@demiurgejs/core 0.2.0-beta.4 → 0.2.0-beta.5

package/dist/chunks/plugin-BZauDxRY.js

@@ -0,0 +1,2310 @@
+import { existsSync as ye } from "node:fs";
+import { mkdir as Et, writeFile as xt, readdir as He, readFile as Ke } from "node:fs/promises";
+import { dirname as M, resolve as O, relative as I, sep as A, basename as he, join as Ge } from "node:path";
+import Ot from "magic-string";
+import { parseAst as K, transformWithEsbuild as Pt } from "vite";
+import { e as Dt, f as Nt } from "./index-0MNiR_wo.js";
+import { v as kt, n as Mt, o as jt, p as It, i as k, q as Ct, s as be, u as At, D as Tt, w as Z, x as Ft, y as we, z as _t, A as ie, t as Lt, B as Vt, C as Ye, M as Wt, E as Bt, F as ee, G as Se, H as zt, I as Jt, J as Ut, K as Xe, f as qt, g as Ht, h as Kt, L as Gt, N as Yt } from "./testing-CUwGj2ie.js";
+import "react";
+import "react-dom/server";
+import "react/jsx-runtime";
+import { c as Xt, t as $e, U as Re, w as Ee, b as U, d as Zt, e as Qt } from "./streaming-GYIsVTQH.js";
+import { p as en } from "./images-CG7ZzayG.js";
+const F = "@demiurgejs/core";
+async function tn(e) {
+  const t = await rn(e.routesDir), n = t.map((i) => sn(e, i)).filter((i) => !!i), r = t.map((i) => on(e, i, n)).filter((i) => !!i).sort((i, s) => i.pattern.localeCompare(s.pattern));
+  nn(r, e.localeNamespaces ?? []);
+  const o = cn(r, n, e.locales);
+  return await Et(M(e.outputFile), { recursive: !0 }), await xt(e.outputFile, o), {
+    routes: r,
+    source: o
+  };
+}
+function nn(e, t) {
+  const n = new Set(t.map((r) => r.toLowerCase()));
+  for (const r of e) {
+    const [o] = r.pattern.slice(1).split("/");
+    if (o && !o.startsWith("[") && n.has(o.toLowerCase()))
+      throw new Error(
+        `Route "${r.pattern}" conflicts with the locale URL namespace "${o}". Move the route or change the locale label.`
+      );
+  }
+}
+async function rn(e) {
+  return (await He(e, {
+    recursive: !0,
+    withFileTypes: !0
+  })).filter((n) => n.isFile() && /\.tsx?$/.test(n.name)).map((n) => O(n.parentPath, n.name));
+}
+function on(e, t, n) {
+  const o = I(e.routesDir, t).split(A).join("/").replace(/\.tsx?$/, "").split("/");
+  if (o.at(-1)?.startsWith("@"))
+    return null;
+  const s = o.flatMap((c) => xe(c) ? [] : c === "index" ? [] : c.startsWith("[...") && c.endsWith("]") ? [c] : c.startsWith("[") && c.endsWith("]") ? [c] : [c]), a = o.flatMap((c) => xe(c) ? [] : c.startsWith("[...") && c.endsWith("]") ? [c.slice(4, -1)] : c.startsWith("[") && c.endsWith("]") ? [c.slice(1, -1)] : []);
+  return {
+    contextMiddleware: n.filter((c) => an(c.fileSegments, o)).map((c) => n.indexOf(c)),
+    fileSegments: o,
+    importPath: Ze(e.outputFile, t),
+    pathVars: a,
+    pattern: `/${s.join("/")}`.replace(/\/$/, "") || "/"
+  };
+}
+function sn(e, t) {
+  const r = I(e.routesDir, t).split(A).join("/").replace(/\.tsx?$/, "").split("/");
+  return r.at(-1) !== "@middleware" ? null : {
+    file: t,
+    fileSegments: r.slice(0, -1),
+    importPath: Ze(e.outputFile, t)
+  };
+}
+function Ze(e, t) {
+  let n = I(M(e), t).split(A).join("/").replace(/\.tsx?$/, "");
+  return n.startsWith(".") || (n = `./${n}`), n;
+}
+function an(e, t) {
+  return e.every(
+    (n, r) => t[r] === n
+  );
+}
+function xe(e) {
+  return e.startsWith("(") && e.endsWith(")");
+}
+function cn(e, t, n = []) {
+  return `// Generated by Demiurge. Do not edit by hand.
+import "${F}";
+import type { MiddlewareContextOf, MutationMethodsOf, PathValue } from "${F}";
+${t.map(un).join(`
+`)}
+
+${t.map((r, o) => ln(o)).join(`
+`)}
+
+declare module "${F}" {
+  interface RouteLocales {
+${n.map((r) => `    ${JSON.stringify(r)}: true;`).join(`
+`)}
+  }
+
+  interface RoutePathVars {
+${e.map(fn).join(`
+`)}
+  }
+
+  interface RouteConcretePaths {
+${e.map(dn).join(`
+`)}
+  }
+
+  interface RouteRequestContexts {
+${e.map(pn).join(`
+`)}
+  }
+
+  interface RouteMutationMethods {
+${e.map(mn).join(`
+`)}
+  }
+}
+
+export {};
+`;
+}
+function un(e, t) {
+  return `type __DemiurgeMiddleware${t} = typeof import(${JSON.stringify(e.importPath)}) extends { middleware?: infer T } ? T : never;`;
+}
+function ln(e) {
+  return `type __DemiurgeMiddlewareContext${e} = MiddlewareContextOf<__DemiurgeMiddleware${e}>;`;
+}
+function fn(e) {
+  if (e.pathVars.length === 0)
+    return `    ${JSON.stringify(e.pattern)}: {};`;
+  const t = e.pathVars.map((n) => `${n}: PathValue`).join("; ");
+  return `    ${JSON.stringify(e.pattern)}: { ${t} };`;
+}
+function dn(e) {
+  return `    ${JSON.stringify(e.pattern)}: ${yn(e.pattern)};`;
+}
+function pn(e) {
+  const t = e.contextMiddleware.map((r) => `__DemiurgeMiddlewareContext${r}`), n = t.length > 0 ? t.join(" & ") : "Record<never, never>";
+  return `    ${JSON.stringify(e.pattern)}: ${n};`;
+}
+function mn(e) {
+  return `    ${JSON.stringify(e.pattern)}: MutationMethodsOf<typeof import(${JSON.stringify(e.importPath)})>;`;
+}
+function yn(e) {
+  return e.includes("[") ? `\`${e.split(/(\[\.\.\.[^\]]+\]|\[[^\]]+\])/g).filter(Boolean).map((n) => n.startsWith("[") ? "${PathValue}" : hn(n)).join("")}\`` : JSON.stringify(e);
+}
+function hn(e) {
+  return e.replace(/[`$\\]/g, "\\$&");
+}
+function gn(e) {
+  const t = /* @__PURE__ */ new Map();
+  for (const [n, r] of Object.entries(e ?? {}))
+    r.client || t.set(n, { sensitive: r.sensitive });
+  return t;
+}
+function vn(e, t) {
+  const n = new Set(t), r = /* @__PURE__ */ new Set();
+  return n.size ? [...n].some((o) => e.includes(o)) ? (et(K(e), n, r), [...r].sort()) : [] : [];
+}
+function Qe(e, t, n) {
+  if (e === t) return [e];
+  const r = /* @__PURE__ */ new Set([e]), o = [[e]];
+  for (; o.length; ) {
+    const i = o.shift();
+    for (const s of n(i[i.length - 1]))
+      if (!r.has(s)) {
+        if (s === t) return [...i, s];
+        r.add(s), o.push([...i, s]);
+      }
+  }
+}
+function bn(e) {
+  return [
+    "Demiurge stopped the build. Client code reads an environment variable that stays on the server.",
+    "",
+    ...e.flatMap(wn)
+  ].join(`
+`);
+}
+function wn(e) {
+  return [
+    `  variable: ${e.key}`,
+    `  module: ${e.module}`,
+    `  import path: ${e.importPath.join(" -> ")}`,
+    e.code === "client-secret" ? "  A secret variable never reaches the browser. Read the value on the server, then send the result through route data." : "  Declare the variable with client: true to put the value in the browser bundle.",
+    ""
+  ];
+}
+function et(e, t, n) {
+  if (e.type !== "ImportDeclaration" && !(e.type === "ExportNamedDeclaration" && !e.declaration) && e.type !== "ExportAllDeclaration") {
+    if (e.type === "Identifier") {
+      ce(e.name, t, n);
+      return;
+    }
+    if (e.type === "MemberExpression") {
+      W(e.object, t, n), Oe(e.property, !!e.computed, t, n);
+      return;
+    }
+    if (e.type === "Property" || e.type === "PropertyDefinition") {
+      (e.computed || Sn(e)) && Oe(e.key, !!e.computed, t, n), W(e.value, t, n);
+      return;
+    }
+    $n(e, t, n);
+  }
+}
+function Sn(e) {
+  const t = ge(e.value);
+  return t?.type === "Identifier" || t?.type === "ObjectPattern" || t?.type === "ArrayPattern" || t?.type === "AssignmentPattern";
+}
+function Oe(e, t, n, r) {
+  const o = ge(e);
+  if (o) {
+    if (o.type === "Literal") {
+      ce(o.value, n, r);
+      return;
+    }
+    if (!t) {
+      o.type === "Identifier" && ce(o.name, n, r);
+      return;
+    }
+    W(o, n, r);
+  }
+}
+function ce(e, t, n) {
+  typeof e == "string" && t.has(e) && n.add(e);
+}
+function $n(e, t, n) {
+  for (const [r, o] of Object.entries(e))
+    r === "end" || r === "loc" || r === "start" || r === "type" || W(o, t, n);
+}
+function W(e, t, n) {
+  if (!e || typeof e != "object") return;
+  if (Array.isArray(e)) {
+    for (const o of e) W(o, t, n);
+    return;
+  }
+  const r = ge(e);
+  if (r) {
+    et(r, t, n);
+    return;
+  }
+  for (const o of Object.values(e))
+    W(o, t, n);
+}
+function ge(e) {
+  return e && typeof e == "object" && "type" in e && typeof e.type == "string" ? e : void 0;
+}
+const Rn = /* @__PURE__ */ new Set([
+  "@demiurgejs/core/server-only",
+  "server-only"
+]);
+function En(e) {
+  return e.includes("server-only") ? Dn(K(e)) : !1;
+}
+function xn(e) {
+  return [
+    "Demiurge stopped the build. A browser bundle reaches a module marked server-only.",
+    "",
+    ...e.flatMap(Pn)
+  ].join(`
+`);
+}
+function On(e) {
+  return `Demiurge stopped the development server. The browser requested ${e}, and this module is marked server-only.
