@docubook/flame 2.0.0-beta.1 → 2.0.0-beta.2

package/.docu/lib/utils-DA17MyQG.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils-DA17MyQG.js","names":[],"sources":["../node/security.ts","../node/utils.ts"],"sourcesContent":["import { randomBytes } from \"node:crypto\";\nimport { resolve } from \"node:path\";\nimport { realpathSync } from \"node:fs\";\n\nexport const SECURITY_HEADERS: Record<string, string> = {\n  \"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\",\n  \"X-Frame-Options\": \"DENY\",\n  \"X-Content-Type-Options\": \"nosniff\",\n  \"Referrer-Policy\": \"strict-origin-when-cross-origin\",\n  \"Permissions-Policy\": \"camera=(), microphone=(), geolocation=()\",\n};\n\nexport function generateNonce(): string {\n  return randomBytes(16).toString(\"base64\");\n}\n\nexport function cspHeader(nonce: string, allowEval = false): string {\n  const scriptSrc = allowEval\n    ? `script-src 'self' 'nonce-${nonce}' 'unsafe-eval'`\n    : `script-src 'self' 'nonce-${nonce}'`;\n  return [\n    \"default-src 'self'\",\n    scriptSrc,\n    \"style-src 'self' 'unsafe-inline'\",\n    \"img-src 'self' https: data:\",\n    \"font-src 'self' data:\",\n    \"connect-src 'self' https:\",\n    \"frame-src https://www.youtube-nocookie.com\",\n    \"frame-ancestors 'none'\",\n  ].join(\"; \");\n}\n\nexport function isPathSafe(pathname: string, baseDir: string): boolean {\n  const decoded = decodeURIComponent(pathname);\n  const resolved = resolve(baseDir, decoded.slice(1));\n  const baseDirSlash = baseDir.endsWith(\"/\") ? baseDir : baseDir + \"/\";\n  if (!(resolved === baseDir || resolved.startsWith(baseDirSlash))) {\n    return false;\n  }\n\n  if (resolved === baseDir) return true;\n  try {\n    const real = realpathSync(resolved);\n    const realBase = realpathSync(baseDir);\n    const realBaseDirSlash = realBase.endsWith(\"/\") ? realBase : realBase + \"/\";\n    return real.startsWith(realBaseDirSlash);\n  } catch (err) {\n    const nodeErr = err as NodeJS.ErrnoException;\n    if (nodeErr.code === \"ENOENT\") {\n      return true;\n    }\n    console.error(\n      `[security] isPathSafe error for pathname=\"${pathname}\": ${nodeErr.message} (code=${nodeErr.code})`\n    );\n    return false;\n  }\n}\n\nexport function isSlugSafe(slug: string, docsDir: string): boolean {\n  const resolved = resolve(docsDir, slug);\n  const docsDirSlash = docsDir.endsWith(\"/\") ? docsDir : docsDir + \"/\";\n  if (!(resolved === docsDir || resolved.startsWith(docsDirSlash))) {\n    return false;\n  }\n\n  if (resolved === docsDir) return true;\n  try {\n    const real = realpathSync(resolved);\n    const realDocsDir = realpathSync(docsDir);\n    const realDocsDirSlash = realDocsDir.endsWith(\"/\") ? realDocsDir : realDocsDir + \"/\";\n    return real.startsWith(realDocsDirSlash);\n  } catch (err) {\n    const nodeErr = err as NodeJS.ErrnoException;\n    if (nodeErr.code === \"ENOENT\") {\n      return true;\n    }\n    console.error(\n      `[security] isSlugSafe error for slug=\"${slug}\": ${nodeErr.message} (code=${nodeErr.code})`\n    );\n    return false;\n  }\n}\n\n/** Normalize an esbuild importer path to a canonical forward-slash absolute form. */\nexport function normalizeImporterPath(importer: string): string {\n  return resolve(importer).replace(/\\\\/g, \"/\");\n}\n\nexport function injectNonce(html: string, nonce: string): string {\n  return html.replace(/<script\\b(?![^>]*\\bsrc\\s*=)([^>]*)>/gi, (match) => {\n    if (/nonce\\s*=/i.test(match)) {\n      return match.replace(/nonce=\"[^\"]*\"/i, `nonce=\"${nonce}\"`);\n    }\n    return match.replace(/>$/, ` nonce=\"${nonce}\">`);\n  });\n}\n\nexport interface PluginResponseLike {\n  status: number;\n  statusText?: string;\n  headers: Headers;\n  body: BodyInit | null;\n}\n\n/**\n * Wrap a plugin response with security headers.