@naru-pub/dev 0.0.0-stage → 1.1.0

package/dist/chunk-CQFKRWOD.mjs

@@ -0,0 +1,1230 @@
+// src/naru.ts
+import { spawn } from "node:child_process";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { existsSync, watch } from "node:fs";
+import {
+  mkdir,
+  mkdtemp,
+  readFile,
+  readdir,
+  rename,
+  rm,
+  stat,
+  writeFile
+} from "node:fs/promises";
+import {
+  createServer
+} from "node:http";
+import { connect, createServer as createNetServer } from "node:net";
+import { tmpdir } from "node:os";
+import { dirname, extname, join, relative, resolve, sep } from "node:path";
+
+// ../control-plane/src/lib/site-data/validation.ts
+var NAME = /^[a-zA-Z0-9_-]{1,64}$/;
+var MAX_DOCUMENT_BYTES = 64 * 1024;
+var MAX_SITE_BYTES = 100 * 1024 * 1024;
+var DataError = class extends Error {
+  constructor(status, message, code, details, site) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.details = details;
+    this.site = site;
+  }
+};
+function name(value) {
+  if (typeof value !== "string" || !NAME.test(value)) {
+    throw new DataError(
+      400,
+      "Names must contain 1\u201364 letters, numbers, underscores or hyphens."
+    );
+  }
+  return value;
+}
+function functionModule(value) {
+  if (typeof value !== "string")
+    throw new DataError(400, "Invalid function module.");
+  return value.split("/").map(name).join("/");
+}
+function functionReference(value) {
+  const parts = value.split(":");
+  if (parts.length !== 2) throw new DataError(404, "Not found.");
+  return { file: functionModule(parts[0]), fn: name(parts[1]) };
+}
+
+// ../control-plane/src/lib/site-data/filters.ts
+var MAX_FILTER_BYTES = 2048;
+function parseFilterQuery(raw) {
+  if (raw === null) return void 0;
+  if (Buffer.byteLength(raw) > MAX_FILTER_BYTES)
+    throw new DataError(400, "Filter exceeds 2048 bytes.");
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new DataError(400, "filter must be a JSON object.");
+  }
+}
+
+// ../control-plane/src/lib/site-data/live-ticket.ts
+var TICKET_MS = 6e4;
+var base64url = (bytes) => btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+async function key(secret) {
+  return crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(`naru-live-ticket:${secret}`),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign", "verify"]
+  );
+}
+async function signLiveTicket(secret, site, member, now = Date.now()) {
+  const payload = base64url(
+    new TextEncoder().encode(
+      JSON.stringify({ s: site, m: member, e: now + TICKET_MS })
+    )
+  );
+  const signature = new Uint8Array(
+    await crypto.subtle.sign(
+      "HMAC",
+      await key(secret),
+      new TextEncoder().encode(payload)
+    )
+  );
+  return `${payload}.${base64url(signature)}`;
+}
+var OWNER_TICKET = "~owner";
+
+// ../control-plane/src/lib/site-data/protocol.ts
+var OWNER_EXPIRES = "Naru-Owner-Expires";
+var OWNER_EXPIRES_IN = "Naru-Owner-Expires-In";
+var publicHeaders = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
+  "Access-Control-Allow-Headers": "Content-Type, Authorization",
+  // A token renews as it is used, so the SDK is told the expiry it now has;
+  // a 429 says when its limit resets.
+  "Access-Control-Expose-Headers": `${OWNER_EXPIRES}, ${OWNER_EXPIRES_IN}, Retry-After`,
+  "Access-Control-Max-Age": "600"
+};
+function encodeRevision(version) {
+  if (!Number.isSafeInteger(version) || Number(version) < 1)
+    throw new Error("Invalid stored document version.");
+  return `r1.${Number(version).toString(36)}`;
+}
+function decodeRevision(value) {
+  if (value === null) return void 0;
+  const match = /^r1\.([0-9a-z]+)$/.exec(value);
+  const version = match ? Number.parseInt(match[1], 36) : NaN;
+  if (!Number.isSafeInteger(version) || version < 1)
+    throw new DataError(400, "Invalid revision.");
+  return version;
+}
+function websiteCondition(url) {
+  const revision = url.searchParams.get("ifRevision");
+  const absent = url.searchParams.get("ifAbsent");
+  if (revision !== null && absent !== null)
+    throw new DataError(400, "Use one write condition.");
+  return absent === "1" ? 0 : decodeRevision(revision);
+}
+function publicResult(value) {
+  if (Array.isArray(value)) return value.map(publicResult);
+  if (value instanceof Date) return value;
+  if (!value || typeof value !== "object") return value;
+  const record = value;
+  return Object.fromEntries(
+    Object.entries(record).flatMap(
+      ([key2, item]) => key2 === "version" ? [["revision", encodeRevision(item)]] : [[key2, key2 === "data" ? item : publicResult(item)]]
+    )
+  );
+}
+var CALLS = {
+  _query: "query",
+  _mutate: "mutation"
+};
+
+// ../control-plane/src/lib/site-functions/routes.ts
+var NO_ROUTES = Object.freeze({
+  include: [],
+  exclude: []
+});
+var MAX_RULES = 100;
+var MAX_RULE_LENGTH = 100;
+var refused = (message) => new DataError(400, `_naru/routes.json: ${message}`);
+function routeRules(text) {
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    throw refused("not JSON.");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw refused('an object of "version", "include" and "exclude".');
+  const {
+    version,
+    include,
+    exclude = [],
+    ...rest
+  } = value;
+  if (Object.keys(rest).length)
+    throw refused(
+      `unknown ${Object.keys(rest).map((key2) => `"${key2}"`).join(", ")}.`
+    );
+  if (version !== 1) throw refused('"version" is 1.');
+  const rules = (list, name2) => {
+    if (!Array.isArray(list)) throw refused(`"${name2}" is a list of paths.`);
+    for (const rule of list)