+
+Keep this module out of client code. Move the server logic to a module that no client module imports.`;
+}
+function Pn(e) {
+  return [
+    `  module: ${e.module}`,
+    `  import path: ${e.importPath.join(" -> ")}`,
+    "  Keep this module out of client code. Move the server logic to a module that no client module imports.",
+    ""
+  ];
+}
+function Dn(e) {
+  let t = !1;
+  return ue(e, (n) => {
+    t || (n.type === "ImportDeclaration" || n.type === "ExportNamedDeclaration" || n.type === "ExportAllDeclaration" || n.type === "ImportExpression") && Nn(n.source) && (t = !0);
+  }), t;
+}
+function Nn(e) {
+  const t = kn(e);
+  return t?.type === "Literal" && typeof t.value == "string" && Rn.has(t.value);
+}
+function ue(e, t) {
+  if (!e || typeof e != "object") return;
+  if (Array.isArray(e)) {
+    for (const r of e) ue(r, t);
+    return;
+  }
+  const n = e;
+  if (typeof n.type == "string") {
+    t(n);
+    for (const [r, o] of Object.entries(n))
+      (/* @__PURE__ */ new Set(["end", "loc", "start", "type"])).has(r) || ue(o, t);
+  }
+}
+function kn(e) {
+  return e && typeof e == "object" && "type" in e ? e : void 0;
+}
+const tt = [
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "OPTIONS",
+  "HEAD"
+], Mn = /* @__PURE__ */ new Set([
+  "mutation",
+  "html",
+  "json",
+  "jsonl",
+  "notFound",
+  "redirect",
+  "response",
+  "sse",
+  "stream",
+  "text"
+]);
+async function jn(e) {
+  const t = await Ke(e, "utf8"), n = await nt(t, e), r = he(e).startsWith("@");
+  return {
+    accessState: n.accessState,
+    declaresDocumentPolicy: n.declaresDocumentPolicy,
+    documentCspState: n.documentCspState,
+    // An attached file owns no address, so it never declares a route.
+    declaresRoute: !r && n.declaredMethods.size > 0,
+    declaresPageRoute: !r && ot(t),
+    file: e,
+    findings: ft(n, e),
+    methods: r ? [] : tt.filter((o) => n.declaredMethods.has(o))
+  };
+}
+async function No(e, t) {
+  return ft(
+    await nt(e, t),
+    t
+  );
+}
+async function nt(e, t) {
+  const n = t.endsWith(".tsx") ? "tsx" : "ts", r = await Pt(e, t, {
+    format: "esm",
+    loader: n,
+    target: "esnext"
+  });
+  return Wn(r.code);
+}
+function In(e, t) {
+  const n = t.filter((o) => rt(o.file)), r = [];
+  for (const o of t) {
+    if (!o.declaresPageRoute && !Tn(o.file))
+      continue;
+    const i = _n(
+      e,
+      M(o.file),
+      n
+    );
+    Ln(
+      i,
+      o.documentCspState
+    ) === "absent" && r.push({
+      code: "document-policy-missing",
+      file: o.file,
+      message: Fn(e, i),
+      severity: "error"
+    });
+  }
+  return r;
+}
+function Cn(e, t) {
+  const n = t.filter(
+    (o) => rt(o.file)
+  ), r = [];
+  for (const o of t)
+    !o.declaresRoute || An(
+      e,
+      M(o.file),
+      o.accessState,
+      n
+    ) !== "absent" || r.push({
+      code: "access-declaration-missing",
+      file: o.file,
+      message: "This route inherits no access declaration, so the request pipeline denies each request. Add access: { public: true } for a public route, or access: { authorize } to this route or an ancestor @policy.ts file.",
+      severity: "error"
+    });
+  return r;
+}
+function An(e, t, n, r) {
+  const o = r.filter(
+    (s) => te(M(s.file), t) && te(e, M(s.file))
+  );
+  let i = n;
+  for (const s of o)
+    s.accessState !== "absent" && (i = s.accessState);
+  return i;
+}
+function Tn(e) {
+  return /^@(?:not-found|error)\.tsx?$/.test(he(e));
+}
+function Fn(e, t) {
+  const n = "To accept a document without a Content-Security-Policy, declare csp with a value of false and a reason.", r = t.at(-1);
+  return r ? `This route inherits no document policy. ${r.file} does not declare one. Add document: security.strict() to ${r.file}. ${n}` : `This route inherits no document policy. No @policy.ts file exists above it. Create ${Ge(e, "@policy.ts")} with document: security.strict(). ${n}`;
+}
+function _n(e, t, n) {
+  return n.filter(
+    (r) => te(M(r.file), t) && te(e, M(r.file))
+  ).sort(
+    (r, o) => M(r.file).length - M(o.file).length || r.file.localeCompare(o.file)
+  );
+}
+function Ln(e, t) {
+  let n = "absent";
+  for (const r of e)
+    n = Pe(n, r.documentCspState);
+  return Pe(n, t);
+}
+function Pe(e, t) {
+  return t === "absent" ? e : t;
+}
+function rt(e) {
+  return /^@policy\.tsx?$/.test(he(e));
+}
+function te(e, t) {
+  const n = I(e, t);
+  return n === "" || n !== ".." && !n.startsWith(`..${A}`) && !n.startsWith(A);
+}
+const Vn = F.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), De = new RegExp(
+  `import\\s*\\{([^}]*)\\}\\s*from\\s*["']${Vn}["']`,
+  "g"
+);
+function ot(e) {
+  const t = [...e.matchAll(De)].flatMap(
+    (r) => r[1].split(",").flatMap((o) => {
+      const [i, s] = o.trim().split(/\s+as\s+/);
+      return i.replace(/^type\s+/, "") === "page" ? [s ?? i] : [];
+    })
+  );
+  if (t.length === 0)
+    return !1;
+  const n = e.replace(De, "");
+  return t.some((r) => new RegExp(`\\b${r}\\s*\\(`).test(n));
+}
+function Wn(e) {
+  const t = K(e), n = Gn(t), r = Yn(t), o = zn(t), i = Jn(t), s = {}, a = /* @__PURE__ */ new Set();
+  let c = "absent", u = !1, l = "absent", d;
+  for (const [f, b] of i) {
+    const R = o.get(b);
+    if (f === "policy") {
+      c = R ? it(R, n, r) : "unknown", l = R ? st(R, n, r) : "unknown", u = l !== "absent", R && (d = lt(R, n, r));
+      continue;
+    }
+    if (!Xn(f) || (a.add(f), !R)) continue;
+    const h = Un(R, n, r);
+    h && (s[f] = h);
+  }
+  return {
+    accessState: c,
+    capabilities: s,
+    declaredMethods: a,
+    declaresDocumentPolicy: u,
+    documentCspState: l,
+    policy: d
+  };
+}
+function it(e, t, n) {
+  if (e.type === "Identifier") {
+    if (e.name === "undefined") return "absent";
+    const r = n.get(String(e.name));
+    return r === void 0 && !n.has(String(e.name)) || !k(r) ? "unknown" : Object.prototype.hasOwnProperty.call(r, "access") ? "declared" : "absent";
+  }
+  if (e.type === "CallExpression") {
+    const r = j(e.callee);
+    if (r && t.get(r) === "defineRoutePolicy") {
+      const o = m(e.arguments)[0];
+      return o ? it(o, t, n) : "unknown";
+    }
+    return "unknown";
+  }
+  if (e.type !== "ObjectExpression") return "unknown";
+  for (const r of m(e.properties)) {
+    if (r.type === "SpreadElement") return "unknown";
+    if (r.type !== "Property") continue;
+    if (r.computed) return "unknown";
+    if (D(r.key) !== "access") continue;
+    const o = y(r.value);
+    return o?.type === "Identifier" && o.name === "undefined" ? "absent" : "declared";
+  }
+  return "absent";
+}
+function st(e, t, n) {
+  if (e.type === "Identifier") {
+    if (e.name === "undefined") return "absent";
+    const r = n.get(String(e.name));
+    return r === void 0 && !n.has(String(e.name)) ? "unknown" : ut(r);
+  }
+  if (e.type === "CallExpression") {
+    const r = j(e.callee);
+    if (r && t.get(r) === "defineRoutePolicy") {
+      const i = m(e.arguments)[0];
+      return i ? st(i, t, n) : "unknown";
+    }
+    const o = y(e.callee);
+    if (o?.type === "MemberExpression") {