\n * - Fills in SECURITY_HEADERS defaults where plugin hasn't set a value\n * - Adds Content-Security-Policy for HTML responses (with optional unsafe-eval)\n * - Preserves plugin body, status, statusText unchanged\n */\nexport function wrapPluginResponse(\n  pluginResponse: PluginResponseLike,\n  allowEval = false\n): Response {\n  const securedHeaders = new Headers(pluginResponse.headers);\n  for (const [key, value] of Object.entries(SECURITY_HEADERS)) {\n    if (!securedHeaders.has(key)) {\n      securedHeaders.set(key, value);\n    }\n  }\n  let body = pluginResponse.body;\n  const contentType = securedHeaders.get(\"Content-Type\") || \"\";\n  if (contentType.includes(\"text/html\") && !securedHeaders.has(\"Content-Security-Policy\")) {\n    const nonce = generateNonce();\n    securedHeaders.set(\"Content-Security-Policy\", cspHeader(nonce, allowEval));\n    if (typeof body === \"string\") {\n      body = injectNonce(body, nonce);\n    }\n  }\n  return new Response(body, {\n    status: pluginResponse.status,\n    statusText: pluginResponse.statusText,\n    headers: securedHeaders,\n  });\n}\n\nexport function htmlResponse(\n  html: string,\n  nonce: string,\n  status = 200,\n  allowEval = false\n): Response {\n  return new Response(html, {\n    status,\n    headers: {\n      \"Content-Type\": \"text/html\",\n      ...SECURITY_HEADERS,\n      \"Content-Security-Policy\": cspHeader(nonce, allowEval),\n    },\n  });\n}\n","export { cn, parseDate, formatDate, formatDate2 } from \"@docubook/core\";\n\nimport { readdir, stat } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nexport interface ScannedMdxFile {\n  path: string;\n  absPath: string;\n  mtime: number;\n}\n\n/**\n * Scan a directory recursively for MDX/MD files.\n * Skips \"assets\" directories, hidden directories (dot-prefixed), and root-level index.mdx.\n * Shared between build.ts and search-indexer.ts.\n */\nexport async function scanMdxFiles(dir: string, baseDir = \"\"): Promise<ScannedMdxFile[]> {\n  const files: ScannedMdxFile[] = [];\n  const entries = await readdir(dir, { withFileTypes: true });\n\n  for (const entry of entries) {\n    const fullPath = join(dir, entry.name);\n    const relativePath = baseDir ? `${baseDir}/${entry.name}` : entry.name;\n\n    if (entry.isDirectory()) {\n      if (entry.name === \"assets\" || entry.name.startsWith(\".\")) continue;\n      files.push(...(await scanMdxFiles(fullPath, relativePath)));\n    } else if (entry.name.endsWith(\".mdx\") || entry.name.endsWith(\".md\")) {\n      if (entry.name === \"index.mdx\" && !baseDir) continue;\n      const stats = await stat(fullPath);\n      let path = relativePath.replace(/\\.(mdx|md)$/, \"\");\n\n      if (/\\/index$/.test(path)) {\n        path = path.replace(/\\/index$/, \"\");\n      }\n      files.push({ path, absPath: fullPath, mtime: stats.mtimeMs });\n    }\n  }\n\n  return files;\n}\n\nexport function isExternalUrl(url: string): boolean {\n  return /^(https?:\\/\\/|\\/\\/)/.test(url);\n}\n\n/** Suffix an internal docs link with `.html` to match the flat static build output. */\nexport function docsHtmlHref(path: string): string {\n  return `${path}.html`;\n}\n\n/** Map a `/docs{.html,/*.html}` request back to its extensionless route (dev server).