+      if (typeof rule !== "string" || !rule.startsWith("/") || rule.length > MAX_RULE_LENGTH)
+        throw refused(
+          `${JSON.stringify(rule)} in "${name2}" is not a path from / of at most ${MAX_RULE_LENGTH} characters.`
+        );
+    return list;
+  };
+  const routes = {
+    include: rules(include, "include"),
+    exclude: rules(exclude, "exclude")
+  };
+  if (!routes.include.length) throw refused('"include" needs a path.');
+  if (routes.include.length + routes.exclude.length > MAX_RULES)
+    throw refused(`at most ${MAX_RULES} rules.`);
+  return routes;
+}
+function takes(rule, pathname) {
+  const parts = rule.split("*");
+  if (parts.length === 1) return rule === pathname;
+  if (!pathname.startsWith(parts[0]) || !pathname.endsWith(parts.at(-1)))
+    return false;
+  let at = parts[0].length;
+  const end = pathname.length - parts.at(-1).length;
+  if (end < at) return false;
+  for (const part of parts.slice(1, -1)) {
+    const found = pathname.indexOf(part, at);
+    if (found < 0 || found + part.length > end) return false;
+    at = found + part.length;
+  }
+  return true;
+}
+function routed(rules, pathname) {
+  return !rules.exclude.some((rule) => takes(rule, pathname)) && rules.include.some((rule) => takes(rule, pathname));
+}
+var BODY_TYPES = [
+  "text/html",
+  "text/plain",
+  "text/css",
+  "text/calendar",
+  "text/xml",
+  "application/xml",
+  "application/rss+xml",
+  "application/atom+xml",
+  "application/json"
+];
+var invalid = (message) => new DataError(500, `The route answered ${message}`);
+function routeAnswer(value) {
+  if (typeof value === "string")
+    return { status: 200, cache: 0, body: value, type: "text/html" };
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw invalid("neither HTML nor { body }, { file } or { redirect }.");
+  const answer = value;
+  const status = answer.status ?? (answer.redirect !== void 0 ? 302 : 200);
+  if (!Number.isInteger(status) || status < 200 || status > 599)
+    throw invalid("a status outside 200\u2013599.");
+  const cache = answer.cache ?? 0;
+  if (!Number.isInteger(cache) || cache < 0 || cache > 300)
+    throw invalid("a cache other than 0\u2013300 seconds.");
+  const base = { status, cache };
+  if (typeof answer.body === "string") {
+    if (typeof answer.type !== "string" || !BODY_TYPES.includes(answer.type))
+      throw invalid(
+        `a body whose type is not one of ${BODY_TYPES.join(", ")}.`
+      );
+    return { ...base, body: answer.body, type: answer.type };
+  }
+  if (typeof answer.file === "string") {
+    const file = answer.file.replace(/^\/+/, "");
+    if (!file || file.split("/").some((part) => part === ".." || part === "."))
+      throw invalid("a file outside the site.");
+    if (answer.head !== void 0 && typeof answer.head !== "string")
+      throw invalid("a head that is not a string.");
+    return { ...base, file, head: answer.head ?? "" };
+  }
+  if (typeof answer.redirect === "string") {
+    if (![301, 302, 303, 307, 308].includes(base.status))
+      throw invalid("a redirect without a redirect status.");
+    if (!/^(\/(?!\/)|https:\/\/)/.test(answer.redirect))
+      throw invalid("a redirect to neither a path nor an https URL.");
+    return { ...base, redirect: answer.redirect };
+  }
+  throw invalid("neither HTML nor { body }, { file } or { redirect }.");
+}
+function withHead(html, head) {
+  if (!head) return html;
+  const at = html.search(/<\/head\s*>/i);
+  return at < 0 ? head + html : html.slice(0, at) + head + html.slice(at);
+}
+
+// src/naru.ts
+var OWNER = "1";
+var SITE_NAME = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+var FOLDERS = ["modules", "migrations", "queries", "mutations"];
+var ROUTE_FILES = ["routes.json", "routes.js"];
+var MEDIA_ORIGIN = "https://media.naru.pub";
+var TYPES = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".json": "application/json",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".ico": "image/x-icon",
+  ".txt": "text/plain; charset=utf-8",
+  ".xml": "application/xml",
+  ".wasm": "application/wasm",
+  ".woff2": "font/woff2",
+  ".ts": "text/plain; charset=utf-8"
+};
+var freePort = () => new Promise((done, fail) => {
+  const probe = createNetServer().listen(0, "127.0.0.1", () => {
+    const { port } = probe.address();
+    probe.close(() => done(port));
+  });
+  probe.on("error", fail);
+});
+async function readBody(req) {
+  const chunks = [];
+  for await (const chunk of req) chunks.push(chunk);
+  return Buffer.concat(chunks);
+}
+var json = (res, status, value) => res.writeHead(status, {
+  "content-type": "application/json",
+  "cache-control": "no-store"
+}).end(JSON.stringify(value));
+var escape = (text) => text.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+var shortest = (path) => {
+  const near = relative(process.cwd(), path) || ".";
+  return near.length < path.length ? near : path;
+};
+async function files(dir) {
+  if (!existsSync(dir)) return [];
+  const found = [];
+  for (const entry of await readdir(dir, { withFileTypes: true })) {
+    const path = join(dir, entry.name);
+    if (entry.isDirectory()) found.push(...await files(path));
+    else if (/\.(m?js|sql)$/.test(entry.name)) found.push(path);
+  }
+  return found;
+}
+async function start(options, resources) {
+  const folder = resolve(options.site);
+  const site = options.name ?? "localsite";
+  if (!SITE_NAME.test(site))
+    throw new TypeError(
+      "The site's name is a Naru login name: lowercase letters, digits, hyphens."
