@specbook/vite 0.0.0-stage → 0.1.0

package/dist/index.js

@@ -0,0 +1,1348 @@
+// src/index.ts
+import { existsSync as existsSync3, readdirSync } from "fs";
+import { mkdir as mkdir2, readFile as readFile5, writeFile as writeFile2 } from "fs/promises";
+import { createRequire } from "module";
+import { basename, dirname, join as join4, relative as relative4, resolve as resolve2, sep as sep4 } from "path";
+import fg4 from "fast-glob";
+
+// src/docs.ts
+import { readFile } from "fs/promises";
+import { relative, sep } from "path";
+import fg from "fast-glob";
+import { marked } from "marked";
+function frontmatter(src) {
+  const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/.exec(src);
+  if (!m) return { meta: {}, body: src };
+  const meta = {};
+  for (const line of m[1].split(/\r?\n/)) {
+    const i = line.indexOf(":");
+    if (i > 0)
+      meta[line.slice(0, i).trim()] = line.slice(i + 1).trim().replace(/^["']|["']$/g, "");
+  }
+  return { meta, body: src.slice(m[0].length) };
+}
+var OP_FOLDER = /(?:^|\/)(?:requests|apis)\/([^/]+)\/([^/]+)\/(?:readme|index)\.md$/i;
+var OP_FLAT = /(?:^|\/)(?:requests|apis)\/([^/]+)\/docs\/([^/]+)\.md$/i;
+var NOT_AN_OPERATION = /^(readme|index)$/i;
+function colocated(file) {
+  if (/\.seq\.md$/.test(file)) return { sequenceFile: file.replace(/\.md$/, ".ts") };
+  if (/\.req\.md$/.test(file)) return { requestFile: file.replace(/\.md$/, ".ts") };
+  const folder = OP_FOLDER.exec(file);
+  if (folder && folder[2] !== "docs") return { operation: `${folder[1]}/${folder[2]}` };
+  const flat = OP_FLAT.exec(file);
+  if (flat && !NOT_AN_OPERATION.test(flat[2]))
+    return { operation: `${flat[1]}/${flat[2]}` };
+  return void 0;
+}
+async function scanDocs(root) {
+  const files = await fg("**/*.md", {
+    cwd: root,
+    absolute: true,
+    ignore: ["**/node_modules/**", "**/.generated/**", "**/dist/**", "**/.git/**"]
+  });
+  const pages = [];
+  const claimed = /* @__PURE__ */ new Map();
+  for (const abs of files.sort()) {
+    const { meta, body } = frontmatter(await readFile(abs, "utf8"));
+    const file = relative(root, abs).split(sep).join("/");
+    const near = colocated(file);
+    if (!near && !meta.operation && !meta.sequence && !meta.page) continue;
+    const operation = meta.operation ?? near?.operation;
+    if (operation) {
+      const first = claimed.get(operation);
+      if (first) {
+        console.warn(
+          `[specbook] ${file} documents ${operation}, which ${first} already does; ignored`
+        );
+        continue;
+      }
+      claimed.set(operation, file);
+    }
+    pages.push({
+      file,
+      operation,
+      sequence: meta.sequence,
+      sequenceFile: near?.sequenceFile,
+      requestFile: near?.requestFile,
+      replace: meta.replace === "true" || void 0,
+      title: meta.title ?? meta.page,
+      html: marked.parse(body, { async: false })
+    });
+  }
+  return pages;
+}
+
+// src/environments.ts
+import { existsSync } from "fs";
+import { mkdir, readdir, readFile as readFile2, writeFile } from "fs/promises";
+import { join } from "path";
+
+// ../core/src/proxy/policy.ts
+var DEFAULT_METHODS = ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
+var DEFAULT_MAX_BODY = 25 * 1024 * 1024;
+var DEFAULT_TIMEOUT_MS = 6e4;
+var STRIPPED_REQUEST_HEADERS = /* @__PURE__ */ new Set([
+  "host",
+  "connection",
+  "content-length",
+  "transfer-encoding",
+  "keep-alive",
+  "upgrade",
+  "te",
+  "trailer",
+  "proxy-authorization",
+  "proxy-connection",
+  "cookie",
+  "origin",
+  "referer",
+  "x-forwarded-for",
+  "x-forwarded-host",
+  "x-forwarded-proto",
+  "x-real-ip"
+]);
+var isStrippedHeader = (name) => {
+  const n = name.toLowerCase();
+  return STRIPPED_REQUEST_HEADERS.has(n) || n.startsWith("sec-fetch-") || n.startsWith("sec-ch-");
+};
+var STRIPPED_RESPONSE_HEADERS = /* @__PURE__ */ new Set([
+  "connection",
+  "keep-alive",
+  "transfer-encoding",
+  "upgrade",
+  "content-encoding",
+  "content-length",
+  "set-cookie"
+]);
+function ipv4(host) {
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  if (!m) return void 0;
+  const n = m.slice(1).map(Number);
+  return n.every((x) => x <= 255) ? n : void 0;
+}
+function isPrivateAddress(host) {
+  const h = host.replace(/^\[|\]$/g, "").toLowerCase();
+  const v4 = ipv4(h);
+  if (v4) {
+    const [a, b] = v4;
+    return a === 0 || a === 10 || a === 127 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a >= 224;
+  }
+  if (h.includes(":")) {
+    if (h === "::" || h === "::1") return true;
+    const mapped = /^::ffff:(.+)$/.exec(h)?.[1];
+    if (mapped) {
+      const dotted = ipv4(mapped);
+      if (dotted) return isPrivateAddress(mapped);
+      return true;
+    }
+    return /^f[cd]/.test(h) || /^fe[89ab]/.test(h);
+  }
+  return false;
+}
+var PRIVATE_NAMES = /(^|\.)(localhost|local|internal|lan|home|corp|intranet)$/i;
+function upstreamProblem(raw, opts = {}) {
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    return "the upstream is not a valid URL";
+  }
+  if (u.protocol !== "https:" && u.protocol !== "http:") return "only http and https are proxied";
+  if (u.username || u.password) return "credentials in a URL are not allowed";
+  if (!opts.allowPrivateHosts) {
+    if (isPrivateAddress(u.hostname) || PRIVATE_NAMES.test(u.hostname))
+      return "private and local addresses are not reachable through this proxy";
+    if (/^\d+$/.test(u.hostname) || /^0x/i.test(u.hostname))
+      return "numeric host forms are not allowed";
+  }
+  return void 0;
+}
+function crossSiteProblem(headers, url) {
+  const site = headers.get("sec-fetch-site");
+  if (site === "cross-site") return "cross-site requests are not accepted";
+  const origin = headers.get("origin");
+  if (origin && origin !== "null") {
+    try {
+      if (new URL(origin).host !== url.host) return "requests from another origin are not accepted";
+    } catch {
+      return "invalid Origin";
+    }
+  }
+  if (origin === "null") return "requests from an opaque origin are not accepted";
+  return void 0;
+}
+
+// ../core/src/proxy/substitute.ts
+var OPEN = 123;
+var CLOSE = 125;
+var isSpace = (c) => c === 32 || c === 9 || c === 10 || c === 13;
+var isName = (c) => c >= 48 && c <= 57 || c >= 65 && c <= 90 || c >= 97 && c <= 122 || c === 95 || c === 36 || c === 45;
+var PREFIX = [115, 101, 99, 114, 101, 116, 115, 46];
+function placeholderAt(b, i) {
+  let p = i + 2;
+  while (p < b.length && isSpace(b[p])) p++;
