@hardikg/mdview 0.10.0 → 0.11.0

package/bin/server-KALIU7HM.mjs

@@ -0,0 +1,1854 @@
+#!/usr/bin/env node
+import {
+  CONFIG_FILENAME,
+  DEFAULT_IGNORED_DIRS,
+  describeRoot,
+  loadEffectiveConfig,
+  parseWorkspacePath,
+  resolveRootId,
+  toWorkspacePath
+} from "./chunk-WWM6JNAS.mjs";
+import {
+  highlightCode
+} from "./chunk-RBYD2HWV.mjs";
+import {
+  DEFAULT_PALETTE,
+  PALETTES
+} from "./chunk-XFRQFZZ4.mjs";
+
+// src/server/index.ts
+import { timingSafeEqual } from "crypto";
+import path10 from "path";
+import chokidar2 from "chokidar";
+import Fastify from "fastify";
+
+// src/server/fs/grep.ts
+import { readFile, realpath as realpath2, stat } from "fs/promises";
+import path4 from "path";
+import { setImmediate as yieldToEventLoop } from "timers/promises";
+
+// src/render/frontmatter.ts
+import { CORE_SCHEMA, load, mergeTag } from "js-yaml";
+var MAX_NODES = 1e4;
+var MAX_STRING_CHARS = 1e6;
+var SCHEMA = CORE_SCHEMA.withTags(mergeTag);
+function unparsed(raw) {
+  return { data: null, body: raw, bodyStartLine: 0 };
+}
+function parseFrontmatter(raw) {
+  const block = locateBlock(raw);
+  if (!block) return unparsed(raw);
+  let loaded = {};
+  if (!isBlank(block.yaml)) {
+    try {
+      loaded = load(block.yaml, { schema: SCHEMA });
+    } catch {
+      return unparsed(raw);
+    }
+    if (!withinBudget(loaded)) return unparsed(raw);
+  }
+  return {
+    data: isPlainObject(loaded) ? loaded : null,
+    body: block.body,
+    bodyStartLine: block.bodyStartLine
+  };
+}
+function locateBlock(raw) {
+  if (!isFenceLine(raw, 0)) return null;
+  let next = nextLineStart(raw, 0);
+  const yamlStart = next;
+  let closingIdx = -1;
+  let closingStart = -1;
+  for (let i = 1; next >= 0; i++) {
+    if (isFenceLine(raw, next)) {
+      closingIdx = i;
+      closingStart = next;
+      break;
+    }
+    next = nextLineStart(raw, next);
+  }
+  if (closingIdx < 0) return null;
+  let bodyStart = nextLineStart(raw, closingStart);
+  let bodyStartLine = closingIdx + 1;
+  while (bodyStart >= 0 && lineEnd(raw, bodyStart) === bodyStart) {
+    bodyStartLine++;
+    bodyStart = nextLineStart(raw, bodyStart);
+  }
+  return {
+    yaml: raw.slice(yamlStart, closingStart).replace(/\r?\n$/, "").replace(/\r\n/g, "\n"),
+    body: bodyStart < 0 ? "" : raw.slice(bodyStart),
+    bodyStartLine
+  };
+}
+function lineEnd(raw, start) {
+  const nl = raw.indexOf("\n", start);
+  if (nl < 0) return raw.length;
+  return nl > start && raw.charCodeAt(nl - 1) === 13 ? nl - 1 : nl;
+}
+function nextLineStart(raw, start) {
+  const nl = raw.indexOf("\n", start);
+  return nl < 0 ? -1 : nl + 1;
+}
+function isFenceLine(raw, start) {
+  return lineEnd(raw, start) - start === 3 && raw.startsWith("---", start);
+}
+function isBlank(yaml) {
+  return yaml.split(/\r?\n/).every((line) => /^\s*(?:#.*)?$/.test(line));
+}
+function withinBudget(root) {
+  const stack = [root];
+  let visited = 0;
+  let chars = 0;
+  while (stack.length > 0) {
+    const node = stack.pop();
+    if (++visited > MAX_NODES) return false;
+    if (typeof node === "string") {
+      chars += node.length;
+    } else if (Array.isArray(node)) {
+      for (const child of node) stack.push(child);
+    } else if (isPlainObject(node)) {
+      for (const [key, child] of Object.entries(node)) {
+        chars += key.length;
+        stack.push(child);
+      }
+    }
+    if (chars > MAX_STRING_CHARS) return false;
+  }
+  return true;
+}
+function isPlainObject(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+
+// src/shared/search-pattern.ts
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function inert(query, valid) {
+  return { test: () => null, matchAll: () => [], source: "", flags: "", query, valid };
+}
+function compilePattern(query, opts) {
+  if (!query) return inert(query, true);
+  let re;
+  if (opts.regex) {
+    try {
+      re = new RegExp(query, opts.caseSensitive ? "g" : "gi");
+    } catch {
+      return inert(query, false);
+    }
+  } else {
+    let pat = escapeRegex(query);
+    if (opts.wholeWord) pat = `\\b${pat}\\b`;
+    re = new RegExp(pat, opts.caseSensitive ? "g" : "gi");
+  }
+  return {
+    query,
+    valid: true,
+    source: re.source,
+    flags: re.flags,
+    test(text) {
+      re.lastIndex = 0;
+      return re.exec(text);
+    },
+    matchAll(text) {
+      re.lastIndex = 0;
+      const out = [];
+      let m;
+      while ((m = re.exec(text)) !== null) {
+        if (m[0].length === 0) {
+          re.lastIndex++;
+          continue;
+        }
+        out.push({ index: m.index, length: m[0].length });
+      }
+      return out;
+    }
+  };
+}
+
+// src/shared/tree-utils.ts
+var MD_EXT = /* @__PURE__ */ new Set([".md", ".markdown", ".mdx"]);
+function flattenMdRelPaths(nodes, out = []) {
+  for (const n of nodes) {
+    if (n.type === "file" && n.isMarkdown) out.push(n.relPath);
+    else if (n.type === "dir" && n.children) flattenMdRelPaths(n.children, out);
+  }
+  return out;
+}
+
+// src/server/fs/limiter.ts
+var LimiterAbortError = class extends Error {
+};
+var Limiter = class {
+  constructor(capacity) {
+    this.capacity = capacity;
+  }
+  capacity;
+  used = 0;
+  queue = [];
+  /** Units currently held. */
+  get inUse() {
+    return this.used;
+  }
+  /** Requests waiting for their turn. */
+  get waiting() {
+    return this.queue.length;
+  }
+  acquire(weight = 1, signal) {
+    if (signal?.aborted) return Promise.reject(new LimiterAbortError("Aborted while queued"));
+    if (this.queue.length === 0 && this.fits(weight)) {
+      return Promise.resolve(this.take(weight));
+    }
+    return new Promise((resolve, reject) => {
+      const onAbort = () => {
+        const i = this.queue.indexOf(waiter);
+        if (i >= 0) this.queue.splice(i, 1);
+        reject(new LimiterAbortError("Aborted while queued"));
+        this.drain();
+      };
+      const waiter = {
+        weight,
+        grant: () => {
+          signal?.removeEventListener("abort", onAbort);
+          resolve(this.take(weight));
+        }
+      };
+      this.queue.push(waiter);
+      signal?.addEventListener("abort", onAbort, { once: true });
+    });
+  }
+  fits(weight) {
+    return this.used === 0 || this.used + weight <= this.capacity;
+  }
+  take(weight) {
+    this.used += weight;
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      this.used -= weight;
+      this.drain();
+    };
+  }
+  drain() {
+    for (let head = this.queue[0]; head && this.fits(head.weight); head = this.queue[0]) {
+      this.queue.shift();
+      head.grant();
+    }
+  }
+};
+
+// src/server/fs/regex-runner.ts
+import { Worker } from "worker_threads";
+var WORKER_URL = new URL(
+  import.meta.url.endsWith(".ts") ? "./regex-worker.ts" : "./regex-worker.mjs",
+  import.meta.url
+);
+var RegexTimeoutError = class extends Error {
+};
+var RegexAbortError = class extends Error {
+};
+var idle = null;
+var nextId = 1;
+function spawn() {
+  const worker = new Worker(WORKER_URL);
+  worker.unref();
+  worker.on("error", () => void 0);
+  worker.once("exit", () => {
+    if (idle === worker) idle = null;
+  });
+  return worker;
+}
+async function closeRegexWorkers() {
+  const w = idle;
+  idle = null;
+  if (w) await w.terminate();
+}
+function openRegexSession(opts) {
+  let worker = null;
+  let started = false;
+  let spentMs = 0;
+  function ready() {
+    if (started) return;
+    started = true;