+    );
+  if (!existsSync(folder)) throw new Error(`There is no folder ${folder}.`);
+  const madeState = !options.state;
+  const state = options.state ? resolve(options.state) : await mkdtemp(join(tmpdir(), "naru-dev-"));
+  const mediaDir = join(state, "media", OWNER);
+  const bucketDir = join(state, "bucket");
+  await mkdir(mediaDir, { recursive: true });
+  let output = "";
+  const log = (line) => {
+    output += `${line}
+`;
+    if (!options.quiet) console.log(line);
+  };
+  const warn = (line) => {
+    output += `${line}
+`;
+    if (!options.quiet) console.error(line);
+  };
+  const secret = randomBytes(24).toString("base64url");
+  let origin = "";
+  let workerUrl = "";
+  let workerPort = 0;
+  let ready;
+  const started = new Promise((done) => ready = done);
+  const bucketPath = (key2) => {
+    const path = resolve(bucketDir, key2);
+    if (!path.startsWith(bucketDir + sep))
+      throw new DataError(400, "Invalid key.");
+    return path;
+  };
+  async function bucketKeys(dir) {
+    if (!existsSync(dir)) return [];
+    const found = [];
+    for (const entry of await readdir(dir, { withFileTypes: true })) {
+      const path = join(dir, entry.name);
+      if (entry.isDirectory()) found.push(...await bucketKeys(path));
+      else if (!entry.name.endsWith(".naru-dev-partial")) found.push(path);
+    }
+    return found;
+  }
+  async function bucket(req, res, url) {
+    if (req.headers.authorization !== `Bearer ${secret}`)
+      return res.writeHead(401).end();
+    const rest = url.pathname.slice("/_naru-dev/bucket/".length);
+    if (rest === "list") {
+      const prefix = url.searchParams.get("prefix") ?? "";
+      const objects = [];
+      for (const path2 of (await bucketKeys(bucketDir)).sort()) {
+        const key3 = relative(bucketDir, path2).split(sep).join("/");
+        if (!key3.startsWith(prefix)) continue;
+        const info = await stat(path2);
+        objects.push({
+          key: key3,
+          size: info.size,
+          etag: `${info.size}-${info.mtimeMs}`,
+          uploaded: info.mtime.toISOString()
+        });
+      }
+      return json(res, 200, { objects, truncated: false });
+    }
+    if (!rest.startsWith("objects/")) return res.writeHead(404).end();
+    const key2 = rest.slice("objects/".length).split("/").map(decodeURIComponent).join("/");
+    const path = bucketPath(key2);
+    if (req.method === "GET") {
+      if (!existsSync(path)) return res.writeHead(404).end();
+      const content = await readFile(path);
+      const info = await stat(path);
+      return res.writeHead(200, {
+        etag: `${info.size}-${info.mtimeMs}`,
+        "content-length": content.length
+      }).end(content);
+    }
+    if (req.method === "PUT") {
+      const body = await readBody(req);
+      if (req.headers["if-none-match"] === "*" && existsSync(path))
+        return res.writeHead(412).end();
+      await mkdir(dirname(path), { recursive: true });
+      const partial = `${path}.${randomBytes(6).toString("hex")}.naru-dev-partial`;
+      try {
+        await writeFile(partial, body);
+        await rename(partial, path);
+      } catch (error) {
+        await rm(partial, { force: true });
+        throw error;
+      }
+      return res.writeHead(200).end();
+    }
+    if (req.method === "DELETE") {
+      await rm(path, { force: true });
+      return res.writeHead(204).end();
+    }
+    return res.writeHead(405).end();
+  }
+  async function object(operation, input) {
+    const response = await fetch(`${workerUrl}/v1/sites/${site}/${operation}`, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${secret}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify(input)
+    });
+    const answer = await response.json();
+    if (answer.error)
+      throw new DataError(
+        answer.error.status,
+        answer.error.message,
+        answer.error.code,
+        answer.error.details,
+        answer.error.site
+      );
+    return answer.value;
+  }
+  let worker = null;
+  let stopping = false;
+  async function startWorker() {
+    workerPort = await freePort();
+    workerUrl = `http://127.0.0.1:${workerPort}`;
+    const objects = join(state, "worker", "v3", "do");
+    await mkdir(objects, { recursive: true });
+    const child = spawn(
+      resources.workerd,
+      [
+        "serve",
+        join(resources.workerDir, "config.capnp"),
+        "--directory-path",
+        `site-objects=${objects}`,
+        "--directory-path",
+        `sdk-files=${resources.sdkDir}`,
+        "--socket-addr",
+        `http=127.0.0.1:${workerPort}`
+      ],
+      {
+        cwd: resources.workerDir,
+        env: {
+          ...process.env,
+          EDGE_WORKER_SECRET: secret,
+          PASSTHROUGH_ORIGIN: origin.replace("localhost", "127.0.0.1"),
+          SITE_BUCKET_URL: `${origin.replace("localhost", "127.0.0.1")}/_naru-dev/bucket/`
+        },
+        stdio: ["ignore", "pipe", "pipe"]
+      }
+    );
+    worker = child;
+    const orphaned = () => child.kill();
+    process.on("exit", orphaned);
+    child.once("exit", () => process.off("exit", orphaned));
+    const relay = (chunk) => {
+      for (const line of chunk.toString("utf8").split("\n"))
+        if (line.trim() && !/compatibility flag nodejs_compat became/.test(line))
+          warn(line);
+    };
+    child.stdout.on("data", relay);
+    child.stderr.on("data", relay);
+    let exited;
+    child.once("exit", (code) => {
+      exited = code;
+      if (!stopping) warn(`naru-dev: the edge Worker stopped (${code}).`);
+    });
+    for (let tries = 0; ; tries++) {
+      if (exited !== void 0)
+        throw new Error(`The edge Worker exited (${exited}):
+${output}`);
+      try {
+        if ((await fetch(`${workerUrl}/healthz`)).ok) break;
+      } catch {
+      }
+      if (tries > 300) throw new Error("The edge Worker did not start.");
+      await new Promise((done) => setTimeout(done, 100));
+    }
+  }
+  async function publish(path, publishing = true) {
+    const inside = relative(join(folder, "_naru"), path).split(sep);
+    const root = inside.length === 1 && ROUTE_FILES.includes(inside[0]);
+    const kind = root ? "root" : inside[0];
+    if (!root && (!FOLDERS.includes(kind) || !(kind === "migrations" ? /\.sql$/ : /\.m?js$/).test(path)))
