@salesforce/storefront-next-dev 1.4.0 → 1.4.1-alpha.0

package/dist/package.js

@@ -0,0 +1,5 @@
+//#region package.json
+var version = "1.4.1-alpha.0";
+
+//#endregion
+export { version as t };

package/dist/sanitize.js

@@ -0,0 +1,185 @@
+//#region src/audit/sanitize.ts
+/**
+* Copyright 2026 Salesforce, Inc.
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+const bearer = /\bBearer\s+[A-Za-z0-9._~+/-]+=*/gi;
+const secretKey = new RegExp(`\\b([\\w-]{0,64}?)(?:api[_-]?key|api[_-]?signature|access[_-]?token|token|secret|password|passwd|authorization|set-cookie|cookie|session[_-]?id|sessionid|credentials?|csrf[_-]?token|private[_-]?key)(?:[_-]?(?:access[_-]?)?(?:key|value|hash|id|token))?\\\\?["']?\\s*[:=]\\s*`, "gi");
+const knownToken = /(?<![\w-])eyJ[\w-]{1,1024}\.eyJ[\w-]{1,16384}\.[\w-]*|\b[rs]k_(?:live|test)_[A-Za-z0-9]{10,}|\bwhsec_[A-Za-z0-9]{20,}|\bgh[opsru]_[A-Za-z0-9]{20,}|\bgithub_pat_\w{20,}|\bnpm_[A-Za-z0-9]{36}\b|\bx(?:ox[abeprs]|app)-(?![\w-]{0,253}\.[A-Za-z])[A-Za-z0-9-]{10,}|\bsk-(?:ant|proj)-(?![\w-]{0,253}\.[A-Za-z])[\w-]{20,}|\b(?:AKIA|ASIA)[0-9A-Z]{16}\b|(?<=hooks\.slack\.com\/services\/)[A-Za-z0-9/]+/g;
+const pemBegin = /-----BEGIN [A-Z ]{0,40}PRIVATE KEY-----/;
+const pemEnd = /-----END [A-Z ]{0,40}PRIVATE KEY-----/;
+const pemLine = /(?:[ \t]*(?:\r?\n|(?:\\r)?\\n))*[ \t]*(?:(?:Proc-Type|DEK-Info):[^\r\n\\]*|[A-Za-z0-9+/=]{16,})/y;
+const maxKeyLength = 16384;
+/** Not after `@` or `~`: `@/components/header` and `~/lib` are import aliases, not files on disk. */
+const absolutePath = /(?<![\w.@~-])(?:[A-Za-z]:[\\/]|\/)(?:[^\s<>'"`]+[\\/])+[^\s<>'"`,.;:]*/g;
+const webUrl = /https?:\/\/[^\s<>'"`]+/gi;
+/** Returns the first match at or after an index. Indexes must not decrease; reusing the last match keeps repeated searches linear. */
+function finder(pattern, text) {
+	const global = new RegExp(pattern.source, "g");
+	let found;
+	return (from) => {
+		if (found === void 0 || found && found.index < from) {
+			global.lastIndex = from;
+			found = global.exec(text);
+		}
+		return found;
+	};
+}
+/** Redacts each private key from its BEGIN line to its END line. A key without an END line before the next key
+* (or within maxKeyLength) is redacted up to its last key-like line, so prose after a lone header stays. */
+function redactPrivateKeys(text) {
+	const nextBegin = finder(pemBegin, text);
+	const nextEnd = finder(pemEnd, text);
+	let out = "";
+	let last = 0;
+	for (let begin = nextBegin(0); begin; begin = nextBegin(last)) {
+		const start = begin.index + begin[0].length;
+		const end = nextEnd(start);
+		const following = nextBegin(start);
+		let stop = start;
+		if (end && end.index - start <= maxKeyLength && (!following || following.index > end.index)) stop = end.index + end[0].length;
+		else for (pemLine.lastIndex = stop; pemLine.exec(text); pemLine.lastIndex = stop) stop = pemLine.lastIndex;
+		out += `${text.slice(last, begin.index)}[REDACTED]`;
+		last = stop;
+	}
+	return out + text.slice(last);
+}
+const quoteAt = (text, index) => {
+	if (text[index] === "\"" || text[index] === "'") return text[index];
+	return text[index] === "\\" && (text[index + 1] === "\"" || text[index + 1] === "'") ? text.slice(index, index + 2) : "";
+};
+const lineEnd = (text, index) => {
+	const end = text.indexOf("\n", index);
+	return end === -1 ? text.length : end;
+};
+const skip = (text, index, pattern) => {
+	while (index < text.length && pattern.test(text.charAt(index))) index++;
+	return index;
+};
+const wordChar = /[^\s"',;}&\\]/;
+const tokenChar = /[\w.~+/=-]/;
+const schemeCredential = /[ \t]+[^\s"',;}&\\]+/y;
+/**
+* Reads the value that starts at `start`: a quoted string up to its unescaped closing quote, a list or object up
+* to its matching bracket (plus any token glued to it), an auth scheme with its credential, or one word. An
+* unclosed quote or bracket takes the rest of the line. `core` is the value without its quotes.
