@tiddlywiki/mws 0.0.12 → 0.0.13

package/dist/server.js

@@ -50,6 +50,13 @@ var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot
 var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
 var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 
+// node_modules/tsup/assets/esm_shims.js
+var init_esm_shims = __esm({
+  "node_modules/tsup/assets/esm_shims.js"() {
+    "use strict";
+  }
+});
+
 // src/global.ts
 import * as path from "path";
 import * as fs from "fs";
@@ -57,6 +64,7 @@ var __Result, _Result;
 var init_global = __esm({
   "src/global.ts"() {
     "use strict";
+    init_esm_shims();
     global.hop = function(object2, property) {
       return object2 ? Object.prototype.hasOwnProperty.call(object2, property) : false;
     };
@@ -144,8 +152,8 @@ var init_global = __esm({
       });
     };
     __Result = class __Result {
-      constructor(ok7, error, value) {
-        this.ok = ok7;
+      constructor(ok8, error, value) {
+        this.ok = ok8;
         this.error = error;
         this.value = value;
       }
@@ -186,6 +194,7 @@ var init_global = __esm({
 var require_depd = __commonJS({
   "node_modules/depd/index.js"(exports, module2) {
     "use strict";
+    init_esm_shims();
     var relative = __require("path").relative;
     module2.exports = depd;
     var basePath = process.cwd();
@@ -513,6 +522,7 @@ var require_depd = __commonJS({
 var require_setprototypeof = __commonJS({
   "node_modules/setprototypeof/index.js"(exports, module2) {
     "use strict";
+    init_esm_shims();
     module2.exports = Object.setPrototypeOf || ({ __proto__: [] } instanceof Array ? setProtoOf : mixinProperties);
     function setProtoOf(obj, proto) {
       obj.__proto__ = proto;
@@ -606,6 +616,7 @@ var require_codes = __commonJS({
 var require_statuses = __commonJS({
   "node_modules/statuses/index.js"(exports, module2) {
     "use strict";
+    init_esm_shims();
     var codes = require_codes();
     module2.exports = status;
     status.message = codes;
@@ -682,6 +693,7 @@ var require_statuses = __commonJS({
 var require_inherits_browser = __commonJS({
   "node_modules/inherits/inherits_browser.js"(exports, module2) {
     "use strict";
+    init_esm_shims();
     if (typeof Object.create === "function") {
       module2.exports = /* @__PURE__ */ __name(function inherits(ctor, superCtor) {
         if (superCtor) {
@@ -715,6 +727,7 @@ var require_inherits_browser = __commonJS({
 var require_inherits = __commonJS({
   "node_modules/inherits/inherits.js"(exports, module2) {
     "use strict";
+    init_esm_shims();
     try {
       util = __require("util");
       if (typeof util.inherits !== "function") throw "";
@@ -730,6 +743,7 @@ var require_inherits = __commonJS({
 var require_toidentifier = __commonJS({
   "node_modules/toidentifier/index.js"(exports, module2) {
     "use strict";
+    init_esm_shims();
     module2.exports = toIdentifier;
     function toIdentifier(str) {
       return str.split(" ").map(function(token) {
@@ -744,6 +758,7 @@ var require_toidentifier = __commonJS({
 var require_http_errors = __commonJS({
   "node_modules/http-errors/index.js"(exports, module2) {
     "use strict";
+    init_esm_shims();
     var deprecate = require_depd()("http-errors");
     var setPrototypeOf = require_setprototypeof();
     var statuses = require_statuses();
@@ -920,6 +935,7 @@ var require_http_errors = __commonJS({
 var require_ms = __commonJS({
   "node_modules/ms/index.js"(exports, module2) {
     "use strict";
+    init_esm_shims();
     var s = 1e3;
     var m = s * 60;
     var h = m * 60;
@@ -1041,6 +1057,7 @@ var require_ms = __commonJS({
 var require_common = __commonJS({
   "node_modules/debug/src/common.js"(exports, module2) {
     "use strict";
+    init_esm_shims();
     function setup(env) {
       createDebug.debug = createDebug;
       createDebug.default = createDebug;
@@ -1230,6 +1247,7 @@ var require_common = __commonJS({
 var require_browser = __commonJS({
   "node_modules/debug/src/browser.js"(exports, module2) {
     "use strict";
+    init_esm_shims();
     exports.formatArgs = formatArgs;
     exports.save = save;
     exports.load = load;
@@ -1406,6 +1424,7 @@ var require_browser = __commonJS({
 var require_node = __commonJS({
   "node_modules/debug/src/node.js"(exports, module2) {
     "use strict";
+    init_esm_shims();
     var tty = __require("tty");
     var util = __require("util");
     exports.init = init;
@@ -1588,6 +1607,7 @@ var require_node = __commonJS({
 var require_src = __commonJS({
   "node_modules/debug/src/index.js"(exports, module2) {
     "use strict";
+    init_esm_shims();
     if (typeof process === "undefined" || process.type === "renderer" || process.browser === true || process.__nwjs) {
       module2.exports = require_browser();
     } else {
@@ -1600,6 +1620,7 @@ var require_src = __commonJS({
 var require_destroy = __commonJS({
   "node_modules/destroy/index.js"(exports, module2) {
     "use strict";
+    init_esm_shims();
     var EventEmitter = __require("events").EventEmitter;
     var ReadStream = __require("fs").ReadStream;
     var Stream = __require("stream");
@@ -1698,6 +1719,7 @@ var require_destroy = __commonJS({
 var require_encodeurl = __commonJS({
   "node_modules/encodeurl/index.js"(exports, module2) {
     "use strict";
+    init_esm_shims();
     module2.exports = encodeUrl;
     var ENCODE_CHARS_REGEXP = /(?:[^\x21\x23-\x3B\x3D\x3F-\x5F\x61-\x7A\x7C\x7E]|%(?:[^0-9A-Fa-f]|[0-9A-Fa-f][^0-9A-Fa-f]|$))+/g;
     var UNMATCHED_SURROGATE_PAIR_REGEXP = /(^|[^\uD800-\uDBFF])[\uDC00-\uDFFF]|[\uD800-\uDBFF]([^\uDC00-\uDFFF]|$)/g;
@@ -1713,6 +1735,7 @@ var require_encodeurl = __commonJS({
 var require_escape_html = __commonJS({
   "node_modules/escape-html/index.js"(exports, module2) {
     "use strict";
+    init_esm_shims();
     var matchHtmlRegExp = /["'&<>]/;
     module2.exports = escapeHtml;
     function escapeHtml(string4) {
@@ -1761,6 +1784,7 @@ var require_escape_html = __commonJS({
 var require_etag = __commonJS({
   "node_modules/etag/index.js"(exports, module2) {
     "use strict";
+    init_esm_shims();
     module2.exports = etag;
     var crypto = __require("crypto");
     var Stats = __require("fs").Stats;
@@ -1807,6 +1831,7 @@ var require_etag = __commonJS({
 var require_fresh = __commonJS({
   "node_modules/fresh/index.js"(exports, module2) {
     "use strict";
+    init_esm_shims();
     var CACHE_CONTROL_NO_CACHE_REGEXP = /(?:^|,)\s*?no-cache\s*?(?:,|$)/;
     module2.exports = fresh;
     function fresh(reqHeaders, resHeaders) {
@@ -10408,6 +10433,7 @@ var require_db = __commonJS({
 var require_mime_db = __commonJS({
   "node_modules/mime-db/index.js"(exports, module2) {
     "use strict";
+    init_esm_shims();
     module2.exports = require_db();
   }
 });
@@ -10416,6 +10442,7 @@ var require_mime_db = __commonJS({
 var require_mime_types = __commonJS({
   "node_modules/mime-types/index.js"(exports) {
     "use strict";
+    init_esm_shims();
     var db = require_mime_db();
     var extname = __require("path").extname;
     var EXTRACT_TYPE_REGEXP = /^\s*([^;\s]*)(?:;|\s|$)/;
@@ -10511,6 +10538,7 @@ var require_mime_types = __commonJS({
 var require_ee_first = __commonJS({
   "node_modules/ee-first/index.js"(exports, module2) {
     "use strict";
+    init_esm_shims();
     module2.exports = first;
     function first(stuff, done) {
       if (!Array.isArray(stuff))
@@ -10572,6 +10600,7 @@ var require_ee_first = __commonJS({
 var require_on_finished = __commonJS({
   "node_modules/on-finished/index.js"(exports, module2) {
     "use strict";
+    init_esm_shims();
     module2.exports = onFinished;
     module2.exports.isFinished = isFinished;
     var asyncHooks = tryRequireAsyncHooks();
@@ -10687,6 +10716,7 @@ var require_on_finished = __commonJS({
 var require_range_parser = __commonJS({
   "node_modules/range-parser/index.js"(exports, module2) {
     "use strict";
+    init_esm_shims();
     module2.exports = rangeParser;
     function rangeParser(size, str, options) {
       if (typeof str !== "string") {
@@ -10774,6 +10804,7 @@ var require_range_parser = __commonJS({
 var require_send = __commonJS({
   "node_modules/send/index.js"(exports, module2) {
     "use strict";
+    init_esm_shims();
     var createError = require_http_errors();
     var debug = require_src()("send");
     var destroy = require_destroy();
@@ -10791,7 +10822,7 @@ var require_send = __commonJS({
     var Stream = __require("stream");
     var util = __require("util");
     var extname = path5.extname;
-    var join2 = path5.join;
+    var join3 = path5.join;
     var normalize = path5.normalize;
     var resolve13 = path5.resolve;
     var sep2 = path5.sep;
@@ -10965,7 +10996,7 @@ var require_send = __commonJS({
           return res;
         }
         parts = path6.split(sep2);
-        path6 = normalize(join2(root, path6));
+        path6 = normalize(join3(root, path6));
       } else {
         if (UP_PATH_REGEXP.test(path6)) {
           debug('malicious path "%s"', path6);
@@ -11099,7 +11130,7 @@ var require_send = __commonJS({
           if (err) return self.onStatError(err);
           return self.error(404);
         }
-        var p = join2(path6, self._index[i]);
+        var p = join3(path6, self._index[i]);
         debug('stat "%s"', p);
         fs3.stat(p, function(err2, stat) {
           if (err2) return next(err2);
@@ -11458,6 +11489,7 @@ var _TypedGenerator, TypedGenerator, _UserError, UserError;
 var init_utils = __esm({
   "src/utils/utils.ts"() {
     "use strict";
+    init_esm_shims();
     __name(readMultipartData, "readMultipartData");
     __name(sendResponse, "sendResponse");
     __name(is, "is");
@@ -11522,6 +11554,7 @@ var test1;