+  for (const c of PREFIX) if (b[p++] !== c) return void 0;
+  const from = p;
+  while (p < b.length && isName(b[p])) p++;
+  if (p === from) return void 0;
+  const name = String.fromCharCode(...b.subarray(from, p));
+  while (p < b.length && isSpace(b[p])) p++;
+  if (b[p] !== CLOSE || b[p + 1] !== CLOSE) return void 0;
+  return { start: i, end: p + 2, name };
+}
+function find(b) {
+  const out = [];
+  for (let i = 0; i < b.length - 1; i++) {
+    if (b[i] === OPEN && b[i + 1] === OPEN) {
+      const hit = placeholderAt(b, i);
+      if (hit) {
+        out.push(hit);
+        i = hit.end - 1;
+      }
+    }
+  }
+  return out;
+}
+var enc = new TextEncoder();
+function secretNames(bytes) {
+  return [...new Set(find(bytes).map((h) => h.name))];
+}
+function secretNamesIn(text) {
+  return text.includes("{{") ? secretNames(enc.encode(text)) : [];
+}
+function substituteBytes(bytes, values) {
+  const hits = find(bytes).filter((h) => values.has(h.name));
+  if (hits.length === 0) return bytes;
+  const parts = [];
+  let at = 0;
+  for (const h of hits) {
+    parts.push(bytes.subarray(at, h.start), enc.encode(values.get(h.name)));
+    at = h.end;
+  }
+  parts.push(bytes.subarray(at));
+  const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+  let o = 0;
+  for (const p of parts) {
+    out.set(p, o);
+    o += p.length;
+  }
+  return out;
+}
+var dec = new TextDecoder();
+function substituteText(text, values) {
+  if (!text.includes("{{")) return text;
+  return dec.decode(substituteBytes(enc.encode(text), values));
+}
+
+// ../core/src/proxy/forward.ts
+var json = (status, body) => new Response(JSON.stringify(body), {
+  status,
+  headers: { "content-type": "application/json" }
+});
+async function forward(req, target, deps) {
+  const started = Date.now();
+  const { policy } = deps;
+  let bytesIn = 0;
+  const done = (res, outcome) => {
+    deps.onEvent?.({
+      env: target.env,
+      service: target.service,
+      method: req.method,
+      host: safeHost(target.url),
+      status: res.status,
+      ms: Date.now() - started,
+      bytesIn,
+      outcome
+    });
+    return res;
+  };
+  if (policy.refuseCrossSite !== false) {
+    const why = crossSiteProblem(req.headers, new URL(req.url));
+    if (why) return done(json(403, { error: why }), "refused");
+  }
+  const methods = policy.methods ?? DEFAULT_METHODS;
+  if (!methods.includes(req.method.toUpperCase()))
+    return done(json(405, { error: `${req.method} is not allowed` }), "refused");
+  const bad = upstreamProblem(target.url, { allowPrivateHosts: policy.allowPrivateHosts });
+  if (bad) return done(json(403, { error: bad }), "refused");
+  const max = policy.maxBodyBytes ?? DEFAULT_MAX_BODY;
+  const declared = Number(req.headers.get("content-length") ?? 0);
+  if (declared > max) return done(json(413, { error: "request body too large" }), "refused");
+  let body;
+  if (req.method !== "GET" && req.method !== "HEAD" && req.body) {
+    body = new Uint8Array(await req.arrayBuffer());
+    bytesIn = body.length;
+    if (body.length > max) return done(json(413, { error: "request body too large" }), "refused");
+  }
+  const headerPairs = [...req.headers.entries()].filter(([k]) => !isStrippedHeader(k));
+  const asked = /* @__PURE__ */ new Set();
+  for (const [, v] of headerPairs) for (const n of secretNamesIn(v)) asked.add(n);
+  const url = new URL(target.url);
+  const plainQuery = url.search.replace(/%7B/gi, "{").replace(/%7D/gi, "}").replace(/%20/g, " ");
+  for (const n of secretNamesIn(plainQuery)) asked.add(n);
+  if (body) for (const n of secretNames(body)) asked.add(n);
+  const values = /* @__PURE__ */ new Map();
+  const missing = [];
+  for (const name of asked) {
+    const v = await deps.lookup?.(name, { env: target.env, service: target.service });
+    if (v === void 0) missing.push(name);
+    else values.set(name, v);
+  }
+  if (missing.length)
+    return done(json(400, { error: `Missing secrets: ${missing.join(", ")}` }), "missing-secrets");
+  const headers = new Headers();
+  for (const [k, v] of headerPairs) headers.set(k, substituteText(v, values));
+  if (secretNamesIn(plainQuery).length > 0) {
+    const encoded = new Map([...values].map(([k, v]) => [k, encodeURIComponent(v)]));
+    url.search = substituteText(plainQuery, encoded);
+  }
+  const ctl = new AbortController();
+  const timer = setTimeout(() => ctl.abort(), policy.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+  req.signal?.addEventListener("abort", () => ctl.abort());
+  try {
+    const upstream = await (deps.fetch ?? fetch)(url.toString(), {
+      method: req.method,
+      headers,
+      body: body ? substituteBytes(body, values) : void 0,
+      // a redirect is the caller's to follow: following one could leave the allow-listed host
+      redirect: "manual",
+      signal: ctl.signal
+    });
+    const out = new Headers();
+    upstream.headers.forEach((v, k) => {
+      if (!STRIPPED_RESPONSE_HEADERS.has(k.toLowerCase())) out.set(k, v);
+    });
+    return done(new Response(upstream.body, { status: upstream.status, headers: out }), "ok");
+  } catch (e) {
+    if (ctl.signal.aborted) return done(json(504, { error: "the upstream timed out" }), "timeout");
+    return done(json(502, { error: e instanceof Error ? e.message : String(e) }), "upstream-error");
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function safeHost(url) {
+  try {
+    return new URL(url).host;
+  } catch {
+    return void 0;
+  }
+}
+function parseRoute(pathname, mount) {
+  const base = mount.replace(/\/+$/, "");
+  if (!pathname.startsWith(`${base}/`)) return void 0;
+  const m = /^\/([^/]+)\/([^/]+)(\/.*)?$/.exec(pathname.slice(base.length));
+  if (!m) return void 0;
+  return { env: m[1], service: m[2], rest: m[3] ?? "/" };
+}
+async function handleProxy(req, deps) {
+  const url = new URL(req.url);
+  const route = parseRoute(url.pathname, deps.mount);
+  if (!route) return void 0;
+  const base = await deps.policy.upstream?.(route.env, route.service);
+  if (!base)
+    return json(404, {
+      error: `No baseUrl for service "${route.service}" in env "${route.env}"`
+    });
+  return forward(
+    req,
+    {
+      env: route.env,
+      service: route.service,
+      url: `${base.replace(/\/+$/, "")}${route.rest}${url.search}`
+    },
+    deps
+  );
+}
+
+// ../core/src/secrets.ts
+function parseDotenv(text) {
+  const out = {};
+  for (const raw of text.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq < 1) continue;