+*/
+function scanValue(text, start) {
+	const quote = quoteAt(text, start);
+	if (quote) {
+		for (let index = start + quote.length; index < text.length && text[index] !== "\n"; index += text[index] === "\\" && text[index + 1] !== "\n" ? 2 : 1) if (text.startsWith(quote, index)) return {
+			end: index + quote.length,
+			quote,
+			core: text.slice(start + quote.length, index)
+		};
+	} else if (text[start] === "[" || text[start] === "{") {
+		let depth = 0;
+		let inQuote = "";
+		for (let index = start; index < text.length && text[index] !== "\n"; index++) {
+			if (inQuote) {
+				if (text.startsWith(inQuote, index)) {
+					index += inQuote.length - 1;
+					inQuote = "";
+				} else if (text[index] === "\\") index++;
+				continue;
+			}
+			inQuote = quoteAt(text, index);
+			if (inQuote) index += inQuote.length - 1;
+			else if (text[index] === "[" || text[index] === "{") depth++;
+			else if ((text[index] === "]" || text[index] === "}") && --depth === 0) {
+				const end$1 = skip(text, index + 1, tokenChar);
+				return {
+					end: end$1,
+					quote: "",
+					core: text.slice(start, end$1)
+				};
+			}
+		}
+	} else {
+		let end$1 = skip(text, start, wordChar);
+		if (/^(?:Basic|Bearer|Digest|Token)$/i.test(text.slice(start, end$1))) {
+			schemeCredential.lastIndex = end$1;
+			if (schemeCredential.exec(text)) end$1 = schemeCredential.lastIndex;
+		}
+		return {
+			end: end$1,
+			quote: "",
+			core: text.slice(start, end$1)
+		};
+	}
+	const end = lineEnd(text, start);
+	return {
+		end,
+		quote: "",
+		core: text.slice(start, end)
+	};
+}
+/** Values that can't be secrets: an exact placeholder, booleans and null under any name (`hasPassword: true`),
+* and numbers under a page, count or limit name (`pageToken=2`). */
+function keepValue(prefix, value) {
+	return /^(?:\[REDACTED\]|(?:Basic|Bearer|Digest|Token) \[REDACTED\]|true|false|null|undefined)$/i.test(value) || /^-?\d+(?:\.\d+)?$/.test(value) && /page|max|min|count|limit|total|num/i.test(prefix);
+}
+/** Redacts the value of every secret-named assignment. Each value is read and decided on once, and the search
+* resumes after it, so a value is never rewritten twice and the work stays linear. */
+function redactAssignments(text) {
+	let out = "";
+	let last = 0;
+	secretKey.lastIndex = 0;
+	for (let key = secretKey.exec(text); key; key = secretKey.exec(text)) {
+		const start = key.index + key[0].length;
+		const { end, quote, core } = scanValue(text, start);
+		if (end === start) continue;
+		if (!keepValue(key[1] ?? "", core)) {
+			const scheme = /^(Basic|Bearer|Digest|Token)\s+\S/i.exec(core)?.[1];
+			out += `${text.slice(last, start)}${quote}${scheme ? `${scheme} ` : ""}[REDACTED]${quote}`;
+			last = end;
+		}
+		secretKey.lastIndex = end;
+	}
+	return out + text.slice(last);
+}
+function sanitizeUrl(value) {
+	const parsed = new URL(value);
+	if (parsed.protocol !== "https:" && parsed.protocol !== "http:") throw new Error("URL must use https (or http with --allow-http)");
+	parsed.username = "";
+	parsed.password = "";
+	for (const key of [...parsed.searchParams.keys()]) parsed.searchParams.set(key, "[REDACTED]");
+	parsed.hash = "";
+	return parsed.toString();
+}
+function sanitizeText(value) {
+	const urls = [];
+	let sanitized = redactPrivateKeys(value.replaceAll("\0", "")).replace(knownToken, "[REDACTED]").replace(webUrl, (url) => {
+		try {
+			urls.push(sanitizeUrl(url));
+			return `\u0000URL${urls.length - 1}\u0000`;