+    worker = idle ?? spawn();
+    idle = null;
+  }
+  function kill() {
+    const w = worker;
+    worker = null;
+    void w?.terminate();
+  }
+  return {
+    async match(files) {
+      ready();
+      const w = worker;
+      if (!w) return Promise.reject(new RegexTimeoutError("Regex worker is gone"));
+      const remaining = opts.budgetMs - spentMs;
+      if (remaining <= 0) {
+        kill();
+        return Promise.reject(new RegexTimeoutError("Regex search budget used up"));
+      }
+      if (opts.signal?.aborted) {
+        kill();
+        return Promise.reject(new RegexAbortError("Search aborted"));
+      }
+      const id = nextId++;
+      const started2 = performance.now();
+      return new Promise((resolve, reject) => {
+        const cleanup = () => {
+          clearTimeout(timer);
+          w.off("message", onMessage);
+          w.off("error", onError);
+          w.off("exit", onExit);
+          opts.signal?.removeEventListener("abort", onAbort);
+          spentMs += performance.now() - started2;
+        };
+        const onMessage = (res) => {
+          if (res.id !== id) return;
+          cleanup();
+          if (res.ok) resolve(res.files);
+          else reject(new Error("Regex worker could not run the pattern"));
+        };
+        const onError = (err) => {
+          cleanup();
+          worker = null;
+          reject(err);
+        };
+        const onExit = () => {
+          cleanup();
+          worker = null;
+          reject(new Error("Regex worker exited"));
+        };
+        const onAbort = () => {
+          cleanup();
+          kill();
+          reject(new RegexAbortError("Search aborted"));
+        };
+        const timer = setTimeout(() => {
+          cleanup();
+          kill();
+          reject(new RegexTimeoutError("Regex search budget used up"));
+        }, remaining);
+        w.on("message", onMessage);
+        w.on("error", onError);
+        w.on("exit", onExit);
+        opts.signal?.addEventListener("abort", onAbort, { once: true });
+        const req = {
+          id,
+          source: opts.source,
+          flags: opts.flags,
+          maxLineLen: opts.maxLineLen,
+          perFileCap: opts.perFileCap,
+          files
+        };
+        w.postMessage(req);
+      });
+    },
+    release() {
+      const w = worker;
+      worker = null;
+      if (w) {
+        if (idle) void w.terminate();
+        else idle = w;
+      }
+    }
+  };
+}
+
+// src/server/fs/resolve.ts
+import { realpath } from "fs/promises";
+import path from "path";
+var MAX_MARKDOWN_BYTES = 16 * 1024 * 1024;
+var OutsideRootError = class extends Error {
+};
+function isWithin(absRoot, candidate) {
+  const rel = path.relative(absRoot, candidate);
+  return rel !== ".." && !rel.startsWith(`..${path.sep}`) && !path.isAbsolute(rel);
+}
+function hasDotSegment(rel) {
+  return path.normalize(rel).split(/[\\/]/).some((seg) => seg.startsWith(".") && seg !== ".");
+}
+async function resolveSafePath(root, relPath, opts = {}) {
+  if (path.isAbsolute(relPath)) {
+    throw new OutsideRootError(`Refusing absolute path: ${relPath}`);
+  }
+  const absRoot = path.resolve(root);
+  const candidate = path.resolve(absRoot, relPath);
+  if (!isWithin(absRoot, candidate)) {
+    throw new OutsideRootError(`Path resolves outside root: ${relPath}`);
+  }
+  const realRoot = opts.realRoot ?? await realpath(absRoot);
+  const realCandidate = await realpath(candidate);
+  if (!isWithin(realRoot, realCandidate)) {
+    throw new OutsideRootError(`Path resolves outside root: ${relPath}`);
+  }
+  return realCandidate;
+}
+
+// src/server/fs/tree.ts
+import { readdir } from "fs/promises";
+import path3 from "path";
+
+// src/server/fs/ignore.ts
+import path2 from "path";
+var DEFAULT_IGNORED_DIRS2 = new Set(DEFAULT_IGNORED_DIRS);
+function buildIgnoreSet(extra = []) {
+  return /* @__PURE__ */ new Set([...DEFAULT_IGNORED_DIRS2, ...extra]);
+}
+function isDirIgnored(name, set) {
+  return name.startsWith(".") || set.has(name);
+}
+function isPathIgnored(abs, root, set) {
+  const rel = path2.relative(root, abs);
+  if (rel === "" || rel.startsWith("..")) return false;
+  for (const seg of rel.split(path2.sep)) {
+    if (!seg) continue;
+    if (seg.startsWith(".")) return true;
+    if (set.has(seg)) return true;
+  }
+  return false;
+}
+
+// src/server/fs/tree.ts
+async function walkFolder(root, opts = {}) {
+  const ignore = opts.ignore ?? DEFAULT_IGNORED_DIRS2;
+  return walkInner(root, opts.relBase ?? "", ignore);
+}
+async function walkInner(absDir, relBase, ignore) {
+  const entries = await readdir(absDir, { withFileTypes: true });
+  const out = [];
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      if (isDirIgnored(entry.name, ignore)) continue;
+    } else if (entry.name.startsWith(".")) {
+      continue;
+    }
+    const childRel = relBase ? `${relBase}/${entry.name}` : entry.name;
+    if (entry.isDirectory()) {
+      const children = await walkInner(path3.join(absDir, entry.name), childRel, ignore);
+      out.push({
+        name: entry.name,
+        relPath: childRel,
+        type: "dir",
+        children
+      });
+    } else if (entry.isFile()) {
+      const ext = path3.extname(entry.name).toLowerCase();
+      out.push({
+        name: entry.name,
+        relPath: childRel,
+        type: "file",
+        isMarkdown: MD_EXT.has(ext)
+      });
+    }
+  }
+  out.sort((a, b) => {
+    if (a.type !== b.type) return a.type === "dir" ? -1 : 1;
+    return a.name.localeCompare(b.name);
+  });
+  return out;
+}
+
+// src/server/fs/grep.ts
+var READ_CONCURRENCY = 8;
+var LITERAL_SLICE_MS = 10;
+var LITERAL_CHECK_STEPS = 4096;
+var searchSlots = new Limiter(2);
+var searchReadBudget = new Limiter(2 * MAX_MARKDOWN_BYTES);
+var BATCH_FILES = 64;
+var BATCH_CHARS = 1e6;
+var ContentCache = class {
+  entries = /* @__PURE__ */ new Map();
+  maxChars;
+  chars = 0;
+  constructor(maxChars = 32 * 1024 * 1024) {
+    this.maxChars = maxChars;
+  }
+  get(key, mtimeMs, size) {
+    const e = this.entries.get(key);
+    if (!e) return void 0;
+    if (e.mtimeMs !== mtimeMs || e.size !== size) {
+      this.invalidate(key);
+      return void 0;
+    }
+    this.entries.delete(key);
+    this.entries.set(key, e);
+    return e.body;
+  }
+  set(key, mtimeMs, size, body) {
+    this.invalidate(key);
+    if (body.length > this.maxChars / 4) return;
+    this.entries.set(key, { mtimeMs, size, body });
+    this.chars += body.length;
+    for (const [oldKey] of this.entries) {
+      if (this.chars <= this.maxChars) break;
+      this.invalidate(oldKey);
+    }
+  }
+  invalidate(key) {
+    const e = this.entries.get(key);
+    if (!e) return;
+    this.chars -= e.body.length;
+    this.entries.delete(key);
+  }
+  clear() {
+    this.entries.clear();
+    this.chars = 0;
+  }
+  /** The key a root-relative path is cached under. Shared with the watcher hook. */
+  static keyFor(rootAbsPath, relPath) {
+    return path4.join(rootAbsPath, relPath);
+  }
+};
+function buildSnippet(line, start, end, radius) {
+  const from = Math.max(0, start - radius);
+  const to = Math.min(line.length, end + radius);
+  const prefix = from > 0 ? "\u2026" : "";
+  const suffix = to < line.length ? "\u2026" : "";
+  const sliced = line.slice(from, to);
+  const hlStart = prefix.length + (start - from);
+  const hlEnd = hlStart + (end - start);
+  return {
+    snippet: prefix + sliced + suffix,