+    const key = line.slice(0, eq).trim().replace(/^export\s+/, "");
+    let val = line.slice(eq + 1).trim();
+    if (val.startsWith('"') && val.endsWith('"') || val.startsWith("'") && val.endsWith("'")) {
+      val = val.slice(1, -1);
+    }
+    out[key] = val;
+  }
+  return out;
+}
+
+// src/environments.ts
+var ENV_NAME = /^[A-Za-z0-9_-]+$/;
+var VAR_NAME = /^[A-Za-z_][\w.-]*$/;
+var environmentsDir = (root) => join(root, ".specbook", "environments");
+var varsFile = (root, env) => join(environmentsDir(root), `${env}.env`);
+var secretsFileFor = (root, env) => join(environmentsDir(root), `${env}.secrets.env`);
+var sharedSecretsFile = (root) => join(root, ".specbook", "secrets.local.env");
+var isEnvName = (s) => typeof s === "string" && ENV_NAME.test(s);
+var isVarName = (s) => typeof s === "string" && VAR_NAME.test(s);
+async function readParsed(file) {
+  return existsSync(file) ? parseDotenv(await readFile2(file, "utf8")) : {};
+}
+async function readEnvironment(root, env) {
+  if (!isEnvName(env))
+    return { vars: {}, secrets: {}, shared: await readParsed(sharedSecretsFile(root)) };
+  const [vars, secrets, shared] = await Promise.all([
+    readParsed(varsFile(root, env)),
+    readParsed(secretsFileFor(root, env)),
+    readParsed(sharedSecretsFile(root))
+  ]);
+  return { vars, secrets, shared };
+}
+async function listEnvironmentFiles(root) {
+  const dir = environmentsDir(root);
+  if (!existsSync(dir)) return [];
+  const names = /* @__PURE__ */ new Set();
+  for (const f of await readdir(dir)) {
+    const m = /^([A-Za-z0-9_-]+)(\.secrets)?\.env$/.exec(f);
+    if (m) names.add(m[1]);
+  }
+  return [...names].sort();
+}
+async function readAllVars(root) {
+  const out = {};
+  const dir = environmentsDir(root);
+  if (!existsSync(dir)) return out;
+  for (const f of await readdir(dir)) {
+    const m = /^([A-Za-z0-9_-]+)\.env$/.exec(f);
+    if (m) out[m[1]] = parseDotenv(await readFile2(join(dir, f), "utf8"));
+  }
+  return out;
+}
+var quote = (v) => {
+  if (/[\r\n]/.test(v)) throw new Error("values must be a single line");
+  if (!/[\s#"'\\]/.test(v)) return v;
+  if (!v.includes('"')) return `"${v}"`;
+  if (!v.includes("'")) return `'${v}'`;
+  return v;
+};
+function setDotenvKey(text, key, value) {
+  const lines = text === "" ? [] : text.split("\n");
+  const at = lines.findIndex((l) => new RegExp(`^\\s*(?:export\\s+)?${escapeRe(key)}\\s*=`).test(l));
+  if (value === void 0) {
+    if (at >= 0) lines.splice(at, 1);
+  } else if (at >= 0) lines[at] = `${key}=${quote(value)}`;
+  else {
+    if (lines.length && lines[lines.length - 1] === "") lines.pop();
+    lines.push(`${key}=${quote(value)}`);
+  }
+  const out = lines.join("\n");
+  return out === "" || out.endsWith("\n") ? out : `${out}
+`;
+}
+var escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+async function ensureEnvironmentsDir(root) {
+  const dir = environmentsDir(root);
+  await mkdir(dir, { recursive: true });
+  const ignore = join(dir, ".gitignore");
+  if (!existsSync(ignore))
+    await writeFile(ignore, "# secrets never leave this machine\n*.secrets.env\n");
+  return dir;
+}
+async function writeEnvKey(file, key, value) {
+  const current = existsSync(file) ? await readFile2(file, "utf8") : "";
+  await writeFile(file, setDotenvKey(current, key, value));
+}
+
+// src/examples.ts
+import { relative as relative2, sep as sep2 } from "path";
+import fg2 from "fast-glob";
+var IGNORE = ["**/node_modules/**", "**/.generated/**", "**/dist/**", "**/.git/**"];
+var NAME = /\.example\.json$/;
+async function scanExamples(root, outDir, operations) {
+  const examples = {};
+  const assets = {};
+  const dirs = /* @__PURE__ */ new Map();
+  const add = (key, entry) => {
+    examples[key] ??= [];
+    const list = examples[key];
+    const at = list.findIndex((e) => e.name === entry.name);
+    if (at >= 0) list[at] = entry;
+    else list.push(entry);
+    dirs.set(entry.dir, entry.abs.slice(0, entry.abs.lastIndexOf(sep2)));
+  };
+  const gen = `${root}/${outDir}`;
+  for (const abs of await fg2("*/examples/*/*.example.json", { cwd: gen, absolute: true })) {
+    const [svc, , id, file] = relative2(gen, abs).split(sep2);
+    add(`${svc}/${id}`, {
+      name: file.replace(NAME, ""),
+      abs,
+      source: "generated",
+      dir: `${svc}/${id}@generated`
+    });
+  }
+  for (const abs of await fg2("**/*.example.json", { cwd: root, absolute: true, ignore: IGNORE })) {
+    const parts = relative2(root, abs).split(sep2);
+    const file = parts.pop();
+    const id = parts.pop();
+    const svc = parts.pop();
+    const key = `${svc}/${id}`;
+    if (!svc || !id || !operations.has(key)) continue;
+    add(key, {
+      name: file.replace(NAME, ""),
+      abs,
+      source: "project",
+      dir: `${svc}/${id}@project`
+    });
+  }
+  for (const [dir, abs] of dirs) {
+    for (const f of await fg2("*", { cwd: abs, absolute: false, ignore: ["*.json"] })) {
+      assets[`${dir}/${f}`] = `${abs}/${f}`;
+    }
+  }
+  for (const list of Object.values(examples))
+    list.sort((a, b) => order(a) - order(b) || a.name.localeCompare(b.name));
+  return { examples, assets };
+}
+var order = (e) => e.source === "project" ? 0 : e.name === "default" ? 2 : e.name === "dynamic" ? 3 : 1;
+
+// src/files.ts
+import { existsSync as existsSync2 } from "fs";
+import { readFile as readFile3 } from "fs/promises";
+import { join as join2, relative as relative3, resolve, sep as sep3 } from "path";
+import fg3 from "fast-glob";
+var IGNORE2 = ["**/node_modules/**", "**/.generated/**", "**/dist/**", "**/.git/**"];
+async function scanProject(root) {
+  const rel = (e) => e.map((f) => relative3(root, f).split(sep3).join("/")).sort();
+  const [requests, sequences, sources] = await Promise.all([
+    fg3("**/*.req.ts", { cwd: root, absolute: true, ignore: IGNORE2 }),
+    fg3("**/*.seq.ts", { cwd: root, absolute: true, ignore: IGNORE2 }),
+    fg3(["**/*.ts", "**/*.json"], {
+      cwd: root,
+      absolute: true,
+      ignore: [
+        ...IGNORE2,
+        "**/package.json",
+        "**/tsconfig*.json",
+        "**/openapi/**",
+        "**/*.d.ts",
+        "**/*.example.json"
+      ]
+    })
+  ]);
+  return { requests: rel(requests), sequences: rel(sequences), sources: rel(sources) };
+}
+var WRITABLE = /\.(ts|json|txt|csv|png|jpe?g|gif|webp|pdf|zip|bin)$/;
+var BLOCKED = /(^|\/)(node_modules|\.generated|\.git|dist)(\/|$)|secrets\.local\.env/;