+      const i = j(o.object), s = D(o.property);
+      if (i && t.get(i) === "security" && s)
+        return at(s, m(e.arguments)[0], n);
+    }
+    return "unknown";
+  }
+  if (e.type !== "ObjectExpression") return "unknown";
+  for (const r of m(e.properties)) {
+    if (r.type === "SpreadElement") return "unknown";
+    if (r.type === "Property") {
+      if (r.computed) return "unknown";
+      if (D(r.key) === "document")
+        return Bn(
+          y(r.value),
+          t,
+          n
+        );
+    }
+  }
+  return "absent";
+}
+function Bn(e, t, n) {
+  if (!e) return "unknown";
+  if (e.type === "UnaryExpression" && e.operator === "void")
+    return "absent";
+  if (e.type === "Identifier") {
+    if (e.name === "undefined") return "absent";
+    const r = n.get(String(e.name));
+    return r === void 0 && !n.has(String(e.name)) ? "unknown" : ut(r);
+  }
+  if (e.type === "CallExpression") {
+    const r = y(e.callee);
+    if (r?.type !== "MemberExpression") return "unknown";
+    const o = j(r.object), i = D(r.property);
+    return !o || t.get(o) !== "security" || !i ? "unknown" : at(i, m(e.arguments)[0], n);
+  }
+  if (e.type !== "ObjectExpression") return "unknown";
+  for (const r of m(e.properties)) {
+    if (r.type === "SpreadElement" || r.computed) return "unknown";
+    if (r.type !== "Property" || D(r.key) !== "csp") continue;
+    const o = y(r.value);
+    if (!o) return "unknown";
+    if (o.type === "Literal")
+      return o.value === !1 ? "false" : o.value === void 0 || o.value === null ? "absent" : "present";
+    if (o.type === "Identifier") {
+      const i = P(o, n);
+      return i === g ? "unknown" : ne(i);
+    }
+    if (o.type === "ObjectExpression") {
+      const i = P(o, n);
+      return i === g ? "unknown" : ne(i);
+    }
+    return o.type === "ArrayExpression" ? "present" : "unknown";
+  }
+  return "absent";
+}
+function at(e, t, n) {
+  const r = e === "api" ? "absent" : e === "strict" || e === "static" || e === "crossOriginIsolated" ? "present" : "unknown";
+  if (!t) return r;
+  if (t.type === "Identifier") {
+    const o = P(t, n);
+    return o === g ? "unknown" : Ne(r, ct(o));
+  }
+  if (t.type !== "ObjectExpression") return "unknown";
+  for (const o of m(t.properties)) {
+    if (o.type === "SpreadElement" || o.computed) return "unknown";
+    if (o.type !== "Property" || D(o.key) !== "csp") continue;
+    const i = P(y(o.value), n);
+    return i === g ? "unknown" : Ne(r, ne(i));
+  }
+  return r;
+}
+function ct(e) {
+  return k(e) ? Object.prototype.hasOwnProperty.call(e, "csp") ? ne(e.csp) : "absent" : e === void 0 ? "absent" : "unknown";
+}
+function ne(e) {
+  return e === !1 ? "false" : Ft(e) ? e.value === !1 ? "false" : "unknown" : e == null ? "absent" : k(e) || Array.isArray(e) ? "present" : "unknown";
+}
+function Ne(e, t) {
+  return t === "absent" ? e : t;
+}
+function ut(e) {
+  return e === void 0 ? "absent" : k(e) ? Object.prototype.hasOwnProperty.call(e, "document") ? ct(e.document) : "absent" : "unknown";
+}
+function zn(e) {
+  const t = /* @__PURE__ */ new Map();
+  for (const n of m(e.body)) {
+    const r = n.type === "ExportNamedDeclaration" ? y(n.declaration) : n;
+    if (r?.type === "VariableDeclaration")
+      for (const o of m(r.declarations)) {
+        const i = j(o.id), s = y(o.init);
+        i && s && t.set(i, s);
+      }
+  }
+  return t;
+}
+function Jn(e) {
+  const t = /* @__PURE__ */ new Map();
+  for (const n of m(e.body)) {
+    if (n.type !== "ExportNamedDeclaration") continue;
+    const r = y(n.declaration);
+    if (r?.type === "VariableDeclaration")
+      for (const o of m(r.declarations)) {
+        const i = j(o.id);
+        i && t.set(i, i);
+      }
+    for (const o of m(n.specifiers)) {
+      const i = D(o.exported), s = D(o.local);
+      i && s && t.set(i, s);
+    }
+  }
+  return t;
+}
+function Un(e, t, n) {
+  if (e.type !== "CallExpression") return;
+  const r = j(e.callee), o = r ? t.get(r) : void 0;
+  if (!o || !Mn.has(o)) return;
+  const i = m(e.arguments), s = o === "mutation" ? i[0] : i[1];
+  if (!s) return {};
+  const a = ke(s, "cors", n), c = ke(
+    s,
+    "security",
+    n
+  );
+  return {
+    cors: k(a) ? a : void 0,
+    security: k(c) ? c : void 0
+  };
+}
+function ke(e, t, n) {
+  if (e.type === "Identifier") {
+    const o = n.get(String(e.name));
+    return k(o) ? o[t] : g;
+  }
+  if (e.type !== "ObjectExpression") return g;
+  let r;
+  for (const o of m(e.properties)) {
+    if (o.type !== "Property" || o.computed) return g;
+    D(o.key) === t && (r = P(y(o.value), n));
+  }
+  return r;
+}
+function lt(e, t, n) {
+  if (e.type === "CallExpression") {
+    const o = j(e.callee);
+    if (o && t.get(o) === "defineRoutePolicy") {
+      const i = m(e.arguments)[0];
+      return i ? lt(i, t, n) : void 0;
+    }
+  }
+  if (e.type !== "ObjectExpression") {
+    const o = P(e, n);
+    return k(o) ? o : void 0;
+  }
+  const r = {};
+  for (const o of m(e.properties)) {
+    if (o.type !== "Property" || o.computed) return;
+    const i = D(o.key), s = y(o.value);
+    if (!i || !s) return;
+    if (i === "document") {
+      const c = qn(s, t, n);
+      if (!c) return;
+      r.document = c;
+      continue;
+    }
+    const a = P(s, n);
+    if (a === g) return;
+    r[i] = a;
+  }
+  return r;
+}
+function qn(e, t, n) {
+  if (e.type !== "CallExpression") {
+    const a = P(e, n);
+    return k(a) ? a : void 0;
+  }
+  const r = y(e.callee);
+  if (r?.type !== "MemberExpression") return;
+  const o = j(r.object), i = D(r.property);
+  if (!o || t.get(o) !== "security" || !i)
+    return;
+  const s = P(m(e.arguments)[0], n);
+  if (s !== g && !(s !== void 0 && !k(s))) {
+    if (i === "api")
+      return Z.api(s);
+    if (i === "crossOriginIsolated")
+      return Z.crossOriginIsolated(s);
+    if (i === "static")
+      return Z.static(s);
+    if (i === "strict")
+      return Z.strict(s);
+  }
+}
+function ft(e, t) {
+  const n = [], r = new Set(e.declaredMethods);
+  r.has("GET") && r.add("HEAD"), r.add("OPTIONS");
+  for (const [o, i] of Object.entries(
+    e.capabilities
+  )) {
+    if (i.cors) {
+      try {
+        kt(i.cors);
+      } catch (s) {
+        n.push(_(
+          "cors-invalid",
+          t,
+          le(s, "The CORS policy is invalid."),
+          o
+        ));
+      }
+      for (const s of i.cors.methods ?? [])
+        r.has(s) || n.push(_(
+          "cors-method-unavailable",
+          t,
+          `CORS method ${s} is not available from this route.`,
+          o
+        ));
+    }
+    Ie(i.security, t, o, n), Me(
+      void 0,
+      i.security,
+      t,
+      o,
+      n
+    );
+  }
+  if (Ie(e.policy?.security, t, void 0, n), Me(
+    e.policy?.document,
+    e.policy?.security,
+    t,
+    void 0,
+    n
+  ), e.policy?.document)
+    try {
+      Mt(Hn(e.policy.document), {
+        nonce: "build-verification-nonce"
+      });
+    } catch (o) {
+      n.push(_(
+        "security-header-render-failed",
+        t,
+        le(o, "The security headers are invalid.")