 var init_rootRoute = __esm({
   "src/utils/rootRoute.ts"() {
     "use strict";
+    init_esm_shims();
     __name(test, "test");
     test1 = test({ schema: z.object({ test: z.string() }) });
   }
@@ -11533,6 +11566,7 @@ var _DataChecks, DataChecks;
 var init_data_checks = __esm({
   "src/utils/data-checks.ts"() {
     "use strict";
+    init_esm_shims();
     init_utils();
     _DataChecks = class _DataChecks {
       constructor(options) {
@@ -11688,6 +11722,7 @@ var ZodAssert, _zodAssertAny, _zodAssert, Z2;
 var init_zodAssert = __esm({
   "src/utils/zodAssert.ts"() {
     "use strict";
+    init_esm_shims();
     init_streamer();
     ((ZodAssert2) => {
       function data(state, schema, onError) {
@@ -11756,6 +11791,7 @@ var init_zodAssert = __esm({
 var init_utils2 = __esm({
   "src/utils/index.ts"() {
     "use strict";
+    init_esm_shims();
     init_utils();
     init_rootRoute();
     init_data_checks();
@@ -11764,12 +11800,12 @@ var init_utils2 = __esm({
 });
 
 // src/streamer.ts
-import * as http2 from "node:http2";
 import { createReadStream } from "node:fs";
 var import_send, SYMBOL_IGNORE_ERROR, STREAM_ENDED, _Streamer, Streamer, _StreamerState, StreamerState;
 var init_streamer = __esm({
   "src/streamer.ts"() {
     "use strict";
+    init_esm_shims();
     init_global();
     import_send = __toESM(require_send(), 1);
     init_utils2();
@@ -11796,54 +11832,67 @@ var init_streamer = __esm({
         }), "readBody");
         this.headers = req.headers;
         this.url = req.url;
-        if (is(req, req.httpVersionMajor > 1)) {
-          this.req.headers.host = req.headers[":authority"];
+        if (!this.url.startsWith("/")) throw new Error("This should never happen");
+        if (router.pathPrefix) {
+          if (this.url === router.pathPrefix) {
+            res.writeHead(302, { "location": req.url + "/" }).end();
+            throw STREAM_ENDED;
+          } else if (this.url.startsWith(router.pathPrefix)) {
+            this.url = this.url.slice(router.pathPrefix.length);
+          } else {
+            res.writeHead(500, {}).end("The server is setup with a path prefix " + router.pathPrefix + ", but this request is outside of that prefix.", "utf8");
+            throw STREAM_ENDED;
+          }
         }
+        if (is(req, req.httpVersionMajor > 1))
+          req.headers.host = req.headers[":authority"];
         if (!req.headers.host) throw new Error("This should never happen");
-        if (!req.method) throw new Error("This should never happen");
-        if (!req.url?.startsWith("/")) throw new Error("This should never happen");
-        if (!is(req.method, AllowedMethods.includes(req.method)))
-          throw this.sendString(501, {}, "Method not supported", "utf8");
         this.host = req.headers.host;
+        if (!req.method) throw new Error("This should never happen");
+        if (!is(req.method, AllowedMethods.includes(req.method))) {
+          res.writeHead(501, {}).end("Method not supported", "utf8");
+          throw STREAM_ENDED;
+        }
         this.method = req.method;
         this.isSecure = !!req.socket.encrypted;
-        this.urlInfo = new URL(`https://${req.headers.host}${req.url}`);
+        this.urlInfo = new URL(`https://${this.headers.host}${this.url}`);
         this.cookies = this.parseCookieString(req.headers.cookie || "");
+        if (this.cookies.getAll("session").length > 1) {
+          console.warn("Multiple session cookies found. This is very likely to cause problems. This may happen after changing the path prefix.");
+        }
       }
       // RIP Push Stream. it was a great idea.
-      async pushStream(path5) {
-        return new Promise((resolve13, reject) => {
-          const req2 = this.req;
-          if (!req2.stream || !req2.stream.pushAllowed) return reject();
-          req2.stream.write;
-          const newRawHeaders = this.req.rawHeaders.slice();
-          for (let i = 0; i < newRawHeaders.length; i += 2) {
-            if (newRawHeaders[i] === ":method") newRawHeaders[i + 1] = "GET";
-            if (newRawHeaders[i] === ":path") newRawHeaders[i + 1] = path5;
-          }
-          req2.stream.pushStream({ ":method": "GET", ":path": path5 }, (err, pushStream, headers) => {
-            if (err) return reject(err);
-            const preq = new http2.Http2ServerRequest(pushStream, req2.headers, {}, newRawHeaders);
-            const pres = new http2.Http2ServerResponse(pushStream);
-            const pushStreamer = new _Streamer(preq, pres, this.router);
-            resolve13(pushStreamer);
-          });
-        }).then(async (streamer) => {
-          await this.router.handle(streamer);
-          return streamer;
-        }, (err) => {
-          if (err) throw err;
-        });
-      }
+      // async pushStream(path: string) {
+      //   return new Promise<Streamer>((resolve, reject) => {
+      //     const req2: http2.Http2ServerRequest = this.req as any;
+      //     if (!req2.stream || !req2.stream.pushAllowed) return reject();
+      //     req2.stream.write
+      //     const newRawHeaders = this.req.rawHeaders.slice();
+      //     for (let i = 0; i < newRawHeaders.length; i += 2) {
+      //       if (newRawHeaders[i] === ":method") newRawHeaders[i + 1] = "GET";
+      //       if (newRawHeaders[i] === ":path") newRawHeaders[i + 1] = path;
+      //     }
+      //     req2.stream.pushStream({ ":method": "GET", ":path": path }, (err, pushStream, headers) => {
+      //       if (err) return reject(err);
+      //       const preq = new http2.Http2ServerRequest(pushStream, req2.headers, {}, newRawHeaders);
+      //       const pres = new http2.Http2ServerResponse(pushStream);
+      //       const pushStreamer = new Streamer(preq, pres, this.router);
+      //       resolve(pushStreamer);
+      //     });
+      //   }).then(async streamer => {
+      //     await this.router.handle(streamer);
+      //     return streamer;
+      //   }, (err) => { if (err) throw err; });
+      // }
       parseCookieString(cookieString) {
-        const cookies = {};
+        const cookies = new URLSearchParams();
         if (typeof cookieString !== "string") throw new Error("cookieString must be a string");
         cookieString.split(";").forEach((cookie) => {
           const parts = cookie.split("=");
           if (parts.length >= 2) {
             const key = parts[0].trim();
             const value = parts.slice(1).join("=").trim();
-            cookies[key] = decodeURIComponent(value);
+            cookies.append(key, decodeURIComponent(value));
           }
         });
         return cookies;
@@ -12100,6 +12149,7 @@ var _StateObject, StateObject, zodURIComponent;
 var init_StateObject = __esm({
   "src/StateObject.ts"() {
     "use strict";
+    init_esm_shims();
     init_utils2();
     init_streamer();
     init_utils2();
@@ -12308,6 +12358,7 @@ var RecipeKeyMap, _RecipeManager, RecipeManager;
 var init_manager_recipes = __esm({
   "src/routes/managers/manager-recipes.ts"() {
     "use strict";
+    init_esm_shims();
     init_router();
     init_utils2();
     RecipeKeyMap = {
@@ -12655,6 +12706,8 @@ var UserKeyMap, _UserManager, UserManager;
 var init_manager_users = __esm({
   "src/routes/managers/manager-users.ts"() {
     "use strict";
+    init_esm_shims();
+    init_server();
     init_router();
     UserKeyMap = {
       user_edit_data: true,
@@ -12717,12 +12770,12 @@ var init_manager_users = __esm({
         this.user_create = zodManage((z5) => z5.object({
           username: z5.string(),
           email: z5.string(),
-          role_id: z5.prismaField("Roles", "role_id", "number", false)
+          role_ids: z5.prismaField("Roles", "role_id", "number", false).array()
         }), async (state, prisma) => {
-          const { username, email, role_id } = state.data;
+          const { username, email, role_ids } = state.data;
           state.okAdmin();
           const user = await prisma.users.create({
-            data: { username, email, password: "", roles: { connect: { role_id } } },
+            data: { username, email, password: "", roles: { connect: role_ids.map((role_id) => ({ role_id })) } },
             select: { user_id: true, created_at: true }
           });
           return user;
@@ -12731,14 +12784,14 @@ var init_manager_users = __esm({
           user_id: z5.number(),
           username: z5.string(),
           email: z5.string(),
-          role_id: z5.prismaField("Roles", "role_id", "number").optional()
+          role_ids: z5.prismaField("Roles", "role_id", "number").array()
         }), async (state, prisma) => {
-          const { user_id, username, email, role_id } = state.data;
+          const { user_id, username, email, role_ids } = state.data;
           state.okAdmin();
           if (state.user.user_id === user_id) throw "Admin cannot update themselves";
           await prisma.users.update({
             where: { user_id },
-            data: { username, email, roles: { set: [{ role_id }] } }
+            data: { username, email, roles: { set: role_ids.map((role_id) => ({ role_id })) } }
           });
           return null;
         });
@@ -12756,12 +12809,29 @@ var init_manager_users = __esm({
         this.user_update_password = zodManage((z5) => z5.object({
           user_id: z5.prismaField("Users", "user_id", "number"),
           registrationRequest: z5.string().optional(),
-          registrationRecord: z5.string().optional()
+          registrationRecord: z5.string().optional(),
+          session_id: z5.string().optional(),
+          signature: z5.string().optional()
         }), async (state, prisma) => {
           const { user_id, registrationRecord, registrationRequest } = state.data;
