@noverax/courier-build 0.4.0 → 0.5.0

package/lib/load-config-barNPfXN.js

@@ -0,0 +1,2834 @@
+import { n as isRecord, t as errnoCode } from "./errno-code-CNx_E80R.js";
+import { createRequire } from "node:module";
+import { basename, dirname, isAbsolute, join, normalize, posix, relative, resolve, sep, win32 } from "node:path";
+import { closeSync, constants, existsSync, fstatSync, futimesSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, statSync, unlinkSync, utimesSync, writeFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { CourierError, createLogger } from "@noverax/courier";
+import { createHash, randomBytes } from "node:crypto";
+import { parseJSON5 } from "confbox";
+import { REDACTED, cutSecrets, isSecretValue, sliceWhole } from "@noverax/courier/internal";
+import { inspect } from "node:util";
+// src/config/config-candidates.ts
+/** The file names a Courier config may have, in the order they are looked for */
+const CONFIG_BASENAMES = [
+	"courier.config.ts",
+	"courier.config.mts",
+	"courier.config.cts",
+	"courier.config.js",
+	"courier.config.mjs",
+	"courier.config.cjs"
+];
+const PROJECT_TOP_MARKERS = [
+	".git",
+	".hg",
+	".jj",
+	"pnpm-workspace.yaml"
+];
+/**
+* Every path a config is looked for at from a folder, in the order it is
+* looked for: each of {@link CONFIG_BASENAMES} in the folder, then in each
+* folder above it, up to the top of the project — the first folder that
+* holds its repository (`.git`, `.hg`, `.jj`) or is the root of its
+* workspace (`pnpm-workspace.yaml`, or a `package.json` that declares
+* `workspaces`) — or, with no such folder, the root of the file system.
+*
+* @param startDir - The folder to look in first
+* @returns The paths, absolute, whether there or not
+* @example
+* ```ts
+* configCandidates("/repo/apps/web"); // → ["/repo/apps/web/courier.config.ts", …, "/repo/courier.config.cjs"]
+* ```
+*/
+function configCandidates(startDir) {
+	const candidates = [];
+	let dir = resolve(startDir);
+	while (true) {
+		for (const basename of CONFIG_BASENAMES) candidates.push(join(dir, basename));
+		const parent = dirname(dir);
+		if (parent === dir || isProjectTop(dir)) return candidates;
+		dir = parent;
+	}
+}
+function isProjectTop(dir) {
+	return PROJECT_TOP_MARKERS.some((marker) => existsSync(join(dir, marker))) || declaresWorkspaces(join(dir, "package.json"));
+}
+function declaresWorkspaces(manifest) {
+	if (!existsSync(manifest)) return false;
+	try {
+		const parsed = JSON.parse(readFileSync(manifest, "utf8"));
+		return isRecord(parsed) && parsed.workspaces !== void 0;
+	} catch {
+		return false;
+	}
+}
+// src/config/frameworks.ts
+/**
+* Which framework a project is built with, told by the packages its
+* package.json lists — the one rule Courier tells a framework by, for
+* reading a project's modules as its server does and for setting Courier
+* up in it.
+*/
+/** The frameworks, the ones built on others first: a Next.js app lists React too; a server before a page Vite builds. */
+const FRAMEWORK_MARKERS = [
+	{
+		id: "next",
+		label: "Next.js",
+		marker: "next"
+	},
+	{
+		id: "nuxt",
+		label: "Nuxt",
+		marker: "nuxt"
+	},
+	{
+		id: "sveltekit",
+		label: "SvelteKit",
+		marker: "@sveltejs/kit"
+	},
+	{
+		id: "astro",
+		label: "Astro",
+		marker: "astro"
+	},
+	{
+		id: "react-router",
+		label: "React Router",
+		marker: "@react-router/dev"
+	},
+	{
+		id: "remix",
+		label: "Remix",
+		marker: "@remix-run/dev"
+	},
+	{
+		id: "solid-start",
+		label: "SolidStart",
+		marker: "@solidjs/start"
+	},
+	{
+		id: "expo",
+		label: "Expo",
+		marker: "expo"
+	},
+	{
+		id: "nestjs",
+		label: "NestJS",
+		marker: "@nestjs/core",
+		server: true
+	},
+	{
+		id: "fastify",
+		label: "Fastify",
+		marker: "fastify",
+		server: true
+	},
+	{
+		id: "hono",
+		label: "Hono",
+		marker: "hono",
+		runsWith: true,
+		server: true
+	},
+	{
+		id: "express",
+		label: "Express",
+		marker: "express",
+		server: true
+	},
+	{
+		id: "koa",
+		label: "Koa",
+		marker: "koa",
+		server: true
+	},
+	{
+		id: "hapi",
+		label: "hapi",
+		marker: "@hapi/hapi",
+		server: true
+	},
+	{
+		id: "elysia",
+		label: "Elysia",
+		marker: "elysia",
+		server: true
+	},
+	{
+		id: "h3",
+		label: "h3",
+		marker: "h3",
+		server: true
+	},
+	{
+		id: "nitro",
+		label: "Nitro",
+		marker: "nitro",
+		server: true
+	},
+	{
+		id: "react",
+		label: "React with Vite",
+		marker: "vite",
+		also: "react"
+	},
+	{
+		id: "vue",
+		label: "Vue with Vite",
+		marker: "vite",
+		also: "vue"
+	}
+];
+/**
+* The framework a project is built with, told by the packages it lists: a
+* framework told first by what the app runs with counts among the dev
+* dependencies only where no other framework is listed.
+*
+* @param listed - The packages the project's package.json lists
+* @returns The framework, or `undefined` when it lists none Courier tells
+* @example
+* ```ts
+* detectFramework({ dependencies: { next: "^16.0.0", react: "^19.0.0" }, … })?.label; // "Next.js"
+* ```
+*/
+function detectFramework(listed) {
+	const lists = (name) => [
+		listed.dependencies,
+		listed.devDependencies,
+		listed.peerDependencies,
+		listed.optionalDependencies
+	].some((field) => Object.hasOwn(field, name));
+	const told = (framework, marked) => marked && (framework.also === void 0 || lists(framework.also));
+	return FRAMEWORK_MARKERS.find((framework) => told(framework, framework.runsWith === true ? Object.hasOwn(listed.dependencies, framework.marker) : lists(framework.marker))) ?? FRAMEWORK_MARKERS.find((framework) => told(framework, framework.runsWith === true && lists(framework.marker)));
+}
+/**
+* The framework of the project a folder belongs to, told by the nearest
+* package.json at or above it. A package.json that does not parse lists
+* nothing: the project is then read as plain Node, as it would be with none.
+*
+* @param folder - A folder of the project, absolute: the config's own
+* @returns The framework, and the package.json that told it
+* @example
+* ```ts
+* projectFramework("/app").framework?.id; // "sveltekit", where /app/package.json lists @sveltejs/kit
+* ```
+*/
+function projectFramework(folder) {
+	const manifest = nearestManifest(folder);
+	if (manifest === void 0) return {
+		framework: void 0,
+		manifest
+	};
+	return {
+		framework: detectFramework(listedIn(manifest)),
+		manifest
+	};
+}
+function nearestManifest(folder) {
+	for (let current = folder;; current = dirname(current)) {
+		const candidate = join(current, "package.json");
+		if (existsSync(candidate)) return candidate;
+		if (dirname(current) === current) return void 0;
+	}
+}
+function listedIn(manifest) {
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(manifest, "utf8"));
+	} catch {
+		parsed = void 0;
+	}
+	const field = (name) => {
+		const value = isRecord(parsed) ? parsed[name] : void 0;
+		return isRecord(value) ? value : {};
+	};
+	return {
+		dependencies: field("dependencies"),
+		devDependencies: field("devDependencies"),
+		peerDependencies: field("peerDependencies"),
+		optionalDependencies: field("optionalDependencies")
+	};
+}
+// src/config/installed-packages.ts
+/**
+* Which packages a project has installed, for the path aliases to stop at.
+*/
+/**
+* The packages installed where `projectRoot` resolves them, each looked up
+* once.
+*
+* @param projectRoot - Directory holding the project's `tsconfig.json`
+* @returns The lookup
+* @example
+* ```ts
+* installedPackages("/app").has("@acme/ui"); // true once it is in node_modules
+* ```
+*/
+function installedPackages(projectRoot) {
+	const require = createRequire(resolve(projectRoot, "tsconfig.json"));
+	const known = /* @__PURE__ */ new Map();
+	return { has(name) {
+		let installed = known.get(name);
+		if (installed === void 0) {
+			installed = resolves(require, name);
+			known.set(name, installed);
+		}
+		return installed;
+	} };
+}
+/**
+* The package a specifier or an alias prefix names: `@scope/name`, or its
+* first segment; `null` when it names none, as `@scope/` does.
+*
+* @param specifier - A specifier, or an alias's text before its wildcard
+* @returns The package's name, or `null`
+* @example
+* ```ts
+* packageNameOf("@acme/ui/button"); // "@acme/ui"
+* ```
+*/
+function packageNameOf(specifier) {
+	const segments = specifier.split("/");
+	const wanted = specifier.startsWith("@") ? 2 : 1;
+	if (segments.length < wanted) return null;
+	const name = segments.slice(0, wanted);
+	return name.every((segment) => segment.length > 0) ? name.join("/") : null;
+}
+function resolves(require, name) {
+	try {
+		require.resolve(name);
+		return true;
+	} catch (error) {
+		return errnoCode(error) !== "MODULE_NOT_FOUND";
+	}
+}
+// src/config/scope-alias.ts
+/**
+* An alias for a whole scope, `@acme/*`, in the shape the module loader takes.
+*/
+const log$7 = createLogger("Config");
+const MODULE_EXTENSION = /\.(d\.ts|[cm]?[jt]sx?|json)$/;
+/**
+* The scope's name, `@acme`, when `prefix` is an alias's text before the
+* wildcard of a pattern for a whole scope, `@acme/*`.
+*
+* @param prefix - An alias's text before its wildcard
+* @returns The scope, or `undefined` for any other prefix
+* @example
+* ```ts
+* scopeOf("@acme/"); // "@acme"
+* ```
+*/
+function scopeOf(prefix) {
+	return /^(@[^/]+)\/$/.exec(prefix)?.[1];
+}
+/**
+* One loader alias per name a scope alias leads to, leaving out the names of
+* installed packages. The loader follows an alias whatever it finds there,
+* where TypeScript takes an installed package past it: `@acme/*` to
+* `./src/*` keeps `@acme/utils` on `src/utils` while `@acme/ui`, installed,
+* loads the build it ships.
+*
+* @param scope - The scope, `@acme`
+* @param directory - The directory the alias's `*` stands in, absolute
+* @param installed - The packages the project installed
+* @returns Prefix → absolute target, for each name the directory holds
+* @example
+* ```ts
+* scopeAliases("@acme", "/app/src", installed); // { "@acme/utils": "/app/src/utils" }
+* ```
+*/
+function scopeAliases(scope, directory, installed) {
+	const alias = {};
+	for (const entry of entriesOf$1(directory)) {
+		const name = entry.replace(MODULE_EXTENSION, "");
+		if (!installed.has(`${scope}/${name}`)) alias[`${scope}/${name}`] = join(directory, name);
+	}
+	return alias;
+}
+function entriesOf$1(directory) {
+	try {
+		return readdirSync(directory);
+	} catch (error) {
+		const code = errnoCode(error);
+		if (code !== "ENOENT" && code !== "ENOTDIR") log$7.warn(`Could not list ${directory} for a path alias; the alias leads nowhere`, error);
+		return [];
+	}
+}
+// src/config/read-tsconfig-file.ts
+const log$6 = createLogger("Config");
+function isTextList(value) {
+	if (!Array.isArray(value)) return false;
+	return value.every((item) => typeof item === "string");
+}
+function readText(path) {
+	try {
+		if (!statSync(path).isFile()) {
+			log$6.warn(`${path} is not a regular file, so its path aliases are ignored`);
+			return null;
+		}
+		return readFileSync(path, "utf-8");
+	} catch (err) {
+		log$6.warn(`Could not read ${path}, so its path aliases are ignored`, err);
+		return null;
+	}
+}
+function extendsOf(value, path) {
+	if (value === void 0 || value === null) return [];
+	if (typeof value === "string") return [value];
+	if (!Array.isArray(value)) {
+		log$6.warn(`${path}: "extends" is neither a path nor a list of paths, so it is not followed`);
+		return [];
+	}
+	const entries = value;
+	const paths = entries.filter((entry) => typeof entry === "string");
+	if (paths.length < entries.length) log$6.warn(`${path}: "extends" lists something other than a path, which is skipped`);
+	return paths;
+}
+function pathsOf(value, path) {
+	if (value === void 0) return void 0;
+	if (!isRecord(value)) {
+		log$6.warn(`${path}: "paths" is not an object, so its path aliases are ignored`);
+		return;
+	}
+	const kept = [];
+	for (const [pattern, targets] of Object.entries(value)) if (isTextList(targets)) kept.push([pattern, targets]);
+	else log$6.warn(`${path}: "paths" maps "${pattern}" to something other than a list of paths, so it is ignored`);
+	return Object.fromEntries(kept);
+}
+function optionsOf(value, path) {
+	if (value === void 0) return {};
+	if (!isRecord(value)) {
+		log$6.warn(`${path}: "compilerOptions" is not an object, so its path aliases are ignored`);
+		return {};
+	}
+	const { baseUrl } = value;
+	const paths = pathsOf(value.paths, path);
+	const base = typeof baseUrl === "string" ? baseUrl : void 0;
+	if (baseUrl !== void 0 && base === void 0) log$6.warn(`${path}: "baseUrl" is not a path, so its aliases resolve from its own directory`);
+	return {
+		...base !== void 0 && { baseUrl: base },
+		...paths && { paths }
+	};
+}
+/**
+* Read the fields of a tsconfig that its path mapping depends on. A field
+* of another shape than TypeScript takes is left out with a warning, as
+* TypeScript reports it, rather than failing the load of the config that
+* reads the mapping.