+      ));
+    }
+  return n;
+}
+function Hn(e) {
+  const t = e.headers?.reportingEndpoints, n = !!(t && Object.keys(t).length), r = It(e.csp), o = r ? r.reportTo : void 0;
+  return n || !o ? e : {
+    ...e,
+    csp: { ...r, reportTo: void 0 },
+    headers: t ? { ...e.headers, reportingEndpoints: void 0 } : e.headers
+  };
+}
+function Me(e, t, n, r, o) {
+  e && je(e.csp) && o.push(_(
+    "security-exception-reason-missing",
+    n,
+    "This document policy accepts no Content-Security-Policy and states no reason. Declare csp with a value of false and a reason.",
+    r
+  )), t && je(t.csrf) && o.push(_(
+    "security-exception-reason-missing",
+    n,
+    "This route runs no CSRF check and states no reason. Declare csrf with a value of false and a reason.",
+    r
+  )), Kn(t, n, r, o);
+}
+function je(e) {
+  return e === !1 ? !0 : k(e) && "value" in e && typeof e.reason != "string";
+}
+function Kn(e, t, n, r) {
+  const o = e?.request?.maxBodySize;
+  if (o === void 0 || Ct(o))
+    return;
+  let i, s;
+  try {
+    i = be(At(o)), s = be(Tt);
+  } catch {
+    return;
+  }
+  i <= s || r.push(_(
+    "security-exception-reason-missing",
+    t,
+    `This route raises the request body limit to ${String(o)} and states no reason. Declare maxBodySize with a limit value and a reason.`,
+    n
+  ));
+}
+function Ie(e, t, n, r) {
+  if (e?.rateLimit)
+    try {
+      jt(e.rateLimit);
+    } catch (o) {
+      r.push(_(
+        "rate-limit-invalid",
+        t,
+        le(o, "The rate limit policy is invalid."),
+        n
+      ));
+    }
+}
+function _(e, t, n, r) {
+  return { code: e, exportName: r, file: t, message: n, severity: "error" };
+}
+function Gn(e) {
+  const t = /* @__PURE__ */ new Map();
+  for (const n of m(e.body))
+    if (!(n.type !== "ImportDeclaration" || y(n.source)?.value !== "@demiurgejs/core"))
+      for (const r of m(n.specifiers)) {
+        if (r.type !== "ImportSpecifier") continue;
+        const o = j(r.local), i = D(r.imported);
+        o && i && t.set(o, i);
+      }
+  return t;
+}
+function Yn(e) {
+  const t = /* @__PURE__ */ new Map();
+  for (const n of m(e.body)) {
+    const r = n.type === "ExportNamedDeclaration" ? y(n.declaration) : n;
+    if (r?.type === "VariableDeclaration")
+      for (const o of m(r.declarations)) {
+        const i = j(o.id), s = y(o.init);
+        if (!i || !s) continue;
+        const a = P(s, t);
+        a !== g && t.set(i, a);
+      }
+  }
+  return t;
+}
+const g = Symbol("unresolved");
+function P(e, t) {
+  if (e) {
+    if (e.type === "Literal") return e.value;
+    if (e.type === "Identifier")
+      return e.name === "undefined" ? void 0 : t.has(String(e.name)) ? t.get(String(e.name)) : g;
+    if (e.type === "TemplateLiteral")
+      return m(e.expressions).length ? g : m(e.quasis).map((n) => y(n.value)?.cooked ?? "").join("");
+    if (e.type === "UnaryExpression") {
+      const n = P(y(e.argument), t);
+      return typeof n != "number" ? g : e.operator === "-" ? -n : e.operator === "+" ? n : g;
+    }
+    if (e.type === "ArrayExpression") {
+      const n = [];
+      for (const r of m(e.elements)) {
+        const o = P(r, t);
+        if (o === g) return g;
+        n.push(o);
+      }
+      return n;
+    }
+    if (e.type === "ObjectExpression") {
+      const n = {};
+      for (const r of m(e.properties)) {
+        if (r.type !== "Property" || r.computed) return g;
+        const o = D(r.key), i = P(y(r.value), t);
+        if (!o || i === g) return g;
+        n[o] = i;
+      }
+      return n;
+    }
+    return g;
+  }
+}
+function Xn(e) {
+  return tt.includes(e);
+}
+function le(e, t) {
+  return e instanceof Error ? e.message : t;
+}
+function y(e) {
+  return e && typeof e == "object" && "type" in e ? e : void 0;
+}
+function m(e) {
+  return Array.isArray(e) ? e.map(y).filter((t) => !!t) : [];
+}
+function j(e) {
+  const t = y(e);
+  return t?.type === "Identifier" ? String(t.name) : void 0;
+}
+function D(e) {
+  const t = y(e);
+  return t?.type === "Identifier" || t?.type === "Literal" ? String(t.name ?? t.value) : void 0;
+}
+const Zn = "[redacted]", dt = /* @__PURE__ */ new Set([
+  "cookie",
+  "cookies",
+  "setcookie",
+  "setcookies"
+]), pt = /* @__PURE__ */ new Set([
+  "session",
+  "sessiondata",
+  "sessionrecord",
+  "sessions"
+]), Qn = /* @__PURE__ */ new Set(["value"]), er = /* @__PURE__ */ new Set(["data", "id"]);
+function tr(e, t = {}) {
+  const n = nr(e, t), r = rr(n);
+  return JSON.stringify(r, void 0, t.space ?? 2);
+}
+function nr(e, t = {}) {
+  const n = [], r = {
+    inCookie: !1,
+    inSession: !1,
+    secretEnvKeys: new Set(t.secretEnvKeys ?? [])
+  }, o = fe(e, "", r, n);
+  return n.sort((i, s) => i.path.localeCompare(s.path)), { redactions: n, value: o };
+}
+function rr(e) {
+  return !yt(e.value) || !Array.isArray(e.value.redactions) ? e.value : { ...e.value, redactions: e.redactions };
+}
+function fe(e, t, n, r) {
+  if (Array.isArray(e))
+    return e.map(
+      (s, a) => fe(s, `${t}[${a}]`, n, r)
+    );
+  if (!yt(e)) return e;
+  const o = sr(e) ? { ...n, inSession: !0 } : n, i = {};
+  for (const [s, a] of Object.entries(e)) {
+    const c = t ? `${t}.${s}` : s, u = or(s, a, o);
+    if (u) {
+      r.push({ name: s, path: c, reason: u }), i[s] = Zn;
+      continue;
+    }
+    i[s] = fe(a, c, ir(s, o), r);
+  }
+  return i;
+}
+function or(e, t, n) {
+  if (n.secretEnvKeys.has(e)) return "environment-secret";
+  const r = mt(e);
+  if (n.inCookie && Qn.has(r))
+    return "cookie-value";
+  if (n.inSession && er.has(r))
+    return "session-record";
+  if (typeof t == "string") {
+    if (dt.has(r)) return "cookie-value";
+    if (pt.has(r)) return "session-record";
+  }
+}
+function ir(e, t) {
+  const n = mt(e);
+  return dt.has(n) ? { ...t, inCookie: !0 } : pt.has(n) ? { ...t, inSession: !0 } : t;
+}
+function mt(e) {
+  return e.toLowerCase().replaceAll("-", "").replaceAll("_", "");
+}
+function yt(e) {
+  if (!k(e)) return !1;
+  const t = Object.getPrototypeOf(e);
+  return t === Object.prototype || t === null;
+}
+function sr(e) {
+  return typeof e.id == "string" && typeof e.createdAt == "number" && typeof e.expiresAt == "number" && typeof e.version == "number" && "data" in e;
+}
+const ar = 1, ht = "/_demiurge/audit", gt = [
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "OPTIONS",
+  "HEAD"
+], cr = {
+  audit: "request",
+  cacheReads: "request",
+  metadata: "request",
+  policy: "static",
+  route: "static",
+  scripts: "request"
+};
+function ur(e) {
+  return new URL(e.url).pathname === ht;
+}
+async function lr(e, t) {
+  const n = new URL(t.url), r = await fr(
+    e,
+    n.searchParams.get("path") || "/",
+    t
+  ), o = n.searchParams.get("format") === "json";
+  return new Response(
+    o ? tr(r) : yr(r),
+    {
+      headers: {
+        "cache-control": "no-store",
+        // The panel is a side channel. It declares its own policy, so the
+        // policy of the application stays unchanged. The panel runs no script.
+        "content-security-policy": "default-src 'none'; base-uri 'none'; form-action 'self'; style-src 'unsafe-inline'",
+        "content-type": o ? "application/json; charset=utf-8" : "text/html; charset=utf-8",
+        "x-robots-tag": "noindex"
+      }
+    }
+  );
+}
+async function fr(e, t, n) {
+  const r = new URL(n.url).origin, o = new URL(t, r), i = o.pathname, s = new Request(o, { headers: n.headers }), a = dr(e, i);
+  if (!a) {
+    const h = await we(
+      e,
+      { fileSegments: [] },
+      {},
+      void 0
+    );
+    return Ce({
+      cacheReads: [],
+      kind: "unmatched",
+      method: "GET",
+      pathname: i,
+      policy: h,
+      request: s,
+      scripts: []
+    });
+  }
+  const c = await a.route.load(), u = pr(c), l = c[u], d = await we(
+    e,
+    a.route,
+    c,
+    l
+  ), f = [], b = l?.kind === "page" ? await _t(
+    e,
+    i,
+    s,
+    void 0,
+    mr(f)
+  ) : void 0, R = b?.status === "ready" ? b.match : void 0;
+  return Ce({
+    cacheReads: f,
+    cors: l && l.kind !== "page" ? l.cors : void 0,
+    kind: l?.kind === "page" ? "page" : "resource",
+    metadata: R?.metadata,
+    method: u,
+    pathname: i,
+    policy: d,
+    request: s,
+    route: {
+      file: a.route.file,
+      groups: a.route.fileSegments.filter(Vt),
+      layouts: e.layouts.filter((h) => ie(h.fileSegments, a.route.fileSegments)).map((h) => h.file),
+      methods: gt.filter((h) => c[h]),
+      middlewares: e.middlewares.filter((h) => ie(h.fileSegments, a.route.fileSegments)).map((h) => h.file),
+      params: a.path,
+      pattern: Lt(a.route.segments),
+      policies: e.policies.filter((h) => ie(h.fileSegments, a.route.fileSegments)).map((h) => h.file),
+      render: R?.render.mode
+    },
+    scripts: R?.scripts ?? []
+  });
+}
+function Ce(e) {
+  const t = e.kind === "page", n = t && Bt(e.policy.document) ? ee() : void 0, r = e.scripts.map((s) => ({
+    ...s,
+    nonce: s.nonce ?? n
+  })), o = {
+    headers: { nonce: n, request: e.request },
+    policy: e.policy.document ?? {},
+    scriptDependencies: !0
+  };
+  return {
+    audit: Se({
+      document: t ? { ...o, scripts: r } : void 0,
+      route: {
+        // A path that matches no route file has no access declaration to
+        // report, so the audit says nothing about its authorization.
+        access: e.kind === "unmatched" ? void 0 : e.policy.access,
+        cors: e.cors,
+        method: e.method,
+        security: e.policy.security
+      }
+    }),
+    // A nonce makes a document unique for each response. The request handler
+    // therefore replaces the cache directives of the application.
+    cacheControl: n ? "private, no-store" : void 0,
+    cacheReads: e.cacheReads,
+    kind: e.kind,
+    metadata: e.metadata,
+    method: e.method,
+    nonce: n,
+    pathname: e.pathname,
+    policy: e.policy,
+    resolutions: cr,
+    route: e.route,
+    scripts: r.map((s) => ({
+      // One audit for each script gives the status of that script alone. The
+      // panel reads the same code path that the complete audit reads.