+function safeProjectPath(root, relPath) {
+  if (typeof relPath !== "string" || relPath.includes("\0")) return void 0;
+  const abs = resolve(root, relPath);
+  const rel = relative3(root, abs).split(sep3).join("/");
+  if (rel.startsWith("..") || rel === "" || resolve(rel) === rel) return void 0;
+  if (BLOCKED.test(rel) || !WRITABLE.test(rel)) return void 0;
+  return abs;
+}
+function requestsDirFor(root) {
+  return existsSync2(join2(root, "apis")) && !existsSync2(join2(root, "requests")) ? "apis" : "requests";
+}
+
+// src/proxy.ts
+var MOUNT = "/__specbook/proxy";
+function readBody(req) {
+  return new Promise((res, rej) => {
+    const parts = [];
+    req.on("data", (c) => parts.push(c));
+    req.on("end", () => res(new Uint8Array(Buffer.concat(parts))));
+    req.on("error", rej);
+  });
+}
+async function handleProxy2(req, res, deps) {
+  const url = req.url ?? "/";
+  if (!url.startsWith(`${MOUNT}/`)) return false;
+  const config = await deps.getConfig();
+  const secretsByEnv = /* @__PURE__ */ new Map();
+  const method = req.method ?? "GET";
+  const headers = new Headers();
+  for (const [k, v] of Object.entries(req.headers))
+    if (v !== void 0) headers.set(k, Array.isArray(v) ? v.join(", ") : v);
+  const body = method === "GET" || method === "HEAD" ? void 0 : await readBody(req);
+  const request = new Request(`http://${req.headers.host ?? "localhost"}${url}`, {
+    method,
+    headers,
+    body: body?.length ? body : void 0
+  });
+  const response = await handleProxy(request, {
+    mount: MOUNT,
+    policy: {
+      upstream: (env, service) => config.services[service]?.baseUrl[env],
+      // a developer's own machine: their local services are the point
+      allowPrivateHosts: true
+    },
+    lookup: async (name, ctx) => {
+      const env = ctx.env ?? "";
+      const key = config.secretNames[name]?.env ?? name;
+      const fromMemory = deps.memory?.[env]?.[name] ?? deps.memory?.["*"]?.[name];
+      if (fromMemory !== void 0) return fromMemory;
+      if (deps.env[key] !== void 0) return deps.env[key];
+      let local = secretsByEnv.get(env);
+      if (!local) {
+        local = await deps.readSecrets(env);
+        secretsByEnv.set(env, local);
+      }
+      return local[key];
+    },
+    fetch: deps.fetch
+  });
+  if (!response) return false;
+  res.statusCode = response.status;
+  response.headers.forEach((v, k) => {
+    res.setHeader(k, v);
+  });
+  if (response.body) for await (const chunk of response.body) res.write(chunk);
+  res.end();
+  return true;
+}
+
+// src/sequences.ts
+import { readFile as readFile4 } from "fs/promises";
+import { join as join3 } from "path";
+var KEYS = ["id", "title", "description", "group", "tags"];
+function readString(src, i) {
+  const q = src[i];
+  if (q !== "'" && q !== '"' && q !== "`") return void 0;
+  let out = "";
+  for (let j = i + 1; j < src.length; j++) {
+    const c = src[j];
+    if (c === "\\") {
+      const n = src[j + 1];
+      out += n === "n" ? "\n" : n === "t" ? "	" : n;
+      j++;
+    } else if (c === q) return [out, j + 1];
+    else if (q === "`" && c === "$" && src[j + 1] === "{") return void 0;
+    else out += c;
+  }
+  return void 0;
+}
+var skipSpace = (src, i) => {
+  while (i < src.length) {
+    if (/\s/.test(src[i])) i++;
+    else if (src.startsWith("//", i))
+      i = src.indexOf("\n", i) < 0 ? src.length : src.indexOf("\n", i);
+    else if (src.startsWith("/*", i))
+      i = src.indexOf("*/", i) < 0 ? src.length : src.indexOf("*/", i) + 2;
+    else break;
+  }
+  return i;
+};
+function skipValue(src, i) {
+  let depth = 0;
+  for (let j = i; j < src.length; j++) {
+    const c = src[j];
+    const s = readString(src, j);
+    if (s) j = s[1] - 1;
+    else if (c === "`" || c === "'" || c === '"') return src.length;
+    else if ("([{".includes(c)) depth++;
+    else if (")]}".includes(c)) {
+      if (depth === 0) return j;
+      depth--;
+    } else if (c === "," && depth === 0) return j;
+  }
+  return src.length;
+}
+function parseSequenceMeta(src) {
+  const call = /\bsequence\s*(?:<[^>]*>)?\s*\(\s*\{/.exec(src);
+  if (!call) return void 0;
+  const found = {};
+  let i = call.index + call[0].length;
+  for (; ; ) {
+    i = skipSpace(src, i);
+    if (i >= src.length || src[i] === "}") break;
+    const key = /^[A-Za-z_$][\w$]*|^(['"])(.*?)\1/.exec(src.slice(i));
+    if (!key) return void 0;
+    const name = key[2] ?? key[0];
+    i = skipSpace(src, i + key[0].length);
+    if (src[i] !== ":") {
+      if (KEYS.includes(name)) return void 0;
+      i = skipValue(src, i);
+    } else {
+      i = skipSpace(src, i + 1);
+      if (KEYS.includes(name)) {
+        const str = readString(src, i);
+        if (str) {
+          found[name] = str[0];
+          i = str[1];
+        } else if (src[i] === "[" && name === "tags") {
+          const tags = [];
+          i++;
+          for (; ; ) {
+            i = skipSpace(src, i);
+            if (src[i] === "]") {
+              i++;
+              break;
+            }
+            const t = readString(src, i);
+            if (!t) return void 0;
+            tags.push(t[0]);
+            i = skipSpace(src, t[1]);
+            if (src[i] === ",") i++;
+          }
+          found[name] = tags;
+        } else return void 0;
+        i = skipSpace(src, i);
+        if (src[i] !== "," && src[i] !== "}") return void 0;
+      } else i = skipValue(src, i);
+    }
+    i = skipSpace(src, i);
+    if (src[i] === ",") i++;
+  }
+  if (typeof found.id !== "string" || typeof found.title !== "string") return void 0;
+  return found;
+}
+async function scanSequences(root, files) {
+  const meta = {};
+  const unresolved = [];
+  await Promise.all(
+    files.map(async (file) => {
+      const parsed = parseSequenceMeta(await readFile4(join3(root, file), "utf8").catch(() => ""));
+      if (parsed) meta[parsed.id] = { ...parsed, file };
+      else unresolved.push(file);
+    })
+  );
+  return { meta, unresolved: unresolved.sort() };
+}
+
+// src/index.ts
+var VIRTUAL = "virtual:specbook/registry";
+var RESOLVED = `\0${VIRTUAL}`;
+var VIRTUAL_TYPES = "virtual:specbook/types";
+var RESOLVED_TYPES = `\0${VIRTUAL_TYPES}`;
+var VIRTUAL_FAKER = "virtual:specbook/faker";
+var RESOLVED_FAKER = `\0${VIRTUAL_FAKER}`;
+var VIRTUAL_FAKER_LOCALE = "virtual:specbook/faker-locale/";
+var RESOLVED_FAKER_LOCALE = `\0${VIRTUAL_FAKER_LOCALE}`;
+var VIRTUAL_MANIFESTS = "virtual:specbook/manifests";