           state.okUser();
-          if (state.user.user_id !== user_id && !state.user.isAdmin)
-            throw "You must be an admin to update another user's password";
+          if (!state.user.isAdmin) {
+            if (!state.data) throw "Session id and signature are required";
+            const session = await prisma.sessions.findUnique({
+              where: { session_id: state.data.session_id }
+            });
+            if (!session?.session_key)
+              throw "Session not found";
+            const { session_key } = session;
+            const { session_id, signature } = state.data;
+            if (!session_id || !signature)
+              throw "Session id and signature are required";
+            assertSignature({ session_id, session_key, signature });
+            if (session.user_id !== user_id)
+              throw "You must be an admin to update another user's password";
+            if (state.user.user_id !== user_id)
+              throw "You must be logged in as this user to update the password, but normally this isn't supposed to happen (this is a bug, please report it)";
+          }
           const userExists = await prisma.users.count({ where: { user_id } });
           if (!userExists) throw "User does not exist";
           if (registrationRequest) {
@@ -12823,6 +12893,7 @@ var ManagerRoutes;
 var init_managers = __esm({
   "src/routes/managers/index.ts"() {
     "use strict";
+    init_esm_shims();
     init_manager_recipes();
     init_manager_users();
     init_manager_users();
@@ -12840,6 +12911,7 @@ var _TiddlerStore, TiddlerStore;
 var init_TiddlerStore = __esm({
   "src/routes/TiddlerStore.ts"() {
     "use strict";
+    init_esm_shims();
     init_utils2();
     _TiddlerStore = class _TiddlerStore {
       constructor(commander, prisma) {
@@ -13244,6 +13316,7 @@ var init_TiddlerStore = __esm({
 var require_sjcl = __commonJS({
   "node_modules/sjcl/sjcl.js"(exports, module2) {
     "use strict";
+    init_esm_shims();
     var sjcl3 = { cipher: {}, hash: {}, keyexchange: {}, mode: {}, misc: {}, codec: {}, exception: { corrupt: /* @__PURE__ */ __name(function(a) {
       this.toString = function() {
         return "CORRUPT: " + this.message;
@@ -14015,6 +14088,7 @@ var import_sjcl, _TiddlerServer, TiddlerServer;
 var init_bag_file_server = __esm({
   "src/routes/bag-file-server.ts"() {
     "use strict";
+    init_esm_shims();
     init_TiddlerStore();
     import_sjcl = __toESM(require_sjcl(), 1);
     _TiddlerServer = class _TiddlerServer extends TiddlerStore {
@@ -14022,7 +14096,7 @@ var init_bag_file_server = __esm({
         super(state.commander, prisma);
         this.state = state;
       }
-      toTiddlyWebJson(info10) {
+      toTiddlyWebJson(info11) {
         const output = { fields: {} };
         const knownFields = [
           "bag",
@@ -14039,16 +14113,16 @@ var init_bag_file_server = __esm({
           "type",
           "uri"
         ];
-        each(info10.tiddler, (field, name) => {
+        each(info11.tiddler, (field, name) => {
           if (knownFields.indexOf(name) !== -1) {
             output[name] = field;
           } else {
             output.fields[name] = field;
           }
         });
-        output.type = info10.tiddler.type || "text/vnd.tiddlywiki";
-        output.revision = `${info10.tiddler_id}`;
-        output.bag = info10.bag_name;
+        output.type = info11.tiddler.type || "text/vnd.tiddlywiki";
+        output.revision = `${info11.tiddler_id}`;
+        output.bag = info11.bag_name;
         return output;
       }
       /** If neither bag_name nor bag_id are specified, the fallback will be sent. */
@@ -14265,6 +14339,10 @@ var init_bag_file_server = __esm({
           title: "$:/state/multiwikiclient/recipe/last_tiddler_id",
           text: (lastTiddlerId._max.tiddler_id ?? 0).toString()
         });
+        writeTiddler({
+          title: "$:/config/multiwikiclient/host",
+          text: "$protocol$//$host$" + this.state.config.pathPrefix + "/"
+        });
         state.write(template.substring(markerPos + marker.length));
         return state.end();
       }
@@ -14284,6 +14362,7 @@ var TiddlerKeyMap, _TiddlerRouter, TiddlerRouter;
 var init_router_tiddlers = __esm({
   "src/routes/managers/router-tiddlers.ts"() {
     "use strict";
+    init_esm_shims();
     init_streamer();
     init_utils2();
     init_router();
@@ -14532,551 +14611,187 @@ var init_router_tiddlers = __esm({
   }
 });
 
-// src/routes/services/PasswordService.ts
-var PasswordService_exports = {};
-__export(PasswordService_exports, {
-  createPasswordService: () => createPasswordService
-});
-import * as opaque from "@serenity-kit/opaque";
-import { randomBytes } from "node:crypto";
-async function createPasswordService(serverSetup) {
-  await opaque.ready;
-  const serverState = /* @__PURE__ */ new Map();
-  const LoginGenerator = TypedGenerator.wrapper()(async function* ({
-    user_id,
-    startLoginRequest,
-    registrationRecord
-  }) {
-    const { asV, asY } = TypedGenerator.checker();
-    const { serverLoginState, loginResponse } = opaque.server.startLogin({
-      serverSetup,
-      userIdentifier: user_id.toString(),
-      registrationRecord,
-      startLoginRequest
-    });
-    const timestamp = Date.now();
-    const finishLoginRequest = asV(1, yield asY(0, loginResponse));
-    if (timestamp + 1e3 * 60 * 5 < Date.now()) return;
-    return asY(1, {
-      session: opaque.server.finishLogin({
-        finishLoginRequest,
-        serverLoginState
-      }),
-      user_id
-    });
-  });
-  async function PasswordCreation(userID, password) {
-    const { clientRegistrationState, registrationRequest } = opaque.client.startRegistration({ password });
-    const userIdentifier = userID;
-    const { registrationResponse } = opaque.server.createRegistrationResponse({
-      serverSetup,
-      userIdentifier,
-      registrationRequest
-    });
-    const { registrationRecord } = opaque.client.finishRegistration({
-      clientRegistrationState,
-      registrationResponse,
-      password
+// import("./**/*/**/*") in src/routes/index.ts
+var globImport;
+var init_ = __esm({
+  'import("./**/*/**/*") in src/routes/index.ts'() {
+    globImport = __glob({
+      "./managers/index.ts": () => Promise.resolve().then(() => (init_managers(), managers_exports)),
+      "./managers/manager-recipes.ts": () => Promise.resolve().then(() => (init_manager_recipes(), manager_recipes_exports)),
+      "./managers/manager-users.ts": () => Promise.resolve().then(() => (init_manager_users(), manager_users_exports)),
+      "./managers/router-tiddlers.ts": () => Promise.resolve().then(() => (init_router_tiddlers(), router_tiddlers_exports))
     });
-    return registrationRecord;
   }
-  __name(PasswordCreation, "PasswordCreation");
-  async function createRegistrationResponse({ userID, registrationRequest }) {
-    const { registrationResponse } = opaque.server.createRegistrationResponse({
-      serverSetup,
-      userIdentifier: userID.toString(),
-      registrationRequest
+});
+
+// src/routes/index.ts
+import { Prisma } from "@prisma/client";
+async function RootRoute(root, config) {
+  TiddlerRouter.defineRoutes(root);
+  ManagerRoutes(root, config);
+  if (typeof ENABLE_UNSAFE_PRISMA_ROUTE !== "undefined")
+    root.defineRoute({
+      method: ["POST"],
+      path: /^\/prisma$/,
+      bodyFormat: "json"
+    }, async (state) => {
+      ZodAssert.data(state, (z5) => z5.object({
+        table: z5.string(),
+        action: z5.string(),
+        arg: z5.any()
+      }));
+      return await state.$transaction(async (prisma) => {
+        const p = prisma;
+        const table = p[state.data.table];
+        if (!table) throw new Error(`No such table`);
+        const fn = table[state.data.action];
+        if (!fn) throw new Error(`No such table or action`);
+        console.log(state.data.arg);
+        return state.sendJSON(200, await fn.call(table, state.data.arg));
+      });
     });
-    return registrationResponse;
-  }
-  __name(createRegistrationResponse, "createRegistrationResponse");
-  async function startLoginSession(stater) {
-    let loginSession;
-    do {
-      loginSession = randomBytes(16).toString("base64url");
-    } while (serverState.has(loginSession));
-    serverState.set(loginSession, stater);
-    return loginSession;
+  await importEsbuild(root);
+}
+async function importEsbuild(root) {
+  root.defineRoute({
+    method: ["GET"],
+    path: /^\/.*/,
+    bodyFormat: "stream"
+  }, async (state) => {
+    await state.sendDevServer();
+  });
+}
+function findValueInObject(val, predicate, keys = [], paths = []) {
+  if (predicate(val)) {
+    paths.push(keys.join("/"));
+    return paths;
   }
-  __name(startLoginSession, "startLoginSession");
-  async function finishLoginSession(loginSession) {
-    const stater = serverState.get(loginSession);
-    if (stater) serverState.delete(loginSession);
-    return stater;
+  if (val && typeof val === "object") {
+    for (const key of Object.keys(val)) {
+      if (!val.hasOwnProperty(key)) continue;
+      findValueInObject(val[key], predicate, [...keys, key], paths);
+    }
   }
-  __name(finishLoginSession, "finishLoginSession");
-  return {
-    serverState,
-    LoginGenerator,
-    PasswordCreation,
-    createRegistrationResponse,
-    startLoginSession,
-    finishLoginSession
-  };
+  console.log(paths, keys);
+  return paths;
 }
-var init_PasswordService = __esm({
-  "src/routes/services/PasswordService.ts"() {
+function capitalize(table) {
+  return table.slice(0, 1).toUpperCase() + table.slice(1);
+}
+var _error, _ProxyPromise, ProxyPromise, argproxy;