+    highlight: [hlStart, hlEnd]
+  };
+}
+function eachLine(body, visit, from = { index: 0, start: 0 }) {
+  let start = from.start;
+  for (let index = from.index; ; index++) {
+    const nl = body.indexOf("\n", start);
+    if (nl < 0) {
+      visit(index, start, body.length);
+      return null;
+    }
+    const end = nl > start && body.charCodeAt(nl - 1) === 13 ? nl - 1 : nl;
+    const more = visit(index, start, end);
+    start = nl + 1;
+    if (!more) return { index: index + 1, start };
+  }
+}
+function linesAt(body, wanted) {
+  const out = /* @__PURE__ */ new Map();
+  let w = 0;
+  if (wanted.length === 0) return out;
+  eachLine(body, (index, start, end) => {
+    if (wanted[w] === index) out.set(index, body.slice(start, end));
+    while (wanted[w] === index) w++;
+    return w < wanted.length;
+  });
+  return out;
+}
+var HOLDS_NOTHING = () => void 0;
+async function loadBody(t, cache, signal, turn) {
+  let release = HOLDS_NOTHING;
+  let passed = false;
+  try {
+    const abs = await resolveSafePath(t.root.absPath, t.relPath, { realRoot: t.realRoot });
+    const st = await stat(abs);
+    if (!st.isFile() || st.size > MAX_MARKDOWN_BYTES) return { body: null, release };
+    const key = ContentCache.keyFor(t.root.absPath, t.relPath);
+    const cached = cache.get(key, st.mtimeMs, st.size);
+    if (cached !== void 0) return { body: cached, release };
+    await turn.prev;
+    const granted = searchReadBudget.acquire(st.size, signal);
+    passed = true;
+    turn.pass();
+    release = await granted;
+    const { body } = parseFrontmatter(await readFile(abs, "utf8"));
+    cache.set(key, st.mtimeMs, st.size, body);
+    return { body, release };
+  } catch {
+    release();
+    return { body: null, release: HOLDS_NOTHING };
+  } finally {
+    if (!passed) void turn.prev.then(turn.pass);
+  }
+}
+async function* readAhead(targets, cache, concurrency, signal) {
+  const inflight = [];
+  let next = 0;
+  let queued = Promise.resolve();
+  const fill = () => {
+    while (inflight.length < concurrency && next < targets.length) {
+      const prev = queued;
+      let pass = HOLDS_NOTHING;
+      queued = new Promise((resolve) => {
+        pass = resolve;
+      });
+      inflight.push(loadBody(targets[next++], cache, signal, { prev, pass }));
+    }
+  };
+  try {
+    fill();
+    for (const t of targets) {
+      const loaded = await inflight.shift();
+      fill();
+      yield [t, loaded];
+    }
+  } finally {
+    for (const pending of inflight) void pending.then((l) => l.release());
+  }
+}
+async function collectTargets(roots, opts) {
+  const out = [];
+  for (const root of roots) {
+    let realRoot;
+    try {
+      realRoot = await realpath2(root.absPath);
+    } catch {
+      continue;
+    }
+    const tree = await walkFolder(root.absPath, { ignore: root.ignore ?? opts.ignore });
+    for (const relPath of flattenMdRelPaths(tree)) out.push({ root, realRoot, relPath });
+  }
+  return out;
+}
+async function grepFiles(roots, query, opts = {}) {
+  const perFileCap = opts.perFileCap ?? 20;
+  const globalCap = opts.globalCap ?? 200;
+  const snippetRadius = opts.snippetRadius ?? 60;
+  const maxLineLen = opts.maxLineLen ?? 1e4;
+  const regexMode = opts.regex ?? false;
+  const cache = opts.cache ?? new ContentCache();
+  const signal = opts.signal;
+  const empty = { query, results: [], truncated: false, timedOut: false };
+  if (!query) return empty;
+  const pattern = compilePattern(query, {
+    caseSensitive: opts.caseSensitive ?? false,
+    wholeWord: opts.wholeWord ?? false,
+    regex: regexMode
+  });
+  if (!pattern.valid) return empty;
+  const results = [];
+  let totalHits = 0;
+  let truncated = false;
+  let timedOut = false;
+  const record = (t, body, m) => {
+    if (m.skipped) truncated = true;
+    if (m.total === 0) return;
+    const lines = linesAt(body, m.hits.map(([lineIdx]) => lineIdx));
+    const hits = [];
+    let fileTruncated = m.skipped || m.total > m.hits.length;
+    for (const [lineIdx, col, len] of m.hits) {
+      if (totalHits >= globalCap) {
+        truncated = true;
+        fileTruncated = true;
+        break;
+      }
+      const { snippet, highlight } = buildSnippet(
+        lines.get(lineIdx) ?? "",
+        col,
+        col + len,
+        snippetRadius
+      );
+      hits.push({ line: lineIdx + 1, col, snippet, highlight });
+      totalHits++;
+    }
+    if (totalHits >= globalCap) truncated = true;
+    if (hits.length > 0) {
+      results.push({
+        relPath: `${t.root.id}/${t.relPath}`,
+        hits,
+        total: m.total,
+        truncated: fileTruncated
+      });
+    }
+  };
+  const literalRe = regexMode ? null : new RegExp(pattern.source, pattern.flags);
+  let literalLeftMs = opts.literalBudgetMs ?? 1e3;
+  let sliceMs = 0;
+  let clock = 0;
+  let steps = 0;
+  const charge = () => {
+    const now = performance.now();
+    literalLeftMs -= now - clock;
+    sliceMs += now - clock;
+    clock = now;
+  };
+  const checkpoint = async () => {
+    steps = 0;
+    charge();
+    if (literalLeftMs <= 0) return "time";
+    if (sliceMs < LITERAL_SLICE_MS) return null;
+    sliceMs = 0;
+    await yieldToEventLoop();
+    clock = performance.now();
+    return stop.signal.aborted ? "abort" : null;
+  };
+  const matchLiteral = async (re, body) => {
+    const out = { total: 0, hits: [], skipped: false };
+    let stopped = null;
+    clock = performance.now();
+    const visit = (index, start, end) => {
+      if (end - start > maxLineLen) {
+        out.skipped = true;
+      } else {
+        const line = body.slice(start, end);
+        re.lastIndex = 0;
+        for (let m = re.exec(line); m !== null; m = re.exec(line)) {
+          out.total++;
+          steps++;
+          if (out.hits.length < perFileCap) out.hits.push([index, m.index, m[0].length]);
+        }
+      }
+      return ++steps < LITERAL_CHECK_STEPS;
+    };
+    for (let at = eachLine(body, visit); at !== null; at = eachLine(body, visit, at)) {
+      stopped = await checkpoint();
+      if (stopped) break;
+    }
+    charge();
+    if (stopped === "time") out.skipped = true;
+    return { m: out, stopped };
+  };
+  const stop = new AbortController();
+  const onCallerAbort = () => stop.abort();
+  if (signal?.aborted) stop.abort();
+  signal?.addEventListener("abort", onCallerAbort, { once: true });
+  let releaseSlot;
+  try {
+    releaseSlot = await searchSlots.acquire(1, stop.signal);
+  } catch (err) {
+    signal?.removeEventListener("abort", onCallerAbort);
+    if (err instanceof LimiterAbortError) return empty;
+    throw err;
+  }
+  let session = null;
+  let batch = [];
+  let batchChars = 0;
+  const flush = async () => {
+    if (!session || batch.length === 0) return;
+    const pending = batch;
+    batch = [];
+    batchChars = 0;
+    try {
+      const matches = await session.match(pending.map(([, body]) => body));
+      for (let i = 0; i < pending.length && totalHits < globalCap; i++) {
+        const [t, body] = pending[i];
+        record(t, body, matches[i]);
+      }
+    } finally {
+      for (const [, , release] of pending) release();
+    }
+  };
+  try {
+    const targets = await collectTargets(roots, opts);
+    session = regexMode ? openRegexSession({
+      source: pattern.source,
+      flags: pattern.flags,
+      maxLineLen,
+      perFileCap,
+      budgetMs: opts.regexBudgetMs ?? 3e3,