+      findings: Se({
+        document: { ...o, scripts: [s] }
+      }).findings,
+      integrity: s.integrity,
+      nonce: s.nonce,
+      purpose: s.purpose,
+      src: s.src,
+      strategy: s.strategy
+    })),
+    version: ar
+  };
+}
+function dr(e, t) {
+  try {
+    return Ye(e.routes, t);
+  } catch (n) {
+    if (n instanceof Wt)
+      return null;
+    throw n;
+  }
+}
+function pr(e) {
+  return gt.find((t) => e[t]) ?? "GET";
+}
+function mr(e) {
+  const t = zt();
+  return {
+    get: async (n) => (e.push({
+      key: Ut(n.key),
+      scope: n.scope ?? "request",
+      staleWhileRevalidate: Ae(n.staleWhileRevalidate),
+      tags: (n.tags ?? []).map(Jt),
+      ttl: Ae(n.ttl)
+    }), await t.get(n)),
+    invalidateKey: t.invalidateKey,
+    invalidateTags: t.invalidateTags
+  };
+}
+function Ae(e) {
+  return e === void 0 ? void 0 : String(e);
+}
+function yr(e) {
+  return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Demiurge route audit</title>
+    <style>${hr}</style>
+  </head>
+  <body>
+    <h1>Demiurge route audit</h1>
+    <form method="get" action="${ht}">
+      <label for="path">Path</label>
+      <input id="path" name="path" value="${p(e.pathname)}" />
+      <button type="submit">Audit</button>
+    </form>
+${gr(e)}
+${vr(e.audit.findings)}
+${br(e.audit.headers)}
+${wr(e)}
+${Sr(e.metadata)}
+${$r(e.scripts)}
+${Rr(e)}
+    <p class="footer">
+      The development server serves this panel. A production build and a static
+      export do not contain it.
+    </p>
+  </body>
+</html>
+`;
+}
+const hr = `
+  :root { color-scheme: light dark; }
+  body {
+    font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+    line-height: 1.5;
+    margin: 0 auto;
+    max-width: 60rem;
+    padding: 2rem 1rem;
+  }
+  h1 { font-size: 1.25rem; }
+  h2 { font-size: 1rem; margin-bottom: 0.25rem; }
+  form { display: flex; gap: 0.5rem; margin-bottom: 1.5rem; }
+  input { flex: 1; padding: 0.25rem 0.5rem; }
+  section { border-top: 1px solid currentColor; padding: 0.75rem 0; }
+  table { border-collapse: collapse; width: 100%; }
+  td, th { padding: 0.25rem 0.5rem 0.25rem 0; text-align: left; vertical-align: top; }
+  th { white-space: nowrap; width: 12rem; }
+  ul { margin: 0; padding-left: 1.25rem; }
+  .empty { opacity: 0.7; }
+  .error { font-weight: 700; }
+  .footer { opacity: 0.7; }
+`;
+function gr(e) {
+  if (!e.route)
+    return N(
+      "Route",
+      `<p class="empty">No route matches ${p(e.pathname)}.</p>`
+    );
+  const t = e.route;
+  return N(
+    "Route",
+    V([
+      ["Pathname", p(e.pathname)],
+      ["Pattern", p(t.pattern)],
+      ["File", p(t.file)],
+      ["Kind", p(e.kind)],
+      ["Method", p(e.method)],
+      ["Methods", p(t.methods.join(", "))],
+      ["Render mode", t.render ? p(t.render) : C()],
+      ["Path values", Er(t.params)],
+      ["Route groups", L(t.groups)],
+      ["Layouts", L(t.layouts)],
+      ["Policies", L(t.policies)],
+      ["Middleware", L(t.middlewares)]
+    ])
+  );
+}
+function vr(e) {
+  return e.length === 0 ? N("Findings", '<p class="empty">No findings.</p>') : N(
+    "Findings",
+    `<ul>${e.map(vt).join("")}</ul>`
+  );
+}
+function vt(e) {
+  return `<li${e.severity === "error" ? ' class="error"' : ""}>${p(e.severity)}: ${p(e.message)} <code>${p(e.code)}</code></li>`;
+}
+function br(e) {
+  const t = Object.keys(e).sort();
+  return t.length === 0 ? N(
+    "Response headers",
+    '<p class="empty">The response carries no document header.</p>'
+  ) : N(
+    "Response headers",
+    V(t.map((n) => [n, p(e[n])]))
+  );
+}
+function wr(e) {
+  const t = {
+    cors: e.audit.route?.cors,
+    document: e.policy.document,
+    security: e.policy.security
+  };
+  return N(
+    "Effective policy",
+    `<pre>${p(JSON.stringify(t, null, 2))}</pre>`
+  );
+}
+function Sr(e) {
+  return e ? N(
+    "Metadata",
+    `<pre>${p(JSON.stringify(e, null, 2))}</pre>`
+  ) : N("Metadata", '<p class="empty">No document metadata.</p>');
+}
+function $r(e) {
+  return e.length === 0 ? N("Scripts", '<p class="empty">No contributed scripts.</p>') : N(
+    "Scripts",
+    e.map(
+      (t) => V([
+        ["Source", p(t.src)],
+        ["Strategy", p(t.strategy)],
+        ["Purpose", t.purpose ? p(t.purpose) : C()],
+        ["Integrity", t.integrity ? p(t.integrity) : C()],
+        ["Nonce", t.nonce ? "applied" : C()],
+        [
+          "Policy status",
+          t.findings.length === 0 ? "allowed" : `<ul>${t.findings.map(vt).join("")}</ul>`
+        ]
+      ])
+    ).join("")
+  );
+}
+function Rr(e) {
+  const t = [
+    [
+      "Response cache-control",
+      e.cacheControl ? p(e.cacheControl) : C()
+    ],
+    ["Nonce", e.nonce ? "required" : C()]
+  ];
+  return e.cacheReads.length === 0 ? N(
+    "Cache behavior",
+    `${V(t)}<p class="empty">The request read no cache entry.</p>`
+  ) : N(
+    "Cache behavior",
+    `${V(t)}${e.cacheReads.map(
+      (n) => V([
+        ["Key", p(n.key)],
+        ["Scope", p(n.scope)],
+        ["Time to live", n.ttl ? p(n.ttl) : C()],
+        [
+          "Stale while revalidate",
+          n.staleWhileRevalidate ? p(n.staleWhileRevalidate) : C()
+        ],
+        ["Tags", L(n.tags)]
+      ])
+    ).join("")}`
+  );
+}
+function N(e, t) {
+  return `    <section>
+      <h2>${p(e)}</h2>
+      ${t}
+    </section>`;
+}
+function V(e) {
+  return `<table><tbody>${e.map(
+    ([t, n]) => `<tr><th scope="row">${p(t)}</th><td>${n}</td></tr>`
+  ).join("")}</tbody></table>`;
+}
+function L(e) {
+  return e.length === 0 ? C() : `<ul>${e.map((t) => `<li>${p(t)}</li>`).join("")}</ul>`;
+}
+function Er(e) {
+  return L(
+    Object.entries(e).map(([t, n]) => `${t} = ${String(n)}`)
+  );
+}
+function C() {
+  return '<span class="empty">none</span>';
+}
+function p(e) {
+  return e.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+}
+const re = "virtual:demiurge/client-entry", de = `/@id/${re}`, se = `\0${re}`, bt = "virtual:demiurge/server-entry", Te = `\0${bt}`, Fe = ".demiurge/route-manifest.d.ts";
+function ko(e = {}) {
+  e.locales && (e = { ...e, locales: qt(e.locales) });
+  let t = process.cwd(), n = !1;
+  const r = gn(e.env), o = /* @__PURE__ */ new Map(), i = /* @__PURE__ */ new Set(), s = `demiurge-${ee()}`;
+  return {
+    api: {
+      demiurge: !0,
+      fonts: e.fonts,
+      images: e.images,
+      staticDeployment: e.static?.deployment,
+      staticFileHeaders: e.static?.headers
+    },
+    enforce: "post",
+    name: "demiurge",
+    config(a, c) {
+      return Ar(a, c, s);
+    },
+    configResolved(a) {
+      t = a.root, n = a.command === "build", n || zr(e);
+    },
+    resolveId(a) {
+      return a === re ? se : a === bt ? Te : null;
+    },
+    load(a) {
+      return a === se ? Wr(t, e) : a === Te ? Br(t, e) : null;
+    },
+    transform: {
+      order: "post",
+      handler(a, c, u) {
+        if (u?.ssr || _r(i, n, t, a, c), n && !u?.ssr && Tr(o, r, a, c), !kr(t, e, c))
+          return null;
+        if (u?.ssr)
+          return n ? null : xr(a, c);
+        const l = Or(a);
+        return l === a ? null : { code: l, map: null };
+      }
+    },
+    generateBundle(a, c) {
+      const u = Object.values(c).find(
+        (f) => f.type === "chunk" && f.isEntry && f.facadeModuleId === se
+      );
+      if (!u)
+        return;
+      const l = Object.values(c).filter(
+        (f) => f.type === "asset" && f.fileName.endsWith(".css")
+      ).map((f) => `/${f.fileName}`), d = `/${u.fileName}`;
+      this.emitFile({
+        fileName: "index.html",
+        source: ao({
+          entrySrc: d,
+          lang: e.document?.lang,
+          styles: l,
+          title: e.document?.title
+        }),
+        type: "asset"
+      }), this.emitFile({
+        fileName: "demiurge-manifest.json",
+        source: JSON.stringify({ clientEntry: d, styles: l }, null, 2),
+        type: "asset"
+      });
+    },
+    buildEnd() {
+      const a = Fr({
+        moduleIds: [...this.getModuleIds()],
+        moduleInfo: (u) => this.getModuleInfo(u),
+        references: o,
+        root: t,
+        serverEnvKeys: r
+      });
+      a.length && this.error(bn(a));
+      const c = Lr({
+        markers: i,
+        moduleIds: [...this.getModuleIds()],
+        moduleInfo: (u) => this.getModuleInfo(u),
+        root: t
+      });
+      c.length && this.error(xn(c));
+    },
+    async buildStart() {
+      if (o.clear(), i.clear(), n) {
+        await ro(t, e);
+        const a = await qe(t, e), c = a.filter(
+          (u) => u.severity === "error"
+        );
+        for (const u of a)
+          u.severity !== "error" && this.warn(me(u));
+        if (c.length)
+          throw new Error(yo(c));
+      }
+      e.typedRoutes && await Ue(t, e);
+    },
+    configureServer(a) {
+      const c = async () => {
+        const w = await qe(a.config.root, e);
+        for (const S of w)
+          a.config.logger.warn(me(S));
+      };
+      let u, l = Promise.resolve();
+      const d = () => {
+        l = l.then(c).catch(() => {
+        });
+      }, f = () => {
+        u && clearTimeout(u), u = setTimeout(() => {
+          u = void 0, d();
+        }, fo), u.unref?.();
+      };
+      if (a.httpServer?.once("close", () => {
+        u && (clearTimeout(u), u = void 0);
+      }), d(), e.typedRoutes) {
+        const w = O(
+          a.config.root,
+          e.routesDir ?? "src/routes"
+        ), S = () => {
+          Ue(a.config.root, e).catch(
+            ($) => {
+              a.config.logger.error(
+                $ instanceof Error ? $.message : String($)
+              );
+            }
+          );
+        };
+        S(), a.watcher.add(w), a.watcher.on("add", ($) => {
+          Q(w, $) && (S(), f());
+        }), a.watcher.on("change", ($) => {
+          Q(w, $) && (S(), f());
+        }), a.watcher.on("unlink", ($) => {
+          Q(w, $) && (S(), f());
+        });
+      } else {
+        const w = O(
+          a.config.root,
+          e.routesDir ?? "src/routes"
+        );
+        a.watcher.add(w);
+        for (const S of ["add", "change", "unlink"])
+          a.watcher.on(S, ($) => {
+            Q(w, $) && f();
+          });
+      }
+      const b = Kr(e), R = Gr(a, e), h = Xt({
+        fonts: e.fonts,
+        root: a.config.root
+      });
+      return a.middlewares.use(async (w, S, $) => {
+        try {
+          let x;
+          try {
+            x = $e(w, {
+              // Vite performs its own configured host allowlist check before
+              // Demiurge's middleware runs. Production Node listeners require
+              // an explicit application allowlist instead.