+      return;
+    const file = root ? inside[0] : inside.slice(1).join("/").replace(/\.(m?js|sql)$/, "");
+    const source = existsSync(path) ? await readFile(path, "utf8") : null;
+    try {
+      await object("putFunctions", {
+        site,
+        folder: kind,
+        file,
+        source,
+        publish: publishing
+      });
+      if (publishing) {
+        log(`published _naru/ (${root ? file : `${kind}/${file}`} changed)`);
+        await writeTypes();
+      }
+    } catch (error) {
+      warn(
+        `_naru/${root ? file : `${kind}/${file}`}: ${error.message}`
+      );
+    }
+  }
+  const SETTLE_MS = 200;
+  const changed = /* @__PURE__ */ new Set();
+  const settled = /* @__PURE__ */ new Set();
+  let settling;
+  let draining = false;
+  function republish(path) {
+    changed.add(path);
+    clearTimeout(settling);
+    settling = setTimeout(() => {
+      for (const path2 of changed) settled.add(path2);
+      changed.clear();
+      void drain();
+    }, SETTLE_MS);
+  }
+  async function drain() {
+    if (draining) return;
+    draining = true;
+    try {
+      while (settled.size && !stopping) {
+        const [path] = settled;
+        settled.delete(path);
+        await publish(path);
+      }
+    } finally {
+      draining = false;
+    }
+  }
+  async function writeTypes() {
+    const tables = await object("siteTables", {});
+    const typeOf = (declared) => {
+      const type = declared.toUpperCase();
+      if (type.includes("INT")) return "number";
+      if (/CHAR|CLOB|TEXT/.test(type)) return "string";
+      if (type.includes("BLOB") || !type) return "unknown";
+      return "number";
+    };
+    const pascal = (name2) => name2.split(/[^A-Za-z0-9]+/).filter(Boolean).map((part) => part[0].toUpperCase() + part.slice(1)).join("").replace(/^(?=\d)/, "T");
+    const key2 = (name2) => /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name2) ? name2 : JSON.stringify(name2);
+    const body = [
+      "// Written by naru dev from the site's tables: do not edit.",
+      "",
+      ...tables.flatMap((table) => [
+        `/** ${table.view ? "View" : "Table"} ${table.name}. */`,
+        `export interface ${pascal(table.name)} {`,
+        ...table.columns.map(
+          (column) => `  ${key2(column.name)}: ${typeOf(column.type)}${column.nullable ? " | null" : ""};`
+        ),
+        "}",
+        ""
+      ]),
+      "export interface Database {",
+      ...tables.map((table) => `  ${key2(table.name)}: ${pascal(table.name)};`),
+      "}",
+      ""
+    ].join("\n");
+    const path = join(folder, "_naru", "types", "database.d.ts");
+    if (existsSync(path) && await readFile(path, "utf8") === body) return;
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, body);
+    log("wrote _naru/types/database.d.ts");
+  }
+  async function installDeclaration() {
+    const path = join(folder, "_naru", "collections.json");
+    if (!existsSync(path)) return;
+    try {
+      const declared = JSON.parse(await readFile(path, "utf8")).collections;
+      if (!declared || typeof declared !== "object")
+        throw new Error('it needs a "collections" object');
+      const names = Object.keys(declared);
+      for (const name2 of names)
+        if (!declared[name2]?.read || !declared[name2]?.write)
+          throw new Error(`"${name2}" needs both "read" and "write"`);
+      const existing = await object("collections", { names });
+      const wanted = names.map((name2) => ({
+        name: name2,
+        read_access: declared[name2].read,
+        write_access: declared[name2].write,
+        ...declared[name2].unique !== void 0 ? { unique: declared[name2].unique } : {},
+        ...declared[name2].indexes !== void 0 ? { indexes: declared[name2].indexes } : {}
+      }));
+      const differing = wanted.filter((want) => {
+        const row = existing.find((r) => r.name === want.name);
+        return !row || row.read_access !== want.read_access || row.write_access !== want.write_access || "unique" in want && (row.unique ?? []).join(",") !== (want.unique ?? []).join(",") || "indexes" in want && (row.indexes ?? []).join(",") !== (want.indexes ?? []).join(",");
+      });
+      if (!differing.length) return;
+      const created = await object("configureCollections", {
+        ownerId: OWNER,
+        collections: differing
+      });
+      log(
+        `_naru/collections.json: ${created?.length ?? 0} created, ${differing.length - (created?.length ?? 0)} changed`
+      );
+    } catch (error) {
+      warn(`_naru/collections.json: ${error.message}`);
+    }
+  }
+  async function install() {
+    await object("configure", {
+      ownerId: OWNER,
+      entitledUntil: null,
+      confirmedUntil: Date.now() + 10 * 365 * 86400 * 1e3,
+      monthlyRequests: null
+    });
+    const everything = [
+      ...(await Promise.all(
+        FOLDERS.map((kind) => files(join(folder, "_naru", kind)))
+      )).flat(),
+      ...ROUTE_FILES.map((name2) => join(folder, "_naru", name2)).filter(
+        (path) => existsSync(path)
+      )
+    ];
+    for (const [index, path] of everything.entries())
+      await publish(path, index === everything.length - 1);
+    await installDeclaration();
+    await recordUploads([...uploads.values()], true);
+  }
+  const pending = /* @__PURE__ */ new Map();
+  const tokensFile = join(state, "tokens.json");
+  const saved = existsSync(tokensFile) ? JSON.parse(await readFile(tokensFile, "utf8")) : { owners: [], members: [] };
+  const owners = new Set(saved.owners);
+  const memberTokens = new Map(saved.members);
+  const saveTokens = () => writeFile(
+    tokensFile,
+    JSON.stringify({ owners: [...owners], members: [...memberTokens] })
+  );
+  const membersFile = join(state, "members.json");
+  const members = async () => existsSync(membersFile) ? JSON.parse(await readFile(membersFile, "utf8")) : {};
+  const memberId = (name2) => {
+    const hex = createHash("sha256").update(`${site}:${name2}`).digest("hex");
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-7${hex.slice(13, 16)}-8${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
+  };
+  async function keepMember(name2, status) {
+    const all = await members();
+    const id = memberId(name2);