+*
+* @param path - The tsconfig
+* @returns What it declares; `null` when it cannot be read or parsed
+* @example
+* ```ts
+* readTsconfigFile("/app/tsconfig.json");
+* // → { extends: ["./tsconfig.base.json"], paths: { "@/*": ["./src/*"] } }
+* ```
+*/
+function readTsconfigFile(path) {
+	const text = readText(path);
+	if (text === null) return null;
+	let parsed;
+	try {
+		parsed = parseJSON5(text);
+	} catch (err) {
+		log$6.warn(`Could not parse ${path}, so its path aliases are ignored`, err);
+		return null;
+	}
+	if (!isRecord(parsed)) {
+		log$6.warn(`${path} does not hold an object, so its path aliases are ignored`);
+		return null;
+	}
+	return {
+		extends: extendsOf(parsed.extends, path),
+		...optionsOf(parsed.compilerOptions, path)
+	};
+}
+// src/config/tsconfig-paths.ts
+/**
+* Read a project's `compilerOptions.paths` without loading TypeScript.
+*
+* The compiler would do this for us, but its API is exactly what a config
+* reader must not depend on: it is an optional peer a JavaScript-only project
+* is entitled not to have, and TypeScript 7 publishes no parser under the
+* package root at all. Reading the file directly costs one JSONC parse.
+*
+* `paths` is not merged down an `extends` chain — TypeScript replaces the map
+* wholesale — so the nearest config that declares one wins, and its targets
+* resolve against its own `baseUrl`, or its own directory when it has none.
+*
+* Parsing is JSON5 rather than strict JSONC: a tsconfig is hand-edited and
+* routinely carries comments and trailing commas, both of which TypeScript
+* accepts. Refusing them would drop a real project's aliases without a word.
+*/
+const log$5 = createLogger("Config");
+/**
+* Read the path mapping that applies to files in `directory`: the one of the
+* nearest `tsconfig.json` at or above it, as TypeScript finds it, so a config
+* file kept below the project root — `deploy/server.config.ts` — keeps every
+* alias the project declares.
+*
+* @param directory - Directory of the file whose imports are resolved
+* @returns The mapping, or `null` when no tsconfig declares one
+*
+* @example
+* ```ts
+* const mapping = readTsconfigPaths("/app/deploy");
+* // → { baseUrl: "/app", paths: { "@/*": ["./src/*"] } }
+* ```
+*/
+function readTsconfigPaths(directory) {
+	const tsconfig = nearestTsconfig(resolve(directory));
+	return tsconfig ? findPaths(tsconfig, /* @__PURE__ */ new Set()) : null;
+}
+function nearestTsconfig(directory) {
+	for (let dir = directory;; dir = dirname(dir)) {
+		const candidate = resolve(dir, "tsconfig.json");
+		if (existsSync(candidate)) return candidate;
+		if (dirname(dir) === dir) return null;
+	}
+}
+/** Walk the `extends` chain depth-first, stopping at the first declared map. */
+function findPaths(file, visited) {
+	const path = resolve(file);
+	if (visited.has(path)) return null;
+	visited.add(path);
+	const config = readTsconfigFile(path);
+	if (!config) return null;
+	if (config.paths) return {
+		baseUrl: resolve(dirname(path), config.baseUrl ?? "."),
+		paths: config.paths
+	};
+	for (const specifier of [...config.extends].reverse()) {
+		const parent = resolveExtends(specifier, dirname(path));
+		if (!parent) {
+			log$5.warn(`${path} extends "${specifier}", which cannot be found, so its path aliases are not read`);
+			continue;
+		}
+		const found = findPaths(parent, visited);
+		if (found) return found;
+	}
+	return null;
+}
+/**
+* Resolve an `extends` specifier: a path, a directory holding a
+* `tsconfig.json`, or an installed package that ships one.
+*/
+function resolveExtends(specifier, fromDir) {
+	if (specifier.startsWith(".") || isAbsolute(specifier)) {
+		const candidate = resolve(fromDir, specifier);
+		if (existsSync(candidate) && statSync(candidate).isDirectory()) {
+			const nested = resolve(candidate, "tsconfig.json");
+			return existsSync(nested) ? nested : null;
+		}
+		if (existsSync(candidate)) return candidate;
+		const suffixed = `${candidate}.json`;
+		return existsSync(suffixed) ? suffixed : null;
+	}
+	const requireFrom = createRequire(resolve(fromDir, "tsconfig.json"));
+	for (const target of [specifier, `${specifier}/tsconfig.json`]) {
+		const found = resolveFrom(requireFrom, target);
+		if (found) return found;
+	}
+	return null;
+}
+function resolveFrom(requireFrom, target) {
+	try {
+		return requireFrom.resolve(target);
+	} catch (err) {
+		log$5.debug(`"${target}" does not resolve to a tsconfig`, err);
+		return null;
+	}
+}
+// src/config/path-aliases.ts
+/**
+* Turn a project's tsconfig `paths` into the two shapes that reading a config
+* needs: the alias map the module loader takes, and a lookup the dependency
+* walker uses to follow an aliased import.
+*
+* An alias that shadows an installed package is left out of both. Such an
+* entry redirects a dependency to its sources for the bundler's benefit —
+* `@acme/ui` to `../ui/src`, or a whole scope, `@acme/*` — and following it
+* would load a library's source instead of the build it ships, then treat
+* every file inside it as something the config depends on. A dependency
+* changes when it is reinstalled, not while the developer is editing; the
+* graph stops at the package boundary. A catch-all `*` covers every package,
+* so it is left out too: the loader, which cannot fall back to the package as
+* TypeScript does, would put its target before every path it loads.
+*/
+const EMPTY$1 = {
+	loader: {},
+	candidatesFor: () => []
+};
+/**
+* Read the path aliases that apply to `projectRoot`.
+*
+* @param projectRoot - Directory holding the project's `tsconfig.json`
+* @returns The aliases, empty when the project declares none
+*
+* @example
+* ```ts
+* const aliases = readPathAliases("/app");
+* aliases.candidatesFor("@/lib/sources"); // → ["/app/src/lib/sources"]
+* ```
+*/
+function readPathAliases(projectRoot) {
+	const mapping = readTsconfigPaths(projectRoot);
+	if (!mapping) return EMPTY$1;
+	const installed = installedPackages(projectRoot);
+	const entries = toEntries(mapping).filter((entry) => !shadowsInstalled(entry, installed));
+	if (entries.length === 0) return EMPTY$1;
+	return {
+		loader: toLoaderAlias(entries, installed),
+		candidatesFor: (specifier) => candidatesOf(entries, specifier, installed)
+	};
+}
+function shadowsInstalled(entry, installed) {
+	if (entry.prefix === "") return true;
+	if (entry.wildcard && scopeOf(entry.prefix) !== void 0) return false;
+	const name = packageNameOf(entry.prefix);
+	return name !== null && installed.has(name);
+}
+function toEntries({ baseUrl, paths }) {
+	const entries = [];
+	for (const [pattern, targets] of Object.entries(paths)) {
+		const star = pattern.indexOf("*");
+		entries.push(star === -1 ? {
+			prefix: pattern,
+			suffix: "",
+			wildcard: false,
+			base: baseUrl,
+			targets
+		} : {
+			prefix: pattern.slice(0, star),
+			suffix: pattern.slice(star + 1),
+			wildcard: true,
+			base: baseUrl,
+			targets
+		});
+	}
+	return entries;
+}
+/** TypeScript picks the single match with the longest prefix before `*`. */
+function candidatesOf(entries, specifier, installed) {
+	let best = null;
+	for (const entry of entries) {
+		if (!matches(entry, specifier)) continue;
+		if (!best || entry.prefix.length > best.prefix.length) best = entry;
+	}
+	if (!best) return [];
+	const { base } = best;
+	if (!best.wildcard) return best.targets.map((target) => resolve(base, target));
+	const name = scopeOf(best.prefix) === void 0 ? null : packageNameOf(specifier);
+	if (name !== null && installed.has(name)) return [];
+	const matched = specifier.slice(best.prefix.length, specifier.length - best.suffix.length);
+	return best.targets.map((target) => resolve(base, withStarFilled(target, matched)));
+}
+function withStarFilled(target, matched) {
+	const star = target.indexOf("*");
+	return star === -1 ? target : `${target.slice(0, star)}${matched}${target.slice(star + 1)}`;
+}
+function matches(entry, specifier) {
+	if (!entry.wildcard) return specifier === entry.prefix;
+	return specifier.length >= entry.prefix.length + entry.suffix.length && specifier.startsWith(entry.prefix) && specifier.endsWith(entry.suffix);
+}
+/**
+* Only a mapping that ends in `*` on both sides translates to a prefix alias;
+* one with a suffix after the wildcard has no equivalent and stays behind. A
+* scope's alias becomes one alias per name it leads to that is not installed.
+*/
+function toLoaderAlias(entries, installed) {
+	const alias = {};
+	for (const entry of entries) {
+		const written = entry.targets[0];
+		if (!written) continue;
+		const target = resolve(entry.base, written);
+		if (!entry.wildcard) alias[entry.prefix] = target;
+		else if (entry.suffix === "" && target.endsWith("*")) {
+			const scope = scopeOf(entry.prefix);
+			if (scope === void 0) alias[entry.prefix] = target.slice(0, -1);
+			else Object.assign(alias, scopeAliases(scope, target.slice(0, -1), installed));
+		}
+	}
+	return alias;
+}
+// src/config/profiles/refused-module-error.ts
+/**
+* A module of the project imported one its framework refuses where
+* definitions run — Next's `client-only` — so the config did not load.
+*
+* @example
+* ```ts
+* throw new RefusedModuleError("client-only", rule, nextMarker);
+* ```
+*/
+var RefusedModuleError = class extends CourierError {
+	/** Why the framework refuses it, worded to follow the import: `is the marker of …`. */
+	reason;
+	/** What to do about it, worded as an instruction. */
+	remedy;
+	/**
+	* @param specifier - The import, as written
+	* @param rule - Why the framework refuses it, and what to do
+	* @param framework - The framework whose rule it is
+	*/
+	constructor(specifier, rule, framework) {
+		super(`${specifier} ${rule.reason}. ${rule.remedy}.`, {
+			code: "MODULE_REFUSED",
+			context: {
+				specifier,
+				framework: framework?.label
+			}
+		});
+		this.reason = rule.reason;
+		this.remedy = rule.remedy;
+	}
+};
+// src/config/profiles/profile-modules.ts
+const EMPTY = Object.freeze({});
+/**
+* A profile's imports, in the shape the module loader's `virtualModules`
+* take: each answered before the loader resolves the import, in every module
+* of the load. A `provided` module is made when the load first imports it,
+* and a `refused` one throws there, in the module that imports it. An import
+* the project's own path aliases send elsewhere is left to them: the project
+* says what it is.
+*
+* @param profile - How the framework's server answers its imports
+* @param aliases - The project's path aliases, prefix → target
+* @returns The modules, by specifier
+* @example
+* ```ts
+* createJiti(file, { virtualModules: profileModules(profile, aliases) });
+* ```
+*/
+function profileModules(profile, aliases) {
+	const modules = {};
+	for (const [specifier, rule] of profile.modules) {
+		if (isAliased(specifier, aliases)) continue;
+		let made;
+		Object.defineProperty(modules, specifier, {
+			enumerable: true,
+			get: () => {
+				if (rule.kind === "refused") throw new RefusedModuleError(specifier, rule, profile.framework);
+				if (rule.kind === "empty") return EMPTY;
+				made ??= rule.exports();
+				return made;
+			}
+		});
+	}
+	return modules;
+}
+function isAliased(specifier, aliases) {
+	return Object.keys(aliases).some((prefix) => specifier === prefix || specifier.startsWith(prefix.endsWith("/") ? prefix : `${prefix}/`));
+}
+// src/config/profiles/environment-view.ts
+/**
+* The environment as a framework's env module shows it, read from
+* `process.env` as code reads it: a module that names one variable depends
+* on that one alone — which a reading of the routes notes, so a change to
+* any other variable does not read them again — and a variable a loader set
+* before the config ran, from the project's env files, is the one seen.
+*/
+const NOT_VARIABLES = /* @__PURE__ */ new Set([
+	"default",
+	"__esModule",
+	"then"
+]);
+/**
+* A read-only view of the variables `shows` lets through, with `members`
+* beside them — Astro's `getSecret`, say.
+*
+* @param shows - Whether the view shows a variable, by its name
+* @param members - What the view holds besides the variables, by name
+* @returns The view, an object whose properties are the variables it shows
+* @example
+* ```ts
+* const publicEnv = environmentView((name) => name.startsWith("PUBLIC_"));
+* publicEnv.PUBLIC_API_URL; // process.env.PUBLIC_API_URL
+* publicEnv.DATABASE_URL; // undefined
+* ```
+*/
+function environmentView(shows, members = {}) {
+	const isMember = (key) => typeof key === "string" && Object.hasOwn(members, key);
+	const isShown = (key) => typeof key === "string" && !NOT_VARIABLES.has(key) && !isMember(key) && shows(key);
+	const variable = (name) => {
+		const value = process.env[name];
+		return typeof value === "string" ? value : void 0;
+	};
+	const descriptor = (value) => ({
+		value,
+		enumerable: true,
+		configurable: true,
+		writable: false
+	});
+	return new Proxy({}, {
+		get: (_, key) => isMember(key) ? members[key] : isShown(key) ? variable(key) : void 0,
+		has: (_, key) => isMember(key) || isShown(key) && variable(key) !== void 0,
+		ownKeys: () => [...Object.keys(members), ...Object.keys(process.env).filter(isShown)],
+		getOwnPropertyDescriptor: (_, key) => {
+			if (isMember(key)) return descriptor(members[key]);
+			const value = isShown(key) ? variable(key) : void 0;
+			return value === void 0 ? void 0 : descriptor(value);
+		},
+		set: () => false,
+		defineProperty: () => false,
+		deleteProperty: () => false
+	});
+}
+// src/config/profiles/astro-profile.ts
+/**
+* Astro, as its server writes `astro:env/server` and `astro:env/client`:
+* the variables of the environment, and `getSecret` beside them. Astro
+* coerces each variable to the type its `env.schema` declares and fills in
+* its default; the schema is in `astro.config`, which is not run to read
+* the project, so here every variable is the string the environment holds,
+* and one it does not hold is `undefined`.