+              allowedHosts: [w.headers.host ?? "localhost"]
+            });
+          } catch (X) {
+            if (X instanceof Re) {
+              Ee(S);
+              return;
+            }
+            throw X;
+          }
+          if (b && ur(x)) {
+            const X = await ae(
+              a,
+              w,
+              O(a.config.root, e.routesDir ?? "src/routes")
+            );
+            await U(
+              S,
+              await lr(X, x)
+            );
+            return;
+          }
+          const B = await h(x);
+          if (B) {
+            await U(S, B);
+            return;
+          }
+          const z = await R(x);
+          if (z) {
+            await U(S, z);
+            return;
+          }
+          const G = O(
+            a.config.root,
+            e.routesDir ?? "src/routes"
+          ), Y = await ae(a, w, G), J = Le(
+            a,
+            s
+          ), oe = await uo(
+            Y,
+            x,
+            Yr(e, J.transform)
+          );
+          if (oe === "next") {
+            $();
+            return;
+          }
+          We(oe, J.nonce), await U(S, oe);
+        } catch (x) {
+          $(x);
+        }
+      }), () => {
+        a.middlewares.use(async (w, S, $) => {
+          try {
+            let x;
+            try {
+              x = $e(w, {
+                allowedHosts: [w.headers.host ?? "localhost"]
+              });
+            } catch (J) {
+              if (J instanceof Re) {
+                Ee(S);
+                return;
+              }
+              throw J;
+            }
+            const B = O(
+              a.config.root,
+              e.routesDir ?? "src/routes"
+            ), z = await ae(a, w, B);
+            no(z, B);
+            const G = Le(
+              a,
+              s
+            ), Y = await Ht(
+              z,
+              x,
+              to(e, G.transform)
+            );
+            We(
+              Y,
+              G.nonce
+            ), await U(S, Y);
+          } catch (x) {
+            $(x);
+          }
+        });
+      };
+    }
+  };
+}
+function xr(e, t) {
+  if (!e.includes("import.meta"))
+    return null;
+  const n = K(e), r = E(n.body).find(
+    (u) => u.type === "ImportDeclaration" && E(u.specifiers).some(
+      (l) => v(l.local)?.type === "Identifier" && v(l.local)?.name === "meta"
+    )
+  ), o = r && E(r.specifiers).find(
+    (u) => v(u.local)?.type === "Identifier" && v(u.local)?.name === "meta"
+  ), i = o && v(o.local);
+  if (!r || !o || !i)
+    return null;
+  let s = "__demiurge_imported_meta__";
+  for (; new RegExp(`\\b${s}\\b`).test(e); )
+    s += "_";
+  const a = new Ot(e), c = v(o.imported);
+  return a.overwrite(
+    i.start,
+    i.end,
+    c?.start === i.start ? `meta as ${s}` : s
+  ), a.appendLeft(r.end, `
+const meta = ${s};`), {
+    code: a.toString(),
+    map: a.generateMap({
+      hires: "boundary",
+      includeContent: !0,
+      source: t
+    })
+  };
+}
+function Or(e) {
+  const t = K(e), n = [], r = Nr(t), o = Pr(t), i = Dr(t), s = [];
+  q(t, (u) => {
+    if (u.type === "ImportDeclaration" && jr(u)) {
+      s.push(u);
+      return;
+    }
+    if (u.type !== "CallExpression" || !Mr(u.callee))
+      return;
+    const l = E(u.arguments)[0];
+    if (l?.type === "ObjectExpression")
+      for (const d of E(l.properties))
+        d.type === "Property" && T(d.key) === "data" && n.push({ end: d.end, start: d.start });
+  });
+  const a = [
+    ...n,
+    ...r,
+    ...o,
+    ...i
+  ];
+  if (a.length === 0)
+    return e;
+  const c = [...a];
+  for (const u of s) {
+    const l = E(u.specifiers).map((b) => v(b.local)).filter((b) => b?.type === "Identifier").map((b) => String(b.name)), d = Ir(e, [
+      ...a,
+      { end: u.end, start: u.start }
+    ]), f = l.find(
+      (b) => new RegExp(`\\b${wt(b)}\\b`).test(d)
+    );
+    if (f)
+      throw new Error(
+        `Server-only import ${JSON.stringify(f)} is used by client route code. Move that use into page data, a document contribution, or a client-safe module.`
+      );
+    c.push({ end: u.end, start: u.start });
+  }
+  return Cr(e, c, (u) => n.includes(u) ? "data: undefined" : r.includes(u) || o.includes(u) ? "undefined" : i.find((l) => l === u)?.replacement ?? "");
+}
+const pe = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+function Pr(e) {
+  const t = [], n = /* @__PURE__ */ new Set();
+  for (const r of E(e.body)) {
+    if (r.type !== "ExportNamedDeclaration") continue;
+    const o = v(r.declaration);
+    if (o?.type === "VariableDeclaration")
+      for (const i of E(o.declarations)) {
+        const s = v(i.id);
+        s?.type === "Identifier" && pe.has(String(s.name)) && n.add(String(s.name));
+      }
+    for (const i of E(r.specifiers)) {
+      const s = T(i.exported), a = T(i.local);
+      s && a && pe.has(s) && n.add(a);
+    }
+  }
+  return q(e, (r) => {
+    if (r.type !== "VariableDeclarator") return;
+    const o = v(r.id), i = v(r.init);
+    o?.type === "Identifier" && n.has(String(o.name)) && i && t.push({ end: i.end, start: i.start });
+  }), t;
+}
+function Dr(e) {
+  const t = [];
+  for (const n of E(e.body)) {
+    if (n.type !== "ExportNamedDeclaration") continue;
+    const r = v(n.source)?.value;
+    if (typeof r != "string") continue;
+    const o = [], i = [];
+    for (const c of E(n.specifiers)) {
+      const u = T(c.exported), l = T(c.local);
+      !u || !l || (pe.has(u) ? i.push(u) : o.push(l === u ? l : `${l} as ${u}`));
+    }
+    if (i.length === 0) continue;
+    const s = o.length > 0 ? `export { ${o.join(", ")} } from ${JSON.stringify(r)};
+` : "", a = i.map((c) => `export const ${c} = undefined;`).join(`
+`);
+    t.push({
+      end: n.end,
+      replacement: `${s}${a}`,
+      start: n.start
+    });
+  }
+  return t;
+}
+const _e = /* @__PURE__ */ new Set(["links", "metadata", "scripts"]);
+function Nr(e) {
+  const t = /* @__PURE__ */ new Set();
+  for (const r of E(e.body)) {
+    if (r.type !== "ExportNamedDeclaration") continue;
+    const o = v(r.declaration);
+    if (o?.type === "VariableDeclaration")
+      for (const i of E(o.declarations)) {
+        const s = v(i.id);
+        s?.type === "Identifier" && _e.has(String(s.name)) && t.add(String(s.name));
+      }
+    for (const i of E(r.specifiers)) {
+      const s = T(i.exported), a = T(i.local);
+      s && a && _e.has(s) && t.add(a);
+    }
+  }
+  const n = [];
+  return q(e, (r) => {
+    if (r.type !== "VariableDeclarator") return;
+    const o = v(r.id), i = v(r.init);
+    o?.type === "Identifier" && t.has(String(o.name)) && i && n.push({ end: i.end, start: i.start });
+  }), n;
+}
+function kr(e, t, n) {
+  const r = n.split("?", 1)[0] ?? n, o = O(e, t.routesDir ?? "src/routes"), i = I(o, r);
+  return i !== "" && i !== ".." && !i.startsWith(`..${A}`);
+}
+function q(e, t) {
+  if (!e || typeof e != "object") return;
+  if (Array.isArray(e)) {
+    for (const r of e) q(r, t);
+    return;
+  }
+  const n = e;
+  if (typeof n.type == "string") {
+    t(n);
+    for (const [r, o] of Object.entries(n))
+      (/* @__PURE__ */ new Set(["end", "loc", "start", "type"])).has(r) || q(o, t);
+  }
+}
+function v(e) {
+  return e && typeof e == "object" && "type" in e ? e : void 0;
+}
+function E(e) {
+  return Array.isArray(e) ? e.map(v).filter((t) => !!t) : [];
+}
+function Mr(e) {
+  const t = v(e);
+  return t?.type === "Identifier" ? t.name === "page" : t?.type === "MemberExpression" && T(t.property) === "page";
+}
+function T(e) {
+  const t = v(e);
+  return t?.type === "Identifier" || t?.type === "Literal" ? String(t.name ?? t.value) : void 0;
+}
+function jr(e) {
+  const t = v(e.source)?.value;
+  return typeof t == "string" && /(?:^|[/.-])server(?:[/.-]|$)/.test(t);
+}
+function Ir(e, t) {
+  const n = [...e];
+  for (const { end: r, start: o } of t)
+    n.fill(" ", o, r);
+  return n.join("");