+		} catch {
+			return "[REDACTED_URL]";
+		}
+	});
+	sanitized = redactAssignments(sanitized.replace(bearer, "Bearer [REDACTED]")).replace(absolutePath, "[REDACTED_PATH]");
+	return sanitized.replace(/\u0000URL(\d+)\u0000/g, (match, index) => urls[Number(index)] ?? match);
+}
+function sanitizeJsonValue(value, key) {
+	if (typeof value === "string") {
+		if (key === "pointer" && value.startsWith("/")) return value.split("/").map((token, index) => index === 0 ? "" : sanitizeText(token)).join("/");
+		return sanitizeText(value);
+	}
+	if (Array.isArray(value)) return value.map((item) => sanitizeJsonValue(item));
+	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([childKey, child]) => [childKey, sanitizeJsonValue(child, childKey)]));
+	return value;
+}
+
+//#endregion
+export { sanitizeText as n, sanitizeUrl as r, sanitizeJsonValue as t };

package/dist/schema.js

@@ -0,0 +1,121 @@
+import { z } from "zod";
+
+//#region src/audit/bundle/schema.ts
+/** Where `prepare` writes the bundle analysis, relative to the run folder. */
+const BUNDLE_DIR = "bundle";
+const BUNDLE_ANALYSIS = `${BUNDLE_DIR}/analysis.json`;
+/** The build's visualizer report, copied into the run for the user to open. */
+const BUNDLE_VISUALIZER = `${BUNDLE_DIR}/client-bundle-size.html`;
+const BUNDLE_SCHEMA_VERSION = 2;
+/**
+* The smallest saving worth a recommendation: 30 KiB of minified JavaScript, about 10 KiB over the network. Below it a
+* change costs more review than it saves; the big wins (a 100–200 KiB library loaded for a closed overlay) are far above.
+*/
+const MIN_RECOMMENDED_BYTES = 30 * 1024;
+const bytes = z.number().int().nonnegative();
+/** A source file: project-relative (`src/components/header.tsx`) or within a package (`zod/v4/core/schemas.js`). */
+const sourceRef = z.object({
+	file: z.string(),
+	line: z.number().int().positive().optional(),
+	excerpt: z.string().optional()
+}).strict();
+/** Who owns a module: an npm package, a project folder, or bytes the bundler adds. */
+const ownerKindSchema = z.enum([
+	"npm",
+	"project",
+	"build"
+]);
+/** What the browser downloaded on the deployed site: sizes only, since its files can't be tied to the local build. */
+const liveTotalsSchema = z.object({
+	scripts: z.number().int().nonnegative(),
+	decodedBytes: bytes,
+	transferBytes: bytes,
+	beforeLoad: z.number().int().nonnegative(),
+	beforeLoadDecodedBytes: bytes,
+	beforeLoadTransferBytes: bytes
+}).strict();
+const bundlePackageSchema = z.object({
+	name: z.string(),
+	kind: ownerKindSchema,
+	bytes,
+	modules: z.number().int().nonnegative(),
+	largestModules: z.array(z.object({
+		file: z.string(),
+		bytes
+	}).strict()),
+	versions: z.array(z.string()).optional(),
+	importers: z.array(sourceRef),
+	importerCount: z.number().int().nonnegative(),
+	deferrableBytes: bytes.optional()
+}).strict();
+const bundleCandidateSchema = z.object({
+	importer: sourceRef,
+	target: z.string(),
+	package: z.string(),
+	savedBytes: bytes,
+	savedModules: z.number().int().positive(),
+	lazyElsewhere: z.array(z.string()).optional()
+}).strict();
+const bundleChunkSchema = z.object({
+	file: z.string(),
+	bytes,
+	owners: z.array(z.object({
+		name: z.string(),
+		bytes
+	}).strict())
+}).strict();
+/** The page's routes in the local build: everything here comes from building the project folder, not from the live site. */
+const localPageSchema = z.object({
+	chunks: z.number().int().nonnegative(),
+	bytes,
