  return `./routes/${D(e, t).split(j).join("/")}`;
+}
+export {
+  Je as R,
+  Qn as a,
+  An as b,
+  Fn as c,
+  or as d,
+  rr as e,
+  cn as f,
+  kn as g,
+  er as h,
+  xr as i,
+  Vt as j,
+  Lt as k,
+  _t as l,
+  Wt as m,
+  lr as n,
+  ir as o,
+  Jn as p,
+  qt as q,
+  dn as r,
+  Sn as s,
+  Ce as v
+};
+//# sourceMappingURL=plugin-BQgMiHxa.js.map