+}
+function Cr(e, t, n) {
+  return [...t].sort((r, o) => o.start - r.start).reduce(
+    (r, o) => `${r.slice(0, o.start)}${n(o)}${r.slice(o.end)}`,
+    e
+  );
+}
+function wt(e) {
+  return e.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function Ar(e, t, n) {
+  return {
+    appType: "custom",
+    build: {
+      assetsInlineLimit: e.build?.assetsInlineLimit ?? 0,
+      ...t.isSsrBuild && e.build?.target === void 0 && e.ssr?.target !== "webworker" ? { target: "node22.13" } : {},
+      rollupOptions: {
+        input: e.build?.rollupOptions?.input ?? re
+      }
+    },
+    ...t.command === "serve" ? {
+      html: { cspNonce: n },
+      ssr: { external: [F] }
+    } : {}
+  };
+}
+function Tr(e, t, n, r) {
+  if (!t.size || r.includes("/node_modules/") || r.startsWith("\0")) return;
+  const o = vn(n, t.keys());
+  o.length && e.set(r, o);
+}
+function Fr(e) {
+  const { moduleIds: t, moduleInfo: n, references: r, root: o, serverEnvKeys: i } = e;
+  if (!r.size) return [];
+  const s = t.filter((u) => n(u)?.isEntry), a = (u) => {
+    const l = n(u);
+    return l ? [...l.importedIds, ...l.dynamicallyImportedIds] : [];
+  }, c = [];
+  for (const u of [...r.keys()].sort()) {
+    const d = s.map((f) => Qe(f, u, a)).filter((f) => !!f).sort((f, b) => f.length - b.length)[0];
+    if (d)
+      for (const f of r.get(u) ?? [])
+        c.push({
+          code: i.get(f)?.sensitive ? "client-secret" : "client-server-only",
+          importPath: d.map((b) => H(o, b)),
+          key: f,
+          module: H(o, u)
+        });
+  }
+  return c;
+}
+function H(e, t) {
+  const n = t.startsWith("\0") ? t.slice(1) : t;
+  return n.startsWith(e) && I(e, n) || n;
+}
+function _r(e, t, n, r, o) {
+  if (!(o.includes("/node_modules/") || o.startsWith("\0")) && En(r)) {
+    if (t) {
+      e.add(o);
+      return;
+    }
+    throw new Error(On(H(n, o)));
+  }
+}
+function Lr(e) {
+  const { markers: t, moduleIds: n, moduleInfo: r, root: o } = e;
+  if (!t.size) return [];
+  const i = n.filter((c) => r(c)?.isEntry), s = (c) => {
+    const u = r(c);
+    return u ? [...u.importedIds, ...u.dynamicallyImportedIds] : [];
+  }, a = [];
+  for (const c of [...t].sort()) {
+    const l = i.map((d) => Qe(d, c, s)).filter((d) => !!d).sort((d, f) => d.length - f.length)[0];
+    l && a.push({
+      importPath: l.map((d) => H(o, d)),
+      module: H(o, c)
+    });
+  }
+  return a;
+}
+function Vr(e = {}, t = process.env) {
+  const n = Object.entries(e.env ?? {}).filter(([, a]) => a.client);
+  if (!n.length) return "";
+  const r = n.filter(
+    ([a, c]) => !c.optional && !t[a]
+  );
+  if (r.length)
+    throw new Error(
+      [
+        "Demiurge stopped the build. The environment of the build does not have a required client variable.",
+        ...r.map(([a]) => `  variable: ${a}`),
+        "  The build inlines the value of a client variable. Give the value to the build."
+      ].join(`
+`)
+    );
+  const o = n.filter(([a]) => t[a] !== void 0).flatMap(([a, c]) => {
+    const u = t[a];
+    try {
+      return c.parse(a, u), [];
+    } catch (l) {
+      return [{
+        key: a,
+        message: l instanceof Error ? l.message : `Environment variable ${a} is invalid.`
+      }];
+    }
+  });
+  if (o.length)
+    throw new Error(
+      [
+        "Demiurge stopped the build. The environment of the build has an invalid client variable.",
+        ...o.map(({ key: a, message: c }) => `  variable: ${a}
+  ${c}`)
+      ].join(`
+`)
+    );
+  const i = Xe(Object.fromEntries(n)), s = Object.fromEntries(
+    n.map(([a]) => [a, t[a]]).filter(([, a]) => a !== void 0)
+  );
+  return `
+// The build put these values in the browser bundle. The schema declares each
+// one as a client variable.
+unstable_startEnvironment(${JSON.stringify(i)}, { source: ${JSON.stringify(s)} });
+`;
+}
+function Wr(e, t = {}, n = process.env) {
+  const r = t.routesDir ?? "src/routes", o = Hr(e, t), i = Vr(t, n);
+  return `import { hydrateFileRouter${i ? ", unstable_startEnvironment" : ""} } from "${F}";
+${o}
+${i}
+${St(r, {
+    exportRoutes: !1,
+    includeServerOnly: !1
+  })}
+
+void hydrateFileRouter({ routes${t.locales ? `, locales: ${JSON.stringify(t.locales)}` : ""} });
+`;
+}
+function Br(e, t = {}) {
+  const n = t.routesDir ?? "src/routes", r = !!(t.env && Object.keys(t.env).length), o = r ? ", unstable_startEnvironment" : "", i = r ? `
+// The framework validates the declared environment before the server accepts
+// traffic. A required variable that is absent or invalid stops the start. A
+// deferred variable validates on its first server access.
+export const env = unstable_startEnvironment(${JSON.stringify(Xe(t.env ?? {}))}).values;
+` : "";
+  return `import { createRequestHandler${o} } from "${F}";
+${i}
+${St(n, {
+    exportRoutes: !0,
+    includeServerOnly: !0,
+    eagerModules: !0
+  })}
+
+export function createHandler(options = {}) {
+  const { clientEntry, lang, locales, styles, title, ...handlerOptions } = options;
+
+  return createRequestHandler({
+    ...handlerOptions,
+    routes,
+    routeModules,
+    locales: locales ?? ${JSON.stringify(t.locales)},
+    ssr: {
+      clientEntry,
+      lang: lang ?? ${JSON.stringify(t.document?.lang)},
+      styles,
+      title: title ?? ${JSON.stringify(t.document?.title)},
+    },
+  });
+}
+`;
+}
+function zr(e) {
+  !e.env || !Object.keys(e.env).length || Yt(e.env);
+}
+function St(e, {
+  exportRoutes: t,
+  eagerModules: n = !1,
+  includeServerOnly: r
+}) {
+  const o = Ur(e, r), i = qr(e);
+  return n ? `const eagerRouteModules = import.meta.glob(${JSON.stringify(o)}, { eager: true });
+const routePrefix = ${JSON.stringify(i)};
+export const routeModules = Object.fromEntries(
+  Object.entries(eagerRouteModules).map(([file, module]) => [
+    \`./routes/\${file.slice(routePrefix.length)}\`,
+    module,
+  ]),
+);
+${t ? "export " : ""}const routes = Object.fromEntries(
+  Object.entries(routeModules).map(([file, module]) => [
+    file,
+    async () => module,
+  ]),
+);` : `const routeModules = import.meta.glob(${JSON.stringify(o)});
+const routePrefix = ${JSON.stringify(i)};
+${t ? "export " : ""}const routes = Object.fromEntries(
+  Object.entries(routeModules).map(([file, load]) => [
+    \`./routes/\${file.slice(routePrefix.length)}\`,
+    load,
+  ]),
+);`;
+}
+const Jr = ["@middleware.ts", "@policy.ts"];
+function Ur(e, t) {
+  const n = `/${e.replace(/^\/|\/$/g, "")}`, r = [`${n}/**/*.{ts,tsx}`];
+  return t || r.push(
+    ...Jr.flatMap((o) => [
+      `!${n}/${o}`,
+      `!${n}/**/${o}`
+    ])
+  ), r;
+}
+function qr(e) {
+  return `/${e.replace(/^\/|\/$/g, "")}/`;
+}
+function Hr(e, t) {
+  if (t.styles === !1)
+    return "";
+  const n = t.styles ?? "src/styles.css", r = O(e, n);
+  return ye(r) ? `import ${JSON.stringify(`/${n.replace(/^\/+/, "")}`)};` : "";
+}
+function Kr(e) {
+  return e.devtools !== !1 && process.env.NODE_ENV !== "production";
+}
+function Gr(e, t) {
+  const n = e.config.publicDir, r = t.images?.optimizerPath ?? "/_demiurge/image";
+  return n ? Zt({
+    policy: t.images,
+    resolveVariant: (o) => en(o, r),
+    root: n
+  }) : async () => null;
+}
+function Yr(e, t) {
+  return {
+    dev: !0,
+    ssr: Rt(e),
+    transformDocument: t,
+    renderPage: async (n, r) => {
+      if (n.render.mode === "streaming")
+        return await Qt(n, {
+          ...r,
+          clientEntry: de,
+          transformDocument: t
+        });
+      const o = await t(
+        Nt(n, {
+          ...r,
+          clientEntry: de
+        })
+      );
+      return new Response(o, {
+        headers: { "content-type": "text/html; charset=utf-8" }
+      });
+    }
+  };
+}
+function Le(e, t) {
+  const n = ee(), r = ee();
+  return {
+    nonce: n,
+    transform: async (o) => {
+      const i = Xr(o, r), s = await e.transformIndexHtml("/", i);
+      return Ve(
+        Ve(s, r),