+      signal: stop.signal
+    }) : null;
+    for await (const [t, { body, release }] of readAhead(
+      targets,
+      cache,
+      READ_CONCURRENCY,
+      stop.signal
+    )) {
+      if (stop.signal.aborted || totalHits >= globalCap) {
+        release();
+        break;
+      }
+      if (body === null) continue;
+      if (literalRe) {
+        let stopped;
+        try {
+          const res = await matchLiteral(literalRe, body);
+          stopped = res.stopped;
+          record(t, body, res.m);
+        } finally {
+          release();
+        }
+        if (stopped === "time") truncated = true;
+        if (stopped) break;
+        continue;
+      }
+      batch.push([t, body, release]);
+      batchChars += body.length;
+      if (batch.length >= BATCH_FILES || batchChars >= BATCH_CHARS) await flush();
+    }
+    if (!stop.signal.aborted && totalHits < globalCap) await flush();
+  } catch (err) {
+    if (err instanceof RegexTimeoutError) {
+      timedOut = true;
+      truncated = true;
+    } else if (!(err instanceof RegexAbortError)) {
+      throw err;
+    }
+  } finally {
+    stop.abort();
+    signal?.removeEventListener("abort", onCallerAbort);
+    for (const [, , release] of batch) release();
+    session?.release();
+    releaseSlot();
+  }
+  if (totalHits >= globalCap) truncated = true;
+  return { query, results, truncated, timedOut };
+}
+
+// src/server/hosts.ts
+var LOOPBACK_NAMES = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
+var MAX_HOST_LEN = 253;
+function hostOnly(value) {
+  const h = value.trim().toLowerCase();
+  if (h.startsWith("[")) {
+    const end = h.indexOf("]");
+    return end === -1 ? h : h.slice(0, end + 1);
+  }
+  if (h.indexOf(":") !== h.lastIndexOf(":")) return h;
+  const colon = h.indexOf(":");
+  return colon === -1 ? h : h.slice(0, colon);
+}
+function isAllowedHost(value) {
+  if (!value || value.length > MAX_HOST_LEN) return false;
+  if (!/^[\x21-\x7e]+$/.test(value)) return false;
+  const host = hostOnly(value);
+  return LOOPBACK_NAMES.has(host) || /^[a-z0-9][a-z0-9.-]*\.localhost$/.test(host);
+}
+
+// src/server/routes/api-asset.ts
+import { createReadStream } from "fs";
+import { realpath as realpath4, stat as stat3 } from "fs/promises";
+import path7 from "path";
+
+// src/server/routes/api-file.ts
+import { readFile as readFile2, realpath as realpath3, stat as stat2 } from "fs/promises";
+import path6 from "path";
+
+// src/render/links.ts
+import path5 from "path/posix";
+
+// src/render/html-tags.ts
+function isSpace(c) {
+  return c === 9 || c === 10 || c === 12 || c === 13 || c === 32;
+}
+function isAsciiAlpha(c) {
+  return c >= 65 && c <= 90 || c >= 97 && c <= 122;
+}
+var GT = 62;
+var SLASH = 47;
+var EQ = 61;
+function nameEnd(html, from) {
+  let j = from;
+  while (j < html.length) {
+    const c = html.charCodeAt(j);
+    if (isSpace(c) || c === SLASH || c === GT) break;
+    j++;
+  }
+  return j;
+}
+function readAttrs(html, from, attrs) {
+  const n = html.length;
+  let j = from;
+  for (; ; ) {
+    while (j < n && (isSpace(html.charCodeAt(j)) || html.charCodeAt(j) === SLASH)) j++;
+    if (j >= n) return -1;
+    if (html.charCodeAt(j) === GT) return j + 1;
+    const nameStart = j;
+    j++;
+    while (j < n) {
+      const c = html.charCodeAt(j);
+      if (isSpace(c) || c === SLASH || c === GT || c === EQ) break;
+      j++;
+    }
+    const nameStop = j;
+    let k = j;
+    while (k < n && isSpace(html.charCodeAt(k))) k++;
+    if (k >= n || html.charCodeAt(k) !== EQ) {
+      attrs?.push({
+        name: html.slice(nameStart, nameStop).toLowerCase(),
+        value: null,
+        start: nameStart,
+        end: nameStop
+      });
+      j = k;
+      continue;
+    }
+    k++;
+    while (k < n && isSpace(html.charCodeAt(k))) k++;
+    if (k >= n) return -1;
+    const q = html[k];
+    let valueStart;
+    let valueEnd;
+    if (q === '"' || q === "'") {
+      valueStart = k + 1;
+      valueEnd = html.indexOf(q, valueStart);
+      if (valueEnd < 0) return -1;
+      j = valueEnd + 1;
+    } else {
+      valueStart = k;
+      while (k < n && !isSpace(html.charCodeAt(k)) && html.charCodeAt(k) !== GT) k++;
+      valueEnd = k;
+      j = k;
+    }
+    attrs?.push({
+      name: html.slice(nameStart, nameStop).toLowerCase(),
+      value: html.slice(valueStart, valueEnd),
+      start: nameStart,
+      end: j
+    });
+  }
+}
+function rewriteTags(html, names, rewrite) {
+  const out = [];
+  let copied = 0;
+  let i = 0;
+  const n = html.length;
+  while (i < n) {
+    const lt = html.indexOf("<", i);
+    if (lt < 0) break;
+    const c1 = html.charCodeAt(lt + 1);
+    if (isAsciiAlpha(c1)) {
+      const ne = nameEnd(html, lt + 1);
+      const name = html.slice(lt + 1, ne).toLowerCase();
+      const wanted = names.has(name);
+      const attrs = wanted ? [] : null;
+      const end = readAttrs(html, ne, attrs);
+      if (end < 0) break;
+      if (wanted) {
+        const replaced = rewrite({ name, start: lt, end, attrs });
+        if (replaced !== null) {
+          out.push(html.slice(copied, lt), replaced);
+          copied = end;
+        }
+      }
+      i = end;
+      continue;
+    }
+    if (html.startsWith("<!--", lt)) {
+      const close = html.indexOf("-->", lt + 4);
+      if (close < 0) break;
+      i = close + 3;
+      continue;
+    }
+    if (c1 === SLASH && isAsciiAlpha(html.charCodeAt(lt + 2))) {
+      const end = readAttrs(html, nameEnd(html, lt + 2), null);
+      if (end < 0) break;
+      i = end;
+      continue;
+    }
+    if (c1 === SLASH || c1 === 33 || c1 === 63) {
+      const close = html.indexOf(">", lt + 2);
+      if (close < 0) break;
+      i = close + 1;
+      continue;
+    }
+    i = lt + 1;
+  }
+  if (copied === 0) return html;
+  out.push(html.slice(copied));
+  return out.join("");
+}
+function hasNameAt(s, at, name) {
+  for (let k = 0; k < name.length; k++) {
+    if ((s.charCodeAt(at + k) | 32) !== name.charCodeAt(k)) return false;
+  }
+  return true;
+}
+var STRIPPED = ["meta", "base"];
+var HAS_STRIPPED = /<(?:meta|base)/i;
+var DANGLING_PREFIX = /<(?:m(?:e(?:ta?)?)?|b(?:a(?:se?)?)?)?$/i;
+function popChars(out, count) {
+  let taken = "";
+  while (taken.length < count && out.length > 0) {
+    const last = out.pop();
+    const need = count - taken.length;
+    if (last.length > need) {
+      out.push(last.slice(0, last.length - need));
+      taken = last.slice(last.length - need) + taken;
+    } else {
+      taken = last + taken;
+    }
+  }
+  return taken;
+}
+function stripMetaAndBase(fragment) {
+  if (!HAS_STRIPPED.test(fragment)) return fragment;
+  const out = [];
+  let i = 0;
+  const n = fragment.length;
+  while (i < n) {
+    const lt = fragment.indexOf("<", i);
+    if (lt < 0) break;
+    const after = lt + 5;
+    const c = fragment.charCodeAt(after);
+    const isTarget = STRIPPED.some((name) => hasNameAt(fragment, lt + 1, name)) && (after >= n || isSpace(c) || c === SLASH || c === GT);
+    if (!isTarget) {
+      out.push(fragment.slice(i, lt + 1));
+      i = lt + 1;
+      continue;
+    }
+    if (lt > i) out.push(fragment.slice(i, lt));
+    const end = readAttrs(fragment, after, null);
+    i = end < 0 ? n : end;
+    const tail = popChars(out, 5);
+    const dangling = DANGLING_PREFIX.exec(tail);
+    if (dangling) {
+      out.push(`${tail.slice(0, dangling.index)}&lt;${tail.slice(dangling.index + 1)}`);