+*/
+const everyVariable = () => true;
+/** What Astro's server answers for its environment modules, and says of its other virtual ones. */
+const ASTRO_RULES = {
+	modules: /* @__PURE__ */ new Map([["astro:env/server", {
+		kind: "provided",
+		exports: () => environmentView(everyVariable, { getSecret: (name) => process.env[name] })
+	}], ["astro:env/client", {
+		kind: "provided",
+		exports: () => environmentView(everyVariable)
+	}]]),
+	unresolved: (specifier) => specifier.startsWith("astro:") ? {
+		reason: "is a module of Astro's runtime, which only Astro's build has",
+		remedy: "Import it from a page, an endpoint or a middleware, and keep it out of the modules courier.config imports, which may read astro:env/server and astro:env/client"
+	} : void 0
+};
+// src/config/profiles/next-profile.ts
+/** What Next's server layers answer for the markers of server and browser code. */
+const NEXT_RULES = { modules: /* @__PURE__ */ new Map([["server-only", { kind: "empty" }], ["client-only", {
+	kind: "refused",
+	reason: "is the marker of code for the browser, which Next.js refuses on the server, where courier.config is read",
+	remedy: "Import that code from a client component alone, out of the modules courier.config imports"
+}]]) };
+// src/config/profiles/nuxt-profile.ts
+const NUXT_ALIASES = [
+	"#imports",
+	"#app",
+	"#build",
+	"#components",
+	"#head",
+	"#vue-router",
+	"#internal"
+];
+const RUNTIME_REMEDY = "Import what the definitions need from its own package — ofetch, h3, defu — or call the runtime inside a function that runs for a request, such as an endpoint's middleware";
+function unresolved$1(specifier) {
+	if (specifier === "~" || specifier.startsWith("~/") || specifier.startsWith("~~/")) return {
+		reason: "is Nuxt's alias for the project's source folder, which nuxi prepare writes into .nuxt/tsconfig.json",
+		remedy: "Run `npx nuxi prepare` before Courier reads the project — in CI, once the packages are installed"
+	};
+	if (!NUXT_ALIASES.some((name) => specifier === name || specifier.startsWith(`${name}/`))) return void 0;
+	return {
+		reason: "is one of Nuxt's aliases, which only Nuxt's build resolves: definitions must not depend on Nuxt's runtime",
+		remedy: RUNTIME_REMEDY
+	};
+}
+/** What Nuxt says of its aliases and its auto-imports outside its build. */
+const NUXT_RULES = {
+	modules: /* @__PURE__ */ new Map(),
+	unresolved: unresolved$1,
+	undefinedName: () => ({
+		reason: "is not defined outside Nuxt: where it is one of the composables or utilities Nuxt imports for you, definitions must not depend on Nuxt's runtime",
+		remedy: RUNTIME_REMEDY
+	})
+};
+// src/config/profiles/sveltekit-profile.ts
+/**
+* SvelteKit, as its server writes the modules it answers itself: `$env/*`
+* from the environment, split by the public prefix as SvelteKit splits it,
+* and `$app/environment` as it reads while SvelteKit analyses the server
+* during a build — not in a browser, building, in development unless
+* `NODE_ENV` says production. Reading definitions is that case: the server's
+* modules run, and no request is served.
+*
+* The prefix is SvelteKit's default, `PUBLIC_`: one set in `svelte.config.js`
+* is not read, as that would run another of the project's files.
+*/
+const PUBLIC_PREFIX = "PUBLIC_";
+const isPublic = (name) => name.startsWith(PUBLIC_PREFIX);
+const isPrivate = (name) => !isPublic(name);
+/** What SvelteKit's server answers for its environment modules. */
+const MODULES = /* @__PURE__ */ new Map([
+	["$env/static/private", {
+		kind: "provided",
+		exports: () => environmentView(isPrivate)
+	}],
+	["$env/static/public", {
+		kind: "provided",
+		exports: () => environmentView(isPublic)
+	}],
+	["$env/dynamic/private", {
+		kind: "provided",
+		exports: () => Object.freeze({ env: environmentView(isPrivate) })
+	}],
+	["$env/dynamic/public", {
+		kind: "provided",
+		exports: () => Object.freeze({ env: environmentView(isPublic) })
+	}],
+	["$app/environment", {
+		kind: "provided",
+		exports: () => Object.freeze({
+			browser: false,
+			building: true,
+			dev: process.env.NODE_ENV !== "production",
+			version: ""
+		})
+	}]
+]);
+function unresolved(specifier) {
+	if (specifier === "$lib" || specifier.startsWith("$lib/")) return {
+		reason: "is SvelteKit's alias for src/lib, which svelte-kit sync writes into .svelte-kit/tsconfig.json",
+		remedy: "Run `npx svelte-kit sync` before Courier reads the project — in CI, once the packages are installed"
+	};
+	if (!specifier.startsWith("$app/") && specifier !== "$service-worker") return void 0;
+	return {
+		reason: "is a module of SvelteKit's runtime, which only SvelteKit's server has",
+		remedy: "Import it where a request is served — a load function, an endpoint, a hook — and keep it out of the modules courier.config imports, which may read $env/* and $app/environment"
+	};
+}
+// src/config/profiles/profile-of.ts
+const RULES = {
+	next: NEXT_RULES,
+	nuxt: NUXT_RULES,
+	sveltekit: {
+		modules: MODULES,
+		unresolved
+	},
+	astro: ASTRO_RULES
+};
+const NONE = { modules: /* @__PURE__ */ new Map() };
+/**
+* How a framework's server answers the imports it answers itself. A
+* framework that answers none, and a project that lists no framework, are
+* read as plain Node.
+*
+* @param framework - The project's framework, as its package.json tells it
+* @returns The profile every loader of the project's files applies
+* @example
+* ```ts
+* profileOf(projectFramework(projectRoot).framework).modules.has("server-only"); // true for Next.js
+* ```
+*/
+function profileOf(framework) {
+	return {
+		framework,
+		...(framework && RULES[framework.id]) ?? NONE
+	};
+}
+/**
+* The framework whose own import a specifier is, among those Courier
+* answers or explains, for a project read as another: `$env/static/private`
+* is SvelteKit's.
+*
+* @param specifier - The import, as written
+* @returns The framework's id, or `undefined` when the import is none of theirs
+* @example
+* ```ts
+* frameworkOfImport("server-only"); // "next"
+* ```
+*/
+function frameworkOfImport(specifier) {
+	return Object.entries(RULES).find(([, rules]) => rules.modules.has(specifier) || rules.unresolved?.(specifier) !== void 0)?.[0];
+}
+// src/config/config-jiti.ts
+let ownTransform;
+function jitiOwnTransform(createJiti) {
+	if (ownTransform) return ownTransform;
+	const { transform } = createJiti(fileURLToPath(import.meta.url), {
+		fsCache: false,
+		moduleCache: false
+	}).options;
+	if (!transform) throw new Error("jiti created an instance without its own transform");
+	ownTransform = transform;
+	return transform;
+}
+/**
+* The module loader for Courier's project files — `courier.config.*` and
+* `courier.mocks.*` — with the options both need: the project's tsconfig path
+* aliases, the imports its framework's server answers itself, default-export
+* interop, no module cache, and no native import tried before the loader's
+* own.
+*
+* A framework resolves some imports where it builds the server, never
+* through Node: Next makes `server-only` an empty module on its server
+* layers, SvelteKit and Astro write their env modules from the environment.
+* The loader answers them as that server does, by the framework the
+* project's package.json lists (see `profileOf`), in every module it
+* transforms; one the project's own path aliases name is theirs. A package
+* the loader hands to Node — an installed library — resolves its own imports
+* as Node does while that works; where it fails — a library that imports
+* `server-only` itself — the loader runs the package itself, and answers
+* them there too. A package Node loads without a failure keeps Node's
+* answers: one that imports an installed `client-only` is not refused.
+*
+* The module cache is off because this is also the reload path: the dev
+* server loads the files again on every edit, and a cached module would hand
+* back the file as it was before the user changed it. Every load therefore
+* reads and evaluates every file again; a `transformCache` only spares the
+* transform of a file whose bytes are unchanged.
+*
+* jiti's native attempt, which imports every module natively before falling
+* back to its own loader, stays off too, whatever `JITI_TRY_NATIVE` says and
+* under Bun, where it defaults to on: a module imported natively is the
+* runtime's first evaluation of it for the life of the process, so an edit to
+* it would never be seen, and the attempt comes before the module cache
+* `evalModule` is handed, so two files evaluated over one cache would each
+* evaluate a module they both import.
+*
+* jiti's own file cache stays off, with or without a `transformCache`:
+* - it writes each entry in place, so concurrent writers can leave an entry
+*   torn between two transforms that its check still accepts;
+* - an entry it cannot write makes the whole load throw `EACCES`;
+* - unless the file's own directory has a `node_modules`, it falls back to
+*   `os.tmpdir()/jiti`, where another user of the machine can place an entry
+*   that is then run;
+* - its key ignores `interopDefault` and the babel options, so a transform
+*   made under other options can be handed back;
+* - nothing ever prunes it.
+*
+* jiti is loaded here rather than at the top of a module so a bundler that
+* merely reaches this code does not pull a TypeScript transpiler into its
+* graph; only a process that actually reads such a file pays for it.
+*
+* @param file - Absolute, symlink-resolved path of the file to load; modules
+*   and aliases resolve from its directory
+* @param options - Whether to resolve through the project's path aliases
+*   (default: yes), where to reuse transforms (default: nowhere), and how the
+*   framework answers its own imports (default: as package.json tells it)
+* @returns A jiti instance for that file
+* @example
+* ```ts
+* const transformCache = createTransformCache();
+* const jiti = await createConfigJiti(configFile, { transformCache });
+* const config = await jiti.import(configFile, { default: true });
+* ```
+*/
+async function createConfigJiti(file, { aliases = true, transformCache, onModule, runTransform, profile, onTransformError } = {}) {
+	const { createJiti } = await import("jiti");
+	const alias = aliases ? readPathAliases(dirname(file)).loader : {};
+	const options = {
+		alias,
+		virtualModules: profileModules(profile ?? profileOf(projectFramework(dirname(file)).framework), alias),
+		interopDefault: true,
+		moduleCache: false,
+		fsCache: false,
+		tryNative: false
+	};
+	if (!transformCache && !onModule && !runTransform && !onTransformError) return createJiti(file, options);
+	const compute = jitiOwnTransform(createJiti);
+	const cached = transformCache ? (transformOptions) => transformCache.transform(transformOptions, compute) : compute;
+	const transform = (given) => {
+		const transformOptions = given.filename === void 0 ? given : {
+			...given,
+			filename: normalize(given.filename)
+		};
+		const { filename } = transformOptions;
+		if (onModule && filename !== void 0) onModule(filename);
+		const result = runTransform ? runTransform(() => cached(transformOptions)) : cached(transformOptions);
+		if (onTransformError && filename !== void 0 && result.error !== void 0) onTransformError(filename, result.error);
+		return result;
+	};
+	return createJiti(file, {
+		...options,
+		transform
+	});
+}
+// src/config/load-error/config-load-error.ts
+/**
+* A project's config, or its mocks file, did not load. The message says
+* what failed and in which module, with the chain of imports that led there
+* from the entry — `src/api.ts imports "server-only", which does not resolve
+* (courier.config.ts → src/api.ts).` — in one line; `hint` says what to do,
+* in another. Neither holds a secret: the project's own message is quoted
+* with the environment's values masked and every credential `redact()`
+* finds cut, each as `[redacted]`. What the project threw is the `cause`,
+* for a log at debug level, cut the same way in its message and its stack.
+*
+* @example
+* ```ts
+* if (error instanceof ConfigLoadError) log.error(`${error.message}\n${error.hint}`);
+* ```
+*/
+var ConfigLoadError = class extends CourierError {
+	/** What to do about it, in a sentence or two. */
+	hint;
+	/**
+	* @param code - Why the load failed
+	* @param message - What failed and where, in one line
+	* @param details - Where it failed, what to do, and what the project threw
+	*/
+	constructor(code, message, details) {
+		super(message, {
+			code,
+			context: details.context,
+			cause: details.cause
+		});
+		this.hint = details.hint;
+	}
+};
+// src/util/local-path.ts
+const NAMESPACE = "\\\\?\\";
+const SHARE_NAMESPACE = "\\\\?\\UNC\\";
+/**
+* A path as this system names it: absolute, written with its own
+* separator, `.` and `..` resolved, and on Windows out of the namespace
+* `path.toNamespacedPath` writes it in (`\\?\D:\app` is `D:\app`). The code
+* a reading runs may name one file in any of these ways, and the loader
+* writes a path with `/` on Windows too; a watcher reports it in this one.
+* The system is the one `process.platform` names, as Node's `path` reads it.
+*
+* @param path - The path, absolute or from the working folder
+* @returns The path
+* @example
+* ```ts
+* localPath("/app/src/../flags.json"); // "/app/flags.json"
+* localPath("D:/a/app/src/api.ts"); // on Windows → "D:\\a\\app\\src\\api.ts"
+* ```
+*/
+function localPath(path) {
+	if (process.platform !== "win32") return posix.resolve(path);
+	if (path.startsWith(SHARE_NAMESPACE)) return win32.resolve(`\\\\${path.slice(8)}`);
+	if (path.startsWith(NAMESPACE)) return win32.resolve(path.slice(4));
+	return win32.resolve(path);
+}
+// src/config/load-error/import-chain.ts
+/**
+* The modules a load ran from its entry to the one that failed, read off the
+* module cache the loader filled: each module it ran is there, with the
+* modules it imported as its `children`, and `loaded` set once it ran to its
+* end. The failure is in the deepest module that has not: every module above
+* it waits on its import. A module whose failure an importer caught ended
+* too, so the newest unfinished child is followed.
+*
+* Each file is named as the system names it, by `localPath`: the loader
+* writes the path of a module it imports with `/` on Windows, where the
+* entry and the error name it with `\`. The failed module is found by its
+* path so named, and on Windows in any case, as Windows reads a path.