+var init_routes = __esm({
+  "src/routes/index.ts"() {
     "use strict";
+    init_esm_shims();
     init_utils2();
-    __name(createPasswordService, "createPasswordService");
+    init_managers();
+    init_router_tiddlers();
+    init_();
+    __name(RootRoute, "RootRoute");
+    __name(importEsbuild, "importEsbuild");
+    _ProxyPromise = class _ProxyPromise {
+      constructor({ action, table, arg }) {
+        __privateAdd(this, _error, new Error("An error occured for this request"));
+        this.action = action;
+        this.table = table;
+        this.arg = arg;
+        Object.defineProperty(this, "toJSON", {
+          configurable: true,
+          enumerable: true,
+          value: /* @__PURE__ */ __name(() => ({
+            action: this.action,
+            table: this.table,
+            arg: this.arg,
+            dbnulls: this.arg.data && findValueInObject(this.arg.data, (e) => e === Prisma.DbNull),
+            jsnulls: this.arg.data && findValueInObject(this.arg.data, (e) => e === Prisma.JsonNull)
+          }), "value")
+        });
+      }
+      static getErrorStack(t) {
+        return __privateGet(t, _error).stack;
+      }
+    };
+    _error = new WeakMap();
+    __name(_ProxyPromise, "ProxyPromise");
+    ProxyPromise = _ProxyPromise;
+    __name(findValueInObject, "findValueInObject");
+    __name(capitalize, "capitalize");
+    argproxy = (() => new Proxy({}, {
+      get(target, table) {
+        return target[table] = target[table] || new Proxy({}, {
+          get(target2, action) {
+            return target2[action] = target2[action] || ((arg) => {
+              return new ProxyPromise({ action, table: capitalize(table), arg });
+            });
+          }
+        });
+      }
+    }))();
   }
 });
 
-// src/routes/services/attachments.ts
-var attachments_exports = {};
-__export(attachments_exports, {
-  AttachmentService: () => AttachmentService
-});
-import * as path3 from "path";
-import * as fs2 from "fs";
-var import_sjcl2, $tw, _AttachmentService, AttachmentService;
-var init_attachments = __esm({
-  "src/routes/services/attachments.ts"() {
-    "use strict";
-    init_utils2();
-    import_sjcl2 = __toESM(require_sjcl(), 1);
-    $tw = {};
-    _AttachmentService = class _AttachmentService {
-      constructor(config, prisma) {
-        this.config = config;
-        this.prisma = prisma;
-      }
-      makeCanonicalUri(bag_name, title) {
-        return `/bags/${encodeURIComponentExtended(bag_name)}/tiddlers/${encodeURIComponentExtended(title)}/blob`;
+// src/setupDevServer.ts
+import { request } from "http";
+import { join, resolve as resolve3 } from "path";
+import { createHash as createHash3 } from "crypto";
+import { readFile } from "fs/promises";
+import { writeFileSync } from "fs";
+async function setupDevServer(enableDevServer, pathPrefix) {
+  const index_file = Buffer.from(`
+<!DOCTYPE html>
+
+<head>
+  <style>
+    @media (prefers-color-scheme: dark) {
+      html:not(.loaded) {
+        background-color: #121212;
       }
-      /*
-      Given tiddler fields, tiddler_id and a bag_name, return the tiddler fields after the following process:
-      - Apply the tiddler_id as the revision field
-      - Apply the bag_name as the bag field
-      */
-      processOutgoingTiddler({ tiddler, tiddler_id, bag_name, attachment_hash }) {
-        if (attachment_hash !== null) {
-          return Object.assign(
-            {},
-            tiddler,
-            {
-              text: void 0,
-              _canonical_uri: this.makeCanonicalUri(bag_name, tiddler.title),
-              revision: tiddler_id,
-              bag: bag_name
-            }
-          );
-        } else {
-          return tiddler;
-        }
+    }
+
+    @media (prefers-color-scheme: light) {
+      html:not(.loaded) {
+        background-color: #ffffff;
       }
-      /*
-      */
-      async processIncomingTiddler({
-        tiddlerFields,
-        existing_attachment_hash,
-        existing_canonical_uri
-      }) {
-        const { attachmentSizeLimit, attachmentsEnabled } = this.config;
-        const contentTypeInfo = this.config.contentTypeInfo[tiddlerFields.type || "text/vnd.tiddlywiki"];
-        const isBinary = !!contentTypeInfo && contentTypeInfo.encoding === "base64";
-        let shouldProcessAttachment = tiddlerFields.text && tiddlerFields.text.length > attachmentSizeLimit;
-        if (existing_attachment_hash) {
-          const fileSize = await this.getAttachmentFileSize(existing_attachment_hash);
-          if (fileSize && fileSize <= attachmentSizeLimit) {
-            const existingAttachmentMeta = await this.getAttachmentMetadata(existing_attachment_hash);
-            const hasCanonicalField = !!tiddlerFields._canonical_uri;
-            const skipAttachment = hasCanonicalField && tiddlerFields._canonical_uri === (existingAttachmentMeta ? existingAttachmentMeta._canonical_uri : existing_canonical_uri);
-            shouldProcessAttachment = !skipAttachment;
-          } else {
-            shouldProcessAttachment = false;
-          }
-        }
-        if (attachmentsEnabled && isBinary && shouldProcessAttachment) {
-          const attachment_hash = existing_attachment_hash || await this.saveAttachment({
-            text: tiddlerFields.text,
-            type: tiddlerFields.type,
-            reference: tiddlerFields.title,
-            _canonical_uri: tiddlerFields._canonical_uri
-          });
-          if (tiddlerFields && tiddlerFields._canonical_uri) {
-            delete tiddlerFields._canonical_uri;
-          }
-          return {
-            tiddlerFields: Object.assign({}, tiddlerFields, { text: void 0 }),
-            attachment_hash
-          };
-        } else {
-          return {
-            tiddlerFields,
-            attachment_hash: existing_attachment_hash
-          };
-        }
-      }
-      /*
-      Check if an attachment name is valid (is a 64 character hex string)
-      */
-      isValidAttachmentName(content_hash) {
-        const re = new RegExp("^[a-f0-9]{64}$");
-        return re.test(content_hash);
-      }
-      /*
-      Saves an attachment to a file. Options include:
-      
-      text: text content (may be binary)
-      type: MIME type of content
-      reference: reference to use for debugging
-      _canonical_uri: canonical uri of the content
-      */
-      async saveAttachment(options) {
-        const contentHash = import_sjcl2.default.codec.hex.fromBits($tw.sjcl.hash.sha256.hash(options.text)).slice(0, 64).toString();
-        const contentTypeInfo = this.config.contentTypeInfo[options.type] || this.config.contentTypeInfo["application/octet-stream"];
-        const attachmentPath = path3.resolve(this.config.storePath, "files", contentHash);
-        createDirectory(attachmentPath);
-        const dataFilename = "data" + contentTypeInfo.extension;
-        fs2.writeFileSync(path3.resolve(attachmentPath, dataFilename), options.text, contentTypeInfo.encoding);
-        this.writeMetaFile(fs2, path3, attachmentPath, options, contentHash, dataFilename);
-        return contentHash;
-      }
-      writeMetaFile(fs3, path5, attachmentPath, options, contentHash, dataFilename) {
-        fs3.writeFileSync(path5.resolve(attachmentPath, "meta.json"), JSON.stringify({
-          _canonical_uri: options._canonical_uri,
-          created: (/* @__PURE__ */ new Date()).toISOString(),
-          modified: (/* @__PURE__ */ new Date()).toISOString(),
-          contentHash,
-          filename: dataFilename,
-          type: options.type
-        }, null, 4));
-      }
-      /*
-      Adopts an attachment file into the store (e.g. move from a temp upload directory)
-      */
-      async adoptAttachment({ incomingFilepath, type, hash, _canonical_uri }) {
-        const contentTypeInfo = this.config.contentTypeInfo[type] || this.config.contentTypeInfo["application/octet-stream"];
-        const attachmentPath = path3.resolve(this.config.storePath, "files", hash);
-        createDirectory(attachmentPath);
-        const dataFilename = "data" + contentTypeInfo.extension, dataFilepath = path3.resolve(attachmentPath, dataFilename);
-        fs2.renameSync(incomingFilepath, dataFilepath);
-        fs2.writeFileSync(path3.resolve(attachmentPath, "meta.json"), JSON.stringify({
-          _canonical_uri,
-          created: (/* @__PURE__ */ new Date()).toISOString(),
-          modified: (/* @__PURE__ */ new Date()).toISOString(),
-          contentHash: hash,
-          filename: dataFilename,
-          type
-        }, null, 4));
-        return hash;
-      }
-      /*
-      Get an attachment ready to stream. Returns null if there is an error or:
-      stream: filestream of file
-      type: type of file
-      */
-      async getAttachmentStream(content_hash) {
-        if (!this.isValidAttachmentName(content_hash)) return null;
-        const attachmentPath = path3.resolve(this.config.storePath, "files", content_hash);
-        const metaJsonPath = path3.resolve(attachmentPath, "meta.json");
-        if (!fs2.existsSync(metaJsonPath) || !fs2.statSync(metaJsonPath).isFile()) return null;
-        const meta = tryParseJSON(fs2.readFileSync(metaJsonPath, "utf8"));
-        if (!meta) return null;
-        const dataFilepath = path3.resolve(attachmentPath, meta.filename);
-        if (!fs2.existsSync(dataFilepath) || !fs2.statSync(dataFilepath).isFile()) return null;
-        return {
-          stream: fs2.createReadStream(dataFilepath),
-          type: meta.type
-        };
-      }
-      /*
-      Get the size of an attachment file given the contentHash.
-      Returns the size in bytes, or null if the file doesn't exist.