+	largest: z.array(bundleChunkSchema),
+	packages: z.array(bundlePackageSchema),
+	candidates: z.array(bundleCandidateSchema)
+}).strict();
+const bundlePageSchema = z.object({
+	page: z.string(),
+	runId: z.string(),
+	lighthouseArtifact: z.string(),
+	observedLoadMs: z.number().nullable(),
+	live: liveTotalsSchema,
+	route: z.object({
+		ids: z.array(z.string()).min(1),
+		source: z.enum(["page", "url"])
+	}).strict().nullable(),
+	local: localPageSchema.nullable()
+}).strict();
+const bundleAnalysisSchema = z.object({
+	schemaVersion: z.literal(BUNDLE_SCHEMA_VERSION),
+	status: z.enum([
+		"complete",
+		"partial",
+		"unavailable"
+	]),
+	notes: z.array(z.string()),
+	build: z.object({
+		packageManager: z.string(),
+		durationMs: z.object({
+			analyze: z.number().nullable(),
+			plain: z.number().nullable()
+		}).strict(),
+		visualizer: z.string().nullable(),
+		chunks: z.number().int().nonnegative(),
+		withMaps: z.number().int().nonnegative(),
+		bytes,
+		attribution: z.object({
+			modules: bytes,
+			unmappedModules: bytes,
+			preloadLists: bytes,
+			routerManifest: bytes,
+			glue: bytes
+		}).strict()
+	}).strict().nullable(),
+	pages: z.array(bundlePageSchema),
+	skipped: z.array(z.object({
+		page: z.string(),
+		reason: z.string()
+	}).strict())
+}).strict();
+
+//#endregion
+export { MIN_RECOMMENDED_BYTES as a, bundlePackageSchema as c, BUNDLE_VISUALIZER as i, bundlePageSchema as l, BUNDLE_DIR as n, bundleAnalysisSchema as o, BUNDLE_SCHEMA_VERSION as r, bundleCandidateSchema as s, BUNDLE_ANALYSIS as t };

package/dist/server.js

@@ -1,5 +1,6 @@
 import { t as logger } from "./logger.js";
-import { o as loadRuntimeConfig } from "./config.js";
+import { t as importTypescript } from "./ts-import.js";
+import { c as loadRuntimeConfig } from "./config.js";
 import path from "path";
 import chalk from "chalk";
 import express from "express";
@@ -21,59 +22,6 @@ import { Resource } from "@opentelemetry/resources";
 import { registerInstrumentations } from "@opentelemetry/instrumentation";
 import { UndiciInstrumentation } from "@opentelemetry/instrumentation-undici";
 
-//#region src/server/ts-import.ts
-/**
-* Parse TypeScript paths from tsconfig.json and convert to jiti alias format.
-*
-* @param tsconfigPath - Path to tsconfig.json
-* @param projectDirectory - Project root directory for resolving relative paths
-* @returns Record of alias mappings for jiti
-*
-* @example
-* // tsconfig.json: { "compilerOptions": { "paths": { "@/*": ["./src/*"] } } }
-* // Returns: { "@/": "/absolute/path/to/src/" }
-*/
-function parseTsconfigPaths(tsconfigPath, projectDirectory) {
-	const alias = {};
-	if (!existsSync(tsconfigPath)) return alias;
-	try {
-		const tsconfigContent = readFileSync(tsconfigPath, "utf-8");
-		const tsconfig = JSON.parse(tsconfigContent);
-		const paths = tsconfig.compilerOptions?.paths;
-		const baseUrl = tsconfig.compilerOptions?.baseUrl || ".";
-		if (paths) {
-			for (const [key, values] of Object.entries(paths)) if (values && values.length > 0) {
-				const aliasKey = key.replace(/\/\*$/, "/");
-				alias[aliasKey] = resolve(projectDirectory, baseUrl, values[0].replace(/\/\*$/, "/").replace(/^\.\//, ""));
-			}
-		}
-	} catch {}
-	const sortedAlias = {};
-	Object.keys(alias).sort((a, b) => b.length - a.length).forEach((key) => {
-		sortedAlias[key] = alias[key];
-	});
-	return sortedAlias;
-}
-/**
-* Import a TypeScript file using jiti with proper path alias resolution.