+    all[id] = { name: name2, status: status ?? all[id]?.status ?? "approved" };
+    await writeFile(membersFile, JSON.stringify(all, null, 2));
+    return id;
+  }
+  const digest = (verifier) => createHash("sha256").update(verifier).digest("base64url");
+  const token = () => randomBytes(32).toString("base64url").slice(0, 43);
+  const LIFETIME = 7 * 86400;
+  async function issue(member) {
+    const issued = member ? `m.${token()}` : token();
+    if (member) memberTokens.set(issued, member);
+    else owners.add(issued);
+    await saveTokens();
+    return issued;
+  }
+  function redirectWithCode(res, query, member) {
+    const code = token();
+    pending.set(code, {
+      challenge: query.get("challenge"),
+      redirectUri: query.get("redirectUri"),
+      member
+    });
+    const back = new URL(query.get("redirectUri"));
+    back.searchParams.set("code", code);
+    back.searchParams.set("state", query.get("state"));
+    res.writeHead(302, { location: back.href }).end();
+  }
+  async function ownerCollections(names) {
+    const existing = await object("collections", {
+      names
+    });
+    const created = await object("configureCollections", {
+      ownerId: OWNER,
+      collections: names.filter((name2) => !existing.some((row) => row.name === name2)).map((name2) => ({
+        name: name2,
+        read_access: "admin",
+        write_access: "admin"
+      }))
+    });
+    log(
+      `owner signed in: ${names.length} collections, ${created?.length ?? 0} created`
+    );
+  }
+  async function ownerSignIn(res, query) {
+    await ownerCollections(
+      (query.get("collections") ?? "").split(",").filter(Boolean)
+    );
+    redirectWithCode(res, query);
+  }
+  async function memberSignIn(res, query) {
+    const name2 = query.getAll("as").find((value) => value.trim())?.trim();
+    if (name2)
+      return redirectWithCode(
+        res,
+        query,
+        await keepMember(name2, query.get("status"))
+      );
+    const keep = [...query].filter(([key2]) => !["as", "status"].includes(key2));
+    const hidden = keep.map(
+      ([key2, value]) => `<input type="hidden" name="${escape(key2)}" value="${escape(value)}">`
+    ).join("");
+    const known = Object.values(await members()).map(
+      (member) => `<button name="as" value="${escape(member.name)}">${escape(member.name)} (${escape(member.status)})</button>`
+    ).join(" ");
+    res.writeHead(200, { "content-type": "text/html; charset=utf-8" }).end(`<!doctype html><meta charset="utf-8"><title>naru-dev member sign-in</title>
+<body style="font:14px sans-serif;max-width:560px;margin:40px auto">
+<h1>${escape(site)} \uD68C\uC6D0\uC73C\uB85C \uB85C\uADF8\uC778 (naru-dev)</h1>
+<form>${hidden}<p>${known || "\uC544\uC9C1 \uD14C\uC2A4\uD2B8 \uD68C\uC6D0\uC774 \uC5C6\uC2B5\uB2C8\uB2E4."}</p>
+<p><label>\uC0C8 \uD14C\uC2A4\uD2B8 \uD68C\uC6D0 \uC774\uB984 <input name="as"></label>
+<select name="status"><option value="approved">approved</option><option value="pending">pending</option><option value="banned">banned</option></select>
+<button>\uB85C\uADF8\uC778</button></p></form>`);
+  }
+  const uploads = /* @__PURE__ */ new Map();
+  const uploadsFile = join(state, "uploads.json");
+  if (existsSync(uploadsFile))
+    for (const upload of JSON.parse(
+      await readFile(uploadsFile, "utf8")
+    ))
+      uploads.set(upload.id, upload);
+  const saveUploads = () => writeFile(uploadsFile, JSON.stringify([...uploads.values()], null, 2));
+  const mediaUrl = (upload) => `${MEDIA_ORIGIN}/${OWNER}/${upload.file}`;
+  async function recordUploads(list, all = false) {
+    for (let at = 0; at < list.length; at += 1e3)
+      await object("recordMedia", {
+        files: list.slice(at, at + 1e3).map((upload) => ({
+          id: upload.id,
+          url: mediaUrl(upload),
+          member: upload.member,
+          name: upload.name,
+          type: upload.contentType,
+          size: upload.size
+        }))
+      });
+    if (all)
+      await object("recordMedia", {
+        files: [],
+        keep: list.map((upload) => upload.id)
+      });
+  }
+  const serviceWorker = `self.addEventListener("install", () => self.skipWaiting());
+self.addEventListener("activate", (event) => event.waitUntil(self.clients.claim()));
+self.addEventListener("fetch", (event) => {
+  const url = new URL(event.request.url);
+  if (url.origin === ${JSON.stringify(MEDIA_ORIGIN)})
+    event.respondWith(fetch("/media" + url.pathname));
+});`;
+  async function executeMedia(method, path, body, who) {
+    if (method === "POST" && !path.length) {
+      const name2 = String(body?.name ?? "upload");
+      const id = randomUUID();
+      const extension = name2.includes(".") ? name2.split(".").pop().toLowerCase().replace(/[^a-z0-9]/g, "").slice(0, 10) : "";
+      uploads.set(id, {
+        id,
+        name: name2,
+        contentType: String(body?.contentType ?? "application/octet-stream"),
+        size: Number(body?.size ?? 0),
+        file: `${id}${extension ? `.${extension}` : ""}`,
+        member: who.member
+      });
+      return {
+        id,
+        uploadUrl: `${origin}/_naru-dev/upload/${id}`,
+        headers: { "Content-Type": String(body?.contentType) }
+      };
+    }
+    const upload = uploads.get(path[0]);
+    if (!upload || who.member && upload.member !== who.member)
+      throw new DataError(404, "File not found.");
+    if (method === "PUT") {
+      await saveUploads();
+      await recordUploads([upload]);
+      return {
+        file: {
+          id: upload.id,
+          name: upload.name,
+          contentType: upload.contentType,
+          size: upload.size,
+          url: mediaUrl(upload)
+        }
+      };
+    }
+    if (method === "DELETE") {
+      await rm(join(mediaDir, upload.file), { force: true });
+      uploads.delete(upload.id);
+      await saveUploads();
+      await object("forgetMedia", { ids: [upload.id] });
+      return { success: true };
+    }
+    throw new DataError(405, "Method not allowed.");
+  }
+  const failure = (res, error) => {
+    if (error instanceof DataError)
+      return json(res, error.status, {
+        error: {
+          code: error.code,
+          message: error.message,
+          ...error.details === void 0 ? {} : { details: error.details },