\n *  Handles both `/docs/*.html` (pages) and `/docs.html` (edge case). */\nexport function stripDocsHtmlSuffix(pathname: string): string {\n  if (pathname === \"/docs.html\") return \"/docs\";\n  if (pathname.startsWith(\"/docs/\") && pathname.endsWith(\".html\"))\n    return pathname.slice(0, -\".html\".length);\n  return pathname;\n}\n\nexport function getPath(url: string): string {\n  try {\n    return new URL(url).pathname;\n  } catch (err) {\n    console.error(\"Failed to parse URL\", url, err);\n    return url;\n  }\n}\n\n/** Get git last modified date for a file */\nexport async function getGitLastModified(filePath: string): Promise<string | null> {\n  try {\n    const cleanPath = filePath.replace(/^\\//, \"\");\n    if (\n      !cleanPath ||\n      !/^[a-zA-Z0-9\\-_/.\\s]+$/.test(cleanPath) ||\n      /(^|\\/)\\.\\.($|\\/)/.test(cleanPath)\n    )\n      return null;\n    const proc = Bun.spawn([\"git\", \"log\", \"-1\", \"--format=%cI\", \"--\", cleanPath], {\n      stderr: \"ignore\",\n    });\n    const text = await new Response(proc.stdout).text();\n    const date = text.trim();\n    return date || null;\n  } catch (err) {\n    console.error(\"Failed to get git last modified for\", filePath, err);\n    return null;\n  }\n}\n\n/** Batch git last modified dates for multiple files in a single spawn */\nexport async function getGitLastModifiedBatch(filePaths: string[]): Promise<Map<string, string>> {\n  const result = new Map<string, string>();\n  if (filePaths.length === 0) return result;\n\n  // Filter and validate paths — same guard as getGitLastModified\n  const safePaths: string[] = [];\n  for (const fp of filePaths) {\n    const cleanPath = fp.replace(/^\\//, \"\");\n    if (\n      !cleanPath ||\n      !/^[a-zA-Z0-9\\-_/.\\s]+$/.test(cleanPath) ||\n      /(^|\\/)\\.\\.($|\\/)/.test(cleanPath)\n    ) {\n      console.warn(`[utils] getGitLastModifiedBatch: skipping invalid path \"${fp}\"`);\n      continue;\n    }\n    safePaths.push(cleanPath);\n  }\n\n  if (safePaths.length === 0) return result;\n\n  try {\n    const proc = Bun.spawn(\n      [\"git\", \"log\", \"--format=%cI\", \"--name-only\", \"--diff-filter=ACMR\", ...safePaths],\n      { stderr: \"ignore\" }\n    );\n    const text = await new Response(proc.stdout).text();\n    let currentDate = \"\";\n\n    for (const line of text.split(\"\\n\")) {\n      const trimmed = line.trim();\n      if (!trimmed) continue;\n      if (/^\\d{4}-\\d{2}-\\d{2}T/.test(trimmed)) {\n        currentDate = trimmed;\n      } else if (currentDate && !result.has(trimmed)) {\n        result.set(trimmed, currentDate);\n      }\n    }\n  } catch (err) {\n    console.error(\"Failed to get git last modified batch for\", filePaths, err);\n  }\n\n  return result;\n}\n\nconst MIME_TYPES: Record<string, string> = {\n  html: \"text/html\",\n  css: \"text/css\",\n  js: \"application/javascript\",\n  json: \"application/json\",\n  png: \"image/png\",\n  jpg: \"image/jpeg\",\n  jpeg: \"image/jpeg\",\n  svg: \"image/svg+xml\",\n  ico: \"image/x-icon\",\n  woff: \"font/woff\",\n  woff2: \"font/woff2\",\n};\n\nexport function getContentType(pathname: string): string {\n  const ext = pathname.split(\".