-      */
-      async getAttachmentFileSize(content_hash) {
-        const attachmentPath = path3.resolve(this.config.storePath, "files", content_hash);
-        const metaJsonPath = path3.resolve(attachmentPath, "meta.json");
-        if (!(fs2.existsSync(metaJsonPath) && fs2.statSync(metaJsonPath).isFile())) return null;
-        const meta = tryParseJSON(fs2.readFileSync(metaJsonPath, "utf8"));
-        if (!meta) return null;
-        const dataFilepath = path3.resolve(attachmentPath, meta.filename);
-        if (!(fs2.existsSync(dataFilepath) && fs2.statSync(dataFilepath).isFile())) return null;
-        return fs2.statSync(dataFilepath).size;
-      }
-      async getAttachmentMetadata(content_hash) {
-        const attachmentPath = path3.resolve(this.config.storePath, "files", content_hash);
-        const metaJsonPath = path3.resolve(attachmentPath, "meta.json");
-        if (!fs2.existsSync(metaJsonPath)) return null;
-        return JSON.parse(fs2.readFileSync(metaJsonPath, "utf8"));
-      }
-    };
-    __name(_AttachmentService, "AttachmentService");
-    AttachmentService = _AttachmentService;
-  }
-});
-
-// src/routes/services/sessions.ts
-var sessions_exports = {};
-__export(sessions_exports, {
-  SessionKeyMap: () => SessionKeyMap,
-  SessionManager: () => SessionManager,
-  zodSession: () => zodSession
-});
-import { randomBytes as randomBytes2 } from "node:crypto";
-function zodSession(path5, zodRequest, inner) {
-  return zodRoute(["POST"], path5, (z5) => ({}), "json", zodRequest, async (state) => {
-    return state.$transaction(async (prisma) => await inner(state, prisma));
-  });
-}
-var SessionKeyMap, _SessionManager, SessionManager;
-var init_sessions = __esm({
-  "src/routes/services/sessions.ts"() {
-    "use strict";
-    init_router();
-    SessionKeyMap = {
-      login1: true,
-      login2: true,
-      logout: true
-    };
-    __name(zodSession, "zodSession");
-    _SessionManager = class _SessionManager {
-      constructor() {
-        this.login1 = zodSession("/login/1", (z5) => z5.object({
-          username: z5.prismaField("Users", "username", "string"),
-          startLoginRequest: z5.string()
-        }), async (state, prisma) => {
-          const { username, startLoginRequest } = state.data;
-          const user = await prisma.users.findUnique({
-            where: { username },
-            select: { user_id: true, password: true }
-          });
-          if (!user) throw "User not found.";
-          const { user_id, password } = user;
-          const stater = state.PasswordService.LoginGenerator({
-            user_id,
-            startLoginRequest,
-            registrationRecord: password
-          });
-          const loginResponse = await stater.next(0);
-          if (loginResponse.done) throw "Login failed.";
-          const loginSession = await state.PasswordService.startLoginSession(stater);
-          state.setCookie("loginsession", loginSession, { httpOnly: true, path: "/", secure: state.isSecure, sameSite: "Strict" });
-          return { loginResponse: loginResponse.value };
-        });
-        this.login2 = zodSession("/login/2", (z5) => z5.object({
-          finishLoginRequest: z5.string()
-        }), async (state, prisma) => {
-          const { finishLoginRequest } = state.data;
-          if (!state.cookies.loginsession) throw "Login session not found.";
-          const stater = state.PasswordService.serverState.get(state.cookies.loginsession);
-          if (!stater) throw "Login session not found.";
-          const { done, value } = await stater.next(1, finishLoginRequest);
-          if (!value?.session?.sessionKey) throw "Login failed.";
-          const session_id = await this.createSession(prisma, value.user_id, value.session.sessionKey);
-          state.setCookie("session", session_id, { httpOnly: true, path: "/", secure: state.isSecure, sameSite: "Strict" });
-          return null;
-        });
-        this.logout = zodSession("/logout", (z5) => z5.undefined(), async (state, prisma) => {
-          if (state.user.isLoggedIn) {
-            await prisma.sessions.delete({ where: { session_id: state.user.sessionId } });
-          }
-          var cookies = state.headers.cookie ? state.headers.cookie.split(";") : [];
-          for (var i = 0; i < cookies.length; i++) {
-            var cookie = cookies[i]?.trim().split("=")[0];
-            if (!cookie) continue;
-            state.setCookie(cookie, "", { httpOnly: true, path: "/", expires: /* @__PURE__ */ new Date(0), secure: state.isSecure, sameSite: "Strict" });
-          }
-          return null;
-        });
-      }
-      static async defineRoutes(root) {
-        registerZodRoutes(root, new _SessionManager(), Object.keys(SessionKeyMap));
-      }
-      static async parseIncomingRequest(streamer, router) {
-        const sessionId = streamer.cookies.session;
-        const session = sessionId && await router.engine.sessions.findUnique({
-          where: { session_id: sessionId },
-          select: { user: { select: { user_id: true, username: true, roles: { select: { role_id: true } } } } }
-        });
-        if (sessionId && session) return {
-          user_id: session.user.user_id,
-          username: session.user.username,
-          isAdmin: session.user.roles.some((e) => e.role_id === 1),
-          role_ids: session.user.roles.map((e) => e.role_id),
-          sessionId,
-          isLoggedIn: true
-        };
-        else return {
-          user_id: 0,
-          username: "(anon)",
-          isAdmin: false,
-          role_ids: [],
-          sessionId: void 0,
-          isLoggedIn: false
-        };
-      }
-      async createSession(prisma, user_id, session_key) {
-        const session_id = randomBytes2(16).toString("base64url");
-        return await prisma.sessions.create({
-          data: {
-            user_id,
-            session_key,
-            session_id,
-            last_accessed: /* @__PURE__ */ new Date()
-          }
-        }).then(({ session_id: session_id2 }) => session_id2);
-      }
-    };
-    __name(_SessionManager, "SessionManager");
-    SessionManager = _SessionManager;
-  }
-});
-
-// import("./**/*/**/*") in src/routes/index.ts
-var globImport;
-var init_ = __esm({
-  'import("./**/*/**/*") in src/routes/index.ts'() {
-    globImport = __glob({
-      "./managers/index.ts": () => Promise.resolve().then(() => (init_managers(), managers_exports)),
-      "./managers/manager-recipes.ts": () => Promise.resolve().then(() => (init_manager_recipes(), manager_recipes_exports)),
-      "./managers/manager-users.ts": () => Promise.resolve().then(() => (init_manager_users(), manager_users_exports)),
-      "./managers/router-tiddlers.ts": () => Promise.resolve().then(() => (init_router_tiddlers(), router_tiddlers_exports)),
-      "./services/PasswordService.ts": () => Promise.resolve().then(() => (init_PasswordService(), PasswordService_exports)),
-      "./services/attachments.ts": () => Promise.resolve().then(() => (init_attachments(), attachments_exports)),
-      "./services/sessions.ts": () => Promise.resolve().then(() => (init_sessions(), sessions_exports))
-    });
-  }
-});
-
-// src/routes/index.ts
-import { Prisma } from "@prisma/client";
-async function RootRoute(root, config) {
-  TiddlerRouter.defineRoutes(root);
-  ManagerRoutes(root, config);
-  if (typeof ENABLE_UNSAFE_PRISMA_ROUTE !== "undefined")
-    root.defineRoute({
-      method: ["POST"],
-      path: /^\/prisma$/,
-      bodyFormat: "json"
-    }, async (state) => {
-      ZodAssert.data(state, (z5) => z5.object({
-        table: z5.string(),
-        action: z5.string(),
-        arg: z5.any()
-      }));
-      return await state.$transaction(async (prisma) => {
-        const p = prisma;
-        const table = p[state.data.table];
-        if (!table) throw new Error(`No such table`);
-        const fn = table[state.data.action];
-        if (!fn) throw new Error(`No such table or action`);
-        console.log(state.data.arg);
-        return state.sendJSON(200, await fn.call(table, state.data.arg));
-      });
-    });
-  await importEsbuild(root);
-}
-async function importEsbuild(root) {
-  root.defineRoute({
-    method: ["GET"],
-    path: /^\/(.*)/,
-    pathParams: ["reqpath"],
-    bodyFormat: "stream"
-  }, async (state) => {
-    await state.sendDevServer();
-  });
-}
-function findValueInObject(val, predicate, keys = [], paths = []) {
-  if (predicate(val)) {
-    paths.push(keys.join("/"));
-    return paths;
-  }
-  if (val && typeof val === "object") {
-    for (const key of Object.keys(val)) {
-      if (!val.hasOwnProperty(key)) continue;
-      findValueInObject(val[key], predicate, [...keys, key], paths);
-    }
-  }
-  console.log(paths, keys);
-  return paths;
-}
-function capitalize(table) {
-  return table.slice(0, 1).toUpperCase() + table.slice(1);
-}
-var _error, _ProxyPromise, ProxyPromise, argproxy;
-var init_routes = __esm({
-  "src/routes/index.ts"() {
-    "use strict";
-    init_utils2();
-    init_managers();
-    init_router_tiddlers();
-    init_();
-    __name(RootRoute, "RootRoute");
-    __name(importEsbuild, "importEsbuild");
-    _ProxyPromise = class _ProxyPromise {
-      constructor({ action, table, arg }) {
-        __privateAdd(this, _error, new Error("An error occured for this request"));
-        this.action = action;
-        this.table = table;
-        this.arg = arg;
-        Object.defineProperty(this, "toJSON", {
-          configurable: true,
-          enumerable: true,
-          value: /* @__PURE__ */ __name(() => ({
-            action: this.action,
-            table: this.table,
-            arg: this.arg,
-            dbnulls: this.arg.data && findValueInObject(this.arg.data, (e) => e === Prisma.DbNull),
-            jsnulls: this.arg.data && findValueInObject(this.arg.data, (e) => e === Prisma.JsonNull)
-          }), "value")
-        });
-      }
-      static getErrorStack(t) {
-        return __privateGet(t, _error).stack;
-      }
-    };
-    _error = new WeakMap();
-    __name(_ProxyPromise, "ProxyPromise");
-    ProxyPromise = _ProxyPromise;
-    __name(findValueInObject, "findValueInObject");
-    __name(capitalize, "capitalize");
-    argproxy = (() => new Proxy({}, {
-      get(target, table) {
-        return target[table] = target[table] || new Proxy({}, {
-          get(target2, action) {
-            return target2[action] = target2[action] || ((arg) => {
-              return new ProxyPromise({ action, table: capitalize(table), arg });
-            });
-          }
-        });
-      }
-    }))();
-  }
-});
+    }
+  </style>
+  <base href="${pathPrefix}/">
+  <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
+  <link rel="stylesheet" href="${pathPrefix}/main.css" />
+</head>
 
-// src/setupDevServer.ts
-import { request } from "http";
-import { resolve as resolve4 } from "path";
-async function setupDevServer(enableDevServer) {
+<body class="tc-body">
+  <div id="root"></div>
+  <script>window.pathPrefix = ${JSON.stringify(pathPrefix)};</script>
+  <script type="module" src="${pathPrefix}/main.js"></script>
+</body>
+
+</html>
+`.trim(), "utf8");
+  const index_hash = createHash3("sha1").update(index_file).digest().toString("base64");
+  const rootdir = dist_resolve("../react-user-mgmt");
+  const index_placeholder = await readFile(join(rootdir, "public/index.html"), "utf8");