-* This is a cross-platform alternative to tsx that works on Windows.
-*
-* @param filePath - Absolute path to the TypeScript file to import
-* @param options - Import options including project directory
-* @returns The imported module
-*/
-async function importTypescript(filePath, options) {
-	const { projectDirectory, tsconfigPath = resolve(projectDirectory, "tsconfig.json") } = options;
-	const { createJiti } = await import("jiti");
-	const alias = parseTsconfigPaths(tsconfigPath, projectDirectory);
-	return createJiti(import.meta.url, {
-		fsCache: false,
-		interopDefault: true,
-		alias
-	}).import(filePath);
-}
-
-//#endregion
 //#region src/server/config.ts
 /**
 * This is a temporary function before we move the config implementation from
@@ -600,12 +548,12 @@ const HEALTH_ENDPOINT_PATH = "/sfdc-health";
 * console.log(metadata?.version);
 * ```
 */
-function readPackageMetadata(path$1) {
-	if (!existsSync(path$1)) return null;
+function readPackageMetadata(path$2) {
+	if (!existsSync(path$2)) return null;
 	try {
-		return JSON.parse(readFileSync(path$1, "utf8"));
+		return JSON.parse(readFileSync(path$2, "utf8"));
 	} catch (error) {
-		logger.debug(`Health check: failed to parse package.json at ${path$1}`, error);
+		logger.debug(`Health check: failed to parse package.json at ${path$2}`, error);
 		return null;
 	}
 }
@@ -701,8 +649,8 @@ async function createServer(options) {
 	} else {
 		const possiblePaths = RELATIVE_MIDDLEWARE_REGISTRY_BUILT_PATHS.map((p) => resolve(projectDirectory, p));
 		let builtRegistryPath = null;
-		for (const path$1 of possiblePaths) if (existsSync(path$1)) {
-			builtRegistryPath = path$1;
+		for (const path$2 of possiblePaths) if (existsSync(path$2)) {
+			builtRegistryPath = path$2;
 			break;
 		}
 		if (builtRegistryPath) registry = await import(pathToFileURL(builtRegistryPath).href);

package/dist/server2.js

@@ -0,0 +1,185 @@
+import "./package.js";
+import { t as AUDIT_ROOT } from "./assets.js";
+import "./sanitize.js";
+import { i as BUNDLE_VISUALIZER } from "./schema.js";
+import { b as listRuns, n as deriveStatus, o as readEvents, p as preparedSchema, r as endsRun, s as LIGHTHOUSE_REPORT, v as RUN_ID, x as runDir } from "./events.js";
+import { constants } from "node:fs";
+import path from "node:path";
+import { access, readFile, rm } from "node:fs/promises";
+import { z } from "zod";
+import { Hono } from "hono";
+import { serve } from "@hono/node-server";
+import { serveStatic } from "@hono/node-server/serve-static";
+import { streamSSE } from "hono/streaming";
+
+//#region src/audit/server.ts
+const defaultUiDir = path.join(AUDIT_ROOT, "ui");
+const POLL_MS = 500;
+async function fileExists(file) {
+	try {
+		await access(file, constants.R_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+const preparedPagesSchema = z.object({ pages: preparedSchema.shape.pages });
+/** Absolute archive directory for `label`, from the run's prepared.json
+* (undefined when it is missing, unreadable, or has no such page). */
+async function preparedArchiveDir(run, label) {
+	const preparedPath = path.join(run, "prepared.json");
+	if (!await fileExists(preparedPath)) return void 0;
+	let raw;
+	try {
+		raw = JSON.parse(await readFile(preparedPath, "utf8"));
+	} catch {
+		return;
+	}
+	const prepared = preparedPagesSchema.safeParse(raw);
+	const page = prepared.success ? prepared.data.pages.find((item) => item.label === label) : void 0;
+	return page && path.resolve(run, page.archiveDir);
+}
+/** A run reports `complete` only once run.complete has landed and the result file is actually readable. */
+async function statusOf(run) {
+	if (!run.eventsFile || !await fileExists(run.eventsFile)) return await fileExists(run.resultPath) ? "complete" : "preparing";
+	const derived = deriveStatus(await readEvents(run.eventsFile));