\").pop()?.toLowerCase();\n  return MIME_TYPES[ext || \"\"] || \"application/octet-stream\";\n}\n"],"mappings":";;;;;;AAIA,IAAa,mBAA2C;CACtD,6BAA6B;CAC7B,mBAAmB;CACnB,0BAA0B;CAC1B,mBAAmB;CACnB,sBAAsB;AACxB;AAEA,SAAgB,gBAAwB;CACtC,OAAO,YAAY,EAAE,CAAC,CAAC,SAAS,QAAQ;AAC1C;AAEA,SAAgB,UAAU,OAAe,YAAY,OAAe;CAIlE,OAAO;EACL;EAJgB,YACd,4BAA4B,MAAM,mBAClC,4BAA4B,MAAM;EAIpC;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,KAAK,IAAI;AACb;AAEA,SAAgB,WAAW,UAAkB,SAA0B;CAErE,MAAM,WAAW,QAAQ,SADT,mBAAmB,QACD,CAAA,CAAQ,MAAM,CAAC,CAAC;CAClD,MAAM,eAAe,QAAQ,SAAS,GAAG,IAAI,UAAU,UAAU;CACjE,IAAI,EAAE,aAAa,WAAW,SAAS,WAAW,YAAY,IAC5D,OAAO;CAGT,IAAI,aAAa,SAAS,OAAO;CACjC,IAAI;EACF,MAAM,OAAO,aAAa,QAAQ;EAClC,MAAM,WAAW,aAAa,OAAO;EACrC,MAAM,mBAAmB,SAAS,SAAS,GAAG,IAAI,WAAW,WAAW;EACxE,OAAO,KAAK,WAAW,gBAAgB;CACzC,SAAS,KAAK;EACZ,MAAM,UAAU;EAChB,IAAI,QAAQ,SAAS,UACnB,OAAO;EAET,QAAQ,MACN,6CAA6C,SAAS,KAAK,QAAQ,QAAQ,SAAS,QAAQ,KAAK,EACnG;EACA,OAAO;CACT;AACF;AAEA,SAAgB,WAAW,MAAc,SAA0B;CACjE,MAAM,WAAW,QAAQ,SAAS,IAAI;CACtC,MAAM,eAAe,QAAQ,SAAS,GAAG,IAAI,UAAU,UAAU;CACjE,IAAI,EAAE,aAAa,WAAW,SAAS,WAAW,YAAY,IAC5D,OAAO;CAGT,IAAI,aAAa,SAAS,OAAO;CACjC,IAAI;EACF,MAAM,OAAO,aAAa,QAAQ;EAClC,MAAM,cAAc,aAAa,OAAO;EACxC,MAAM,mBAAmB,YAAY,SAAS,GAAG,IAAI,cAAc,cAAc;EACjF,OAAO,KAAK,WAAW,gBAAgB;CACzC,SAAS,KAAK;EACZ,MAAM,UAAU;EAChB,IAAI,QAAQ,SAAS,UACnB,OAAO;EAET,QAAQ,MACN,yCAAyC,KAAK,KAAK,QAAQ,QAAQ,SAAS,QAAQ,KAAK,EAC3F;EACA,OAAO;CACT;AACF;;AAGA,SAAgB,sBAAsB,UAA0B;CAC9D,OAAO,QAAQ,QAAQ,CAAC,CAAC,QAAQ,OAAO,GAAG;AAC7C;AAEA,SAAgB,YAAY,MAAc,OAAuB;CAC/D,OAAO,KAAK,QAAQ,0CAA0C,UAAU;EACtE,IAAI,aAAa,KAAK,KAAK,GACzB,OAAO,MAAM,QAAQ,kBAAkB,UAAU,MAAM,EAAE;EAE3D,OAAO,MAAM,QAAQ,MAAM,WAAW,MAAM,GAAG;CACjD,CAAC;AACH;;;;;;;AAeA,SAAgB,mBACd,gBACA,YAAY,OACF;CACV,MAAM,iBAAiB,IAAI,QAAQ,eAAe,OAAO;CACzD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,gBAAgB,GACxD,IAAI,CAAC,eAAe,IAAI,GAAG,GACzB,eAAe,IAAI,KAAK,KAAK;CAGjC,IAAI,OAAO,eAAe;CAE1B,KADoB,eAAe,IAAI,cAAc,KAAK,GAAA,CAC1C,SAAS,WAAW,KAAK,CAAC,eAAe,IAAI,yBAAyB,GAAG;EACvF,MAAM,QAAQ,cAAc;EAC5B,eAAe,IAAI,2BAA2B,UAAU,OAAO,SAAS,CAAC;EACzE,IAAI,OAAO,SAAS,UAClB,OAAO,YAAY,MAAM,KAAK;CAElC;CACA,OAAO,IAAI,SAAS,MAAM;EACxB,QAAQ,eAAe;EACvB,YAAY,eAAe;EAC3B,SAAS;CACX,CAAC;AACH;AAEA,SAAgB,aACd,MACA,OACA,SAAS,KACT,YAAY,OACF;CACV,OAAO,IAAI,SAAS,MAAM;EACxB;EACA,SAAS;GACP,gBAAgB;GAChB,GAAG;GACH,2BAA2B,UAAU,OAAO,SAAS;EACvD;CACF,CAAC;AACH;;;;;;;;ACtIA,eAAsB,aAAa,KAAa,UAAU,IAA+B;CACvF,MAAM,QAA0B,CAAC;CACjC,MAAM,UAAU,MAAM,QAAQ,KAAK,EAAE,eAAe,KAAK,CAAC;CAE1D,KAAK,MAAM,SAAS,SAAS;EAC3B,MAAM,WAAW,KAAK,KAAK,MAAM,IAAI;EACrC,MAAM,eAAe,UAAU,GAAG,QAAQ,GAAG,MAAM,SAAS,MAAM;EAElE,IAAI,MAAM,YAAY,GAAG;GACvB,IAAI,MAAM,SAAS,YAAY,MAAM,KAAK,WAAW,GAAG,GAAG;GAC3D,MAAM,KAAK,GAAI,MAAM,aAAa,UAAU,YAAY,CAAE;EAC5D,OAAO,IAAI,MAAM,KAAK,SAAS,MAAM,KAAK,MAAM,KAAK,SAAS,KAAK,GAAG;GACpE,IAAI,MAAM,SAAS,eAAe,CAAC,SAAS;GAC5C,MAAM,QAAQ,MAAM,KAAK,QAAQ;GACjC,IAAI,OAAO,aAAa,QAAQ,eAAe,EAAE;GAEjD,IAAI,WAAW,KAAK,IAAI,GACtB,OAAO,KAAK,QAAQ,YAAY,EAAE;GAEpC,MAAM,KAAK;IAAE;IAAM,SAAS;IAAU,OAAO,MAAM;GAAQ,CAAC;EAC9D;CACF;CAEA,OAAO;AACT;AAEA,SAAgB,cAAc,KAAsB;CAClD,OAAO,sBAAsB,KAAK,GAAG;AACvC;;AAGA,SAAgB,aAAa,MAAsB;CACjD,OAAO,GAAG,KAAK;AACjB;;;AAIA,SAAgB,oBAAoB,UAA0B;CAC5D,IAAI,aAAa,cAAc,OAAO;CACtC,IAAI,SAAS,WAAW,QAAQ,KAAK,SAAS,SAAS,OAAO,GAC5D,OAAO,SAAS,MAAM,GAAG,EAAe;CAC1C,OAAO;AACT;AA+EA,IAAM,aAAqC;CACzC,MAAM;CACN,KAAK;CACL,IAAI;CACJ,MAAM;CACN,KAAK;CACL,KAAK;CACL,MAAM;CACN,KAAK;CACL,KAAK;CACL,MAAM;CACN,OAAO;AACT;AAEA,SAAgB,eAAe,UAA0B;CAEvD,OAAO,WADK,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,KAC1B,OAAO;AAClC"}