+          ...error.site ? { site: true } : {}
+        }
+      });
+    warn(String(error?.stack ?? error));
+    return json(res, 500, { error: { message: "naru-dev failed." } });
+  };
+  async function signed(req, res, url, path) {
+    const bearer = /^Bearer (.+)$/.exec(req.headers.authorization ?? "")?.[1];
+    const member = bearer ? memberTokens.get(bearer) ?? null : null;
+    const owner = bearer ? owners.has(bearer) : false;
+    if (bearer && !owner && !member)
+      throw new DataError(
+        401,
+        "Sign-in is invalid or expired.",
+        "AUTH_REQUIRED"
+      );
+    if (member) {
+      const status = (await members())[member]?.status ?? "approved";
+      if (status !== "approved")
+        throw new DataError(403, `Membership is ${status}.`, "ACCESS_DENIED", {
+          membership: status
+        });
+    }
+    const raw = await readBody(req);
+    const body = raw.length ? JSON.parse(raw.toString("utf8")) : void 0;
+    const method = req.method;
+    if (path[0] === "_files")
+      return json(
+        res,
+        method === "POST" ? 201 : 200,
+        await executeMedia(method, path.slice(1), body, { member })
+      );
+    if (path[0] === "_batch") {
+      if (!owner) throw new DataError(403, "A batch needs an owner sign-in.");
+      const result2 = await object("batch", {
+        ownerId: OWNER,
+        allowedIds: null,
+        operations: body?.operations
+      });
+      return json(res, 201, publicResult(result2));
+    }
+    if (Object.hasOwn(CALLS, path[0])) {
+      const { file, fn } = functionReference(path.slice(1).join("/"));
+      const { result: result2 } = await object("call", {
+        ownerId: OWNER,
+        site,
+        member,
+        ...owner || member ? {} : { visitor: true },
+        file,
+        name: fn,
+        args: body?.args ?? null,
+        kind: CALLS[path[0]]
+      });
+      return json(res, 200, { result: result2 });
+    }
+    if (path[0] === "_live") {
+      if (!member && !owner)
+        throw new DataError(403, "Live tickets are for members and the owner.");
+      return json(res, 200, {
+        ticket: await signLiveTicket(secret, site, member ?? OWNER_TICKET)
+      });
+    }
+    if (member)
+      throw new DataError(
+        403,
+        "Members reach a site's data through its queries and mutations, not its collections.",
+        "ACCESS_DENIED"
+      );
+    const { result } = await object("execute", {
+      ownerId: OWNER,
+      site,
+      access: { admin: owner, allowedIds: null, anonymous: false },
+      path,
+      method,
+      body,
+      filter: parseFilterQuery(url.searchParams.get("filter")),
+      size: url.searchParams.has("size") ? Number(url.searchParams.get("size")) : void 0,
+      sort: url.searchParams.get("sort") ?? void 0,
+      after: url.searchParams.get("after") ?? void 0,
+      includeTotal: url.searchParams.get("includeTotal") === "1",
+      ifVersion: websiteCondition(url)
+    });
+    return json(res, method === "POST" ? 201 : 200, publicResult(result));
+  }
+  const sdkVersions = (await readdir(resources.sdkDir)).filter((name2) => /^\d+\.\d+\.\d+$/.test(name2)).sort();
+  let importMap = "";
+  const withImportMap = (html) => /<head[^>]*>/i.test(html) ? html.replace(/<head[^>]*>/i, (head) => `${head}${importMap}`) : importMap + html;
+  async function sdk(res, path) {
+    const match = /^\/sdk\/(\d+(?:\.\d+\.\d+)?)\/(naru\.js|naru\.d\.ts|functions\.d\.ts)$/.exec(
+      path
+    );
+    const version = match?.[1] === "1" ? "1.0.0" : match?.[1];
+    if (!match || !sdkVersions.includes(version))
+      return res.writeHead(404).end();
+    const file = join(resources.sdkDir, version, match[2]);
+    if (!existsSync(file)) return res.writeHead(404).end();
+    const source = (await readFile(file, "utf8")).replaceAll("https://sdk.naru.pub", origin).replaceAll("https://naru.pub", origin).replace(
+      "site ||= /^([a-z0-9-]+)\\.naru\\.pub$/.exec(",
+      `site ||= "${site}" || /^([a-z0-9-]+)\\.naru\\.pub$/.exec(`
+    );
+    res.writeHead(200, {
+      "content-type": TYPES[extname(match[2])] ?? "text/plain",
+      "cache-control": "no-store"
+    }).end(source);
+  }
+  async function route(res, url) {
+    let rules = NO_ROUTES;
+    try {
+      rules = routeRules(
+        await readFile(join(folder, "_naru", "routes.json"), "utf8")
+      );
+    } catch {
+    }
+    if (!routed(rules, url.pathname)) return false;
+    const html = (status, body, headers = {}) => res.writeHead(status, {
+      "content-type": "text/html; charset=utf-8",
+      "cache-control": "no-store",
+      ...headers
+    }).end(withImportMap(body));
+    try {
+      const { result } = await object("render", {
+        site,
+        path: url.pathname,
+        origin: url.origin,
+        query: Object.fromEntries(url.searchParams)
+      });
+      const answer = routeAnswer(result);
+      if ("redirect" in answer)
+        res.writeHead(answer.status, { location: answer.redirect }).end();
+      else if ("body" in answer && answer.type === "text/html")
+        html(answer.status, answer.body);
+      else if ("body" in answer)
+        res.writeHead(answer.status, {
+          "content-type": `${answer.type}; charset=utf-8`,
+          "cache-control": "no-store"
+        }).end(answer.body);
+      else {
+        let file = resolve(folder, answer.file);
+        if (existsSync(file) && (await stat(file)).isDirectory())
+          file = join(file, "index.html");
+        if (!file.startsWith(folder) || !existsSync(file))
+          html(404, `The route's file ${answer.file} is not there.`);
+        else
+          html(
+            answer.status,
+            withHead(await readFile(file, "utf8"), answer.head)
+          );
+      }
+    } catch (error) {
+      const status = error instanceof DataError ? error.status : 500;
+      html(status, `<p>${error.message.replace(/</g, "&lt;")}</p>`);
+    }
+    return true;
+  }
+  async function page(res, path) {
+    let file = resolve(folder, `.${decodeURIComponent(path)}`);
+    if (!(file === folder || file.startsWith(folder + sep)) || relative(folder, file).split(sep).includes(".naru-dev") || // As on Naru, which serves nothing under _naru/.