+    } else if (tail) {
+      out.push(tail);
+    }
+  }
+  if (i < n) out.push(fragment.slice(i));
+  return out.join("");
+}
+
+// src/render/links.ts
+var MD_EXT_RE = /\.(md|markdown|mdx)$/i;
+var ANCHOR = /* @__PURE__ */ new Set(["a"]);
+var IMG = /* @__PURE__ */ new Set(["img"]);
+var ENTITY = {
+  "&amp;": "&",
+  "&lt;": "<",
+  "&gt;": ">",
+  "&quot;": '"',
+  "&#39;": "'"
+};
+var ESCAPE = {
+  "&": "&amp;",
+  "<": "&lt;",
+  ">": "&gt;",
+  '"': "&quot;",
+  "'": "&#39;"
+};
+function unescapeHtml(s) {
+  return s.replace(/&(?:amp|lt|gt|quot|#39);/g, (e) => ENTITY[e] ?? e);
+}
+function escapeAttr(s) {
+  return s.replace(/[&<>"']/g, (c) => ESCAPE[c] ?? c);
+}
+function firstAttr(tag, name) {
+  return tag.attrs.find((a) => a.name === name);
+}
+function splitHref(href) {
+  const q = href.indexOf("?");
+  const h = href.indexOf("#");
+  if (h >= 0 && (q < 0 || h < q)) return { target: href.slice(0, h), hash: href.slice(h) };
+  if (q < 0) return { target: href };
+  if (h < 0) return { target: href.slice(0, q), query: href.slice(q) };
+  return { target: href.slice(0, q), query: href.slice(q, h), hash: href.slice(h) };
+}
+function tagInternalLinks(html, currentRelPath) {
+  const currentDir = path5.dirname(currentRelPath);
+  return rewriteTags(html, ANCHOR, (tag) => {
+    const attr = firstAttr(tag, "href");
+    if (!attr?.value) return null;
+    const { target: rawTarget, query: rawQuery, hash: rawHash } = splitHref(attr.value);
+    if (!rawTarget || /^https?:\/\//i.test(rawTarget) || rawTarget.startsWith("mailto:")) {
+      return null;
+    }
+    if (!MD_EXT_RE.test(rawTarget)) return null;
+    const target = unescapeHtml(rawTarget);
+    const query = rawQuery === void 0 ? void 0 : unescapeHtml(rawQuery);
+    const hash = rawHash === void 0 ? void 0 : unescapeHtml(rawHash);
+    const resolved = path5.normalize(path5.join(currentDir, target));
+    let decoded;
+    try {
+      decoded = decodeURIComponent(resolved);
+    } catch {
+      decoded = resolved;
+    }
+    const href = `?file=${encodeURIComponent(decoded)}${hash ?? ""}`;
+    const internal = `${decoded}${query ?? ""}${hash ?? ""}`;
+    return html.slice(tag.start, attr.start) + `href="${escapeAttr(href)}" data-internal-link="${escapeAttr(internal)}"` + html.slice(attr.end, tag.end);
+  });
+}
+function rewriteImageSrc(html, currentRelPath) {
+  const currentDir = path5.dirname(currentRelPath);
+  return rewriteTags(html, IMG, (tag) => {
+    const attr = firstAttr(tag, "src");
+    const src = attr?.value;
+    if (!attr || !src) return null;
+    if (/^(https?:\/\/|data:|\/__asset\/)/i.test(src)) return null;
+    const trimmed = src.replace(/^\/+/, "");
+    const resolved = path5.normalize(path5.join(currentDir, trimmed));
+    if (resolved.startsWith("..")) return null;
+    return html.slice(tag.start, attr.start) + `src="/__asset/${resolved.replaceAll('"', "&quot;")}"` + html.slice(attr.end, tag.end);
+  });
+}
+
+// src/render/markdown.ts
+import MarkdownIt from "markdown-it";
+import anchor from "markdown-it-anchor";
+import taskLists from "markdown-it-task-lists";
+
+// src/render/math.ts
+var BLOCK_RE = /^\$\$([\s\S]+?)\$\$$/;
+var INLINE_RE = /\$(?!\s)([^$\n]+?)(?<!\s)\$/g;
+function blockMathHtml(latex) {
+  const encoded = encodeURIComponent(latex.trim());
+  return `<div class="math-block" data-source="${encoded}"></div>
+`;
+}
+function inlineMathHtml(latex) {
+  const encoded = encodeURIComponent(latex);
+  return `<span class="math-inline" data-source="${encoded}"></span>`;
+}
+function convertBlockMath(tokens) {
+  for (let i = 0; i < tokens.length - 2; i++) {
+    if (tokens[i].type === "paragraph_open" && tokens[i + 1].type === "inline" && tokens[i + 2].type === "paragraph_close") {
+      const inline = tokens[i + 1];
+      const trimmed = inline.content.trim();
+      const m = trimmed.match(BLOCK_RE);
+      if (m) {
+        const replacement = new tokens[i].constructor(
+          "html_block",
+          "",
+          0
+        );
+        replacement.content = blockMathHtml(m[1]);
+        tokens.splice(i, 3, replacement);
+      }
+    }
+  }
+}
+function convertInlineMath(tokens) {
+  const TokenCtor = tokens[0]?.constructor;
+  if (!TokenCtor) return;
+  for (const top of tokens) {
+    if (top.type !== "inline" || !top.children) continue;
+    const out = [];
+    for (const child of top.children) {
+      if (child.type !== "text") {
+        out.push(child);
+        continue;
+      }
+      const text = child.content;
+      INLINE_RE.lastIndex = 0;
+      let last = 0;
+      let m;
+      let found = false;
+      while ((m = INLINE_RE.exec(text)) !== null) {
+        found = true;
+        if (m.index > last) {
+          const t = new TokenCtor("text", "", 0);
+          t.content = text.slice(last, m.index);
+          out.push(t);
+        }
+        const mathTok = new TokenCtor("html_inline", "", 0);
+        mathTok.content = inlineMathHtml(m[1]);
+        out.push(mathTok);
+        last = m.index + m[0].length;
+      }
+      if (!found) {
+        out.push(child);
+      } else if (last < text.length) {
+        const t = new TokenCtor("text", "", 0);
+        t.content = text.slice(last);
+        out.push(t);
+      }
+    }
+    top.children = out;
+  }
+}
+function mathPlugin(md2) {
+  md2.core.ruler.after("inline", "mdview-math", (state) => {
+    convertBlockMath(state.tokens);
+    convertInlineMath(state.tokens);
+  });
+}
+
+// src/render/markdown.ts
+var md = new MarkdownIt({
+  html: true,
+  linkify: true,
+  typographer: false,
+  breaks: false,
+  highlight: () => ""
+});
+md.linkify.set({ fuzzyLink: true });
+md.use(anchor, {
+  slugify: (s) => s.toLowerCase().trim().replace(/[^\wÀ-ɏ\s-]/g, "").replace(/\s+/g, "-")
+});
+md.use(taskLists, { enabled: false, label: false });
+md.use(mathPlugin);
+async function renderMarkdown(source, bodyStartLine = 0, palette = DEFAULT_PALETTE) {
+  const tokens = md.parse(source, {});
+  for (const token of tokens) {
+    if (token.type === "heading_open" && token.map) {
+      token.attrSet("data-source-line", String(token.map[0] + bodyStartLine));
+    }
+    if (token.type === "html_block") {
+      token.content = stripMetaAndBase(token.content);
+    } else if (token.type === "inline" && token.children) {
+      for (const child of token.children) {
+        if (child.type === "html_inline") child.content = stripMetaAndBase(child.content);
+      }
+    } else if (token.type === "fence") {
+      const lang = token.info.trim().split(/\s+/)[0] || "text";
+      if (lang === "mermaid") {
+        token.type = "html_block";
+        token.content = `<div class="mermaid-block" data-source="${encodeURIComponent(token.content)}"></div>
+`;
+      } else {
+        const highlighted = await highlightCode(token.content, lang, palette);
+        token.type = "html_block";
+        token.content = highlighted + "\n";
+      }
+    }
+  }
+  const html = md.renderer.render(tokens, md.options, {});
+  return { html, tokens };
+}
+
+// src/render/outline.ts
+function extractOutline(tokens) {
+  const flat = [];
+  for (let i = 0; i < tokens.length; i++) {
+    const t = tokens[i];
+    if (t.type !== "heading_open") continue;
+    const level = Number(t.tag.slice(1));
+    const inline = tokens[i + 1];
+    const id = (t.attrGet("id") ?? "").toString();
+    const text = inline?.content?.trim() ?? "";