package/.docu/node/hydrate.node.ts

@@ -1,7 +1,7 @@
 /**
  * Client bundle builder for Node/Deno runtimes.
  *
- * Wraps esbuild with the plugins needed to produce a browser-ready client
+ * Uses Vite with Rolldown plugins to produce a browser-ready client
  * bundle (JS + CSS) from the same components Bun.build handles natively.
  * Theme helpers (getThemeConfig, buildThemeCss, computeInlineThemeCss)
  * are re-exported from `hydrate.ts` — that module's `buildClientBundle`
@@ -15,6 +15,7 @@ import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { promisify } from "node:util";
 import { mkdir, readFile, unlink, writeFile } from "node:fs/promises";
 import { createHash } from "node:crypto";
+import { build as viteBuild } from "vite";
 import {
   ASSETS_DIR,
   FRAMEWORK_ROOT,
@@ -203,180 +204,129 @@ export async function buildClientBundle(
   await cleanOldBundles(new Set([`client-${twKey}.css`]));
 
   const nodeEnv = process.env.NODE_ENV || "development";
-  const esbuild = await import("esbuild");
-  const { build } = esbuild;
 
   const entryPath = join(LIB_DIR, "client.ts");
-  const workingDir = process.cwd();
-  let result: Awaited<ReturnType<typeof build>>;
-  try {
-    result = await build({
-      entryPoints: [entryPath],
-      bundle: true,
-      outdir: ASSETS_DIR,
-      entryNames: "client-[hash]",
-      platform: "browser",
-      format: "esm",
-      minify: nodeEnv === "production",
-      define: { "process.env.NODE_ENV": JSON.stringify(nodeEnv) },
-      jsx: "automatic",
-      jsxDev: nodeEnv !== "production",
-      metafile: true,
-      logLevel: "silent",
-      plugins: [
-        {
-          name: "node-builtin-stub",
-          setup(build) {
-            build.onResolve({ filter: NODE_BUILTINS_RE }, (args) => ({
-              path: args.path,
-              namespace: "node-stub",
-            }));
-            build.onLoad({ filter: /.*/, namespace: "node-stub" }, () => ({
-              contents: "module.exports = {};",
-              loader: "js",
-            }));
-          },
+  const bundle = await viteBuild({
+    configFile: false,
+    publicDir: false,
+    define: { "process.env.NODE_ENV": JSON.stringify(nodeEnv) },
+    plugins: [
+      {
+        name: "node-builtin-stub",
+        resolveId(id) {
+          if (NODE_BUILTINS_RE.test(id)) return `\0node-stub:${id}`;
+          return null;
         },
-        {
-          name: "lucide-optimize",
-          setup(build) {
-            build.onResolve({ filter: /^lucide-react$/ }, (args) => {
-              // Imports from within our virtual module go to the real package.
-              if (args.namespace === "lucide-virt") {
-                return { path: getLucideRealEntry(), namespace: "file" };
-              }
-              // markdown Icon.tsx uses namespace import for arbitrary
-              // user-provided icon names in MDX — keep full barrel there.
-              if (args.importer) {
-                const normalized = normalizeImporterPath(args.importer);
-                if (normalized.includes("/markdown/dist/")) {
-                  return { path: getLucideRealEntry(), namespace: "file" };
-                }
-              }
-              // All other files get tree-shaken via the virtual module.
-              // Lucide.tsx renders only config-defined icons, which are
-              // collected by extractConfigIcons() + collectAllLucideIcons().
-              return { path: args.path, namespace: "lucide-virt" };
-            });
-            build.onLoad({ filter: /.*/, namespace: "lucide-virt" }, () => {
-              const scanned = collectAllLucideIcons();
-              const configured = extractConfigIcons(loadDocuConfig());
-              const allIcons = [...new Set([...scanned, ...configured])];
-              return {
-                contents: `export { ${allIcons.join(", ")} } from "lucide-react";`,
-                loader: "js",
-              };
-            });
-          },
+        load(id) {
+          if (!id.startsWith("\0node-stub:")) return null;
+          return "export default {}; export {};";
         },
-        {
-          name: "docu-config",