+    relative(folder, file).split(sep)[0] === "_naru" || file.startsWith(state + sep))
+      return res.writeHead(404).end();
+    if (existsSync(file) && (await stat(file)).isDirectory())
+      file = join(file, "index.html");
+    else if (!existsSync(file) && existsSync(`${file}.html`))
+      file = `${file}.html`;
+    if (!existsSync(file)) return res.writeHead(404).end("Not found.");
+    const type = TYPES[extname(file)] ?? "application/octet-stream";
+    let content = await readFile(file);
+    if (type.startsWith("text/html"))
+      content = withImportMap(content.toString("utf8"));
+    res.writeHead(200, { "content-type": type, "cache-control": "no-store" }).end(content);
+  }
+  async function toWorker(req, res, url) {
+    const body = ["GET", "HEAD"].includes(req.method) ? void 0 : await readBody(req);
+    const headers = new Headers();
+    for (const [key2, value] of Object.entries(req.headers))
+      if (typeof value === "string" && key2 !== "host") headers.set(key2, value);
+    const answer = await fetch(`${workerUrl}${url.pathname}${url.search}`, {
+      method: req.method,
+      headers,
+      body
+    });
+    const headersOut = Object.fromEntries(
+      [...answer.headers].filter(
+        ([key2]) => !["content-encoding", "content-length", "transfer-encoding"].includes(
+          key2
+        )
+      )
+    );
+    res.writeHead(answer.status, headersOut);
+    res.end(Buffer.from(await answer.arrayBuffer()));
+  }
+  async function handle(req, res) {
+    const url = new URL(req.url, origin);
+    if (url.pathname.startsWith("/_naru-dev/bucket/"))
+      return await bucket(req, res, url);
+    await started;
+    if (url.pathname.startsWith("/sdk/")) return await sdk(res, url.pathname);
+    if (url.pathname === "/database/authorize")
+      return await ownerSignIn(res, url.searchParams);
+    if (url.pathname === "/members/sign-in")
+      return await memberSignIn(res, url.searchParams);
+    if (req.method === "POST" && ["/api/data-auth/v1/token", "/api/data-auth/v1/member-token"].includes(
+      url.pathname
+    )) {
+      const body = JSON.parse((await readBody(req)).toString("utf8"));
+      const grant = pending.get(body.code);
+      pending.delete(body.code);
+      if (!grant || grant.challenge !== digest(body.verifier) || grant.redirectUri !== body.redirectUri)
+        throw new DataError(
+          401,
+          "The sign-in could not be completed.",
+          "AUTH_REQUIRED"
+        );
+      return json(res, 200, {
+        accessToken: await issue(grant.member),
+        expiresIn: LIFETIME,
+        ...grant.member ? { memberId: grant.member } : {}
+      });
+    }
+    if (url.pathname.startsWith("/api/data-auth/v1/"))
+      return json(res, 200, { success: true });
+    if (url.pathname === "/_naru-dev/media-worker.js")
+      return res.writeHead(200, {
+        "content-type": "text/javascript",
+        "service-worker-allowed": "/"
+      }).end(serviceWorker);
+    if (url.pathname.startsWith("/_naru-dev/upload/") && req.method === "PUT") {
+      const upload = uploads.get(url.pathname.split("/").pop());
+      if (!upload) return res.writeHead(404).end();
+      await writeFile(join(mediaDir, upload.file), await readBody(req));
+      return res.writeHead(200).end();
+    }
+    if (url.pathname.startsWith(`/media/${OWNER}/`)) {
+      const upload = [...uploads.values()].find(
+        (row) => row.file === url.pathname.split("/").pop()
+      );
+      if (!upload || !existsSync(join(mediaDir, upload.file)))
+        return res.writeHead(404).end();
+      return res.writeHead(200, { "content-type": upload.contentType }).end(await readFile(join(mediaDir, upload.file)));
+    }
+    const api = /^\/api\/data\/v1\/([^/]+)(?:\/(.*))?$/.exec(url.pathname);
+    if (api) {
+      if (api[1] !== site)
+        throw new DataError(404, `naru-dev serves only ${site}.`);
+      const path = (api[2] ?? "").split("/").filter(Boolean).map(decodeURIComponent);
+      if (!req.headers.authorization && !["_files", "_batch", "_live"].includes(path[0] ?? ""))
+        return await toWorker(req, res, url);
+      return await signed(req, res, url, path);
+    }
+    if (["GET", "HEAD"].includes(req.method) && await route(res, url))
+      return;
+    return await page(res, url.pathname);
+  }
+  const server = createServer((req, res) => {
+    handle(req, res).catch((error) => failure(res, error));
+  });
+  const live = /* @__PURE__ */ new Set();
+  server.on("upgrade", (req, socket, head) => {
+    live.add(socket);
+    socket.once("close", () => live.delete(socket));
+    const upstream = connect(workerPort, "127.0.0.1", () => {
+      upstream.write(
+        `${req.method} ${req.url} HTTP/1.1\r
+` + Object.entries(req.headers).map(
+          ([key2, value]) => key2 === "host" ? `host: 127.0.0.1:${workerPort}` : `${key2}: ${value}`
+        ).join("\r\n") + "\r\n\r\n"
+      );
+      upstream.write(head);
+      socket.pipe(upstream).pipe(socket);