+*
+* @param cache - The load's module cache
+* @param entry - The entry's key in it, as the loader registered it
+* @param failed - The file of the module that failed, where the error names it
+* @returns The modules' files, the entry first; only the entry when the cache holds no more
+* @example
+* ```ts
+* importChain(cache, "/app/courier.config.ts");
+* // → ["/app/courier.config.ts", "/app/src/api.ts", "/app/src/server/db.ts"]
+* ```
+*/
+function importChain(cache, entry, failed) {
+	const root = cache[entry];
+	if (root === void 0) return [localPath(entry)];
+	return ((failed === void 0 ? void 0 : pathTo(root, fileKey(failed))) ?? newestUnfinished(root)).map((module) => localPath(module.filename));
+}
+function newestUnfinished(root) {
+	const chain = [root];
+	const seen = /* @__PURE__ */ new Set([root]);
+	for (let current = root;;) {
+		const next = current.children.findLast((child) => !child.loaded && !seen.has(child));
+		if (next === void 0) return chain;
+		seen.add(next);
+		chain.push(next);
+		current = next;
+	}
+}
+function fileKey(path) {
+	const local = localPath(path);
+	return process.platform === "win32" ? local.toLowerCase() : local;
+}
+/**
+* A chain as a line names it: each module by its path from the project's
+* folder, a package by its name.
+*
+* @param chain - The chain, as `importChain` gives it, a package appended by name
+* @param folder - The project's folder, absolute
+* @returns `courier.config.ts → src/api.ts → src/server/db.ts`
+* @example
+* ```ts
+* shownChain(["/app/courier.config.ts", "/app/src/api.ts"], "/app"); // "courier.config.ts → src/api.ts"
+* ```
+*/
+function shownChain(chain, folder) {
+	return chain.map((link) => shownModule(link, folder)).join(" → ");
+}
+/**
+* A module as a line names it: a file of the project by its path from the
+* project's folder, an installed package's by the package's name.
+*
+* @param link - A module's file, absolute, or a package's name
+* @param folder - The project's folder, absolute
+* @returns The name
+* @example
+* ```ts
+* shownModule("/app/node_modules/@acme/ui/index.js", "/app"); // "@acme/ui"
+* ```
+*/
+function shownModule(link, folder) {
+	if (!isAbsolute(link)) return link;
+	return packageOfFile(link, folder) ?? relative(folder, link).split(sep).join("/");
+}
+/**
+* The installed package a file belongs to: the name after its last
+* `node_modules`, with its scope. Only the part of the path below the
+* project's folder counts, so a project that is itself kept under a
+* `node_modules` folder — a cache, a test's — is no package; a file above
+* the folder, a package installed further up a workspace, counts whole.
+*
+* @param file - The file, absolute
+* @param folder - The project's folder, absolute
+* @returns The package's name, or `undefined` for a file of no package
+* @example
+* ```ts
+* packageOfFile("/app/node_modules/@clerk/nextjs/dist/esm/server/index.js", "/app"); // "@clerk/nextjs"
+* ```
+*/
+function packageOfFile(file, folder) {
+	const below = relative(folder, file);
+	const parts = (below.startsWith("..") || isAbsolute(below) ? file : below).split(/[\\/]/);
+	const at = parts.lastIndexOf("node_modules");
+	if (at === -1) return void 0;
+	const [first, second] = parts.slice(at + 1);
+	if (first === void 0) return void 0;
+	return first.startsWith("@") && second !== void 0 ? `${first}/${second}` : first;
+}
+function pathTo(root, failed) {
+	const queue = [{
+		module: root,
+		chain: [root]
+	}];
+	const seen = /* @__PURE__ */ new Set([root]);
+	for (let at = 0; at < queue.length; at += 1) {
+		const step = queue[at];
+		if (step === void 0) break;
+		if (fileKey(step.module.filename) === failed) return step.chain;
+		for (const child of step.module.children) {
+			if (seen.has(child)) continue;
+			seen.add(child);
+			queue.push({
+				module: child,
+				chain: [...step.chain, child]
+			});
+		}
+	}
+}
+// src/config/load-error/load-hints.ts
+/** What to do about a module that could not be compiled. */
+const TRANSFORM_HINT = "Correct the code where the message points. JSX, and a file a framework compiles itself, such as a .vue or .svelte component, stay out of the modules the config imports.";
+/** What to do about a load that never ended. */
+const TIMEOUT_HINT = "Something a module runs as it is imported does not end — a connection, a server, a timer it waits for. Open it in the function that needs it, not as the module loads.";
+/**
+* What to do about an import that did not resolve: what the project's
+* framework says of it, or the framework whose import it is when Courier
+* reads the project as another, or else how to mend an import.
+*
+* @param specifier - The import, as written
+* @param profile - The framework Courier read the project as
+* @param project - The package.json that told it, absolute, and the project's folder
+* @returns The hint
+* @example
+* ```ts
+* notFoundHint("$env/static/private", profileOf(undefined), { manifest: "/app/package.json", folder: "/app" });
+* // → '"$env/static/private" is SvelteKit's own module. Courier reads this project as plain Node, …'
+* ```
+*/
+function notFoundHint(specifier, profile, project) {
+	const { manifest, folder } = project;
+	const own = profile.unresolved?.(specifier);
+	if (own !== void 0) return `"${specifier}" ${own.reason}. ${own.remedy}.`;
+	const owner = FRAMEWORK_MARKERS.find((marker) => marker.id === frameworkOfImport(specifier));
+	if (owner !== void 0 && owner.id !== profile.framework?.id) {
+		const readAs = profile.framework?.label ?? "plain Node";
+		const by = manifest === void 0 ? "as no package.json is in its folder or above it" : `by ${shownModule(manifest, folder)}`;
+		return `"${specifier}" is ${owner.label}'s own module. Courier reads this project as ${readAs}, ${by}: list ${owner.marker} there if the project is built with ${owner.label}.`;
+	}
+	const name = /^[./]|^[A-Za-z]:[\\/]/.test(specifier) ? null : packageNameOf(specifier);
+	return name === null ? "Correct the import, or create the module it names." : `Install ${name} where the project's packages are, or correct the import.`;
+}
+/**
+* What to do about code that threw as it was run: what the framework says of
+* a name its build provides, or how Courier runs the project.
+*
+* @param error - What the code threw
+* @param profile - The framework Courier read the project as
+* @param entryName - The entry's file name, `courier.config.ts`
+* @returns The hint
+* @example
+* ```ts
+* evaluationHint(new ReferenceError("useRuntimeConfig is not defined"), nuxtProfile, "courier.config.ts");
+* ```
+*/
+function evaluationHint(error, profile, entryName) {
+	const name = error instanceof ReferenceError ? /^(\S+) is not defined/.exec(error.message)?.[1] : void 0;
+	const said = name === void 0 ? void 0 : profile.undefinedName?.(name);
+	if (name !== void 0 && said !== void 0) return `${name} ${said.reason}. ${said.remedy}.`;
+	return `Courier runs ${entryName} and every module it imports, as your server would: a module that checks the environment as it is imported needs those variables set where Courier reads the project, or can skip the check while COURIER_PHASE is "definitions".`;
+}
+// src/config/load-error/shown-variables.ts
+/**
+* Which variables of an environment a quoted message shows the values of
+* rather than masks them. A variable the system sets for every process by
+* its own name — `PATH`, `HOME`, `PWD`, the user, the shell — is shown.
+* Any other whose name says it holds a secret, read as the core reads a
+* record's field of that name, is masked whatever it holds, one of a
+* family the system names by a prefix too, as npm's `npm_config__auth`
+* is. The rest are shown where they are of such a family — npm's settings,
+* the locale — or name places: an absolute path, or a list of them, as
+* `RUNNER_TEMP`, `APPDATA` and `NODE_PATH` hold. Masking those would take
+* the path out of every file a message names, and a machine sets more of
+* them than a list of names could know.
+*
+* A path is read as the platform reads one, and on Windows a name in any
+* case, as Windows reads it. A path holding a run of 16 letters and digits
+* mixing both — a key in hex or base64, which may start with `/`, or a
+* token in a path, as a webhook's is — names no place and is masked. The
+* folders a system variable names are read past: the system names its
+* own, at random as macOS names a user's temporary folder.
+*/
+/** Variables a POSIX system, its shells and npm set for every process: paths and settings. */
+const POSIX_VARIABLES = [
+	"PATH",
+	"HOME",
+	"PWD",
+	"OLDPWD",
+	"INIT_CWD",
+	"TMPDIR",
+	"TMP",
+	"TEMP",
+	"SHELL",
+	"USER",
+	"USERNAME",
+	"LOGNAME",
+	"HOSTNAME",
+	"LANG",
+	"LANGUAGE",
+	"TERM",
+	"TERM_PROGRAM",
+	"TERM_PROGRAM_VERSION",
+	"COLORTERM",
+	"EDITOR",
+	"VISUAL",
+	"PAGER",
+	"NODE",
+	"NODE_ENV",
+	"CI",
+	"COURIER_PHASE"
+];
+/** Variables Windows sets for every process that hold no path: the machine's names and settings. */
+const WINDOWS_VARIABLES = [
+	"COMPUTERNAME",
+	"USERDOMAIN",
+	"USERDOMAIN_ROAMINGPROFILE",
+	"OS",
+	"PATHEXT",
+	"PROCESSOR_ARCHITECTURE",
+	"PROCESSOR_IDENTIFIER",
+	"PROCESSOR_LEVEL",
+	"PROCESSOR_REVISION",
+	"NUMBER_OF_PROCESSORS",
+	"SESSIONNAME"
+];
+const SYSTEM_PREFIXES = [
+	"LC_",
+	"XDG_",
+	"npm_config_",
+	"npm_package_",
+	"npm_lifecycle_"
+];
+/** The shortest run of a key's characters, mixing letters with digits, taken for a key. */
+const KEY_RUN = 16;
+const NO_KEY_CHARACTERS = /[^A-Za-z0-9+=]+/;
+const LETTER$1 = /[A-Za-z]/;
+const DIGIT = /\d/;
+const POSIX = {
+	path: posix,
+	separators: /\/+/,
+	caseless: false,
+	names: new Set(POSIX_VARIABLES),
+	prefixes: SYSTEM_PREFIXES
+};
+const WINDOWS = {
+	path: win32,
+	separators: /[\\/]+/,
+	caseless: true,
+	names: /* @__PURE__ */ new Set([...POSIX_VARIABLES, ...WINDOWS_VARIABLES]),
+	prefixes: SYSTEM_PREFIXES.map((prefix) => prefix.toUpperCase())
+};
+/**
+* What tells whether a variable of the environment is shown in a quoted
+* message, by the rules above, on the platform this process runs on.
+*
+* @param env - The environment the variables are of
+* @returns Whether a variable, by its name and value, is shown
+* @example
+* ```ts
+* const shown = shownVariables(process.env);
+* shown("RUNNER_TEMP", "/home/runner/work/_temp"); // → true
+* shown("DATABASE_URL", "postgres://u:p@db/app"); // → false
+* ```
+*/
+function shownVariables(env) {
+	const platform = process.platform === "win32" ? WINDOWS : POSIX;
+	const places = systemPlaces(env, platform);
+	return (name, value) => {
+		if (isSystemName(name, platform)) return true;
+		if (isSecretValue(name, value)) return false;
+		return isSystemFamily(name, platform) || namesPlaces(value, places, platform);
+	};
+}
+function isSystemName(name, platform) {
+	return platform.names.has(platform.caseless ? name.toUpperCase() : name);
+}
+function isSystemFamily(name, platform) {
+	const read = platform.caseless ? name.toUpperCase() : name;
+	return platform.prefixes.some((prefix) => read.startsWith(prefix));
+}
+function systemPlaces(env, platform) {
+	return Object.entries(env).flatMap(([name, value]) => value === void 0 || !isSystemName(name, platform) ? [] : entriesOf(value, platform).filter((entry) => platform.path.isAbsolute(entry)).map((entry) => foldersOf(entry, platform)));
+}
+function namesPlaces(value, places, platform) {
+	const entries = entriesOf(value, platform);
+	return entries.length > 0 && entries.every((entry) => platform.path.isAbsolute(entry) && !holdsKey(pastPlaces(foldersOf(entry, platform), places, platform)));
+}
+function entriesOf(value, platform) {
+	return value.split(platform.path.delimiter).filter((entry) => entry !== "");
+}
+function foldersOf(path, platform) {
+	return path.split(platform.separators).filter((folder) => folder !== "");
+}
+function pastPlaces(folders, places, platform) {
+	let depth = 0;
+	for (const place of places) if (place.length > depth && place.length <= folders.length && place.every((folder, at) => sameName(folder, folders[at], platform))) depth = place.length;
+	return folders.slice(depth);
+}
+function sameName(a, b, platform) {
+	return platform.caseless ? a.toLowerCase() === b?.toLowerCase() : a === b;
+}
+function holdsKey(folders) {
+	return folders.some((folder) => folder.split(NO_KEY_CHARACTERS).some((run) => run.length >= KEY_RUN && LETTER$1.test(run) && DIGIT.test(run)));
+}
+// src/config/load-error/value-spans.ts
+/**
+* Where the values of an environment stand in a text. A value is found as
+* the variable holds it, and in the forms code writes it in: escaped in
+* JSON, encoded for an address, trimmed, and each line of a value of
+* several, such as a key in PEM. A value, or one of its forms, is found
+* where it is 8 characters long or more; a shorter one — `true`, a port —
+* would mask words of the message itself and is rarely a secret. A value
+* the code changed some other way — cut, encoded otherwise — is not found,
+* nor is one of a variable `shownVariables` shows. Each is found wherever
+* it stands, the same text found for two values that overlap included, so
+* no part of one is left where the other was found.
+*/
+/** The shortest value found. */
+const MIN_MASKED_LENGTH = 8;
+/**
+* The stretches of a text that values of the environment stand in, in
+* order and apart: two that overlap or touch are one.