-          setup(build) {
-            // Components import as "../node/client-routes" (no .ts extension),
-            // so filter matches the path tail without requiring the extension.
-            build.onResolve({ filter: /client-routes$/ }, (args) => ({
-              path: args.path,
-              namespace: "client-routes",
-            }));
-            build.onLoad({ filter: /.*/, namespace: "client-routes" }, () => {
-              const config = loadDocuConfig();
-              const resolved = {
-                ...config,
-                routes: resolveRoutes(config.routes as DocuRoute[] | undefined),
-              };
-              return {
-                contents: [
-                  `import type { DocuRoute, DocuConfig } from "./types";`,
-                  `const docuConfig = ${JSON.stringify(resolved)};`,
-                  `export const routes = docuConfig.routes || [];`,
-                  `export const config = docuConfig;`,
-                ].join("\n"),
-                loader: "ts",
-              };
-            });
-          },
+      },
+      {
+        name: "lucide-optimize",
+        resolveId(id, importer) {
+          if (id !== "lucide-react") return null;
+          if (importer) {
+            const normalized = normalizeImporterPath(importer);
+            if (normalized.includes("/markdown/dist/")) return null;
+          }
+          return "\0lucide-virt";
         },
-        {
-          // Serves per-page compiled MDX (program format) as real modules so
-          // the client hydrates the content island without `new Function`.
-          // client.ts imports `{ mdxModules } from "./mdx-manifest"`.
-          name: "mdx-hydrate",
-          setup(build) {
-            // Compiled MDX (program format) imports the JSX runtime and the
-            // MDX provider. Virtual modules have no real directory, so esbuild
-            // cannot resolve bare specifiers from them — map them to the
-            // installed real paths explicitly (same pattern as lucide-optimize).
-            const require = createRequire(import.meta.url);
-            const mdxModuleDeps: Record<string, string> = {
-              "react/jsx-runtime": require.resolve("react/jsx-runtime"),
-              "react/jsx-dev-runtime": require.resolve("react/jsx-dev-runtime"),
-              "@mdx-js/react": require.resolve("@mdx-js/react"),
-            };
-            build.onResolve(
-              { filter: /^(react\/jsx-runtime|react\/jsx-dev-runtime|@mdx-js\/react)$/ },
-              (args) => {
-                if (args.namespace !== "mdx-module") return;
-                return { path: mdxModuleDeps[args.path], namespace: "file" };
-              }
-            );
-            build.onResolve({ filter: /^mdx-module:/ }, (args) => ({
-              path: args.path,
-              namespace: "mdx-module",
-            }));
-            build.onLoad({ filter: /.*/, namespace: "mdx-module" }, (args) => {
-              const slug = args.path.slice("mdx-module:".length);
-              const contents = mdxSources[slug];
-              if (contents == null) {
-                return {
-                  errors: [{ text: `unknown mdx module: ${slug}` }],
-                  contents: "",
-                  loader: "js",
-                };
-              }
-              return { contents, loader: "js" };
-            });
-            build.onResolve({ filter: /mdx-manifest$/ }, (args) => ({
-              path: args.path,
-              namespace: "mdx-manifest",
-            }));
-            build.onLoad({ filter: /.*/, namespace: "mdx-manifest" }, () => {
-              // Sort keys: the prePass fills mdxSources via Promise.all, so
-              // insertion order = resolution order (non-deterministic across
-              // processes). Stable key order keeps the bundle hash stable so
-              // the build cache (`assetsChanged`) actually hits.
-              const slugs = Object.keys(mdxSources).sort();
-              const imports = slugs
-                .map((slug, i) => {
-                  const key = slug.replace(/["\\]/g, "");