+var RESOLVED_MANIFESTS = `\0${VIRTUAL_MANIFESTS}`;
+var VIRTUAL_OPERATIONS = "virtual:specbook/operations";
+var RESOLVED_OPERATIONS = `\0${VIRTUAL_OPERATIONS}`;
+var VIRTUAL_DOC = "virtual:specbook/doc/";
+var RESOLVED_DOC = `\0${VIRTUAL_DOC}`;
+function findConfig(root) {
+  return [join4(root, ".specbook/specbook.config.ts"), join4(root, "specbook.config.ts")].find(
+    existsSync3
+  );
+}
+function json2(res, status, body) {
+  res.statusCode = status;
+  res.setHeader("content-type", "application/json");
+  res.end(JSON.stringify(body));
+}
+async function readBody2(req) {
+  return new Promise((ok, fail) => {
+    let d = "";
+    req.on("data", (c) => {
+      d += c;
+    });
+    req.on("end", () => ok(d));
+    req.on("error", fail);
+  });
+}
+function fakerLocales(entry) {
+  const names = /* @__PURE__ */ new Set(["en", "base"]);
+  const dir = join4(dirname(entry), "locale");
+  if (existsSync3(dir))
+    for (const f of readdirSync(dir)) {
+      const m = /^([A-Za-z0-9_]+)\.js$/.exec(f);
+      if (m) names.add(m[1]);
+    }
+  return [...names].sort();
+}
+function slim(manifests) {
+  return Object.fromEntries(
+    Object.entries(manifests).map(([k, m]) => [
+      k,
+      {
+        ...m,
+        operations: m.operations.map(
+          ({ description, examples, file, ...o }) => o
+        )
+      }
+    ])
+  );
+}
+async function collectTypes(root, outDir) {
+  const libs = {};
+  const req = createRequire(join4(root, "package.json"));
+  try {
+    const entry = req.resolve("@specbook/core");
+    const srcDir = dirname(entry);
+    const files = await fg4("**/*.ts", { cwd: srcDir, ignore: ["**/*.test.ts"] });
+    for (const f of files) {
+      libs[`file:///node_modules/@specbook/core/src/${f}`] = await readFile5(join4(srcDir, f), "utf8");
+    }
+    libs["file:///node_modules/@specbook/core/package.json"] = JSON.stringify({
+      name: "@specbook/core",
+      types: "./src/index.ts"
+    });
+  } catch {
+  }
+  const genDir = join4(root, outDir);
+  for (const f of await fg4("**/*.ts", { cwd: genDir })) {
+    libs[`file:///${outDir}/${f}`] = await readFile5(join4(genDir, f), "utf8");
+  }
+  const project = await scanProject(root);
+  const sources = {};
+  for (const f of project.sources.filter((s) => s.endsWith(".ts"))) {
+    sources[f] = await readFile5(join4(root, f), "utf8");
+  }
+  return { libs, sources };
+}
+function specbook(options) {
+  const root = resolve2(options.projectRoot);
+  const outDir = options.outDir ?? ".generated";
+  let server;
+  let isBuild = false;
+  let docHtml = [];
+  let manifestsCode = "export default {}";
+  let operationsCode = "export const operations = {}";
+  let bundlePlan = /* @__PURE__ */ new Map();
+  let definitionFiles = /* @__PURE__ */ new Map();
+  let operationChunks = /* @__PURE__ */ new Map();
+  const seqHeaders = /* @__PURE__ */ new Map();
+  let notifyRegistryChanged = () => {
+  };
+  const memorySecrets = {};
+  async function registryCode() {
+    const files = await scanProject(root);
+    const manifests = {};
+    for (const m of await fg4("*/manifest.json", { cwd: join4(root, outDir), absolute: true })) {
+      const parsed = JSON.parse(await readFile5(m, "utf8"));
+      manifests[parsed.service] = parsed;
+    }
+    const examples = await fg4("*/examples/*/*.response.json", {
+      cwd: join4(root, outDir),
+      absolute: true
+    });
+    const imp = (abs) => {
+      if (isBuild) return `() => import(${JSON.stringify(abs)})`;
+      if (abs.endsWith(".json"))
+        return `() => import(/* @vite-ignore */ ${JSON.stringify(`/@fs${abs}`)})`;
+      return `(v) => import(/* @vite-ignore */ ${JSON.stringify(`/@fs${abs}`)} + '?t=' + v)`;
+    };
+    const raw = (abs) => `() => import(${JSON.stringify(`${abs}?raw`)}).then((m) => m.default)`;
+    const entry = (file) => `{ file: ${JSON.stringify(file)}, load: ${imp(join4(root, file))}${isBuild ? `, source: ${raw(join4(root, file))}` : ""} }`;
+    const cfg = findConfig(root);
+    const requestsDir = requestsDirFor(root);
+    existsSync3(join4(root, "apis")) && !existsSync3(join4(root, "requests")) ? "apis" : "requests";
+    let fakerEntry;
+    try {
+      fakerEntry = createRequire(join4(root, "package.json")).resolve("@faker-js/faker");
+    } catch {
+    }
+    const operationEntries = Object.values(manifests).flatMap((m) => {
+      const mm = m;
+      return mm.operations.map(
+        (o) => `  ${JSON.stringify(`${mm.service}/${o.id}`)}: ${imp(join4(root, outDir, mm.service, "operations", `${o.id}.ts`))}`
+      );
+    });
+    const schemaFiles = await fg4("*/schemas/*.request.schema.json", {
+      cwd: join4(root, outDir),
+      absolute: true
+    });
+    const responseFiles = await fg4("*/schemas/*.responses.schema.json", {
+      cwd: join4(root, outDir),
+      absolute: true
+    });
+    const responseEntries = responseFiles.map((abs) => {
+      const rel = relative4(join4(root, outDir), abs).split(sep4);
+      const op = rel[2].replace(/\.responses\.schema\.json$/, "");
+      return `  ${JSON.stringify(`${rel[0]}/${op}`)}: ${imp(abs)}`;
+    });
+    const defFiles = await fg4("*/schemas/definitions.schema.json", {
+      cwd: join4(root, outDir),
+      absolute: true
+    });
+    const schemaEntries = schemaFiles.map((abs) => {
+      const rel = relative4(join4(root, outDir), abs).split(sep4);
+      const op = rel[2].replace(/\.request\.schema\.json$/, "");
+      return `  ${JSON.stringify(`${rel[0]}/${op}`)}: ${imp(abs)}`;
+    });
+    const docFiles = await fg4("*/docs/*.json", { cwd: join4(root, outDir), absolute: true });
+    const operationDocEntries = docFiles.map((abs) => {
+      const rel = relative4(join4(root, outDir), abs).split(sep4);
+      return `  ${JSON.stringify(`${rel[0]}/${rel[2].replace(/\.json$/, "")}`)}: ${imp(abs)}`;
+    });
+    const defEntries = defFiles.map((abs) => {
+      const service = relative4(join4(root, outDir), abs).split(sep4)[0];
+      return `  ${JSON.stringify(service)}: ${imp(abs)}`;
+    });
+    const known = new Set(
+      Object.values(manifests).flatMap((m) => {
+        const mm = m;
+        return mm.operations.map((o) => `${mm.service}/${o.id}`);
+      })
+    );
+    const sequenceScan = await scanSequences(root, files.sequences);
+    for (const f of files.sequences) {
+      const src = await readFile5(join4(root, f), "utf8").catch(() => "");
+      seqHeaders.set(join4(root, f), JSON.stringify(parseSequenceMeta(src)));