+    });
+    upstream.on("error", () => socket.destroy());
+    socket.on("error", () => upstream.destroy());
+  });
+  const port = await new Promise((done, fail) => {
+    server.once("error", fail);
+    server.listen(options.port ?? 0, () => {
+      server.off("error", fail);
+      done(server.address().port);
+    });
+  });
+  origin = `http://localhost:${port}`;
+  importMap = `<script>navigator.serviceWorker?.register("/_naru-dev/media-worker.js",{scope:"/"})</script><script type="importmap">${JSON.stringify(
+    {
+      imports: Object.fromEntries(
+        ["1", ...sdkVersions].flatMap(
+          (version) => ["https://sdk.naru.pub", "https://naru.pub"].map((host) => [
+            `${host}/sdk/${version}/naru.js`,
+            `${origin}/sdk/${version}/naru.js`
+          ])
+        )
+      )
+    }
+  )}</script>`;
+  let watcher = null;
+  const stop = async () => {
+    if (stopping) return;
+    stopping = true;
+    watcher?.close();
+    clearTimeout(settling);
+    const closed = new Promise((done) => server.close(done));
+    server.closeAllConnections();
+    for (const socket of live) socket.destroy();
+    if (worker && worker.exitCode === null && worker.signalCode === null) {
+      const exited = new Promise((done) => worker.once("exit", done));
+      worker.kill();
+      await exited;
+    }
+    await closed;
+    if (madeState) await rm(state, { recursive: true, force: true });
+  };
+  try {
+    await startWorker();
+    await install();
+  } catch (error) {
+    await stop();
+    throw error;
+  }
+  if (existsSync(join(folder, "_naru")))
+    watcher = watch(
+      join(folder, "_naru"),
+      { recursive: true },
+      (_event, name2) => {
+        if (!name2) return;
+        const file = name2.toString();
+        if (file === "collections.json") void installDeclaration();
+        else republish(join(folder, "_naru", file));
+      }
+    );
+  ready();
+  log(
+    `naru-dev: ${site} at ${origin}/ (owner and member sign-in are one click; data in ${shortest(state)})`
+  );
+  return {
+    origin,
+    name: site,
+    state,
+    get log() {
+      return output;
+    },
+    url: (path = "/") => new URL(path, origin).href,
+    async signIn(target, who, signInOptions = {}) {
+      if (typeof who !== "string" || !who.trim())
+        throw new TypeError(`who is "owner" or a member's name.`);
+      const member = who === "owner" ? void 0 : await keepMember(who.trim(), signInOptions.status);
+      if (!member && signInOptions.collections)
+        await ownerCollections(signInOptions.collections);
+      const accessToken = await issue(member);
+      const credentials = {
+        accessToken,
+        expiresAt: Date.now() + LIFETIME * 1e3,
+        ...member ? { memberId: member } : {},
+        headers: { authorization: `Bearer ${accessToken}` }
+      };
+      if (target) {
+        const script = `(() => {
+  const s = ${JSON.stringify({
+          origin,
+          site,
+          owner: !member,
+          id: randomUUID(),
+          session: {
+            accessToken,
+            expiresAt: credentials.expiresAt,
+            ...member ? { memberId: member } : {}
+          }
+        })};
+  try {
+    if (location.origin !== s.origin) return;
+    const stores = s.owner ? [sessionStorage, localStorage] : [localStorage];
+    const key = s.owner
+      ? "naru:owner:" + s.origin + ":" + s.site + ":" + location.origin + location.pathname
+      : "naru:member:" + s.origin + ":" + s.site;
+    const mark = "naru-dev:signed-in:" + s.id + ":" + (s.owner ? location.pathname : "");
+    if (sessionStorage.getItem(mark)) return;
+    sessionStorage.setItem(mark, "1");
+    for (const store of stores) store.setItem(key, JSON.stringify(s.session));
+  } catch {}
+})();`;
+        await target.addInitScript(script);
+        const here2 = typeof target.url === "function" ? target.url() : "";
+        if (typeof target.evaluate === "function" && here2.startsWith(origin))
+          await target.evaluate(script);
+      }
+      return credentials;
+    },
+    async reset() {
+      await object("erase", {});
+      uploads.clear();
+      await saveUploads();
+      await rm(mediaDir, { recursive: true, force: true });
+      await mkdir(mediaDir, { recursive: true });
+      await install();
+    },
+    stop
+  };
+}
+
+// src/packaged.ts
+import { readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname as dirname2, join as join2 } from "node:path";
+import { fileURLToPath } from "node:url";
+var here = dirname2(fileURLToPath(import.meta.url));
+function packagedResources() {
+  const require2 = createRequire(import.meta.url);
+  const workerd = require2("workerd");
+  return {
+    workerDir: join2(here, "worker"),
+    sdkDir: join2(here, "sdk"),
+    workerd: workerd.default
+  };
+}
+var packagedInfo = () => JSON.parse(readFileSync(join2(here, "build.json"), "utf8"));
+
+export {
+  start,
+  packagedResources,
+  packagedInfo
+};