+	if (derived === "complete" && !await fileExists(run.resultPath)) return "running";
+	return derived;
+}
+function createApp(options) {
+	const uiDir = options.uiDir ?? defaultUiDir;
+	const app = new Hono();
+	/** The run `id` names (the latest when absent); undefined when there is no such run. */
+	const findRun = async (id) => {
+		if (!options.workspace) {
+			if (id || !options.input) return void 0;
+			return {
+				dir: path.dirname(options.input),
+				resultPath: options.input
+			};
+		}
+		const runs = await listRuns(options.workspace);
+		const runId = id ?? runs[0];
+		if (!runId || !runs.includes(runId)) return void 0;
+		const dir = runDir(options.workspace, runId);
+		return {
+			id: runId,
+			dir,
+			resultPath: path.join(dir, "audit-result.json"),
+			eventsFile: path.join(dir, "events.ndjson")
+		};
+	};
+	const requestedRun = (context) => findRun(context.req.query("run"));
+	app.get("/api/status", async (context) => {
+		const run = await requestedRun(context);
+		const status = run ? await statusOf(run) : "preparing";
+		return context.json({
+			status,
+			phase: status,
+			runId: run?.id
+		});
+	});
+	app.get("/api/runs", async (context) => {
+		const { workspace } = options;
+		if (!workspace) return context.json([]);
+		const runs = await Promise.all((await listRuns(workspace)).map(async (id) => ({
+			id,
+			complete: await fileExists(path.join(runDir(workspace, id), "audit-result.json"))
+		})));
+		return context.json(runs);
+	});
+	app.delete("/api/runs/:id", async (context) => {
+		const id = context.req.param("id");
+		if (!options.workspace || !RUN_ID.test(id)) return context.json({ error: "No such run." }, 404);
+		const runs = await listRuns(options.workspace);
+		if (!runs.includes(id)) return context.json({ error: "No such run." }, 404);
+		if (id === runs[0]) return context.json({ error: "The latest run cannot be deleted." }, 409);
+		await rm(runDir(options.workspace, id), {
+			recursive: true,
+			force: true
+		});
+		return context.body(null, 204);
+	});
+	app.get("/api/events", (context) => {
+		if (!options.workspace) return context.json({ error: "This server is not watching a run." }, 409);
+		return streamSSE(context, async (stream) => {
+			let closed = false;
+			stream.onAbort(() => {
+				closed = true;
+			});
+			let eventsFile;
+			let sent = 0;
+			while (!closed) {
+				eventsFile ??= (await findRun())?.eventsFile;
+				const events = eventsFile ? await readEvents(eventsFile) : [];
+				for (; sent < events.length; sent++) {
+					await stream.writeSSE({ data: JSON.stringify(events[sent]) });
+					if (endsRun(events[sent])) {
+						await stream.writeSSE({
+							event: "end",
+							data: ""
+						});
+						closed = true;
+						break;
+					}
+				}
+				if (closed) break;
+				await stream.sleep(POLL_MS);
+			}
+		});
+	});
+	app.get("/api/audit", async (context) => {
+		const run = await requestedRun(context);
+		if (!run) return context.json({ error: "No such run." }, 404);
+		if (await statusOf(run) !== "complete") return context.json({ error: "Audit is not complete." }, 409);
+		return context.json(JSON.parse(await readFile(run.resultPath, "utf8")));
+	});
+	app.get("/api/pages/:label/report", async (context) => {
+		const run = await requestedRun(context);
+		if (!run) return context.json({ error: "No such run." }, 404);
+		if (await statusOf(run) !== "complete") return context.json({ error: "Audit is not complete." }, 409);
+		const archiveDir = await preparedArchiveDir(run.dir, context.req.param("label"));
+		const report = archiveDir && path.join(archiveDir, LIGHTHOUSE_REPORT);
+		if (!report || !await fileExists(report)) return context.json({ error: "No Lighthouse report for this page." }, 404);