+*
+* @param text - The text, as the code wrote it
+* @param env - The environment
+* @param reach - Where a stretch starts at the latest: the rest of the text is read only as far as a value that starts before it runs
+* @returns The stretches
+* @example
+* ```ts
+* valueSpans("bad key s3cr3t-v4lue", { KEY: "s3cr3t-v4lue" }); // → [[8, 20]]
+* ```
+*/
+function valueSpans(text, env, reach = text.length) {
+	const shown = shownVariables(env);
+	const values = /* @__PURE__ */ new Set();
+	for (const [name, value] of Object.entries(env)) {
+		if (value === void 0 || value.length < MIN_MASKED_LENGTH || shown(name, value)) continue;
+		for (const form of formsOf(value)) if (form.length >= MIN_MASKED_LENGTH) values.add(form);
+	}
+	const longest = Math.max(0, ...[...values].map((value) => value.length));
+	const read = reach + longest < text.length ? text.slice(0, reach + longest) : text;
+	const found = [];
+	for (const value of values) for (let at = read.indexOf(value); at !== -1 && at < reach; at = read.indexOf(value, at + 1)) found.push([at, at + value.length]);
+	return joined(found);
+}
+function formsOf(value) {
+	const lines = value.split(/\r?\n/);
+	return [
+		value,
+		JSON.stringify(value).slice(1, -1),
+		encodeURIComponent(value),
+		value.trim(),
+		...lines.length > 1 ? lines.map((line) => line.trim()) : []
+	];
+}
+/**
+* Stretches in order, each that overlaps or touches the one before it
+* joined to it.
+*
+* @param spans - The stretches, in any order
+* @returns The stretches, in order and apart
+* @example
+* ```ts
+* joined([[4, 9], [0, 2], [2, 3]]); // → [[0, 3], [4, 9]]
+* ```
+*/
+function joined(spans) {
+	const sorted = [...spans].sort((a, b) => a[0] - b[0]);
+	const apart = [];
+	for (const [start, end] of sorted) {
+		const last = apart.at(-1);
+		if (last !== void 0 && start <= last[1]) last[1] = Math.max(last[1], end);
+		else apart.push([start, end]);
+	}
+	return apart;
+}
+// src/config/load-error/without-secrets.ts
+/**
+* A message the project's code wrote, as it leaves the process — for a CI
+* log, which may be public, or a page — with no secret left in it: every
+* value of the environment masked, where `valueSpans` finds one, and every
+* credential the core's `redact()` finds cut — a bearer token, a password
+* in an address, a `token=` pair — each with the one sign, `[redacted]`.
+*
+* Each is found in the text as the code wrote it, so neither reads what the
+* other left. Masking a value first breaks what a credential is found by: a
+* runner's `PGUSER=postgres` masked in `postgres://app:hunter2@db/shop`
+* leaves no address to cut the password from. Cutting first leaves a value
+* whose part a credential's rule cut — the host of `DATABASE_URL`, the last
+* words of a passphrase — where no mask finds it whole.
+*
+* So the text is cut as it is, then cut again for each stretch a value
+* stands in, with that stretch written over and every character of it
+* changed: what the two cuts share before and after it does not hang on the
+* value, and what lies between is masked. A value the cut kept is masked
+* whole, one it took out leaves nothing to mask, and a credential around
+* either is cut as the core cuts it. The cut reads the text as a terminal
+* shows it, without its control codes: a code's letters run into the word
+* after them, which hides a credential's scheme.
+*
+* It costs what `redact()` costs a text, times the cuts, whatever it is
+* handed: four times 8192 characters read, to a word's end and never into a
+* value, 8192 kept, and the text cut again 16 times at most.
+*/
+/** The most of a text kept, in characters, as `redact()` keeps one: past it, the text ends with "…". */
+const MAX_KEPT = 8192;
+/** The most of a text read, four times what is kept, as `redact()` reads one: it ends at a word. */
+const MAX_READ = 4 * MAX_KEPT;
+/** The most times a text is cut again: more stretches are written over together, in as many groups. */
+const MAX_RECUTS = 16;
+const WHITESPACE = /\s/;
+const ANY = /[\s\S]/g;
+const ESCAPE = 27;
+const LETTER = /[A-Za-z]/;
+/**
+* The text with no secret left to quote, by the rules above.
+*
+* @param text - The message, as the project's code wrote it
+* @param env - The environment whose values are masked
+* @returns The message, with the one sign in place of each secret
+* @example
+* ```ts
+* withoutSecrets("cannot reach postgres://app:pw@db/shop", { PGUSER: "postgres" });
+* // → "cannot reach [redacted]://db/shop"
+* ```
+*/
+function withoutSecrets(text, env = process.env) {
+	const reach = Math.min(text.length, MAX_READ);
+	const spans = valueSpans(text, env, reach);
+	const end = readEnd(text, spans, reach);
+	const read = text.slice(0, end);
+	const cut = shownCut(read);
+	const within = spans.filter(([, stop]) => stop <= end);
+	const said = within.length === 0 ? cut : maskedIn(cut, dependentRegions(read, cut, within));
+	if (end === text.length && said.length <= MAX_KEPT) return said;
+	return end === 0 ? `${REDACTED}…` : `${sliceWhole(said, 8191)}…`;
+}
+function readEnd(text, spans, reach) {
+	if (reach === text.length) return reach;
+	let end = reach;
+	for (;;) {
+		while (end > 0 && !WHITESPACE.test(text.charAt(end))) end -= 1;
+		const crossed = spans.find(([start, stop]) => start < end && end < stop);
+		if (crossed === void 0) return end;
+		end = crossed[0];
+	}
+}
+function dependentRegions(read, cut, spans) {
+	const size = Math.ceil(spans.length / MAX_RECUTS);
+	const regions = [];
+	for (let at = 0; at < spans.length; at += size) {
+		const region = unshared(cut, shownCut(writtenOver(read, spans.slice(at, at + size))));
+		if (region[0] < region[1]) regions.push(region);
+	}
+	return joined(regions);
+}
+function writtenOver(text, spans) {
+	let written = "";
+	let at = 0;
+	for (const [start, end] of spans) {
+		const over = text.slice(start, end).replace(ANY, (character) => character === "x" || character === "X" ? "y" : "x");
+		written += `${text.slice(at, start)}${over}`;
+		at = end;
+	}
+	return `${written}${text.slice(at)}`;
+}
+function unshared(text, other) {
+	const shorter = Math.min(text.length, other.length);
+	let start = 0;
+	while (start < shorter && text[start] === other[start]) start += 1;
+	let end = 0;
+	while (end < shorter - start && text[text.length - 1 - end] === other[other.length - 1 - end]) end += 1;
+	return [start, text.length - end];
+}
+function maskedIn(cut, regions) {
+	let said = "";
+	let at = 0;
+	for (const [start, end] of regions) {
+		said += `${cut.slice(at, start)}${REDACTED}`;
+		at = end;
+	}
+	const parts = `${said}${cut.slice(at)}`.split(REDACTED);
+	return parts.filter((part, index) => part !== "" || index === 0 || index === parts.length - 1).join(REDACTED);
+}
+function shownCut(text) {
+	return cutSecrets(withoutTerminalCodes(text));
+}
+function withoutTerminalCodes(text) {
+	let shown = "";
+	for (let at = 0; at < text.length; at += 1) {
+		const code = text.charCodeAt(at);
+		if (code === ESCAPE && text[at + 1] === "[") {
+			at += 2;
+			while (at < text.length && !LETTER.test(text.charAt(at))) at += 1;
+		} else shown += code < 32 && code !== 10 && code !== 9 || code === 127 ? " " : text.charAt(at);
+	}
+	return shown;
+}
+/**
+* What the project's code threw, as an error whose message and stack hold
+* no secret, by the rules above: the error a load error carries as its
+* `cause`, so no log that prints it — at debug level, by a bundler — holds
+* one either. It keeps the thrown error's name and `code`; a value thrown
+* that is no error becomes one, its text cut the same way.
+*
+* @param thrown - What the code threw
+* @param env - The environment whose values are masked
+* @returns The error, masked
+* @example
+* ```ts
+* maskedError(new TypeError(`bad ${process.env.API_KEY}`)).message; // "bad [redacted]"
+* ```
+*/
+function maskedError(thrown, env = process.env) {
+	if (!(thrown instanceof Error)) return new Error(withoutSecrets(describedValue(thrown), env));
+	const masked = new Error(withoutSecrets(thrown.message, env));
+	masked.name = thrown.name;
+	masked.stack = thrown.stack === void 0 ? `${masked.name}: ${masked.message}` : withoutSecrets(thrown.stack, env);
+	const code = Reflect.get(thrown, "code");
+	if (typeof code === "string") Object.defineProperty(masked, "code", {
+		value: code,
+		enumerable: true
+	});
+	return masked;
+}
+/**
+* A value thrown that is no error, as text: a string as it is, anything else
+* as Node's inspector writes it — `[Object: null prototype] {}` — since a
+* value with no string form of its own would throw again when made one.
+*
+* @param value - What was thrown
+* @returns Its text
+* @example
+* ```ts
+* describedValue(Object.create(null)); // "[Object: null prototype] {}"
+* ```
+*/
+function describedValue(value) {
+	return typeof value === "string" ? value : inspect(value, {
+		depth: 2,
+		breakLength: Number.POSITIVE_INFINITY
+	});
+}
+// src/config/load-error/shown-text.ts
+/** The longest part of the project's own message a load error quotes, in characters. */
+const MAX_QUOTED_LENGTH = 300;
+/**
+* The first line of a message the project's code wrote, as a load error
+* quotes it: no secret left in it, as `withoutSecrets` leaves none, its
+* terminal codes and control characters taken out, and cut short past 300
+* characters. The whole text is read as the code wrote it before a line is
+* taken, since a value is found only as it stands — a line break, a control
+* character and all.
+*
+* @param text - The message
+* @returns The line to quote
+* @example
+* ```ts
+* shownText("Invalid environment variables\n  DATABASE_URL: Required"); // "Invalid environment variables"
+* ```
+*/
+function shownText(text) {
+	const line = (withoutSecrets(text).split("\n", 1)[0] ?? "").replace(/\t/g, " ").trim();
+	return line.length > MAX_QUOTED_LENGTH ? `${sliceWhole(line, MAX_QUOTED_LENGTH)}…` : line;
+}
+// src/config/load-error/read-failure.ts
+/**
+* What the error a failed load threw says, read as the loader and Node
+* write it: the module whose transform failed, and where; the import that
+* did not resolve, and the module that made it; and what was thrown, as a
+* line to quote.
+*/
+const PLACE = /^\d+:\d+$/;
+const IMPORTED_FROM = " imported from ";
+const LINE_ENDS = [
+	"\r",
+	"\u2028",
+	"\u2029"
+];
+/**
+* The module whose transform failed, where the error is the one the loader
+* threw for it.
+*
+* @param error - What the load threw
+* @param failures - Each module whose transform failed in the load, with what the transformer said
+* @returns The module, where it stopped and what the transformer said; `undefined` for another failure
+* @example
+* ```ts
+* failedTransform(error, new Map([["/app/src/api.ts", babelError]]))?.line; // 3
+* ```
+*/
+function failedTransform(error, failures) {
+	const message = error instanceof Error ? error.message : "";
+	for (const [file, said] of failures ?? []) if (message.includes(file)) return {
+		file,
+		...parseError(said, file)
+	};
+}
+function parseError(said, file) {
+	const loc = said instanceof Error ? Reflect.get(said, "loc") : void 0;
+	const line = typeof loc === "object" && loc !== null ? Reflect.get(loc, "line") : void 0;
+	const column = typeof loc === "object" && loc !== null ? Reflect.get(loc, "column") : void 0;
+	const text = said instanceof Error ? said.message : describedValue(said);
+	return {
+		line: typeof line === "number" ? line : void 0,
+		column: typeof column === "number" ? column + 1 : void 0,
+		said: withoutPlace(text.replace(`${file}: `, ""))
+	};
+}
+function withoutPlace(text) {
+	const ended = text.trimEnd();
+	if (!ended.endsWith(")")) return text;
+	const open = ended.lastIndexOf("(");
+	if (open === -1 || !PLACE.test(ended.slice(open + 1, -1))) return text;
+	return ended.slice(0, open).trimEnd();
+}
+/**
+* An import Node's resolution or the loader's did not find: the import, and
+* the module that made it, where the error names one.
+*
+* @param error - What the load threw
+* @returns The import and its importer; `undefined` for another failure
+* @example
+* ```ts
+* missingImport(error)?.specifier; // "server-only"
+* ```
+*/
+function missingImport(error) {
+	if (!(error instanceof Error)) return void 0;
+	const code = Reflect.get(error, "code");
+	if (code !== "MODULE_NOT_FOUND" && code !== "ERR_MODULE_NOT_FOUND") return void 0;
+	const line = error.message.split("\n", 1)[0] ?? "";
+	const specifier = /^Cannot find (?:module|package) '([^']+)'/.exec(line)?.[1];
+	if (specifier === void 0) return void 0;
+	const stack = Reflect.get(error, "requireStack");
+	return {
+		specifier,
+		importer: (Array.isArray(stack) && typeof stack[0] === "string" ? stack[0] : void 0) ?? importerIn(line)
+	};
+}
+function importerIn(line) {
+	const after = Math.max(...LINE_ENDS.map((end) => line.lastIndexOf(end))) + 1;
+	const at = line.indexOf(IMPORTED_FROM, after);
+	const importer = at === -1 ? "" : line.slice(at + 15);
+	return importer === "" ? void 0 : importer;
+}
+/**
+* What was thrown, in a line to quote: an error's name and the first line of
+* its message, masked; any other value as text.
+*
+* @param error - What was thrown
+* @returns The line
+* @example
+* ```ts
+* described(new TypeError("Invalid URL")); // "TypeError: Invalid URL"
+* ```
+*/
+function described(error) {
+	return error instanceof Error ? `${error.name}: ${shownText(error.message)}` : shownText(describedValue(error));
+}
+// src/config/load-error/explain-load-failure.ts
+/**
+* Why a project's config — or its mocks file — did not load, told from what
+* the load left: the error, the module cache that holds every module it
+* ran, and the transforms that failed. One explanation for every loader, so
+* the CLI, Studio and a bundler plugin say the same of the same project.
+*/
+/**
+* The load error that says why a load failed, what to do, and where — the
+* chain of imports from the entry to the module that failed.