+    }
+    const scanned = await scanExamples(root, outDir, known);
+    const url = (abs) => isBuild ? `() => import(${JSON.stringify(`${abs}?url`)}).then((m) => m.default)` : `() => import(/* @vite-ignore */ ${JSON.stringify(`/@fs${abs}?url`)}).then((m) => m.default)`;
+    const requestExampleEntries = Object.entries(scanned.examples).map(
+      ([key, list]) => `  ${JSON.stringify(key)}: [${list.map(
+        (e) => `{ name: ${JSON.stringify(e.name)}, source: ${JSON.stringify(e.source)}, dir: ${JSON.stringify(e.dir)}, load: ${imp(e.abs)} }`
+      ).join(", ")}]`
+    );
+    const brandingFiles = await fg4(
+      ".specbook/branding/{logo,favicon}.{svg,png,jpg,jpeg,webp,ico}",
+      {
+        cwd: root,
+        absolute: true,
+        dot: true
+      }
+    );
+    const brandingEntries = brandingFiles.map((abs) => {
+      const name = abs.slice(abs.lastIndexOf("/") + 1).replace(/\.[^.]+$/, "");
+      return `  ${JSON.stringify(name)}: ${url(abs)}`;
+    });
+    const assetEntries = Object.entries(scanned.assets).map(
+      ([key, abs]) => `  ${JSON.stringify(key)}: ${url(abs)}`
+    );
+    const pages = await scanDocs(root);
+    docHtml = pages.map((p) => p.html);
+    const docEntries = pages.map(
+      (p, i) => `{ file: ${JSON.stringify(p.file)}, operation: ${JSON.stringify(p.operation)}, sequence: ${JSON.stringify(p.sequence)}, sequenceFile: ${JSON.stringify(p.sequenceFile)}, requestFile: ${JSON.stringify(p.requestFile)}, replace: ${JSON.stringify(p.replace)}, title: ${JSON.stringify(p.title)}, load: () => import(${JSON.stringify(`${VIRTUAL_DOC}${i}`)}).then((m) => m.default) }`
+    );
+    const exampleEntries = examples.map((abs) => {
+      const rel = relative4(join4(root, outDir), abs).split(sep4);
+      const status = rel[3].replace(/\.response\.json$/, "");
+      const key = `${rel[0]}/${rel[2]}.${status}`;
+      return `  ${JSON.stringify(key)}: ${imp(abs)}`;
+    });
+    if (isBuild) {
+      manifestsCode = `export default ${JSON.stringify(slim(manifests))}`;
+      operationsCode = `export const operations = {
+${operationEntries.join(",\n")}
+}`;
+      const gen = join4(root, outDir);
+      bundlePlan = /* @__PURE__ */ new Map();
+      const slot = (key) => {
+        const have = bundlePlan.get(key);
+        if (have) return have;
+        const fresh = { examples: {}, mock: {} };
+        bundlePlan.set(key, fresh);
+        return fresh;
+      };
+      for (const abs of schemaFiles) {
+        const rel = relative4(gen, abs).split(sep4);
+        slot(`${rel[0]}/${rel[2].replace(/\.request\.schema\.json$/, "")}`).schema = abs;
+      }
+      for (const abs of responseFiles) {
+        const rel = relative4(gen, abs).split(sep4);
+        slot(
+          `${rel[0]}/${rel[2].replace(/\.responses\.schema\.json$/, "")}`
+        ).responses = abs;
+      }
+      for (const abs of docFiles) {
+        const rel = relative4(gen, abs).split(sep4);
+        slot(`${rel[0]}/${rel[2].replace(/\.json$/, "")}`).docs = abs;
+      }
+      for (const abs of examples) {
+        const rel = relative4(gen, abs).split(sep4);
+        slot(`${rel[0]}/${rel[2]}`).mock[rel[3].replace(/\.response\.json$/, "")] = abs;
+      }
+      for (const [key, list] of Object.entries(scanned.examples))
+        for (const e of list) if (e.source === "generated") slot(key).examples[e.name] = e.abs;
+      definitionFiles = new Map(
+        defFiles.map((abs) => [relative4(gen, abs).split(sep4)[0], abs])
+      );
+      operationChunks = /* @__PURE__ */ new Map();
+      for (const m of Object.values(manifests)) {
+        const counts = /* @__PURE__ */ new Map();
+        for (const o of m.operations) {
+          const tag = (o.tags[0] ?? "default").replace(/[^A-Za-z0-9_-]+/g, "-");
+          const n = counts.get(tag) ?? 0;
+          counts.set(tag, n + 1);
+          operationChunks.set(
+            join4(gen, m.service, "operations", `${o.id}.ts`),
+            `ops-${m.service}-${tag}-${Math.floor(n / 40)}`
+          );
+        }
+      }
+      const index = {};
+      const projectLoads = [];
+      for (const [key, list] of Object.entries(scanned.examples)) {
+        index[key] = list.map((e) => [e.name, e.source === "project" ? "p" : "g"]);
+        for (const e of list)
+          if (e.source === "project")
+            projectLoads.push(`  ${JSON.stringify(`${key}/${e.name}`)}: ${imp(e.abs)}`);
+      }
+      const services = Object.keys(manifests);
+      return `import manifests from ${JSON.stringify(VIRTUAL_MANIFESTS)}
+export const mode = "static"
+export const project = ${JSON.stringify({ root, outDir, requestsDir })}
+// where the data files are: dist/data, whether this chunk is in dist/ or dist/assets/
+const dataBase = import.meta.url.replace(/(assets\\/)?[^/]*$/, '') + 'data/'
+const fetchJson = (rel) =>
+  fetch(dataBase + rel).then((r) => (r.ok ? r.json() : undefined), () => undefined)
+// one file per operation holds its schemas, docs, examples and mock responses
+const bundles = new Map()
+const bundle = (key) => {
+  if (!bundles.has(key)) bundles.set(key, fetchJson(key + '.json').then((b) => b ?? {}))
+  return bundles.get(key)
+}
+const part = (pick) =>
+  new Proxy({}, { get: (_, key) => (typeof key === 'string' && key.includes('/') ? () => bundle(key).then((b) => ({ default: pick(b) })) : undefined) })
+export { manifests }
+export const requests = [${files.requests.map(entry).join(",\n")}]
+export const sequences = [${files.sequences.map(entry).join(",\n")}]
+export const sequenceMeta = ${JSON.stringify(sequenceScan.meta)}
+export const unresolvedSequences = ${JSON.stringify(sequenceScan.unresolved)}
+export const brandingAssets = {
+${brandingEntries.join(",\n")}
+}
+export const environmentVars = ${JSON.stringify(await readAllVars(root))}
+const loadOperations = () => import(${JSON.stringify(VIRTUAL_OPERATIONS)}).then((m) => m.operations)
+export const operations = new Proxy({}, {
+  get: (_, key) => typeof key === 'string' ? (v) => loadOperations().then((ops) => {
+    if (!ops[key]) throw new Error('Unknown operation ' + key)
+    return ops[key](v)
+  }) : undefined,
+})
+export const schemas = part((b) => b.schema)
+export const responseSchemas = part((b) => b.responses)
+export const operationDocs = part((b) => b.docs)
+export const examples = new Proxy({}, {
+  get: (_, key) => {
+    if (typeof key !== 'string' || !key.includes('.')) return undefined
+    const at = key.lastIndexOf('.')