+    if (!id || !text) continue;
+    flat.push({ id, text, level, children: [] });
+  }
+  return nest(flat);
+}
+function nest(flat) {
+  const root = [];
+  const stack = [];
+  for (const node of flat) {
+    while (stack.length && stack[stack.length - 1].level >= node.level) {
+      stack.pop();
+    }
+    if (stack.length === 0) {
+      root.push(node);
+    } else {
+      stack[stack.length - 1].children.push(node);
+    }
+    stack.push(node);
+  }
+  return root;
+}
+
+// src/server/routes/api-file.ts
+var MD_FILE_RE = /\.(md|markdown|mdx)$/i;
+var ASSET_URL_RE = /\/__asset\/([^"'<>\s]*)/g;
+var ENTITY2 = {
+  "&amp;": "&",
+  "&lt;": "<",
+  "&gt;": ">",
+  "&quot;": '"',
+  "&#39;": "'"
+};
+function assetRefKey(rel) {
+  return path6.posix.normalize(rel.replace(/^\/+/, ""));
+}
+function collectAssetRefs(html, roots, state) {
+  const refs = /* @__PURE__ */ new Set();
+  for (const m of html.matchAll(ASSET_URL_RE)) {
+    const raw = (m[1] ?? "").replace(/&(?:amp|lt|gt|quot|#39);/g, (e) => ENTITY2[e] ?? e);
+    const bare = raw.split(/[?#]/, 1)[0] ?? "";
+    let decoded;
+    try {
+      decoded = decodeURIComponent(bare);
+    } catch {
+      continue;
+    }
+    const target = parseWorkspacePath(roots, decoded);
+    if (target?.state === state) refs.add(assetRefKey(target.rel));
+  }
+  return refs;
+}
+async function renderDocument(raw, wsRel, palette) {
+  const { data, body, bodyStartLine } = parseFrontmatter(raw);
+  const { html: rawHtml, tokens } = await renderMarkdown(body, bodyStartLine, palette);
+  const html = rewriteImageSrc(tagInternalLinks(rawHtml, wsRel), wsRel);
+  const outline = extractOutline(tokens);
+  const title = (typeof data?.title === "string" ? data.title : null) ?? outline[0]?.text ?? null;
+  return { html, outline, frontmatter: data, title };
+}
+async function documentAssetRefs(roots, state) {
+  if (state.assetRefs) return state.assetRefs;
+  let refs = /* @__PURE__ */ new Set();
+  try {
+    const absPath = await resolveSafePath(state.absPath, state.root.filePath);
+    const st = await stat2(absPath);
+    if (st.isFile() && st.size <= MAX_MARKDOWN_BYTES && MD_FILE_RE.test(absPath)) {
+      const raw = await readFile2(absPath, "utf8");
+      const wsRel = toWorkspacePath(state.root.id, state.root.filePath);
+      const { html } = await renderDocument(raw, wsRel, DEFAULT_PALETTE);
+      refs = collectAssetRefs(html, roots, state);
+    }
+  } catch {
+  }
+  state.assetRefs = refs;
+  return refs;
+}
+function registerApiFile(app, roots) {
+  app.get(
+    "/api/file",
+    async (req, reply) => {
+      const requested = req.query.path?.trim() ?? "";
+      const rawPalette = req.query.palette?.trim() ?? "";
+      const palette = PALETTES.includes(rawPalette) ? rawPalette : DEFAULT_PALETTE;
+      const primary = roots[0];
+      if (!primary) {
+        return reply.code(404).send({ error: "No folders are open" });
+      }
+      let wsPath = requested;
+      if (!wsPath) {
+        if (primary.root.kind !== "file") {
+          return reply.code(400).send({ error: "Missing ?path" });
+        }
+        wsPath = toWorkspacePath(primary.root.id, primary.root.filePath);
+      }
+      const resolved = parseWorkspacePath(roots, wsPath);
+      if (!resolved) {
+        return reply.code(404).send({ error: "File not found" });
+      }
+      const { state, rel } = resolved;
+      const pinned = state.root.kind === "file";
+      if (pinned && rel !== state.root.filePath) {
+        return reply.code(404).send({ error: "File not found in single-file mode" });
+      }
+      if (!MD_FILE_RE.test(rel)) {
+        return reply.code(400).send({ error: "Only markdown files are supported" });
+      }
+      let absPath;
+      let realRoot;
+      try {
+        realRoot = await realpath3(state.absPath);
+        absPath = await resolveSafePath(state.absPath, rel, { realRoot });
+      } catch (err) {
+        if (err instanceof OutsideRootError) {
+          return reply.code(400).send({ error: err.message });
+        }
+        return reply.code(404).send({ error: "File not found" });
+      }
+      if (!MD_FILE_RE.test(absPath)) {
+        return reply.code(400).send({ error: "Only markdown files are supported" });
+      }
+      let raw;
+      let mtimeMs;
+      try {
+        const st = await stat2(absPath);
+        if (!st.isFile()) {
+          return reply.code(404).send({ error: "File not found" });
+        }
+        if (st.size > MAX_MARKDOWN_BYTES) {
+          return reply.code(413).send({ error: "File is too large to render (over 16 MB)" });
+        }
+        raw = await readFile2(absPath, "utf8");
+        mtimeMs = st.mtimeMs;
+      } catch {
+        return reply.code(404).send({ error: "File not found" });
+      }
+      const wsRel = toWorkspacePath(state.root.id, rel);
+      const { html, outline, frontmatter, title } = await renderDocument(raw, wsRel, palette);
+      if (pinned) state.assetRefs = collectAssetRefs(html, roots, state);
+      const result = {
+        relPath: wsRel,
+        html,
+        outline,
+        frontmatter,
+        title,
+        lastModified: mtimeMs
+      };
+      return reply.send(result);
+    }
+  );
+}
+
+// src/server/routes/api-asset.ts
+var MIME = {
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".svg": "image/svg+xml",
+  ".avif": "image/avif",
+  ".bmp": "image/bmp",
+  ".ico": "image/x-icon",
+  ".mp4": "video/mp4",
+  ".webm": "video/webm",
+  ".mov": "video/quicktime",
+  ".mp3": "audio/mpeg",
+  ".wav": "audio/wav"
+};
+var ASSET_SECURITY_HEADERS = {
+  "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; sandbox; frame-ancestors 'none'",
+  "x-content-type-options": "nosniff",
+  "cross-origin-resource-policy": "same-origin"
+};
+function registerApiAsset(app, roots) {
+  app.get("/__asset/*", async (req, reply) => {
+    const wsPath = (req.params["*"] ?? "").replace(/^\/+/, "");
+    const resolved = parseWorkspacePath(roots, wsPath);
+    if (!resolved) {
+      return reply.code(404).send({ error: "Asset not found" });
+    }
+    if (resolved.state.root.kind === "file") {
+      const refs = await documentAssetRefs(roots, resolved.state);
+      if (!refs.has(assetRefKey(resolved.rel))) {
+        return reply.code(404).send({ error: "Asset not found" });
+      }
+    }
+    let abs;
+    let realRoot;
+    try {
+      realRoot = await realpath4(resolved.state.absPath);
+      abs = await resolveSafePath(resolved.state.absPath, resolved.rel, { realRoot });
+    } catch (err) {
+      if (err instanceof OutsideRootError) {
+        return reply.code(400).send({ error: err.message });
+      }
+      return reply.code(404).send({ error: "Asset not found" });
+    }
+    if (hasDotSegment(resolved.rel) || hasDotSegment(path7.relative(realRoot, abs))) {
+      return reply.code(404).send({ error: "Asset not found" });
+    }
+    let st;
+    try {
+      st = await stat3(abs);
+    } catch {
+      return reply.code(404).send({ error: "Asset not found" });
+    }
+    if (!st.isFile()) {
+      return reply.code(404).send({ error: "Not a file" });
+    }
+    const mime = MIME[path7.extname(abs).toLowerCase()];
+    if (!mime || !MIME[path7.extname(resolved.rel).toLowerCase()]) {
+      return reply.code(404).send({ error: "Asset type not allowed" });
+    }
+    reply.header("content-type", mime);
+    reply.header("content-length", st.size);