+*
+* @param error - What the load threw
+* @param load - What the loader knows of the load
+* @returns The error, typed: an error that already is one is handed back
+* @example
+* ```ts
+* try { await jiti.evalModule(source, { filename: file, cache }); }
+* catch (error) { throw configLoadError(error, { entry: file, cache }); }
+* ```
+*/
+function configLoadError(error, load) {
+	if (error instanceof ConfigLoadError) return error;
+	const known = knownOf(load);
+	const { cache, entryKey } = known;
+	if (error instanceof RefusedModuleError) return failure(known, "MODULE_REFUSED", error, importChain(cache, entryKey), error.context.specifier, {
+		what: `imports "${error.context.specifier}": it ${error.reason}`,
+		hint: `${error.remedy}.`
+	});
+	const compiled = failedTransform(error, load.transformFailures);
+	if (compiled !== void 0) {
+		const chain = importChain(cache, entryKey, compiled.file);
+		const at = compiled.line === void 0 ? "" : `:${compiled.line}:${compiled.column ?? 0}`;
+		return failure(known, "TRANSFORM_FAILED", error, chain, void 0, {
+			who: `${shownModule(compiled.file, known.folder)}${at}`,
+			what: `cannot be compiled: ${shownText(compiled.said)}`,
+			hint: TRANSFORM_HINT
+		});
+	}
+	const missing = missingImport(error);
+	if (missing !== void 0) {
+		const chain = importChain(cache, entryKey, missing.importer);
+		const inPackage = missing.importer === void 0 ? void 0 : packageOfFile(missing.importer, known.folder);
+		if (inPackage !== void 0 && !chain.some((link) => packageOfFile(link, known.folder) === inPackage)) chain.push(inPackage);
+		return failure(known, "MODULE_NOT_FOUND", error, chain, missing.specifier, {
+			what: `imports "${missing.specifier}", which does not resolve`,
+			hint: notFoundHint(missing.specifier, known.profile, {
+				manifest: known.manifest,
+				folder: known.folder
+			})
+		});
+	}
+	return failure(known, "EVALUATION_FAILED", error, importChain(cache, entryKey), void 0, {
+		what: `threw ${described(error)}`,
+		hint: evaluationHint(error, known.profile, basename(load.entry))
+	});
+}
+/**
+* The load error for a load given up after its time: the evaluation goes on
+* — nothing stops a module's top-level code — and the process that gave up
+* on it ends rather than wait.
+*
+* @param load - What the loader knows of the load
+* @param limitMs - How long it was given
+* @returns The error
+* @example
+* ```ts
+* reject(loadTimedOut({ entry: configFile }, 60_000));
+* ```
+*/
+function loadTimedOut(load, limitMs) {
+	const known = knownOf(load);
+	const chain = importChain(known.cache, known.entryKey);
+	const where = chain.length > 1 ? ` (${shownChain(chain, known.folder)})` : "";
+	return new ConfigLoadError("LOAD_TIMED_OUT", `${basename(load.entry)} was still loading after ${limitMs / 1e3} s and was given up${where}.`, {
+		context: {
+			entry: load.entry,
+			specifier: void 0,
+			importChain: chain
+		},
+		hint: TIMEOUT_HINT
+	});
+}
+function knownOf(load) {
+	const folder = dirname(load.entry);
+	const detected = load.profile === void 0 ? projectFramework(folder) : void 0;
+	return {
+		entry: load.entry,
+		folder,
+		cache: load.cache ?? {},
+		entryKey: load.entryKey ?? load.entry,
+		profile: load.profile ?? profileOf(detected?.framework),
+		manifest: load.manifest ?? detected?.manifest
+	};
+}
+function failure(known, code, cause, chain, specifier, said) {
+	const who = said.who ?? shownModule(chain.at(-1) ?? known.entry, known.folder);
+	const where = chain.length > 1 ? ` (${shownChain(chain, known.folder)})` : "";
+	return new ConfigLoadError(code, `${who} ${said.what}${where}.`, {
+		context: {
+			entry: known.entry,
+			specifier,
+			importChain: chain
+		},
+		hint: said.hint,
+		cause: cause instanceof RefusedModuleError ? cause : maskedError(cause)
+	});
+}
+// src/config/import-project-file.ts
+/**
+* Run one of the project's files — `courier.config.*`, `courier.mocks.*` —
+* with the project's loader, and hand back its module namespace. The
+* modules it runs go into a cache of this load's own, so a failure names the
+* chain of imports that led to it: the file runs as the loader's `import`
+* runs it, the loader choosing by its format whether to transform it or hand
+* it to Node.
+*
+* @param file - The file, absolute and symlink-resolved
+* @param options - How the loader resolves and transforms, what runs before the file, how long it may take, and whether its default is wanted
+* @returns The file's module namespace, or its default export, settled
+* @throws ConfigLoadError saying why the file did not load, where, and what to do
+* @example
+* ```ts
+* const namespace = await importProjectFile("/app/courier.mocks.ts");
+* ```
+*/
+async function importProjectFile(file, { beforeRun, timeoutMs, default: wantsDefault, ...options } = {}) {
+	const { framework, manifest } = projectFramework(dirname(file));
+	const profile = options.profile ?? profileOf(framework);
+	const transformFailures = /* @__PURE__ */ new Map();
+	const jiti = await createConfigJiti(file, {
+		...options,
+		profile,
+		onTransformError: (filename, error) => {
+			transformFailures.set(filename, error);
+			options.onTransformError?.(filename, error);
+		}
+	});
+	beforeRun?.();
+	const cache = {};
+	const load = {
+		entry: file,
+		cache,
+		profile,
+		manifest,
+		transformFailures
+	};
+	const running = Promise.resolve(jiti.evalModule(readFileSync(file, "utf8"), {
+		filename: file,
+		async: true,
+		cache
+	})).then((namespace) => wantsDefault === true ? settledDefault(namespace, load) : namespace).catch((error) => {
+		throw configLoadError(error, load);
+	});
+	if (timeoutMs === void 0) return running;
+	return within(running, () => loadTimedOut(load, timeoutMs), timeoutMs);
+}
+/**
+* A project file's default export, as the runtime's loader hands it back
+* for `import(file, { default: true })`: the namespace's default, or the
+* namespace itself where that is nullish — a promise among them settled.
+* A promise that rejects fails the load as the file's code throwing does,
+* with `ConfigLoadError`, whose text and cause hold no value of the
+* environment. Every loader of a project's file settles its default here.
+*
+* @param namespace - The file's module namespace, as its loader evaluated it
+* @param load - What the loader knows of the load
+* @returns The default export, settled
+* @throws ConfigLoadError when the promise rejects
+* @example
+* ```ts
+* const config = await settledDefault(await loadCourierEntry(file, cache, transformCache), { entry: file });
+* ```
+*/
+async function settledDefault(namespace, load) {
+	const named = isObjectLike(namespace) ? Reflect.get(namespace, "default") : void 0;
+	try {
+		return await (named ?? namespace);
+	} catch (error) {
+		throw configLoadError(error, load);
+	}
+}
+function isObjectLike(value) {
+	return typeof value === "object" && value !== null || typeof value === "function";
+}
+function within(running, expired, limitMs) {
+	let timer;
+	const late = new Promise((_, reject) => {
+		timer = setTimeout(() => reject(expired()), limitMs);
+	});
+	return Promise.race([running, late]).finally(() => clearTimeout(timer));
+}
+// src/config/untrusted-config-error.ts
+/**
+* The config nearest a folder lies in a folder above it, and someone else
+* could have put it there: it belongs to another user, or any user may
+* write it. It was not run, as it would run with the rights of whoever
+* builds or serves the project.
+*
+* @example
+* ```ts
+* throw new UntrustedConfigError("/tmp/courier.config.ts", "/tmp/app", "it belongs to uid 1001");
+* ```
+*/
+var UntrustedConfigError = class extends CourierError {
+	/**
+	* @param configFile - The config that was not run, absolute
+	* @param folder - The folder it was looked for from
+	* @param reason - Why it is not trusted, worded to follow "and"
+	*/
+	constructor(configFile, folder, reason) {
+		super(`${configFile} was not run: it lies above ${folder}, and ${reason}. A config in a folder above the project runs only when it is yours and no one else may change it; move it into the project, or name the project's own config.`, {
+			code: "CONFIG_NOT_TRUSTED",
+			context: {
+				configFile,
+				folder
+			}
+		});
+	}
+};
+// src/config/assert-own-config.ts
+const OTHERS_WRITE = 2;
+/**
+* Refuse a config found in a folder above the one it was looked for from,
+* unless it belongs to this process's user or to the owner of that folder,
+* and no user outside its group may write it. A folder many users share,
+* such as `/tmp`, lets anyone put a config there, and it would run with the
+* rights of whoever builds a project below it. Windows has no owner of that
+* kind, so nothing is refused there.
+*
+* @param configFile - The config found, absolute
+* @param folder - The folder it was looked for from, absolute
+* @throws UntrustedConfigError when someone else could have put it there
+* @example
+* ```ts
+* assertOwnConfig("/repo/courier.config.ts", "/repo/apps/web");
+* ```
+*/
+function assertOwnConfig(configFile, folder) {
+	const uid = process.getuid?.();
+	if (uid === void 0) return;
+	const stats = statSync(configFile);
+	const folderOwner = statSync(folder, { throwIfNoEntry: false })?.uid ?? uid;
+	if (stats.uid !== uid && stats.uid !== folderOwner) throw new UntrustedConfigError(configFile, folder, `it belongs to uid ${stats.uid}, neither this user (${uid}) nor the owner of the folder (${folderOwner})`);
+	if ((stats.mode & OTHERS_WRITE) !== 0) throw new UntrustedConfigError(configFile, folder, "any user may write it");
+}
+// src/config/transform-entry-format.ts
+/**
+* How the first line of a transform cache entry is written.
+*
+* - `prefix`: how every entry starts, whatever the version of its format, so
+*   pruning can tell an entry from a file someone else put in the directory.
+* - `version`: the version this code writes; an entry in any other version
+*   is ignored and replaced.
+*/
+const TRANSFORM_ENTRY_FORMAT = {
+	prefix: "// courier-transform ",
+	version: "2"
+};
+// src/config/encode-transform-entry.ts
+/**
+* The bytes of an entry holding `code`, the transform of the input whose
+* digest is `digest`.
+*
+* The first line names the format's version, the input digest, and the byte
+* length and sha256 of the UTF-8 body that follows it, so a reader can tell
+* a complete entry from a truncated or altered one.
+*
+* @param digest - The input digest, as `transformDigest` computes it
+* @param code - The transformed code; well-formed UTF-16, so UTF-8 keeps it exactly
+* @returns The entry's bytes
+* @example
+* ```ts
+* writeFileSync(path, encodeTransformEntry(digest, result.code));
+* ```
+*/
+function encodeTransformEntry(digest, code) {
+	const { prefix, version } = TRANSFORM_ENTRY_FORMAT;
+	const body = Buffer.from(code, "utf8");
+	const bodySha256 = createHash("sha256").update(body).digest("hex");
+	const header = `${prefix}${version} ${digest} ${body.length} ${bodySha256}\n`;
+	return Buffer.concat([Buffer.from(header, "latin1"), body]);
+}
+// src/config/prune-transform-cache.ts
+const log$4 = createLogger("Config");
+const HOUR_MS = 36e5;
+const ENTRY_MAX_AGE_MS = 720 * HOUR_MS;
+const TEMPORARY_MAX_AGE_MS = HOUR_MS;
+const READ_FLAGS$1 = constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0);
+const PREFIX = Buffer.from(TRANSFORM_ENTRY_FORMAT.prefix, "latin1");
+function expiryOf(name) {
+	if (name.endsWith(".tmp")) return {
+		maxAgeMs: TEMPORARY_MAX_AGE_MS,
+		prefix: null
+	};
+	if (name.endsWith(".js")) return {
+		maxAgeMs: ENTRY_MAX_AGE_MS,
+		prefix: PREFIX
+	};
+	return null;
+}
+function isExpired(path, { maxAgeMs, prefix }, now) {
+	const fd = openSync(path, READ_FLAGS$1);
+	try {
+		const stats = fstatSync(fd);
+		if (!stats.isFile() || now - stats.mtimeMs <= maxAgeMs) return false;
+		if (prefix === null) return true;
+		const start = Buffer.alloc(prefix.length);
+		return readSync(fd, start, 0, prefix.length, 0) === prefix.length && start.equals(prefix);
+	} finally {
+		closeSync(fd);
+	}
+}
+/**
+* Delete what a transform cache directory holds for nothing: entries not
+* read for 30 days, and temporary files a writer abandoned more than an hour
+* ago.
+*
+* Only regular files directly inside the directory are considered, and no
+* link is followed: a link, a subdirectory, or a `.js` file that does not
+* start like an entry is left alone, whatever its age. A file that cannot be
+* judged or deleted, such as one another process deleted first, is logged at
+* debug level and skipped.
+*
+* @param directory - The transform cache directory
+* @param now - The current time in milliseconds (default: `Date.now()`)
+* @example
+* ```ts
+* pruneTransformCache("/app/node_modules/.cache/courier/transform");
+* ```
+*/
+function pruneTransformCache(directory, now = Date.now()) {
+	let entries;
+	try {
+		entries = readdirSync(directory, { withFileTypes: true });
+	} catch (error) {
+		log$4.debug(`Transform cache: cannot list ${directory} to prune it`, error);
+		return;
+	}
+	for (const entry of entries) {
+		const expiry = entry.isFile() ? expiryOf(entry.name) : null;
+		if (expiry === null) continue;
+		const path = join(directory, entry.name);
+		try {
+			if (isExpired(path, expiry, now)) unlinkSync(path);
+		} catch (error) {
+			log$4.debug(`Transform cache: cannot prune ${path}`, error);
+		}
+	}
+}
+// src/config/decode-transform-entry.ts
+const HEADER = new RegExp(`^${TRANSFORM_ENTRY_FORMAT.prefix}${TRANSFORM_ENTRY_FORMAT.version} ([0-9a-f]{64}) (\\d{1,15}) ([0-9a-f]{64})$`);
+const NEWLINE = 10;
+const MAX_HEADER_BYTES = 256;
+function sha256Hex(bytes) {
+	return createHash("sha256").update(bytes).digest("hex");
+}
+/**
+* Read an entry as the answer for the input whose digest is `digest`.