-                  return `import * as _mdx${i} from "mdx-module:${key}";`;
-                })
-                .join("\n");
-              const map = slugs.map((slug, i) => `${JSON.stringify(slug)}: _mdx${i}`).join(", ");
-              return {
-                contents: `${imports}\nexport const mdxModules = { ${map} };\n`,
-                loader: "js",
-              };
-            });
-          },
+        load(id) {
+          if (id !== "\0lucide-virt") return null;
+          const scanned = collectAllLucideIcons();
+          const configured = extractConfigIcons(loadDocuConfig());
+          const allIcons = [...new Set([...scanned, ...configured])];
+          return `export { ${allIcons.join(", ")} } from ${JSON.stringify(getLucideRealEntry())};`;
         },
-      ],
-    });
-  } finally {
-    // esbuild's service child process keeps Deno's event loop alive after a
-    // one-shot build (node-compat gap) — stop it so `flame build` exits.
-    await esbuild.stop();
-  }
-
-  // The single entry produces one output. Match resolved source path.
-  const { outputs } = result.metafile!;
-  const jsOutput = Object.keys(outputs).find((p) => {
-    const o = outputs[p];
-    return o.entryPoint && resolve(workingDir, o.entryPoint) === entryPath;
+      },
+      {
+        name: "docu-config",
+        resolveId(id) {
+          if (!/client-routes$/.test(id)) return null;
+          return "\0client-routes";
+        },
+        load(id) {
+          if (id !== "\0client-routes") return null;
+          const config = loadDocuConfig();
+          const resolved = {
+            ...config,
+            routes: resolveRoutes(config.routes as DocuRoute[] | undefined),
+          };
+          return [
+            `const docuConfig = ${JSON.stringify(resolved)};`,
+            `export const routes = docuConfig.routes || [];`,
+            `export const config = docuConfig;`,
+          ].join("\n");
+        },
+      },
+      {
+        name: "mdx-hydrate",
+        resolveId(id) {
+          if (/mdx-manifest$/.test(id)) return "\0mdx-manifest";
+          if (id.startsWith("mdx-module:")) return `\0${id}`;
+          return null;
+        },
+        load(id) {
+          if (id === "\0mdx-manifest") {
+            const slugs = Object.keys(mdxSources).sort();
+            const imports = slugs
+              .map((slug, i) => {
+                const key = slug.replace(/["\\]/g, "");
+                return `import * as _mdx${i} from ${JSON.stringify(`mdx-module:${key}`)};`;
+              })
+              .join("\n");
+            const map = slugs.map((slug, i) => `${JSON.stringify(slug)}: _mdx${i}`).join(", ");
+            return `${imports}\nexport const mdxModules = { ${map} };\n`;
+          }
+          if (!id.startsWith("\0mdx-module:")) return null;
+          const slug = id.slice("\0mdx-module:".length);
+          const contents = mdxSources[slug];
+          if (contents == null) {
+            throw new Error(`unknown mdx module: ${slug}`);
+          }
+          return contents;
+        },
+      },
+    ],
+    build: {
+      outDir: ASSETS_DIR,
+      emptyOutDir: false,
+      sourcemap: true,
+      minify: nodeEnv === "production",
+      target: "es2020",
+      rollupOptions: {
+        input: entryPath,
+        output: {
+          format: "es",
+          entryFileNames: "client-[hash].js",
+          chunkFileNames: "chunks/[name]-[hash].js",
+          assetFileNames: "assets/[name]-[hash][extname]",
+        },
+      },
+    },
   });
-  if (!jsOutput) {
+
+  const outputs = Array.isArray(bundle) ? bundle : [bundle];
+  let jsFile: string | undefined;
+  for (const item of outputs) {
+    if (!("output" in item)) continue;
+    for (const output of item.output) {
+      if (
+        output.type === "chunk" &&
+        output.isEntry &&
+        output.facadeModuleId &&
+        resolve(output.facadeModuleId) === entryPath
+      ) {
+        jsFile = basename(output.fileName);
+        break;
+      }
+    }
+    if (jsFile) break;
+  }
+  if (!jsFile) {
     throw new Error("Client bundle produced no output files");
   }
-  const jsFile = basename(jsOutput);
 