+    return () => bundle(key.slice(0, at)).then((b) => ({ default: b.mock?.[key.slice(at + 1)] }))
+  },
+})
+export const definitions = {${services.map((svc) => `
+  ${JSON.stringify(svc)}: () => fetchJson(${JSON.stringify(`${svc}/_definitions.json`)}).then((d) => ({ default: d }))`).join(",")}
+}
+const exampleIndex = ${JSON.stringify(index)}
+const projectLoad = {
+${projectLoads.join(",\n")}
+}
+const exampleLists = new Map()
+export const requestExamples = new Proxy({}, {
+  get: (_, key) => {
+    if (typeof key !== 'string' || !exampleIndex[key]) return undefined
+    if (!exampleLists.has(key)) {
+      exampleLists.set(key, exampleIndex[key].map(([name, src]) => ({
+        name,
+        source: src === 'p' ? 'project' : 'generated',
+        dir: key + (src === 'p' ? '@project' : '@generated'),
+        load: src === 'p' ? projectLoad[key + '/' + name] : () => bundle(key).then((b) => ({ default: b.examples?.[name] })),
+      })))
+    }
+    return exampleLists.get(key)
+  },
+})
+export const assets = {
+${assetEntries.join(",\n")}
+}
+export const docs = [${docEntries.join(",\n")}]
+export const loadFaker = ${fakerEntry ? `() => import('virtual:specbook/faker')` : "null"}
+export const loadConfig = ${cfg ? imp(cfg) : '() => Promise.resolve({ default: { project: "specbook", services: {} } })'}
+`;
+    }
+    return `export const mode = ${JSON.stringify(isBuild ? "static" : "dev")}
+export const project = ${JSON.stringify({ root, outDir, requestsDir })}
+export const manifests = ${JSON.stringify(slim(manifests))}
+export const requests = [${files.requests.map(entry).join(",\n")}]
+export const sequences = [${files.sequences.map(entry).join(",\n")}]
+export const sequenceMeta = ${JSON.stringify(sequenceScan.meta)}
+export const unresolvedSequences = ${JSON.stringify(sequenceScan.unresolved)}
+export const brandingAssets = {
+${brandingEntries.join(",\n")}
+}
+export const environmentVars = ${JSON.stringify(await readAllVars(root))}
+export const operations = {
+${operationEntries.join(",\n")}
+}
+export const schemas = {
+${schemaEntries.join(",\n")}
+}
+export const responseSchemas = {
+${responseEntries.join(",\n")}
+}
+export const operationDocs = {
+${operationDocEntries.join(",\n")}
+}
+export const definitions = {
+${defEntries.join(",\n")}
+}
+export const examples = {
+${exampleEntries.join(",\n")}
+}
+export const requestExamples = {
+${requestExampleEntries.join(",\n")}
+}
+export const assets = {
+${assetEntries.join(",\n")}
+}
+export const docs = [${docEntries.join(",\n")}]
+export const loadFaker = ${fakerEntry ? `() => import('virtual:specbook/faker')` : "null"}
+export const loadConfig = ${cfg ? imp(cfg) : '() => Promise.resolve({ default: { project: "specbook", services: {} } })'}
+`;
+  }
+  async function getProxyConfig() {
+    const cfgFile = findConfig(root);
+    if (!server || !cfgFile) return { services: {}, secretNames: {} };
+    const mod = await server.ssrLoadModule(cfgFile);
+    const cfg = mod.default ?? {};
+    return {
+      services: Object.fromEntries(
+        Object.entries(cfg.services ?? {}).map(([k, v]) => [k, { baseUrl: v.baseUrl ?? {} }])
+      ),
+      secretNames: cfg.secrets ?? {}
+    };
+  }
+  return {
+    name: "specbook",
+    configResolved(c) {
+      isBuild = c.command === "build";
+    },
+    async generateBundle() {
+      const read = async (abs) => JSON.parse(await readFile5(abs, "utf8"));
+      for (const [key, p] of bundlePlan) {
+        const out = {};
+        if (p.schema) out.schema = await read(p.schema);
+        if (p.responses) out.responses = await read(p.responses);
+        if (p.docs) {
+          const docs = await read(p.docs);
+          if (docs.description || (docs.examples?.length ?? 0) > 2) out.docs = docs;
+        }
+        const names = Object.keys(p.examples);
+        if (names.length) {
+          out.examples = Object.fromEntries(
+            await Promise.all(names.map(async (n) => [n, await read(p.examples[n])]))
+          );
+        }
+        const statuses = Object.keys(p.mock);
+        if (statuses.length) {
+          out.mock = Object.fromEntries(
+            await Promise.all(statuses.map(async (n) => [n, await read(p.mock[n])]))
+          );
+        }
+        this.emitFile({
+          type: "asset",
+          fileName: `data/${key}.json`,
+          source: JSON.stringify(out)
+        });
+      }
+      for (const [svc, abs] of definitionFiles)
+        this.emitFile({
+          type: "asset",
+          fileName: `data/${svc}/_definitions.json`,
+          source: await readFile5(abs)
+        });
+    },
+    config(_, env) {
+      if (env.command !== "build") return void 0;
+      return {
+        build: {
+          rollupOptions: {
+            output: {
+              // manifests are their own chunk (preloaded with the app, so no extra round trip), and
+              // operation modules are grouped by tag instead of one chunk per operation
+              manualChunks(id) {
+                if (id === RESOLVED_MANIFESTS) return "manifests";
+                return operationChunks.get(id);
+              }
+            }
+          }
+        }
+      };
+    },
+    resolveId(id) {
+      if (id === VIRTUAL) return RESOLVED;
+      if (id === VIRTUAL_TYPES) return RESOLVED_TYPES;
+      if (id === VIRTUAL_FAKER) return RESOLVED_FAKER;
+      if (id === VIRTUAL_MANIFESTS) return RESOLVED_MANIFESTS;
+      if (id === VIRTUAL_OPERATIONS) return RESOLVED_OPERATIONS;
+      if (id.startsWith(VIRTUAL_FAKER_LOCALE)) return `\0${id}`;
+      if (id.startsWith(VIRTUAL_DOC)) return `\0${id}`;
+      return void 0;
+    },
+    async load(id) {
+      if (id === RESOLVED) return registryCode();
+      if (id === RESOLVED_MANIFESTS) return manifestsCode;
+      if (id === RESOLVED_OPERATIONS) return operationsCode;
+      if (id === RESOLVED_FAKER || id.startsWith(RESOLVED_FAKER_LOCALE)) {
+        const r = await this.resolve("@faker-js/faker", join4(root, "package.json"), {
+          skipSelf: true
+        });
+        if (!r) return "export {}";
+        const pkg = JSON.stringify(r.id);
+        if (id.startsWith(RESOLVED_FAKER_LOCALE))
+          return `export { ${id.slice(RESOLVED_FAKER_LOCALE.length)} as default } from ${pkg}`;
+        let entry = r.id;
+        try {
+          entry = createRequire(join4(root, "package.json")).resolve("@faker-js/faker");
+        } catch {
+        }
+        const names = fakerLocales(entry);
+        return `export { Faker, base } from ${pkg}
+export const locales = {
+${names.map((n) => `  ${JSON.stringify(n)}: () => import(${JSON.stringify(`${VIRTUAL_FAKER_LOCALE}${n}`)}).then((m) => m.default)`).join(",\n")}
+}`;
+      }
+      if (id === RESOLVED_TYPES)
+        return `export default ${JSON.stringify(await collectTypes(root, outDir))}`;
+      if (id.startsWith(RESOLVED_DOC))
+        return `export default ${JSON.stringify(docHtml[Number(id.slice(RESOLVED_DOC.length))] ?? "")}`;
+      return void 0;
+    },
+    configureServer(s) {
+      server = s;