+*
+* @param bytes - The whole entry, as read from disk
+* @param digest - The digest of the input being transformed
+* @returns Its code when the header names that input and the body matches
+*   the header's length and sha256; otherwise why it is not a hit
+* @example
+* ```ts
+* const entry = decodeTransformEntry(readFileSync(path), digest);
+* if (entry.state === "hit") return entry.code;
+* ```
+*/
+function decodeTransformEntry(bytes, digest) {
+	const end = bytes.subarray(0, MAX_HEADER_BYTES).indexOf(NEWLINE);
+	if (end === -1) return { state: "stale" };
+	const header = HEADER.exec(bytes.toString("latin1", 0, end));
+	if (header === null || header[1] !== digest) return { state: "stale" };
+	const body = bytes.subarray(end + 1);
+	if (body.length !== Number(header[2]) || sha256Hex(body) !== header[3]) return { state: "damaged" };
+	return {
+		state: "hit",
+		code: body.toString("utf8")
+	};
+}
+// src/config/why-untrusted.ts
+const SHARED_WRITE = 18;
+/**
+* Why a path cannot be trusted to hold only what this user put there, or
+* `null` when it can.
+*
+* A symbolic link can lead anywhere, and something of another kind is not
+* what the caller expects. On POSIX, a path owned by another user, or one the
+* group or others may write, lets someone else place code that this process
+* would then run. Windows has no owner or mode bits of that kind, so only
+* the first two rules apply there.
+*
+* @param stats - The `lstat` of the path, or the `fstat` of a descriptor opened on it
+* @param kind - What the path should be
+* @param options - Whether write permission for the group and others is accepted (default: no)
+* @returns The reason, worded to follow "is", or `null`
+* @example
+* ```ts
+* const reason = whyUntrusted(lstatSync(nodeModules), "directory");
+* if (reason !== null) log.debug(`${nodeModules} is ${reason}`);
+* ```
+*/
+function whyUntrusted(stats, kind, { allowSharedWrite = false } = {}) {
+	if (stats.isSymbolicLink()) return "a symbolic link";
+	if (!(kind === "file" ? stats.isFile() : stats.isDirectory())) return `not a ${kind}`;
+	const uid = process.getuid?.();
+	if (uid === void 0) return null;
+	if (stats.uid !== uid) return `owned by uid ${stats.uid}, not ${uid}`;
+	if (!allowSharedWrite && (stats.mode & SHARED_WRITE) !== 0) return "writable by its group or others";
+	return null;
+}
+// src/config/read-transform-entry.ts
+const log$3 = createLogger("Config");
+const READ_FLAGS = constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0);
+const ABSENT_CODES = /* @__PURE__ */ new Set(["ENOENT", "ENOTDIR"]);
+const LINK_CODES = /* @__PURE__ */ new Set(["ELOOP", "EMLINK"]);
+function openEntry(path) {
+	try {
+		return openSync(path, READ_FLAGS);
+	} catch (error) {
+		const code = errnoCode(error);
+		if (code !== void 0 && ABSENT_CODES.has(code)) return null;
+		if (code === void 0 || !LINK_CODES.has(code)) throw error;
+		log$3.debug(`Transform cache: ignoring ${path}, a symbolic link`);
+		return null;
+	}
+}
+function markUsed(fd, path) {
+	try {
+		const now = /* @__PURE__ */ new Date();
+		if (process.platform === "win32") utimesSync(path, now, now);
+		else futimesSync(fd, now, now);
+	} catch (error) {
+		log$3.debug(`Transform cache: cannot mark ${path} as used`, error);
+	}
+}
+function readOpenEntry(fd, path, digest, mark) {
+	const reason = whyUntrusted(fstatSync(fd), "file");
+	if (reason !== null) {
+		log$3.debug(`Transform cache: ignoring ${path}, ${reason}`);
+		return null;
+	}
+	const entry = decodeTransformEntry(readFileSync(fd), digest);
+	if (entry.state === "damaged") log$3.debug(`Transform cache: ignoring ${path}, whose body does not match its header`);
+	if (entry.state !== "hit") return null;
+	if (mark) markUsed(fd, path);
+	return entry.code;
+}
+/**
+* Read the transform of one input from its entry.
+*
+* The entry is read through one descriptor, opened without blocking and, on
+* POSIX, without following a link. It is used only when it is a regular
+* file — on POSIX also owned by this user and writable by no one else — and
+* when it holds exactly that input's transform. A link, another kind of
+* file, an untrusted owner or mode, and a damaged body are logged at debug
+* level; a stale or missing entry is not. On Windows a link is followed, and
+* what it leads to is judged like the entry itself.
+*
+* @param path - The entry's path
+* @param digest - The digest of the input being transformed
+* @param mark - Whether a hit updates the entry's modification time, which
+*   keeps an entry in use from being pruned
+* @returns The kept code, or `null` on a miss
+* @throws The file system's error for anything else, such as `EACCES`
+* @example
+* ```ts
+* const code = readTransformEntry(join(directory, `${name}.js`), digest, true);
+* ```
+*/
+function readTransformEntry(path, digest, mark) {
+	const fd = openEntry(path);
+	if (fd === null) return null;
+	try {
+		return readOpenEntry(fd, path, digest, mark);
+	} finally {
+		closeSync(fd);
+	}
+}
+// src/config/write-transform-entry.ts
+const log$2 = createLogger("Config");
+const PASSING_RENAME_CODES = /* @__PURE__ */ new Set([
+	"EPERM",
+	"EBUSY",
+	"EACCES"
+]);
+function heldOpen(error, path) {
+	const code = errnoCode(error);
+	if (code === void 0 || !PASSING_RENAME_CODES.has(code)) return false;
+	return lstatSync(path, { throwIfNoEntry: false })?.isDirectory() !== true;
+}
+function discard(temporary) {
+	try {
+		unlinkSync(temporary);
+	} catch (error) {
+		log$2.debug(`Transform cache: cannot remove ${temporary}`, error);
+	}
+}
+function writeTemporary(temporary, bytes) {
+	const fd = openSync(temporary, "wx", 384);
+	try {
+		try {
+			writeFileSync(fd, bytes);
+		} finally {
+			closeSync(fd);
+		}
+	} catch (error) {
+		discard(temporary);
+		throw error;
+	}
+}
+/**
+* Replace the entry at `path` with `bytes`, so that a reader sees either the
+* old entry or the whole new one.
+*
+* The bytes go to a temporary file beside the entry, named after it, this
+* process and random bytes, which is then renamed over the entry. On any
+* failure the temporary file is removed. A rename refused because the entry
+* is held open (`EPERM`, `EBUSY` or `EACCES`, while no folder stands in its
+* place) skips this one write, logged at debug level.
+*
+* @param path - The entry's path, in a directory that exists
+* @param bytes - The whole entry
+* @throws The file system's error for any other failure
+* @example
+* ```ts
+* writeTransformEntry(join(directory, `${name}.js`), encodeTransformEntry(digest, code));
+* ```
+*/
+function writeTransformEntry(path, bytes) {
+	const temporary = `${path}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+	writeTemporary(temporary, bytes);
+	try {
+		renameSync(temporary, path);
+	} catch (error) {
+		discard(temporary);
+		if (!heldOpen(error, path)) throw error;
+		log$2.debug(`Transform cache: skipped writing ${path} (${errnoCode(error)})`);
+	}
+}
+// src/config/transform-cache-disk.ts
+const log$1 = createLogger("Config");
+const prunedDirectories = /* @__PURE__ */ new Set();
+const markedEntries = /* @__PURE__ */ new Set();
+/**
+* Keep transforms in `directory`, where the next process can read them.
+*
+* Each entry is named after the sha256 of its key and replaced atomically,
+* so a reader sees a whole entry or none. It is read only when it is a
+* regular file — on POSIX also not a symbolic link, owned by this user and
+* writable by no one else — and when its header names the same input and its
+* body the header's length and sha256. Anything else is a miss, and the
+* write that follows replaces it. The first hit on an entry in a process
+* marks it as used, so pruning spares it.
+*
+* The first write of each cache creates the directory with mode 0700; the
+* first write in the process prunes it. A failure is never fatal: a missing
+* entry is a quiet miss; any other read error is logged once and is a miss.
+* A directory removed while the process runs, as by clearing
+* `node_modules/.cache`, is created again at the next write. A rename refused
+* because the entry is held open skips that one write; any other write error
+* is logged once, naming the directory and the code, and stops this cache's
+* writes while reads go on.
+*
+* A `readOnly` one reads entries by the same rules and changes nothing: its
+* writes are dropped, and a hit leaves the entry's time as it was, so the
+* process that keeps the entries alone decides what pruning spares.
+*
+* @param directory - Where entries are kept; see `findTransformCacheDirectory`
+* @param options - Whether the directory is only read (default: no)
+* @returns The directory's reader and writer
+* @example
+* ```ts
+* const disk = createTransformCacheDisk("/app/node_modules/.cache/courier/transform");
+* const code = disk.read(key, digest) ?? transformAndKeep();
+* ```
+*/
+function createTransformCacheDisk(directory, { readOnly = false } = {}) {
+	const root = resolve(directory);
+	let readFailureLogged = false;
+	let created = false;
+	let writable = true;
+	function entryPath(key) {
+		return join(root, `${createHash("sha256").update(key).digest("hex").slice(0, 40)}.js`);
+	}
+	function warn(failure, outcome, error) {
+		const code = errnoCode(error);
+		const message = `Transform cache: cannot ${failure} ${root} (${code ?? "unexpected error"}); ${outcome}`;
+		log$1.warn(message, code === void 0 ? error : void 0);
+	}
+	function stopWriting(error) {
+		writable = false;
+		warn("write to", "this process keeps new transforms in memory only", error);
+	}
+	function create() {
+		mkdirSync(root, {
+			recursive: true,
+			mode: 448
+		});
+		const reason = whyUntrusted(lstatSync(root), "directory");
+		if (reason !== null) {
+			writable = false;
+			log$1.warn(`Transform cache: ${root} is ${reason}; this process keeps new transforms in memory only`);
+			return false;
+		}
+		created = true;
+		if (prunedDirectories.has(root)) return true;
+		prunedDirectories.add(root);
+		pruneTransformCache(root);
+		return true;
+	}
+	function writeEntry(path, bytes) {
+		if (!created && !create()) return;
+		try {
+			writeTransformEntry(path, bytes);
+		} catch (error) {
+			if (errnoCode(error) !== "ENOENT") throw error;
+			if (create()) writeTransformEntry(path, bytes);
+		}
+	}
+	return {
+		read(key, digest) {
+			const path = entryPath(key);
+			const mark = !readOnly && !markedEntries.has(path);
+			try {
+				const code = readTransformEntry(path, digest, mark);
+				if (code !== null && mark) markedEntries.add(path);
+				return code;
+			} catch (error) {
+				if (readFailureLogged) log$1.debug(`Transform cache: cannot read ${path}`, error);
+				else warn("read entries in", "such modules are transformed instead", error);
+				readFailureLogged = true;
+				return null;
+			}
+		},
+		write(key, digest, code) {
+			if (readOnly || !writable || !code.isWellFormed()) return;
+			try {
+				writeEntry(entryPath(key), encodeTransformEntry(digest, code));
+			} catch (error) {
+				stopWriting(error);
+			}
+		}
+	};
+}
+// src/config/transform-digest.ts
+let jitiVersion;
+function hasVersion(manifest) {
+	return typeof manifest === "object" && manifest !== null && "version" in manifest && typeof manifest.version === "string";
+}
+function readJitiVersion() {
+	if (jitiVersion !== void 0) return jitiVersion;
+	const manifest = createRequire(import.meta.url)("jiti/package.json");
+	if (!hasVersion(manifest)) throw new Error("jiti/package.json names no version");
+	jitiVersion = manifest.version;
+	return jitiVersion;
+}
+function isPlainData(value) {
+	const prototype = Object.getPrototypeOf(value);
+	if (Array.isArray(value)) return prototype === Array.prototype;
+	return prototype === Object.prototype || prototype === null;
+}
+function describe(value, open) {
+	if (value === void 0) return "u";
+	if (value === null) return "n";
+	if (typeof value === "boolean") return value ? "t" : "f";
+	if (typeof value === "number") return Object.is(value, -0) ? "#-0" : `#${value}`;
+	if (typeof value === "string") return JSON.stringify(value);
+	if (typeof value !== "object" || open.has(value) || !isPlainData(value)) return null;
+	open.add(value);
+	const entries = [];
+	const fields = Object.entries(value);
+	for (const [key, item] of fields) {
+		const described = describe(item, open);
+		if (described === null) return null;
+		entries.push(`${JSON.stringify(key)}:${described}`);
+	}
+	open.delete(value);
+	const [start, end] = Array.isArray(value) ? ["[", "]"] : ["{", "}"];
+	return `${start}${entries.join(",")}${end}`;
+}
+/**
+* The digest of everything that shapes jiti's transform of a module: jiti's
+* version, every option but the source, and the source.
+*
+* Two inputs share a digest only when every option is alike and the source is
+* the same string, code unit for code unit, so a source that is not
+* well-formed UTF-16 is not confused with the text it would decode to. An
+* option whose value cannot be told apart from another — a babel plugin given
+* as a function, a RegExp, a cycle — yields no digest.
+*
+* @param options - What jiti hands its transform
+* @returns A hex sha256, or `null` when an option holds such a value
+* @example
+* ```ts
+* const digest = transformDigest({ filename: "/app/courier.config.ts", source, ts: true });
+* ```
+*/
+function transformDigest({ source, ...rest }) {
+	const described = describe({
+		...rest,
+		async: rest.async === true
+	}, /* @__PURE__ */ new Set());
+	if (described === null) return null;
+	return createHash("sha256").update(`${readJitiVersion()}\0${described}\0`).update(source, "utf16le").digest("hex");
+}
+// src/config/transform-cache.ts
+const DEFAULT_MAX_MEMORY_CHARS = 128 * 2 ** 20;
+function keyOf({ filename, async }) {
+	if (filename === void 0 || !isAbsolute(filename)) return null;
+	return `${async === true}\0${filename}`;
+}
+/**
+* Create a {@link TransformCache} that keeps transforms in memory for the
+* life of the process and, given a `directory`, on disk for the next one.
+*
+* Each file holds one entry per module system — required and imported are
+* transformed differently, and a module reached both ways keeps both. An
+* entry is reused only when the digest of jiti's version, the options and
+* the source matches, so an edited file is transformed again the first time
+* it is loaded.