   if (!enableDevServer) {
     return /* @__PURE__ */ __name(async function sendProdServer(state) {
-      const rootdir = dist_resolve("../react-user-mgmt/public");
+      const sendIndex = /* @__PURE__ */ __name(() => state.sendBuffer(200, {
+        "content-type": "text/html",
+        "content-length": index_file.length,
+        "etag": index_hash
+      }, index_file), "sendIndex");
+      if (state.url === "/") return sendIndex();
       return state.sendFile(200, {}, {
         root: rootdir,
-        reqpath: state.url === "/" ? "/index.html" : state.url,
-        on404: /* @__PURE__ */ __name(() => state.sendFile(200, {}, { reqpath: "/index.html", root: rootdir }), "on404")
+        reqpath: state.url,
+        on404: /* @__PURE__ */ __name(async () => sendIndex(), "on404")
       });
     }, "sendProdServer");
   } else {
-    const esbuild = await import("esbuild");
-    const rootdir = resolve4(enableDevServer, "react-user-mgmt");
-    let ctx = await esbuild.context({
-      entryPoints: [resolve4(rootdir, "src/main.tsx")],
-      bundle: true,
-      target: "es2020",
-      platform: "browser",
-      jsx: "automatic",
-      outdir: resolve4(rootdir, "public"),
-      minify: true,
-      sourcemap: true
-    });
-    const { port } = await ctx.serve({
-      servedir: resolve4(rootdir, "public"),
-      fallback: resolve4(rootdir, "public/index.html")
-    });
+    const { ctx, port } = await esbuildStartup();
     return /* @__PURE__ */ __name(async function sendDevServer(state) {
+      const sendIndex = /* @__PURE__ */ __name(() => state.sendBuffer(200, {
+        "content-type": "text/html",
+        "content-length": index_file.length,
+        "etag": index_hash
+      }, index_file), "sendIndex");
       const proxyRes = await new Promise((resolve13, reject) => {
         const headers2 = { ...state.headers };
         delete headers2[":method"];
@@ -15085,7 +14800,7 @@ async function setupDevServer(enableDevServer) {
         delete headers2[":scheme"];
         headers2.host = "localhost";
         const proxyReq = request({
-          hostname: "localhost",
+          hostname: "127.0.0.20",
           port,
           path: state.url,
           method: state.method,
@@ -15094,20 +14809,62 @@ async function setupDevServer(enableDevServer) {
         state.reader.pipe(proxyReq, { end: true });
       });
       const { statusCode, headers } = proxyRes;
+      if (statusCode === 200 && headers["content-type"] === "text/html; charset=utf-8" && headers["content-length"] === "61") {
+        const indexCheck = await new Promise((resolve13) => {
+          const chunks = [];
+          proxyRes.on("data", (chunk) => {
+            chunks.push(chunk);
+          });
+          proxyRes.on("end", () => {
+            resolve13(Buffer.concat(chunks));
+          });
+        });
+        if (indexCheck.toString() === index_placeholder) return sendIndex();
+      }
       if (statusCode === 404 || !statusCode) {
         proxyRes.resume();
-        return state.sendEmpty(404, { "Content-Type": "text/html" });
+        return state.sendBuffer(200, {
+          "content-type": "text/html",
+          "content-length": index_file.length,
+          "etag": index_hash
+        }, index_file);
       } else {
         return state.sendStream(statusCode, headers, proxyRes);
       }
     }, "sendDevServer");
   }
 }
+async function esbuildStartup() {
+  const rootdir = dist_resolve("../react-user-mgmt");
+  const esbuild = await import("esbuild");
+  let ctx = await esbuild.context({
+    entryPoints: [resolve3(rootdir, "src/main.tsx")],
+    bundle: true,
+    target: "es2020",
+    platform: "browser",
+    jsx: "automatic",
+    outdir: resolve3(rootdir, "public"),
+    minify: true,
+    sourcemap: true,
+    metafile: true,
+    splitting: true,
+    format: "esm"
+  });
+  const { port } = await ctx.serve({
+    servedir: resolve3(rootdir, "public"),
+    host: "127.0.0.20"
+  });
+  const result = await ctx.rebuild();
+  writeFileSync(resolve3(rootdir, "public/stats.json"), JSON.stringify(result.metafile));
+  return { ctx, port, result, rootdir };
+}
 var init_setupDevServer = __esm({
   "src/setupDevServer.ts"() {
     "use strict";
+    init_esm_shims();
     init_utils2();
     __name(setupDevServer, "setupDevServer");
+    __name(esbuildStartup, "esbuildStartup");
   }
 });
 
@@ -15128,6 +14885,7 @@ async function startupCache(commander) {
 var init_cache = __esm({
   "src/routes/cache.ts"() {
     "use strict";
+    init_esm_shims();
     init_utils2();
     __name(startupCache, "startupCache");
   }
@@ -15165,10 +14923,11 @@ function zodManage(zodRequest, inner) {
     return state.$transaction(async (prisma) => await inner(state, prisma));
   });
 }
-var AllowedMethods, BodyFormats, zodTransformJSON, _Router, Router3, ROOT_ROUTE, registerZodRoutes;
+var AllowedMethods, BodyFormats, zodTransformJSON, _Router, Router2, ROOT_ROUTE, registerZodRoutes;
 var init_router = __esm({
   "src/routes/router.ts"() {
     "use strict";
+    init_esm_shims();
     init_streamer();
     init_StateObject();
     init_routes();
@@ -15176,6 +14935,7 @@ var init_router = __esm({
     init_utils2();
     init_setupDevServer();
     init_cache();
+    init_server();
     AllowedMethods = [...["GET", "HEAD", "OPTIONS", "POST", "PUT", "DELETE"]];
     BodyFormats = ["stream", "string", "json", "buffer", "www-form-urlencoded", "www-form-urlencoded-urlsearchparams", "ignore"];
     zodTransformJSON = /* @__PURE__ */ __name((arg, ctx) => {
@@ -15206,13 +14966,12 @@ var init_router = __esm({
         this.enableBrowserCache = true;
         this.enableGzip = false;
         this.csrfDisable = false;
-        this.servername = "";
-        this.variables = /* @__PURE__ */ new Map();
         this.engine = commander.engine;
         this.SessionManager = commander.SessionManager;
+        this.pathPrefix = commander.siteConfig.pathPrefix;
       }
       static async makeRouter(commander, enableDevServer) {
-        const sendDevServer = await setupDevServer(enableDevServer);
+        const sendDevServer = await setupDevServer(enableDevServer, commander.siteConfig.pathPrefix);
         const rootRoute2 = defineRoute(ROOT_ROUTE, {
           method: AllowedMethods,
           path: /^/,
@@ -15225,15 +14984,27 @@ var init_router = __esm({
         const cache = await startupCache(commander);
         return new _Router(rootRoute2, commander, cache);
       }
-      get(name) {
-        return this.variables.get(name) || "";
+      handleIncomingRequest(req, res) {
+        const [ok8, err, streamer] = function() {
+          try {
+            return [true, void 0, new Streamer(req, res, this)];
+          } catch (e) {
+            return [false, e, void 0];
+          }
+        }.call(this);
+        if (!ok8) {
+          if (err === STREAM_ENDED) return;
+          res.writeHead(500, { "x-reason": "handle incoming request" }).end();
+          throw err;
+        }
+        this.handle(streamer).catch(streamer.catcher);
       }
       async handle(streamer) {
         if (!this.csrfDisable && ["POST", "PUT", "DELETE"].includes(streamer.method) && streamer.headers["x-requested-with"] !== "TiddlyWiki")
           throw streamer.sendString(
-            403,
+            400,
             { "x-reason": "x-requested-with missing" },
-            `'X-Requested-With' header required to login to '${this.servername}'`,
+            `'X-Requested-With' header required`,
             "utf8"
           );
         const authUser = await this.SessionManager.parseIncomingRequest(streamer, this);
@@ -15329,13 +15100,11 @@ var init_router = __esm({
       findRoute(streamer) {
         const { method, urlInfo } = streamer;
         let testPath = urlInfo.pathname || "/";
-        if (this.pathPrefix && testPath.startsWith(this.pathPrefix))
-          testPath = testPath.slice(this.pathPrefix.length) || "/";
         return this.findRouteRecursive([this.rootRoute], testPath, method);
       }
     };
     __name(_Router, "Router");
-    Router3 = _Router;
+    Router2 = _Router;
     ROOT_ROUTE = Symbol("ROOT_ROUTE");
     __name(defineRoute, "defineRoute");
     __name(zodRoute, "zodRoute");
@@ -15392,16 +15161,7 @@ var init_router = __esm({
   }
 });
 
-// src/server.ts
-init_router();
-init_StateObject();
-init_streamer();
-init_global();
-import * as opaque2 from "@serenity-kit/opaque";
-import { existsSync as existsSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
-
 // src/tiddlywiki.ts
-init_utils2();
 import { TiddlyWiki } from "tiddlywiki";
 import { ok as ok5 } from "node:assert";
 async function bootTiddlyWiki(wikiPath) {
@@ -15458,19 +15218,341 @@ async function bootTiddlyWiki(wikiPath) {
   ok5(!$tw2.boot.tasks.readBrowserTiddlers);
   return $tw2;
 }
-__name(bootTiddlyWiki, "bootTiddlyWiki");
+var init_tiddlywiki = __esm({
+  "src/tiddlywiki.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_utils2();
+    __name(bootTiddlyWiki, "bootTiddlyWiki");
+  }
+});
 
-// src/commander.ts
-init_sessions();
-init_attachments();
-init_utils2();
-import * as path4 from "node:path";
-import { PrismaClient as PrismaClient2 } from "@prisma/client";
-import { createClient } from "@libsql/client";
-import { PrismaLibSQL } from "@prisma/adapter-libsql";
-import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync4 } from "node:fs";
-import { readdir, readFile } from "node:fs/promises";
-import { createHash as createHash3, randomUUID } from "node:crypto";
+// src/services/sessions.ts
+import { createHash as createHash4, randomBytes } from "node:crypto";
+function zodSession(path5, zodRequest, inner) {
+  return {
+    ...zodRoute(["POST"], path5, (z5) => ({}), "json", zodRequest, async (state) => {
+      return state.$transaction(async (prisma) => await inner(state, prisma));
+    }),
+    path: path5
+  };
+}
+async function createSession(prisma, user_id, session_key) {
+  const session_id = randomBytes(16).toString("base64url");
+  return await prisma.sessions.create({
+    data: {
+      user_id,
+      session_key,
+      session_id,
+      last_accessed: /* @__PURE__ */ new Date()
+    }
+  }).then(({ session_id: session_id2 }) => session_id2);
+}
+function assertSignature({ session_id, signature, session_key }) {
+  const hash = createHash4("sha256").update(session_key + session_id).digest("base64");
+  if (hash !== signature) throw "Invalid session signature.";
+}
+var SessionKeyMap, _SessionManager, SessionManager;
+var init_sessions = __esm({
+  "src/services/sessions.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_router();
+    SessionKeyMap = {
+      login1: true,
+      login2: true,
+      logout: true
+    };
+    __name(zodSession, "zodSession");
+    _SessionManager = class _SessionManager {
+      constructor() {
+        this.login1 = zodSession("/login/1", (z5) => z5.object({
+          username: z5.prismaField("Users", "username", "string"),
+          startLoginRequest: z5.string()
+        }), async (state, prisma) => {
+          const { username, startLoginRequest } = state.data;
+          const user = await prisma.users.findUnique({
+            where: { username },
+            select: { user_id: true, password: true }
+          });
+          if (!user) throw "User not found.";
+          const { user_id, password } = user;