+    reply.header("cache-control", "no-cache");
+    return reply.send(createReadStream(abs));
+  });
+}
+
+// src/server/routes/api-search.ts
+var MAX_QUERY_LEN = 200;
+function isTrue(v) {
+  return v === "1" || v === "true";
+}
+function registerApiSearch(app, roots, opts = {}) {
+  const cache = opts.cache ?? new ContentCache();
+  app.get("/api/search", async (req, reply) => {
+    const q = (req.query.q ?? "").trim();
+    if (q.length === 0) {
+      return reply.send({ query: "", results: [], truncated: false, timedOut: false });
+    }
+    if (q.length > MAX_QUERY_LEN) {
+      return reply.code(400).send({ error: "Query too long" });
+    }
+    const searchable = roots.filter((r) => r.root.kind === "dir").map((r) => ({ absPath: r.absPath, id: r.root.id, ignore: r.ignoreSet }));
+    const ac = new AbortController();
+    const onClose = () => {
+      if (!reply.raw.writableFinished) ac.abort();
+    };
+    reply.raw.once("close", onClose);
+    try {
+      const out = await grepFiles(searchable, q, {
+        caseSensitive: isTrue(req.query.case),
+        wholeWord: isTrue(req.query.word),
+        regex: isTrue(req.query.regex),
+        cache,
+        signal: ac.signal,
+        ...opts.regexBudgetMs !== void 0 ? { regexBudgetMs: opts.regexBudgetMs } : {}
+      });
+      return reply.send(out);
+    } catch {
+      return reply.code(500).send({ error: "Search failed" });
+    } finally {
+      reply.raw.off("close", onClose);
+    }
+  });
+}
+
+// src/server/routes/api-tree.ts
+import path8 from "path";
+function applyOverrides(config, paletteOverride) {
+  if (!paletteOverride) return config;
+  return { ...config ?? {}, palette: paletteOverride };
+}
+async function rootChildren(state) {
+  const { id, kind, filePath } = state.root;
+  if (kind === "file") {
+    return [
+      {
+        name: path8.basename(filePath),
+        relPath: toWorkspacePath(id, filePath),
+        type: "file",
+        isMarkdown: true
+      }
+    ];
+  }
+  return walkFolder(state.absPath, { ignore: state.ignoreSet, relBase: id });
+}
+function registerApiTree(app, roots, paletteOverride) {
+  app.get("/api/tree", async (_req, reply) => {
+    const config = applyOverrides(roots[0]?.config ?? null, paletteOverride);
+    if (roots.length === 1) {
+      const only = roots[0];
+      return reply.send({
+        roots: [only.root],
+        tree: await rootChildren(only),
+        config
+      });
+    }
+    const tree = [];
+    for (const state of roots) {
+      tree.push({
+        name: state.root.name,
+        relPath: state.root.id,
+        type: "dir",
+        children: await rootChildren(state)
+      });
+    }
+    return reply.send({ roots: roots.map((r) => r.root), tree, config });
+  });
+}
+
+// src/server/routes/health.ts
+function registerHealth(app, identity, roots) {
+  app.get(
+    "/api/health",
+    async (_req, reply) => reply.send({
+      ok: true,
+      pid: identity.pid,
+      startedAt: identity.startedAt,
+      version: identity.version,
+      roots: roots.map((r) => r.root.id)
+    })
+  );
+}
+
+// src/server/routes/sse.ts
+function registerSse(app, hub, hooks = {}) {
+  let clients = 0;
+  app.get("/api/watch", (req, reply) => {
+    reply.raw.writeHead(200, {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache, no-transform",
+      Connection: "keep-alive",
+      "X-Accel-Buffering": "no",
+      // Written straight to the socket, so the onSend hook that adds this to
+      // every other response never sees the stream.
+      "X-Content-Type-Options": "nosniff"
+    });
+    reply.raw.write(": connected\n\n");
+    let closed = false;
+    clients++;
+    hooks.onClientsChanged?.(clients);
+    const cleanup = () => {
+      if (closed) return;
+      closed = true;
+      clearInterval(heartbeat);
+      hub.off("event", send);
+      clients--;
+      hooks.onClientsChanged?.(clients);
+      try {
+        reply.raw.end();
+      } catch {
+      }
+    };
+    const send = (e) => {
+      if (closed) return;
+      try {
+        reply.raw.write(`event: ${e.kind}
+`);
+        reply.raw.write(`data: ${JSON.stringify(e)}
+
+`);
+      } catch {
+        cleanup();
+      }
+    };
+    const heartbeat = setInterval(() => {
+      if (closed) return;
+      try {
+        reply.raw.write(": hb\n\n");
+      } catch {
+        cleanup();
+      }
+    }, 15e3);
+    hub.on("event", send);
+    req.raw.on("close", cleanup);
+    req.raw.on("error", cleanup);
+    reply.raw.on("error", cleanup);
+    reply.raw.on("close", cleanup);
+  });
+}
+
+// src/server/watcher.ts
+import { EventEmitter } from "events";
+import path9 from "path";
+import chokidar from "chokidar";
+function createEventHub() {
+  const emitter = new EventEmitter();
+  emitter.setMaxListeners(0);
+  return {
+    on: (event, listener) => emitter.on(event, listener),
+    off: (event, listener) => emitter.off(event, listener),
+    emitSynthetic: (e) => emitter.emit("event", e),
+    close: async () => {
+      emitter.removeAllListeners();
+    }
+  };
+}
+function createWatcher(rootAbsPath, opts = {}) {
+  const emitter = new EventEmitter();
+  emitter.setMaxListeners(0);
+  const ignore = opts.ignore ?? DEFAULT_IGNORED_DIRS2;
+  const prefix = opts.prefix ?? "";
+  const only = opts.only === void 0 ? void 0 : path9.join(rootAbsPath, opts.only);
+  const scope = only === void 0 ? { ignored: (p) => isPathIgnored(p, rootAbsPath, ignore) } : { ignored: (p) => p !== rootAbsPath && p !== only, depth: 0 };
+  const watcher = chokidar.watch(rootAbsPath, {
+    ignoreInitial: true,
+    ...scope,
+    persistent: true,
+    // chokidar follows links by default, so a repo holding `link -> /` would
+    // have it walk and watch the whole disk. The server serves nothing through
+    // a link that leaves the root anyway.
+    followSymlinks: false,
+    awaitWriteFinish: { stabilityThreshold: 60, pollInterval: 30 }
+  });
+  watcher.on("error", (err) => {
+    const e = err;
+    if (e?.code === "EMFILE" || e?.code === "ENOSPC") {
+      console.error(
+        `[mdview] file watcher hit ${e.code} while watching ${rootAbsPath}
+  Path: ${e.path ?? "(unknown)"}
+  Likely cause: a heavy directory (build output, deps) wasn't ignored.
+  Fix: add the directory name to "ignore" in ~/.config/mdview/config.json, e.g.
+    { "ignore": ["deps", "_site"] }
+  Built-in skips already cover ${[...DEFAULT_IGNORED_DIRS2].join(", ")}.`
+      );
+    } else {
+      console.error(`[mdview] watcher error: ${e?.message ?? String(err)}`);
+    }
+  });
+  function emit(kind, abs) {
+    const rel = path9.relative(rootAbsPath, abs).split(path9.sep).join("/");
+    if (!rel) return;
+    const relPath = prefix ? `${prefix}/${rel}` : rel;
+    emitter.emit("event", { kind, relPath });
+  }
+  watcher.on("change", (p) => emit("change", p));
+  watcher.on("add", (p) => emit("add", p));
+  watcher.on("unlink", (p) => emit("unlink", p));
+  return {
+    on: (event, listener) => emitter.on(event, listener),
+    off: (event, listener) => emitter.off(event, listener),
+    emitSynthetic: (e) => emitter.emit("event", e),
+    close: () => watcher.close()
+  };
+}
+
+// src/server/index.ts
+function buildCspHtml(embedMode) {
+  const directives = [
+    "default-src 'self'",
+    "script-src 'self'",
+    // KaTeX and the diagram renderer set inline style attributes on their
+    // output; the rest of the policy is strict.