   const { file: cssFile } = await buildTailwindCss(twKey);
 

package/bin/compile-lib.mjs

@@ -7,37 +7,39 @@
  * The CLI routes non-Bun runtimes here (see `bin/cli.js`).
  */
 
-import { rmSync } from "node:fs";
-import { build, stop } from "esbuild";
+import { build } from "vite";
 
-const ENTRIES = [
-  "server.node.ts",
-  "server.deno.ts",
-  "build.node.ts",
-  "build.deno.ts",
-  "preview.node.ts",
-  "preview.deno.ts",
-  "deploy.node.ts",
-  "deploy.deno.ts",
-  "clean.ts",
+const entries = [
+  "server.node",
+  "server.deno",
+  "build.node",
+  "build.deno",
+  "preview.node",
+  "preview.deno",
+  "deploy.node",
+  "deploy.deno",
+  "clean",
 ];
 
-rmSync(".docu/lib", { recursive: true, force: true });
+const entry = Object.fromEntries(entries.map((name) => [name, `.docu/node/${name}.ts`]));
 
 await build({
-  entryPoints: ENTRIES.map((entry) => `.docu/node/${entry}`),
-  outdir: ".docu/lib",
-  bundle: true,
-  splitting: true,
-  format: "esm",
-  platform: "node",
-  target: "node20",
-  packages: "external",
-  jsx: "automatic",
-  logLevel: "info",
+  build: {
+    outDir: ".docu/lib",
+    emptyOutDir: true,
+    ssr: true,
+    target: "node20",
+    minify: false,
+    sourcemap: true,
+    lib: {
+      entry,
+      formats: ["es"],
+      fileName: (_format, entryName) => `${entryName}.js`,
+    },
+    rollupOptions: {
+      // Keep npm and runtime dependencies resolvable by the target runtime.
+      // Relative imports are bundled from the TypeScript source tree.
+      external: (id) => !id.startsWith(".") && !id.startsWith("/") && !id.startsWith("\0"),
+    },
+  },
 });
-
-// esbuild's service process keeps Deno's event loop alive after one-shot
-// build() calls — stop it explicitly so `flame` can invoke this script
-// under Deno. Harmless under Node.
-await stop();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@docubook/flame",
-  "version": "2.0.0-beta.1",
+  "version": "2.0.0-beta.2",
   "description": "A blazing-fast React + MDX framework powered by Bun, built for modern documentation experiences.",
   "type": "module",
   "bin": {
@@ -50,16 +50,16 @@
     "@tailwindcss/typography": "0.5.16",
     "bun-plugin-tailwind": "^0.1.2",
     "daisyui": "^5.5.19",
-    "esbuild": "^0.28.1",
+    "vite": "^8.2.1",
     "lucide-react": "^1.14.0",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
     "unified": "^11.0.0",
     "zod": "^4.4.3",
-    "@docubook/markdown": "^2.0.0-beta.1",
-    "@docubook/core": "^2.0.0-beta.0",
-    "@docubook/ui-react": "^2.0.0-beta.0",
-    "@docubook/themes-colors": "^2.0.0-beta.0"
+    "@docubook/core": "^2.0.0-beta.2",
+    "@docubook/markdown": "^2.0.0-beta.2",
+    "@docubook/themes-colors": "^2.0.0-beta.2",
+    "@docubook/ui-react": "^2.0.0-beta.2"
   },
   "peerDependencies": {
     "@sentry/bun": "^10.0.0"

package/.docu/lib/build.impl-3ZOQORN3.js

@@ -1,12 +0,0 @@
-import {
-  runBuild,
-  runBuildCli
-} from "./chunk-FERG25YW.js";
-import "./chunk-URBATJEC.js";
-import "./chunk-EOK6KATZ.js";
-import "./chunk-6EOUQCRM.js";
-import "./chunk-4IQXHHPF.js";
-export {
-  runBuild,
-  runBuildCli
-};

package/.docu/lib/chunk-4IQXHHPF.js

@@ -1,62 +0,0 @@
-// .docu/node/paths.ts
-import { resolve, join } from "node:path";
-import { existsSync, readFileSync } from "node:fs";
-import { readdir, rm, unlink } from "node:fs/promises";
-var FRAMEWORK_ROOT = resolve(import.meta.dirname, "../..");
-var PROJECT_ROOT = process.cwd();
-var PAGES_DIR = join(FRAMEWORK_ROOT, ".docu/pages");
-var STYLES_DIR = join(FRAMEWORK_ROOT, ".docu/styles");
-var nodeDir = join(FRAMEWORK_ROOT, ".docu/node");
-var libDir = join(FRAMEWORK_ROOT, ".docu/lib");
-var LIB_DIR = existsSync(nodeDir) ? nodeDir : libDir;
-var DIST_DIR = join(PROJECT_ROOT, ".docu/dist");
-var ASSETS_DIR = join(DIST_DIR, "assets");
-var CACHE_FILE = join(PROJECT_ROOT, ".docu/build-cache.json");
-var DOCS_DIR = join(PROJECT_ROOT, "docs");
-var DOCS_ASSETS_DIR = join(PROJECT_ROOT, "docs/assets");
-var DOCU_CONFIG_PATH = join(PROJECT_ROOT, "docu.json");
-var _config = null;
-async function cleanOldBundles(preserve) {
-  try {
-    const files = await readdir(ASSETS_DIR);
-    for (const file of files) {
-      if (preserve?.has(file)) continue;
-      if (file.startsWith("client.") || file.startsWith("client-")) {
-        await unlink(join(ASSETS_DIR, file));
-      }
-    }
-  } catch (err) {
-    if (err.code !== "ENOENT") {
-      console.error("Failed to clean old bundles:", err.message);
-    }
-  }
-  try {
-    await rm(join(ASSETS_DIR, "chunks"), { recursive: true, force: true });
-  } catch (err) {
-    if (err.code !== "ENOENT") {
-      console.warn("[flame] Failed to clean chunks dir:", err.message);
-    }
-  }
-}
-function loadDocuConfig() {
-  if (_config) return _config;
-  if (!existsSync(DOCU_CONFIG_PATH)) {
-    throw new Error(`docu.json not found at ${DOCU_CONFIG_PATH}`);
-  }
-  _config = JSON.parse(readFileSync(DOCU_CONFIG_PATH, "utf-8"));
-  return _config;
-}
-
-export {
-  FRAMEWORK_ROOT,
-  PROJECT_ROOT,
-  STYLES_DIR,
-  LIB_DIR,
-  DIST_DIR,
-  ASSETS_DIR,
-  CACHE_FILE,
-  DOCS_DIR,
-  DOCS_ASSETS_DIR,
-  cleanOldBundles,
-  loadDocuConfig
-};