+      const SKIP = /* @__PURE__ */ new Set([
+        "node_modules",
+        ".git",
+        "dist",
+        "dist-docs",
+        ".turbo",
+        "openapi",
+        basename(outDir)
+      ]);
+      for (const entry of readdirSync(root, { withFileTypes: true }))
+        if (entry.isDirectory() && !SKIP.has(entry.name)) s.watcher.add(join4(root, entry.name));
+      const relevant = (file) => {
+        const rel = relative4(root, file);
+        if (rel.startsWith("..") || /node_modules/.test(rel)) return false;
+        return /\.(req|seq)\.ts$|\.example\.json$|\.md$/.test(rel) || rel.startsWith(outDir);
+      };
+      let pending;
+      notifyRegistryChanged = () => {
+        clearTimeout(pending);
+        pending = setTimeout(() => {
+          const mod = s.moduleGraph.getModuleById(RESOLVED);
+          if (mod) s.moduleGraph.invalidateModule(mod);
+          s.ws.send({ type: "custom", event: "specbook:registry-changed" });
+        }, 60);
+      };
+      const refresh = (file) => {
+        if (relevant(file)) notifyRegistryChanged();
+      };
+      s.watcher.on("add", refresh);
+      s.watcher.on("unlink", refresh);
+      s.watcher.on("change", async (file) => {
+        if (file.endsWith(".md")) return refresh(file);
+        if (!file.endsWith(".seq.ts")) return;
+        const header = JSON.stringify(
+          parseSequenceMeta(await readFile5(file, "utf8").catch(() => ""))
+        );
+        if (seqHeaders.get(file) !== header) {
+          seqHeaders.set(file, header);
+          refresh(file);
+        }
+      });
+      s.middlewares.use(async (req, res, next) => {
+        const url = new URL(req.url ?? "/", "http://localhost");
+        if (!url.pathname.startsWith("/__specbook/")) return next();
+        try {
+          if (url.pathname === "/__specbook/save" && req.method === "POST") {
+            const { path, content, encoding } = JSON.parse(await readBody2(req));
+            const abs = safeProjectPath(root, path);
+            if (!abs || typeof content !== "string")
+              return json2(res, 400, { error: "path not allowed" });
+            await mkdir2(dirname(abs), { recursive: true });
+            await writeFile2(abs, encoding === "base64" ? Buffer.from(content, "base64") : content);
+            notifyRegistryChanged();
+            return json2(res, 200, { ok: true });
+          }
+          if (url.pathname === "/__specbook/source") {
+            const abs = safeProjectPath(root, url.searchParams.get("path") ?? "");
+            if (!abs || !existsSync3(abs)) return json2(res, 404, { error: "not found" });
+            res.setHeader("content-type", "text/plain; charset=utf-8");
+            return void res.end(await readFile5(abs, "utf8"));
+          }
+          if (url.pathname === "/__specbook/types")
+            return json2(res, 200, await collectTypes(root, outDir));
+          if (url.pathname === "/__specbook/environment" && req.method === "GET") {
+            const env = url.searchParams.get("env") ?? "";
+            if (!isEnvName(env)) return json2(res, 400, { error: "bad environment name" });
+            const cfg = await getProxyConfig();
+            const values = await readEnvironment(root, env);
+            const secrets = Object.entries(cfg.secretNames).map(([name, ref]) => {
+              const key = ref.env ?? name;
+              const source = memorySecrets[env]?.[name] !== void 0 || memorySecrets["*"]?.[name] !== void 0 ? "session" : process.env[key] !== void 0 ? "process" : values.secrets[key] !== void 0 ? "environment" : values.shared[key] !== void 0 ? "shared" : void 0;
+              return { name, key, source };
+            });
+            const warnings = secrets.filter((s2) => s2.key in values.vars).map(
+              (s2) => `"${s2.key}" is a secret but is in ${env}.env, which is committed. Move it to ${env}.secrets.env.`
+            );
+            return json2(res, 200, { env, vars: values.vars, secrets, warnings });
+          }
+          if ((url.pathname === "/__specbook/secret" || url.pathname === "/__specbook/var") && req.method === "POST") {
+            const origin = req.headers.origin;
+            if (origin && new URL(origin).host !== req.headers.host)
+              return json2(res, 403, { error: "cross-origin request refused" });
+            const body = JSON.parse(await readBody2(req));
+            const { name, env } = body;
+            const value = body.value === null || body.value === "" ? void 0 : body.value;
+            if (env !== void 0 && !isEnvName(env))
+              return json2(res, 400, { error: "bad environment name" });
+            if (url.pathname === "/__specbook/var") {
+              if (!isVarName(name) || !env)
+                return json2(res, 400, { error: "name and env required" });
+              await ensureEnvironmentsDir(root);
+              await writeEnvKey(varsFile(root, env), name, value);
+              return json2(res, 200, { ok: true });
+            }
+            const cfg = await getProxyConfig();
+            const ref = cfg.secretNames[name];
+            if (!ref) return json2(res, 400, { error: `unknown secret "${name}"` });
+            const scope = body.scope ?? "session";
+            if (scope === "session") {
+              const scopeKey = env ?? "*";
+              const bucket = memorySecrets[scopeKey] ?? {};
+              if (value) bucket[name] = value;
+              else delete bucket[name];
+              memorySecrets[scopeKey] = bucket;
+            } else if (scope === "environment") {
+              if (!env) return json2(res, 400, { error: "env required" });
+              await ensureEnvironmentsDir(root);
+              await writeEnvKey(secretsFileFor(root, env), ref.env ?? name, value);
+              delete memorySecrets[env]?.[name];
+            } else {
+              await mkdir2(dirname(sharedSecretsFile(root)), { recursive: true });
+              await writeEnvKey(sharedSecretsFile(root), ref.env ?? name, value);
+              for (const bucket of Object.values(memorySecrets)) delete bucket[name];
+            }
+            return json2(res, 200, { ok: true });
+          }
+          if (await handleProxy2(req, res, {
+            getConfig: getProxyConfig,
+            readSecrets: async (env) => {
+              const v = await readEnvironment(root, env);
+              return { ...v.shared, ...v.secrets };
+            },
+            env: process.env,
+            memory: memorySecrets
+          }))
+            return;
+          next();
+        } catch (e) {
+          json2(res, 500, { error: e instanceof Error ? e.message : String(e) });
+        }
+      });
+    }
+  };
+}
+export {
+  ENV_NAME,
+  ensureEnvironmentsDir,
+  environmentsDir,
+  handleProxy2 as handleProxy,
+  isEnvName,
+  isVarName,
+  listEnvironmentFiles,
+  readAllVars,
+  readEnvironment,
+  safeProjectPath,
+  scanProject,
+  secretsFileFor,
+  setDotenvKey,
+  sharedSecretsFile,
+  specbook,
+  varsFile,
+  writeEnvKey
+};