+*
+* A transform is looked for in memory, then in the directory, where a hit
+* is also kept in memory; only when both miss is it computed, and a success
+* is then kept in both. The directory is shared with every process that
+* names it, and a directory that cannot be read or written only costs
+* transforms; see `createTransformCacheDisk` for what an entry must be to be
+* used. A mock worker, which loads once the modules Studio has just loaded,
+* opens Studio's directory `readOnly` with `maxMemoryChars: 0`: it reads
+* what Studio kept, adds nothing to the directory, and holds nothing in
+* memory past its one load.
+*
+* A failed transform, one whose result carries an `error`, is never kept:
+* babel can fail on bytes it transforms without complaint a moment later,
+* such as a deeply nested module that overflows the stack while babel is
+* still cold. Such a file is transformed again on every load, and every
+* failure reaches jiti with its error, as it does without a cache. A file
+* named by a relative path, or not named, is transformed every time.
+*
+* @param options - The directory (default: none, memory only), the memory
+*   bound (default: 128 Mi characters), and whether the directory is only
+*   read (default: no)
+* @returns A cache to pass to `createConfigJiti` or `loadCourierConfig`
+* @example
+* ```ts
+* const transformCache = createTransformCache({
+*   directory: findTransformCacheDirectory(projectRoot),
+* });
+* const first = await loadCourierConfig({ cwd: projectRoot, transformCache });
+* // Unchanged modules are not transformed again, here or in the next process:
+* const second = await loadCourierConfig({ cwd: projectRoot, transformCache });
+*
+* // A process that loads once what another has just kept:
+* const reader = createTransformCache({ directory, readOnly: true, maxMemoryChars: 0 });
+* ```
+*/
+function createTransformCache({ directory, maxMemoryChars = DEFAULT_MAX_MEMORY_CHARS, readOnly = false } = {}) {
+	const disk = directory ? createTransformCacheDisk(directory, { readOnly }) : null;
+	const memo = /* @__PURE__ */ new Map();
+	let memoryChars = 0;
+	function forget(key) {
+		const entry = memo.get(key);
+		if (!entry) return;
+		memo.delete(key);
+		memoryChars -= entry.code.length;
+	}
+	function remember(key, entry) {
+		forget(key);
+		if (maxMemoryChars <= 0 || entry.code.length > maxMemoryChars) return;
+		memo.set(key, entry);
+		memoryChars += entry.code.length;
+		for (const oldest of memo.keys()) {
+			if (memoryChars <= maxMemoryChars) break;
+			forget(oldest);
+		}
+	}
+	return { transform(options, compute) {
+		const key = keyOf(options);
+		const digest = key === null ? null : transformDigest(options);
+		if (key === null || digest === null) return compute(options);
+		const hit = memo.get(key);
+		if (hit?.digest === digest) {
+			memo.delete(key);
+			memo.set(key, hit);
+			return { code: hit.code };
+		}
+		const kept = disk === null ? null : disk.read(key, digest);
+		if (kept !== null) {
+			remember(key, {
+				digest,
+				code: kept
+			});
+			return { code: kept };
+		}
+		const result = compute(options);
+		if (result.error !== void 0) return result;
+		remember(key, {
+			digest,
+			code: result.code
+		});
+		disk?.write(key, digest, result.code);
+		return result;
+	} };
+}
+// src/config/transform-cache-directory.ts
+const log = createLogger("Config");
+/** Values of `COURIER_TRANSFORM_CACHE` that turn the directory off. */
+const OFF_VALUES = /* @__PURE__ */ new Set([
+	"0",
+	"false",
+	"off"
+]);
+/** Values of `COURIER_TRANSFORM_CACHE` that keep it, as leaving it unset does. */
+const ON_VALUES = /* @__PURE__ */ new Set([
+	"",
+	"1",
+	"true",
+	"on"
+]);
+const unknownSettings = /* @__PURE__ */ new Set();
+function nearestNodeModules(start) {
+	let directory = start;
+	while (true) {
+		const candidate = join(directory, "node_modules");
+		const stats = lstatSync(candidate, { throwIfNoEntry: false });
+		if (stats?.isDirectory() || stats?.isSymbolicLink()) return candidate;
+		const parent = dirname(directory);
+		if (parent === directory) return null;
+		directory = parent;
+	}
+}
+function whyRefused(levels) {
+	for (const [path, options] of levels) {
+		const stats = lstatSync(path, { throwIfNoEntry: false });
+		const reason = stats === void 0 ? null : whyUntrusted(stats, "directory", options);
+		if (reason !== null) return `${path} is ${reason}`;
+	}
+	return null;
+}
+const TOOL_OWNED = { allowSharedWrite: true };
+const STUDIO_OWNED = {};
+const lastRefusals = /* @__PURE__ */ new Map();
+function refuse(root, reason, error) {
+	const key = error instanceof Error ? `${reason}\0${error.message}` : reason;
+	if (lastRefusals.get(root) === key) return null;
+	lastRefusals.set(root, key);
+	if (error === void 0) log.debug(`Transform cache directory off: ${reason}`);
+	else log.debug(`Transform cache directory off: ${reason}`, error);
+	return null;
+}
+function locate(projectRoot) {
+	const nodeModules = nearestNodeModules(projectRoot);
+	if (nodeModules === null) return { refusal: `no node_modules at or above ${projectRoot}` };
+	const cache = join(nodeModules, ".cache");
+	const courier = join(cache, "courier");
+	const directory = join(courier, "transform");
+	const refusal = whyRefused([
+		[nodeModules, TOOL_OWNED],
+		[cache, TOOL_OWNED],
+		[courier, STUDIO_OWNED],
+		[directory, STUDIO_OWNED]
+	]);
+	return refusal === null ? { directory } : { refusal };
+}
+/**
+* Where a project's transforms are kept across processes:
+* `.cache/courier/transform` in the nearest `node_modules` directory at or
+* above the project root.
+*
+* The nearest one is taken, not the one module resolution would reach: under
+* pnpm that lies inside `.pnpm`, and what keeps the directory safe is the
+* rule below, not where it is. Every file in it holds code that Studio, mock
+* workers and build plugins run, so on POSIX the directory is refused when
+* `node_modules`, `.cache`, `courier` or `transform` — those that exist — is
+* a symbolic link or belongs to another user, and when `courier` or
+* `transform`, which only Studio creates, is writable by its group or
+* others; any of these lets someone else replace or remove entries, or put
+* the directory somewhere they control. `node_modules` and `.cache` may be
+* group-writable, as package managers leave them under a umask of 002:
+* whoever can write `node_modules` can replace any package in it already. On
+* Windows only links and other kinds of file are refused.
+*
+* There is none when no `node_modules` exists, as with Yarn Plug'n'Play, or
+* when `COURIER_TRANSFORM_CACHE` is `0`, `false` or `off` in any case. The
+* system temporary directory, which every user of the machine may write, is
+* never used instead. Why there is none is logged at debug level, once for
+* each root until the reason changes, however often the root is looked up.
+*
+* @param projectRoot - The directory holding `courier.config.*`
+* @param env - The environment to read `COURIER_TRANSFORM_CACHE` from
+*   (default: `process.env`)
+* @returns The directory, which may not exist yet, or `null` for none
+* @example
+* ```ts
+* const transformCache = createTransformCache({
+*   directory: findTransformCacheDirectory(projectRoot),
+* });
+* ```
+*/
+function findTransformCacheDirectory(projectRoot, env = process.env) {
+	const root = resolve(projectRoot);
+	const setting = env.COURIER_TRANSFORM_CACHE?.trim().toLowerCase();
+	if (setting !== void 0 && OFF_VALUES.has(setting)) return refuse(root, `COURIER_TRANSFORM_CACHE=${setting}`);
+	if (setting !== void 0 && !ON_VALUES.has(setting) && !unknownSettings.has(setting)) {
+		unknownSettings.add(setting);
+		log.warn(`COURIER_TRANSFORM_CACHE=${setting} is not one of 0, false, off, 1, true or on; the transform cache stays on`);
+	}
+	let located;
+	try {
+		located = locate(root);
+	} catch (error) {
+		return refuse(root, `cannot inspect the directories above ${root}`, error);
+	}
+	if (located.refusal !== void 0) return refuse(root, located.refusal);
+	lastRefusals.delete(root);
+	return located.directory;
+}
+// src/config/load-config.ts
+/**
+* Unified `courier.config.{ts,mts,cts,js,mjs,cjs}` loader — the single
+* canonical way to resolve and load a user's config file.
+*
+* Two-stage design:
+*
+*  1. **File discovery** — walk up from `cwd` to the top of the project
+*     looking for a `courier.config.*` file, using nothing but Node builtins.
+*
+*  2. **File loading** — `jiti` imports the file, transpiling a TypeScript
+*     config transparently across Node / Next.js dev / tsx / bun / deno and
+*     resolving the project's `tsconfig` path aliases.
+*
+* Every consumer resolves the config through this one code path:
+*
+*  - The Studio dev server (`@noverax/courier-studio`) wraps this loader and
+*    adds dev-only concerns on top (validation, source-key stamping,
+*    dependency extraction for the fs watcher, rich error reporting).
+*
+*  - The user-app runtime (`attachRuntime` on the server side) calls it
+*    directly to discover and register sources without requiring the user
+*    to import the config file manually.
+*
+*  - `courier-cli`, the standalone server and the MCP server load the
+*    project's config with it, and the bundler plugins read a page's routes
+*    from the config it loads.
+*
+* A missing config is not an error: `null` lets the runtime caller fall back
+* to adapter auto-discovery. A config that exists and cannot be loaded is a
+* different thing entirely and throws, because reporting it as "no config"
+* sends the reader looking for a file that is right where they left it.
+*/
+/**
+* Walk up from `startDir` looking for a `courier.config.*` file, up to the
+* top of the project: the folder that holds its repository or is the root
+* of its workspace (see {@link configCandidates}). A config found in a folder
+* above `startDir` is taken only when it belongs to this user or to the
+* owner of `startDir`, and no user outside its group may write it: a folder
+* many users share, such as `/tmp`, would otherwise run anyone's config.
+*
+* @param startDir - The directory to look in first
+* @returns The absolute path of the first match, or `null` when no directory
+*   up to the top of the project holds one
+* @throws UntrustedConfigError when the nearest config lies above `startDir`
+*   and someone else could have put it there
+* @example
+* ```ts
+* findConfigFile("/app/src"); // → "/app/courier.config.ts", or null
+* ```
+*/
+function findConfigFile(startDir) {
+	const folder = resolve(startDir);
+	const found = configCandidates(folder).find((candidate) => existsSync(candidate));
+	if (found === void 0) return null;
+	if (dirname(found) !== folder) assertOwnConfig(found, folder);
+	return found;
+}
+/**
+* Find a config file in `cwd` itself, without walking up.
+*
+* @param cwd - The directory to look in
+* @returns The first of {@link CONFIG_BASENAMES} present there, or `null`
+* @example
+* ```ts
+* findConfigFileAt(process.cwd()); // → "/app/courier.config.ts", or null
+* ```
+*/
+function findConfigFileAt(cwd) {
+	for (const basename of CONFIG_BASENAMES) {
+		const candidate = resolve(cwd, basename);
+		if (existsSync(candidate)) return candidate;
+	}
+	return null;
+}
+/**
+* Find and load a `courier.config.*` file.
+*
+* Returns `null` when no config file exists, so a caller can fall back.
+* Throws `ConfigLoadError` when a file was found and loading it failed,
+* saying why, where — the chain of imports — and what to do.
+*
+* @param options - Where to look, where to reuse transforms, and how long to wait
+* @returns The config and its canonical path, or `null` when there is no config
+* @example
+* ```ts
+* const loaded = await loadCourierConfig({ cwd: projectRoot, requireAtCwd: true });
+* ```
+*/
+async function loadCourierConfig(options = {}) {
+	const startDir = resolve(options.cwd ?? process.cwd());
+	const found = options.requireAtCwd ? findConfigFileAt(startDir) : findConfigFile(startDir);
+	if (!found) return null;
+	return loadCourierConfigFile(found, {
+		transformCache: options.transformCache ?? (options.projectTransforms === true ? projectTransformCache(dirname(found)) : void 0),
+		onModule: options.onModule,
+		timeoutMs: options.timeoutMs
+	});
+}
+/**
+* The transforms kept in a project's `node_modules/.cache` — the ones Studio
+* keeps — for a process that loads the project's modules once: it reuses
+* them, keeps there the ones it makes, and holds none in memory.
+*
+* @param projectRoot - The project's root
+* @returns The cache, or `undefined` when the project has no directory to keep them in
+* @example
+* ```ts
+* await loadCourierConfigFile(file, { transformCache: projectTransformCache(dirname(file)) });
+* ```
+*/
+function projectTransformCache(projectRoot) {
+	const directory = findTransformCacheDirectory(projectRoot);
+	return directory === null ? void 0 : createTransformCache({
+		directory,
+		maxMemoryChars: 0
+	});
+}
+/**
+* Load one config file, found by whatever means the caller chose — the
+* standalone server takes it from `--config`.
+*
+* @param file - Absolute path of an existing config file
+* @param options - How the loader resolves imports and where it reuses
+*   transforms, see {@link ConfigJitiOptions}, what runs before the config,
+*   and how long it may take
+* @returns The config and the canonical path it was loaded from
+* @throws ConfigLoadError when the file will not load: an import that does
+*   not resolve or that the framework refuses, a module that does not
+*   compile, or code that throws
+* @example
+* ```ts
+* const { config } = await loadCourierConfigFile("/app/courier.config.ts", {
+*   transformCache: createTransformCache(),
+* });
+* ```
+*/
+async function loadCourierConfigFile(file, options = {}) {
+	const configFile = realpathSync(file);
+	return {
+		config: await importProjectFile(configFile, {
+			...options,
+			default: true
+		}),
+		configFile
+	};
+}
+export { projectFramework as C, detectFramework as S, configCandidates as T, createConfigJiti as _, projectTransformCache as a, readPathAliases as b, UntrustedConfigError as c, configLoadError as d, loadTimedOut as f, ConfigLoadError as g, localPath as h, loadCourierConfigFile as i, importProjectFile as l, withoutSecrets as m, findConfigFileAt as n, findTransformCacheDirectory as o, maskedError as p, loadCourierConfig as r, createTransformCache as s, findConfigFile as t, settledDefault as u, profileOf as v, CONFIG_BASENAMES as w, FRAMEWORK_MARKERS as x, RefusedModuleError as y };