+          const stater = state.PasswordService.LoginGenerator({
+            user_id,
+            startLoginRequest,
+            registrationRecord: password
+          });
+          const loginResponse = await stater.next(0);
+          if (loginResponse.done) throw "Login failed.";
+          const loginSession = await state.PasswordService.startLoginSession(stater);
+          return { loginResponse: loginResponse.value, loginSession };
+        });
+        this.login2 = zodSession("/login/2", (z5) => z5.object({
+          finishLoginRequest: z5.string(),
+          loginSession: z5.string(),
+          skipCookie: z5.boolean().optional().default(false)
+        }), async (state, prisma) => {
+          const { finishLoginRequest, skipCookie, loginSession } = state.data;
+          if (!loginSession) throw "Login session not found.";
+          const stater = state.PasswordService.serverState.get(loginSession);
+          if (!stater) throw "Login session not found.";
+          const { value } = await stater.next(1, finishLoginRequest);
+          if (!value?.session?.sessionKey) throw "Login failed.";
+          const session_id = await createSession(prisma, value.user_id, value.session.sessionKey);
+          if (!skipCookie) {
+            state.setCookie("session", session_id, {
+              httpOnly: true,
+              path: state.config.pathPrefix + "/",
+              secure: state.isSecure,
+              sameSite: "Strict"
+            });
+          }
+          return { user_id: value.user_id, session_id };
+        });
+        this.logout = zodSession("/logout", (z5) => z5.object({
+          session_id: z5.string(),
+          signature: z5.string(),
+          skipCookie: z5.boolean().refine((e) => e === true)
+        }).optional(), async (state, prisma) => {
+          if (state.data?.skipCookie) {
+            const session = await prisma.sessions.findUnique({
+              where: { session_id: state.data.session_id },
+              select: { user_id: true, session_key: true }
+            });
+            if (!session?.session_key) throw "Session not found.";
+            const { session_key } = session;
+            const { session_id, signature } = state.data;
+            assertSignature({ session_id, signature, session_key });
+            await prisma.sessions.delete({ where: { session_id: state.data.session_id } });
+            return null;
+          }
+          if (state.user.isLoggedIn) {
+            await prisma.sessions.delete({ where: { session_id: state.user.sessionId } });
+          }
+          var cookies = state.headers.cookie ? state.headers.cookie.split(";") : [];
+          for (var i = 0; i < cookies.length; i++) {
+            var cookie = cookies[i]?.trim().split("=")[0];
+            if (!cookie) continue;
+            state.setCookie(cookie, "", { httpOnly: true, path: state.config.pathPrefix + "/", expires: /* @__PURE__ */ new Date(0), secure: state.isSecure, sameSite: "Strict" });
+          }
+          return null;
+        });
+      }
+      static async defineRoutes(root) {
+        registerZodRoutes(root, new _SessionManager(), Object.keys(SessionKeyMap));
+      }
+      static async parseIncomingRequest(streamer, router) {
+        const sessionId = streamer.cookies.get("session");
+        const session = sessionId && await router.engine.sessions.findUnique({
+          where: { session_id: sessionId },
+          select: { user: { select: { user_id: true, username: true, roles: { select: { role_id: true } } } } }
+        });
+        if (sessionId && session) return {
+          user_id: session.user.user_id,
+          username: session.user.username,
+          isAdmin: session.user.roles.some((e) => e.role_id === 1),
+          role_ids: session.user.roles.map((e) => e.role_id),
+          sessionId,
+          isLoggedIn: true
+        };
+        else return {
+          user_id: 0,
+          username: "(anon)",
+          isAdmin: false,
+          role_ids: [],
+          sessionId: void 0,
+          isLoggedIn: false
+        };
+      }
+    };
+    __name(_SessionManager, "SessionManager");
+    SessionManager = _SessionManager;
+    __name(createSession, "createSession");
+    __name(assertSignature, "assertSignature");
+  }
+});
+
+// src/services/attachments.ts
+import * as path3 from "path";
+import * as fs2 from "fs";
+var import_sjcl2, $tw, _AttachmentService, AttachmentService;
+var init_attachments = __esm({
+  "src/services/attachments.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_utils2();
+    import_sjcl2 = __toESM(require_sjcl(), 1);
+    $tw = {};
+    _AttachmentService = class _AttachmentService {
+      constructor(config, prisma) {
+        this.config = config;
+        this.prisma = prisma;
+      }
+      makeCanonicalUri(bag_name, title) {
+        return `/bags/${encodeURIComponentExtended(bag_name)}/tiddlers/${encodeURIComponentExtended(title)}/blob`;
+      }
+      /*
+      Given tiddler fields, tiddler_id and a bag_name, return the tiddler fields after the following process:
+      - Apply the tiddler_id as the revision field
+      - Apply the bag_name as the bag field
+      */
+      processOutgoingTiddler({ tiddler, tiddler_id, bag_name, attachment_hash }) {
+        if (attachment_hash !== null) {
+          return Object.assign(
+            {},
+            tiddler,
+            {
+              text: void 0,
+              _canonical_uri: this.makeCanonicalUri(bag_name, tiddler.title),
+              revision: tiddler_id,
+              bag: bag_name
+            }
+          );
+        } else {
+          return tiddler;
+        }
+      }
+      /*
+      */
+      async processIncomingTiddler({
+        tiddlerFields,
+        existing_attachment_hash,
+        existing_canonical_uri
+      }) {
+        const { attachmentSizeLimit, attachmentsEnabled } = this.config;
+        const contentTypeInfo = this.config.contentTypeInfo[tiddlerFields.type || "text/vnd.tiddlywiki"];
+        const isBinary = !!contentTypeInfo && contentTypeInfo.encoding === "base64";
+        let shouldProcessAttachment = tiddlerFields.text && tiddlerFields.text.length > attachmentSizeLimit;
+        if (existing_attachment_hash) {
+          const fileSize = await this.getAttachmentFileSize(existing_attachment_hash);
+          if (fileSize && fileSize <= attachmentSizeLimit) {
+            const existingAttachmentMeta = await this.getAttachmentMetadata(existing_attachment_hash);
+            const hasCanonicalField = !!tiddlerFields._canonical_uri;
+            const skipAttachment = hasCanonicalField && tiddlerFields._canonical_uri === (existingAttachmentMeta ? existingAttachmentMeta._canonical_uri : existing_canonical_uri);
+            shouldProcessAttachment = !skipAttachment;
+          } else {
+            shouldProcessAttachment = false;
+          }
+        }
+        if (attachmentsEnabled && isBinary && shouldProcessAttachment) {
+          const attachment_hash = existing_attachment_hash || await this.saveAttachment({
+            text: tiddlerFields.text,
+            type: tiddlerFields.type,
+            reference: tiddlerFields.title,
+            _canonical_uri: tiddlerFields._canonical_uri
+          });
+          if (tiddlerFields && tiddlerFields._canonical_uri) {
+            delete tiddlerFields._canonical_uri;
+          }
+          return {
+            tiddlerFields: Object.assign({}, tiddlerFields, { text: void 0 }),
+            attachment_hash
+          };
+        } else {
+          return {
+            tiddlerFields,
+            attachment_hash: existing_attachment_hash
+          };
+        }
+      }
+      /*
+      Check if an attachment name is valid (is a 64 character hex string)
+      */
+      isValidAttachmentName(content_hash) {
+        const re = new RegExp("^[a-f0-9]{64}$");
+        return re.test(content_hash);
+      }
+      /*
+      Saves an attachment to a file. Options include:
+      
+      text: text content (may be binary)
+      type: MIME type of content
+      reference: reference to use for debugging
+      _canonical_uri: canonical uri of the content
+      */
+      async saveAttachment(options) {
+        const contentHash = import_sjcl2.default.codec.hex.fromBits($tw.sjcl.hash.sha256.hash(options.text)).slice(0, 64).toString();
+        const contentTypeInfo = this.config.contentTypeInfo[options.type] || this.config.contentTypeInfo["application/octet-stream"];
+        const attachmentPath = path3.resolve(this.config.storePath, "files", contentHash);
+        createDirectory(attachmentPath);
+        const dataFilename = "data" + contentTypeInfo.extension;
+        fs2.writeFileSync(path3.resolve(attachmentPath, dataFilename), options.text, contentTypeInfo.encoding);
+        this.writeMetaFile(fs2, path3, attachmentPath, options, contentHash, dataFilename);
+        return contentHash;
+      }
+      writeMetaFile(fs3, path5, attachmentPath, options, contentHash, dataFilename) {
+        fs3.writeFileSync(path5.resolve(attachmentPath, "meta.json"), JSON.stringify({
+          _canonical_uri: options._canonical_uri,
+          created: (/* @__PURE__ */ new Date()).toISOString(),
+          modified: (/* @__PURE__ */ new Date()).toISOString(),
+          contentHash,
+          filename: dataFilename,
+          type: options.type
+        }, null, 4));
+      }
+      /*
+      Adopts an attachment file into the store (e.g. move from a temp upload directory)
+      */
+      async adoptAttachment({ incomingFilepath, type, hash, _canonical_uri }) {
+        const contentTypeInfo = this.config.contentTypeInfo[type] || this.config.contentTypeInfo["application/octet-stream"];
+        const attachmentPath = path3.resolve(this.config.storePath, "files", hash);
+        createDirectory(attachmentPath);
+        const dataFilename = "data" + contentTypeInfo.extension, dataFilepath = path3.resolve(attachmentPath, dataFilename);
+        fs2.renameSync(incomingFilepath, dataFilepath);
+        fs2.writeFileSync(path3.resolve(attachmentPath, "meta.json"), JSON.stringify({
+          _canonical_uri,
+          created: (/* @__PURE__ */ new Date()).toISOString(),
+          modified: (/* @__PURE__ */ new Date()).toISOString(),
+          contentHash: hash,
+          filename: dataFilename,
+          type
+        }, null, 4));
+        return hash;
+      }
+      /*
+      Get an attachment ready to stream. Returns null if there is an error or:
+      stream: filestream of file
+      type: type of file
+      */
+      async getAttachmentStream(content_hash) {
+        if (!this.isValidAttachmentName(content_hash)) return null;
+        const attachmentPath = path3.resolve(this.config.storePath, "files", content_hash);
+        const metaJsonPath = path3.resolve(attachmentPath, "meta.json");
+        if (!fs2.existsSync(metaJsonPath) || !fs2.statSync(metaJsonPath).isFile()) return null;
+        const meta = tryParseJSON(fs2.readFileSync(metaJsonPath, "utf8"));
+        if (!meta) return null;
+        const dataFilepath = path3.resolve(attachmentPath, meta.filename);
+        if (!fs2.existsSync(dataFilepath) || !fs2.statSync(dataFilepath).isFile()) return null;
+        return {
+          stream: fs2.createReadStream(dataFilepath),
+          type: meta.type
+        };
+      }
+      /*
+      Get the size of an attachment file given the contentHash.