+        t,
+        n
+      );
+    }
+  };
+}
+function Xr(e, t) {
+  const n = e.toLowerCase();
+  let r = 0, o = "";
+  for (; r < e.length; ) {
+    const i = e.indexOf("<", r);
+    if (i === -1)
+      return o + e.slice(r);
+    if (o += e.slice(r, i), n.startsWith("<!--", i)) {
+      const u = n.indexOf("-->", i + 4), l = u === -1 ? e.length : u + 3;
+      o += e.slice(i, l), r = l;
+      continue;
+    }
+    const s = n.slice(i).match(/^<\s*(script|style|link)\b/)?.[1];
+    if (!s) {
+      o += "<", r = i + 1;
+      continue;
+    }
+    const a = Zr(e, i);
+    if (a === -1)
+      return o + e.slice(i);
+    const c = e.slice(i, a + 1);
+    if (o += /(?:^|\s)nonce(?:\s|=|>)/i.test(c) ? c : Qr(c, t), r = a + 1, s === "script" || s === "style") {
+      const u = n.indexOf(`</${s}`, r);
+      if (u === -1)
+        return o + e.slice(r);
+      o += e.slice(r, u), r = u;
+    }
+  }
+  return o;
+}
+function Zr(e, t) {
+  let n;
+  for (let r = t + 1; r < e.length; r++) {
+    const o = e[r];
+    if (n) {
+      o === n && (n = void 0);
+      continue;
+    }
+    if (o === '"' || o === "'")
+      n = o;
+    else if (o === ">")
+      return r;
+  }
+  return -1;
+}
+function Qr(e, t) {
+  const n = /\/\s*>$/.test(e) ? e.lastIndexOf("/") : e.length - 1;
+  return `${e.slice(0, n)} nonce="${t}"${e.slice(n)}`;
+}
+function Ve(e, t, n) {
+  const r = new RegExp(
+    `(\\snonce\\s*=\\s*)(["'])${wt(t)}\\2`,
+    "g"
+  );
+  return e.replace(
+    r,
+    n ? `$1"${n}"` : ""
+  );
+}
+function We(e, t) {
+  const n = e.headers.get("content-type"), r = e.headers.get("content-security-policy");
+  if (!n?.toLowerCase().startsWith("text/html") || !r)
+    return;
+  const o = `'nonce-${t}'`, i = Be(
+    r,
+    ["script-src-elem", "script-src"],
+    "script-src",
+    o
+  ), s = eo(
+    i,
+    ["style-src-elem", "style-src"]
+  ) ? i : Be(
+    i,
+    ["style-src-elem", "style-src"],
+    "style-src",
+    o
+  );
+  e.headers.set("content-security-policy", s), e.headers.set("cache-control", "private, no-store");
+}
+function Be(e, t, n, r) {
+  const o = e.split(";").map((l) => l.trim()), i = $t(o, t), s = o.find(
+    (l) => l.split(/\s+/, 1)[0]?.toLowerCase() === "default-src"
+  );
+  if (i === -1 && !s) return e;
+  const [a, ...c] = (i === -1 ? s : o[i]).split(/\s+/), u = [
+    i === -1 ? n : a,
+    .../* @__PURE__ */ new Set([
+      ...c.filter((l) => l !== "'none'"),
+      r
+    ])
+  ].join(" ");
+  return i === -1 ? o.push(u) : o[i] = u, o.join("; ");
+}
+function eo(e, t) {
+  const n = e.split(";").map((s) => s.trim()), r = $t(n, t), i = (r === -1 ? n.find(
+    (s) => s.split(/\s+/, 1)[0]?.toLowerCase() === "default-src"
+  ) : n[r])?.split(/\s+/).slice(1) ?? [];
+  return i.includes("'unsafe-inline'") && !i.some((s) => /^'(?:nonce-|sha(?:256|384|512)-)/i.test(s));
+}
+function $t(e, t) {
+  for (const n of t) {
+    const r = e.findIndex(
+      (o) => o.split(/\s+/, 1)[0]?.toLowerCase() === n
+    );
+    if (r !== -1) return r;
+  }
+  return -1;
+}
+const ze = Symbol.for("demiurge.devManifest");
+async function ae(e, t, n) {
+  const r = t, o = r[ze];
+  if (o)
+    return o;
+  const i = Gt(
+    await co(e, n)
+  );
+  return r[ze] = i, i;
+}
+function Rt(e) {
+  return {
+    clientEntry: de,
+    lang: e.document?.lang,
+    title: e.document?.title
+  };
+}
+function to(e, t) {
+  return {
+    ...Rt(e),
+    dev: !0,
+    transformDocument: t
+  };
+}
+const Je = /* @__PURE__ */ new Set();
+function no(e, t) {
+  Je.has(t) || e.fallbacks.notFound.some(
+    (n) => n.fileSegments.length === 0
+  ) || (Je.add(t), console.warn(so(Ge(t, "@not-found.tsx"))));
+}
+async function ro(e, t = {}) {
+  const n = t.routesDir ?? "src/routes", r = O(e, n);
+  if (!ye(r))
+    return;
+  const o = await ve(r);
+  if (o.map(
+    (a) => I(r, a).split(A).join("/")
+  ).some((a) => /^@not-found\.tsx?$/.test(a)))
+    return;
+  const s = await oo(o);
+  if (s)
+    throw new Error(
+      io(
+        n,
+        I(r, s).split(A).join("/")
+      )
+    );
+}
+async function oo(e) {
+  for (const t of e)
+    if (!I(M(t), t).startsWith("@") && ot(await Ke(t, "utf8")))
+      return t;
+}
+function io(e, t) {
+  return `Demiurge will not build an app with page routes and no ${e}/@not-found.tsx.
+
+"${t}" declares a page, so a browser can reach a path this app does not serve. Decide what that looks like rather than shipping the framework built-in.
+
+Create ${e}/@not-found.tsx:
+
+  export default function NotFound({ pathname }: { pathname: string }) {
+    return <h1>Nothing at {pathname}</h1>;
+  }
+
+It renders inside the layouts above the requested path. Opt out with "export const layout = false".`;
+}
+function so(e) {
+  return `Demiurge is serving its built-in 404 because ${e} does not exist.
+
+Create it before building for production:
+
+  export default function NotFound({ pathname }: { pathname: string }) {
+    return <h1>Nothing at {pathname}</h1>;
+  }
+`;
+}
+function ao({
+  entrySrc: e,
+  lang: t,
+  links: n,
+  metadata: r,
+  nonce: o,
+  scripts: i,
+  styles: s,
+  title: a
+}) {
+  return Dt({
+    entrySrc: e,
+    lang: t,
+    links: n,
+    metadata: r,
+    nonce: o,
+    scripts: i,
+    styles: s,
+    title: a
+  });
+}
+async function Ue(e, t) {
+  const n = O(e, t.routesDir ?? "src/routes"), r = O(
+    e,
+    typeof t.typedRoutes == "object" ? t.typedRoutes.outputFile ?? Fe : Fe
+  );
+  await tn({
+    outputFile: r,
+    routesDir: n,
+    locales: t.locales?.supportedLocales,
+    localeNamespaces: [
+      ...Object.values(t.locales?.path?.labels ?? {}),
+      ...Object.keys(t.locales?.aliases ?? {}),
+      ...t.locales?.path?.reserved ?? []
+    ]
+  });
+}
+function Q(e, t) {
+  return t.startsWith(e) && /\.tsx?$/.test(t);
+}
+async function co(e, t) {
+  const n = await ve(t), r = {};
+  for (const o of n) {
+    const i = ho(t, o);
+    r[i] = async () => await e.ssrLoadModule(o);
+  }
+  return r;
+}
+async function uo(e, t, n = {}) {
+  const r = new URL(t.url);
+  return Ye(e.routes, r.pathname) ? await Kt(e, t, n) : "next";
+}
+async function ve(e) {
+  return (await He(e, {
+    recursive: !0,
+    withFileTypes: !0
+  })).filter((n) => n.isFile() && /\.tsx?$/.test(n.name)).map((n) => O(n.parentPath, n.name));
+}
+const lo = 8, fo = 50;
+async function po(e, t, n) {
+  const r = new Array(e.length);
+  let o = 0;
+  const i = Array.from(
+    { length: Math.min(t, e.length) },
+    async () => {
+      for (; o < e.length; ) {
+        const s = o++;
+        r[s] = await n(e[s]);
+      }
+    }
+  );
+  return await Promise.all(i), r;
+}
+async function mo(e, t = {}) {
+  const n = O(e, t.routesDir ?? "src/routes");
+  if (!ye(n))
+    return { findings: [], inspections: [], routesDir: n };
+  const r = await po(
+    await ve(n),
+    lo,
+    jn
+  ), o = [
+    ...r.flatMap((i) => i.findings),
+    ...In(n, r),
+    ...Cn(n, r)
+  ];
+  return o.sort(
+    (i, s) => i.file.localeCompare(s.file) || (i.exportName ?? "").localeCompare(s.exportName ?? "") || i.code.localeCompare(s.code)
+  ), { findings: o, inspections: r, routesDir: n };
+}
+async function qe(e, t = {}) {
+  return (await mo(e, t)).findings;
+}
+function yo(e) {
+  return [
+    "Demiurge found invalid static route policy:",
+    ...e.map(me)
+  ].join(`
+`);
+}
+function me(e) {
+  return `${e.exportName ? `${e.file} export ${e.exportName}` : e.file}: [${e.code}] ${e.message}`;
+}
+function ho(e, t) {
+  return `./routes/${I(e, t).split(A).join("/")}`;
+}
+export {
+  No as A,
+  tr as B,
+  ht as R,
+  ar as a,
+  ro as b,
+  Cn as c,
+  Wr as d,
+  Vr as e,
+  co as f,
+  ao as g,
+  fr as h,
+  Br as i,
+  ot as j,
+  ko as k,
+  Qe as l,
+  vn as m,
+  gn as n,
+  bn as o,
+  xn as p,
+  On as q,
+  yo as r,
+  uo as s,
+  En as t,
+  jn as u,
+  mo as v,
+  Kr as w,
+  yr as x,
+  Or as y,
+  qe as z
+};
+//# sourceMappingURL=plugin-BZauDxRY.js.map