+		context.header("Content-Security-Policy", "sandbox allow-scripts allow-popups allow-popups-to-escape-sandbox");
+		return context.html(await readFile(report, "utf8"));
+	});
+	app.get("/api/bundle/visualizer", async (context) => {
+		const run = await requestedRun(context);
+		if (!run) return context.json({ error: "No such run." }, 404);
+		if (await statusOf(run) !== "complete") return context.json({ error: "Audit is not complete." }, 409);
+		const report = path.join(run.dir, BUNDLE_VISUALIZER);
+		if (!await fileExists(report)) return context.json({ error: "This run has no bundle visualizer report." }, 404);
+		context.header("Content-Security-Policy", "sandbox allow-scripts allow-popups allow-popups-to-escape-sandbox");
+		return context.html(await readFile(report, "utf8"));
+	});
+	app.use("/*", serveStatic({ root: path.relative(process.cwd(), uiDir) || "." }));
+	app.get("/*", serveStatic({ path: path.relative(process.cwd(), path.join(uiDir, "index.html")) }));
+	return app;
+}
+async function startServer(options) {
+	const app = createApp(options);
+	const port = options.port ?? 8787;
+	const host = options.host ?? "localhost";
+	const server = await new Promise((resolve$1, reject) => {
+		const listening = serve({
+			fetch: app.fetch,
+			port,
+			hostname: host
+		}, () => {
+			listening.off("error", fail);
+			resolve$1(listening);
+		});
+		function fail(error) {
+			reject(error.code === "EADDRINUSE" ? /* @__PURE__ */ new Error(`Port ${port} is in use; pass --port <n> to use another one`) : error);
+		}
+		listening.once("error", fail);
+	});
+	return {
+		url: `http://${host}:${port}`,
+		close: () => server.close()
+	};
+}
+
+//#endregion
+export { createApp, startServer };

package/dist/ts-import.js

@@ -0,0 +1,57 @@
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+//#region src/server/ts-import.ts
+/**
+* Parse TypeScript paths from tsconfig.json and convert to jiti alias format.
+*
+* @param tsconfigPath - Path to tsconfig.json
+* @param projectDirectory - Project root directory for resolving relative paths
+* @returns Record of alias mappings for jiti
+*
+* @example
+* // tsconfig.json: { "compilerOptions": { "paths": { "@/*": ["./src/*"] } } }
+* // Returns: { "@/": "/absolute/path/to/src/" }
+*/
+function parseTsconfigPaths(tsconfigPath, projectDirectory) {
+	const alias = {};
+	if (!existsSync(tsconfigPath)) return alias;
+	try {
+		const tsconfigContent = readFileSync(tsconfigPath, "utf-8");
+		const tsconfig = JSON.parse(tsconfigContent);
+		const paths = tsconfig.compilerOptions?.paths;
+		const baseUrl = tsconfig.compilerOptions?.baseUrl || ".";
+		if (paths) {
+			for (const [key, values] of Object.entries(paths)) if (values && values.length > 0) {
+				const aliasKey = key.replace(/\/\*$/, "/");
+				alias[aliasKey] = resolve(projectDirectory, baseUrl, values[0].replace(/\/\*$/, "/").replace(/^\.\//, ""));
+			}
+		}
+	} catch {}
+	const sortedAlias = {};
+	Object.keys(alias).sort((a, b) => b.length - a.length).forEach((key) => {
+		sortedAlias[key] = alias[key];
+	});
+	return sortedAlias;
+}
+/**
+* Import a TypeScript file using jiti with proper path alias resolution.
+* This is a cross-platform alternative to tsx that works on Windows.
+*
+* @param filePath - Absolute path to the TypeScript file to import
+* @param options - Import options including project directory
+* @returns The imported module
+*/
+async function importTypescript(filePath, options) {
+	const { projectDirectory, tsconfigPath = resolve(projectDirectory, "tsconfig.json") } = options;
+	const { createJiti } = await import("jiti");
+	const alias = parseTsconfigPaths(tsconfigPath, projectDirectory);
+	return createJiti(import.meta.url, {
+		fsCache: false,
+		interopDefault: true,
+		alias
+	}).import(filePath);
+}
+
+//#endregion
+export { importTypescript as t };