+    "style-src 'self' 'unsafe-inline'",
+    "img-src 'self' data:",
+    "font-src 'self' data:",
+    "connect-src 'self'",
+    // Nothing in the SPA frames or embeds documents. A same-origin frame of an
+    // /__asset/* URL would otherwise run as a document of its own.
+    "frame-src 'none'",
+    "object-src 'none'",
+    "base-uri 'none'",
+    "form-action 'none'"
+  ];
+  if (!embedMode) directives.push("frame-ancestors 'none'");
+  return directives.join("; ");
+}
+var EMBED_TOKEN_HEADER = "x-mdview-embed-token";
+function tokenMatcher(expected) {
+  const want = Buffer.from(expected, "utf8");
+  return (presented) => {
+    if (typeof presented !== "string") return false;
+    const got = Buffer.from(presented, "utf8");
+    return got.length === want.length && timingSafeEqual(got, want);
+  };
+}
+function queryToken(req) {
+  return req.query?.token;
+}
+async function createServer(opts) {
+  const app = Fastify({ logger: false });
+  const embedToken = opts.embedToken;
+  if (embedToken !== void 0 && embedToken.length === 0) {
+    throw new Error("Embed mode needs a non-empty token");
+  }
+  const embedMode = embedToken !== void 0;
+  const embedTokenMatches = embedMode ? tokenMatcher(embedToken) : () => true;
+  const cspHtml = buildCspHtml(embedMode);
+  app.addHook("onRequest", async (req, reply) => {
+    if (!isAllowedHost(req.headers.host)) {
+      return reply.code(403).type("text/plain; charset=utf-8").send("Forbidden");
+    }
+    if (embedMode && (req.url.startsWith("/api/") || req.routeOptions.url?.startsWith("/api/")) && !embedTokenMatches(req.headers[EMBED_TOKEN_HEADER]) && !embedTokenMatches(queryToken(req))) {
+      return reply.code(403).type("text/plain; charset=utf-8").send("Forbidden");
+    }
+  });
+  app.addHook("onSend", async (req, reply, payload) => {
+    reply.header("x-content-type-options", "nosniff");
+    const ct = String(reply.getHeader("content-type") ?? "");
+    if (embedMode && ct.startsWith("text/html") && !embedTokenMatches(queryToken(req))) {
+      payload?.destroy?.();
+      for (const h of ["content-length", "etag", "last-modified", "accept-ranges"]) {
+        reply.removeHeader(h);
+      }
+      reply.code(403);
+      reply.header("content-type", "text/plain; charset=utf-8");
+      reply.header("cache-control", "no-store");
+      return "Forbidden";
+    }
+    if (req.routeOptions.url === "/__asset/*" || req.url.startsWith("/__asset/") || ct.startsWith("image/svg+xml")) {
+      reply.headers(ASSET_SECURITY_HEADERS);
+      return payload;
+    }
+    if (ct.startsWith("text/html")) {
+      reply.header("content-security-policy", cspHtml);
+      reply.header("referrer-policy", "no-referrer");
+    }
+    return payload;
+  });
+  const roots = [];
+  const configWatchers = /* @__PURE__ */ new Map();
+  const hub = createEventHub();
+  const searchCache = new ContentCache();
+  hub.on("event", (e) => {
+    if (e.kind === "workspace") {
+      searchCache.clear();
+      return;
+    }
+    if (e.kind === "config") return;
+    const target = parseWorkspacePath(roots, e.relPath);
+    if (target) searchCache.invalidate(ContentCache.keyFor(target.state.absPath, target.rel));
+  });
+  async function openRoot(spec, id) {
+    const config = await loadEffectiveConfig(spec.absPath);
+    const ignoreSet = buildIgnoreSet(config?.ignore ?? []);
+    const root = describeRoot(spec, id);
+    const state = {
+      root,
+      absPath: spec.absPath,
+      ignoreSet,
+      config,
+      watcher: createWatcher(spec.absPath, {
+        ignore: ignoreSet,
+        prefix: id,
+        ...root.kind === "file" ? { only: root.filePath } : {}
+      })
+    };
+    state.watcher.on("event", (e) => {
+      if (root.kind === "file") state.assetRefs = void 0;
+      hub.emitSynthetic(e);
+    });
+    const configWatcher = chokidar2.watch(path10.join(spec.absPath, CONFIG_FILENAME), {
+      ignoreInitial: true,
+      persistent: true,
+      // A `.mdview.json` that links to a directory would otherwise be walked
+      // and watched recursively.
+      followSymlinks: false,
+      awaitWriteFinish: { stabilityThreshold: 60, pollInterval: 30 }
+    });
+    const reloadConfig = async () => {
+      state.config = await loadEffectiveConfig(spec.absPath);
+      const event = { kind: "config", relPath: `${id}/${CONFIG_FILENAME}` };
+      hub.emitSynthetic(event);
+    };
+    configWatcher.on("add", () => void reloadConfig());
+    configWatcher.on("change", () => void reloadConfig());
+    configWatcher.on("unlink", () => void reloadConfig());
+    configWatchers.set(id, configWatcher);
+    return state;
+  }
+  async function closeRoot(state) {
+    const cw = configWatchers.get(state.root.id);
+    configWatchers.delete(state.root.id);
+    await Promise.all([state.watcher.close(), cw?.close()]);
+  }
+  async function setRoots(specs) {
+    const taken = /* @__PURE__ */ new Set();
+    const wanted = specs.map((spec) => {
+      const id = resolveRootId(spec, taken);
+      taken.add(id);
+      return { id, spec };
+    });
+    const keep = new Map(
+      roots.filter((r) => wanted.some((w) => w.id === r.root.id && w.spec.absPath === r.absPath)).map((r) => [r.root.id, r])
+    );
+    const dropped = roots.filter((r) => !keep.has(r.root.id));
+    const next = [];
+    for (const { id, spec } of wanted) {
+      const existing = keep.get(id);
+      next.push(existing ?? await openRoot(spec, id));
+    }
+    roots.length = 0;
+    roots.push(...next);
+    await Promise.all(dropped.map(closeRoot));
+    hub.emitSynthetic({ kind: "workspace" });
+  }
+  {
+    const taken = /* @__PURE__ */ new Set();
+    for (const spec of opts.roots) {
+      const id = resolveRootId(spec, taken);
+      taken.add(id);
+      roots.push(await openRoot(spec, id));
+    }
+  }
+  registerApiFile(app, roots);
+  registerApiTree(app, roots, opts.paletteOverride);
+  registerApiAsset(app, roots);
+  registerApiSearch(app, roots, { cache: searchCache });
+  registerSse(app, hub, { ...opts.onSseClientsChanged ? { onClientsChanged: opts.onSseClientsChanged } : {} });
+  if (opts.identity) registerHealth(app, opts.identity, roots);
+  await app.register(import("@fastify/static"), {
+    root: opts.clientDir,
+    prefix: "/"
+  });
+  app.setNotFoundHandler(async (req, reply) => {
+    if (req.url.startsWith("/api/") || req.url.startsWith("/__asset/")) {
+      reply.code(404).send({ error: "Not found" });
+      return;
+    }
+    const qIndex = req.url.indexOf("?");
+    const rawPath = qIndex >= 0 ? req.url.slice(0, qIndex) : req.url;
+    if (/[\r\n]/.test(rawPath)) {
+      reply.code(404).send({ error: "Not found" });
+      return;
+    }
+    if (/\.(md|markdown|mdx)$/i.test(rawPath)) {
+      const relPath = rawPath.replace(/^\/+/, "");
+      const params = new URLSearchParams({ file: relPath });
+      for (const key of ["embed", "token"]) {
+        const value = req.query[key];
+        if (typeof value === "string") params.set(key, value);
+      }
+      const location = `/?${params.toString()}`;
+      reply.code(302).header("Location", location).send();
+      return;
+    }
+    return reply.sendFile("index.html");
+  });
+  app.addHook("onClose", async () => {
+    await Promise.all([
+      ...roots.map((r) => r.watcher.close()),
+      ...[...configWatchers.values()].map((w) => w.close())
+    ]);
+    await hub.close();
+    await closeRegexWorkers();
+  });
+  return { app, setRoots };
+}
+export {
+  EMBED_TOKEN_HEADER,
+  createServer
+};
+//# sourceMappingURL=server-KALIU7HM.mjs.map