+      Returns the size in bytes, or null if the file doesn't exist.
+      */
+      async getAttachmentFileSize(content_hash) {
+        const attachmentPath = path3.resolve(this.config.storePath, "files", content_hash);
+        const metaJsonPath = path3.resolve(attachmentPath, "meta.json");
+        if (!(fs2.existsSync(metaJsonPath) && fs2.statSync(metaJsonPath).isFile())) return null;
+        const meta = tryParseJSON(fs2.readFileSync(metaJsonPath, "utf8"));
+        if (!meta) return null;
+        const dataFilepath = path3.resolve(attachmentPath, meta.filename);
+        if (!(fs2.existsSync(dataFilepath) && fs2.statSync(dataFilepath).isFile())) return null;
+        return fs2.statSync(dataFilepath).size;
+      }
+      async getAttachmentMetadata(content_hash) {
+        const attachmentPath = path3.resolve(this.config.storePath, "files", content_hash);
+        const metaJsonPath = path3.resolve(attachmentPath, "meta.json");
+        if (!fs2.existsSync(metaJsonPath)) return null;
+        return JSON.parse(fs2.readFileSync(metaJsonPath, "utf8"));
+      }
+    };
+    __name(_AttachmentService, "AttachmentService");
+    AttachmentService = _AttachmentService;
+  }
+});
 
 // src/commands/mws-load-plugin-bags.ts
 var mws_load_plugin_bags_exports = {};
@@ -15478,34 +15560,7 @@ __export(mws_load_plugin_bags_exports, {
   Command: () => Command,
   info: () => info
 });
-init_TiddlerStore();
-init_utils2();
 import { resolve as resolve5 } from "node:path";
-var info = {
-  name: "mws-load-plugin-bags",
-  synchronous: true
-};
-var _Command = class _Command {
-  constructor(params, commander, callback) {
-    this.params = params;
-    this.commander = commander;
-    this.callback = callback;
-  }
-  get $tw() {
-    return this.commander.$tw;
-  }
-  async execute() {
-    console.time(`${info.name} complete`);
-    await loadPluginBags(
-      this.$tw,
-      new TiddlerStore(this.commander, this.commander.engine),
-      this.commander.engine
-    );
-    console.timeEnd(`${info.name} complete`);
-  }
-};
-__name(_Command, "Command");
-var Command = _Command;
 async function loadPluginBags($tw2, store, engine) {
   function makePluginBagName2(type, publisher, name) {
     return "$:/" + type + "/" + (publisher ? publisher + "/" : "") + name;
@@ -15563,7 +15618,41 @@ async function loadPluginBags($tw2, store, engine) {
   });
   await engine.$transaction(prismaPromiseArray);
 }
-__name(loadPluginBags, "loadPluginBags");
+var info, _Command, Command;
+var init_mws_load_plugin_bags = __esm({
+  "src/commands/mws-load-plugin-bags.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_TiddlerStore();
+    init_utils2();
+    info = {
+      name: "mws-load-plugin-bags",
+      synchronous: true
+    };
+    _Command = class _Command {
+      constructor(params, commander, callback) {
+        this.params = params;
+        this.commander = commander;
+        this.callback = callback;
+      }
+      get $tw() {
+        return this.commander.$tw;
+      }
+      async execute() {
+        console.time(`${info.name} complete`);
+        await loadPluginBags(
+          this.$tw,
+          new TiddlerStore(this.commander, this.commander.engine),
+          this.commander.engine
+        );
+        console.timeEnd(`${info.name} complete`);
+      }
+    };
+    __name(_Command, "Command");
+    Command = _Command;
+    __name(loadPluginBags, "loadPluginBags");
+  }
+});
 
 // src/commands/mws-render-tiddlywiki5.ts
 var mws_render_tiddlywiki5_exports = {};
@@ -15572,21 +15661,26 @@ __export(mws_render_tiddlywiki5_exports, {
   info: () => info2
 });
 import { resolve as resolve6 } from "node:path";
-var { writeFileSync: writeFileSync2 } = __require("fs");
-var info2 = {
-  name: "mws-render-tiddlywiki5",
-  synchronous: true
-};
-var _Command2 = class _Command2 {
-  constructor(params, commander, callback) {
-    this.params = params;
-    this.commander = commander;
-    this.callback = callback;
-  }
-  async execute() {
-    const result = this.commander.$tw.wiki.renderTiddler("text/plain", "$:/core/templates/tiddlywiki5.html", {
-      variables: {
-        saveTiddlerFilter: `
+var writeFileSync3, info2, _Command2, Command2;
+var init_mws_render_tiddlywiki5 = __esm({
+  "src/commands/mws-render-tiddlywiki5.ts"() {
+    "use strict";
+    init_esm_shims();
+    ({ writeFileSync: writeFileSync3 } = __require("fs"));
+    info2 = {
+      name: "mws-render-tiddlywiki5",
+      synchronous: true
+    };
+    _Command2 = class _Command2 {
+      constructor(params, commander, callback) {
+        this.params = params;
+        this.commander = commander;
+        this.callback = callback;
+      }
+      async execute() {
+        const result = this.commander.$tw.wiki.renderTiddler("text/plain", "$:/core/templates/tiddlywiki5.html", {
+          variables: {
+            saveTiddlerFilter: `
           $:/boot/boot.css
           $:/boot/boot.js
           $:/boot/bootprefix.js
@@ -15597,14 +15691,16 @@ var _Command2 = class _Command2 {
           $:/themes/tiddlywiki/snowwhite
           $:/themes/tiddlywiki/vanilla
         `
+          }
+        });
+        const filepath = resolve6(this.commander.wikiPath, "tiddlywiki5.html");
+        writeFileSync3(filepath, result);
       }
-    });
-    const filepath = resolve6(this.commander.wikiPath, "tiddlywiki5.html");
-    writeFileSync2(filepath, result);
+    };
+    __name(_Command2, "Command");
+    Command2 = _Command2;
   }
-};
-__name(_Command2, "Command");
-var Command2 = _Command2;
+});
 
 // src/commands/mws-load-wiki-folder.ts
 var mws_load_wiki_folder_exports = {};
@@ -15612,41 +15708,10 @@ __export(mws_load_wiki_folder_exports, {
   Command: () => Command3,
   info: () => info3
 });
-init_TiddlerStore();
 import { resolve as resolve7 } from "path";
-var info3 = {
-  name: "mws-load-wiki-folder",
-  synchronous: true
-};
-var _Command3 = class _Command3 {
-  constructor(params, commander, callback) {
-    this.params = params;
-    this.commander = commander;
-    this.callback = callback;
-  }
-  async execute() {
-    if (this.params.length < 5) {
-      return "Missing parameters for --mws-load-wiki-folder command";
-    }
-    await this.commander.engine.$transaction(loadWikiFolder({
-      wikiPath: this.params[0],
-      bagName: this.params[1],
-      bagDescription: this.params[2],
-      recipeName: this.params[3],
-      recipeDescription: this.params[4],
-      store: new TiddlerStore(this.commander, this.commander.engine),
-      $tw: this.commander.$tw
-    }));
-    console.log(info3.name, "complete:", this.params[0]);
-    return null;
-  }
-};
-__name(_Command3, "Command");
-var Command3 = _Command3;
 function makePluginBagName(type, publisher, name) {
   return "$:/" + type + "/" + (publisher ? publisher + "/" : "") + name;
 }
-__name(makePluginBagName, "makePluginBagName");
 function loadWikiFolder({ $tw: $tw2, store, ...options }) {
   const path5 = __require("path"), fs3 = __require("fs");
   const wikiInfoPath = path5.resolve(options.wikiPath, $tw2.config.wikiInfo);
@@ -15697,7 +15762,45 @@ function loadWikiFolder({ $tw: $tw2, store, ...options }) {
     ...store.saveTiddlersFromPath_PrismaArray(tiddlersFromPath, options.bagName)
   ];
 }
-__name(loadWikiFolder, "loadWikiFolder");
+var info3, _Command3, Command3;
+var init_mws_load_wiki_folder = __esm({
+  "src/commands/mws-load-wiki-folder.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_TiddlerStore();
+    info3 = {
+      name: "mws-load-wiki-folder",
+      synchronous: true
+    };
+    _Command3 = class _Command3 {
+      constructor(params, commander, callback) {
+        this.params = params;
+        this.commander = commander;
+        this.callback = callback;
+      }
+      async execute() {
+        if (this.params.length < 5) {
+          return "Missing parameters for --mws-load-wiki-folder command";
+        }
+        await this.commander.engine.$transaction(loadWikiFolder({
+          wikiPath: this.params[0],
+          bagName: this.params[1],
+          bagDescription: this.params[2],
+          recipeName: this.params[3],
+          recipeDescription: this.params[4],
+          store: new TiddlerStore(this.commander, this.commander.engine),
+          $tw: this.commander.$tw
+        }));
+        console.log(info3.name, "complete:", this.params[0]);
+        return null;
+      }
+    };
+    __name(_Command3, "Command");
+    Command3 = _Command3;
+    __name(makePluginBagName, "makePluginBagName");
+    __name(loadWikiFolder, "loadWikiFolder");
+  }
+});
 
 // src/commands/mws-save-archive.ts
 var mws_save_archive_exports = {};
@@ -15705,98 +15808,105 @@ __export(mws_save_archive_exports, {
   Command: () => Command4,
   info: () => info4
 });
-init_TiddlerStore();
-init_utils2();
 import { resolve as resolve8 } from "path";
 import * as _fsp from "fs/promises";
-var fsp = createStrictAwaitProxy(_fsp);
-var info4 = {
-  name: "mws-save-archive",
-  synchronous: true
-};
-var _Command4 = class _Command4 {
-  constructor(params, commander, callback) {
-    this.params = params;
-    this.commander = commander;
-    this.callback = callback;
-  }
-  get $tw() {
-    return this.commander.$tw;
-  }
-  get archivePath() {
-    return this.params[0];
-  }
-  async execute() {
-    if (this.params.length < 1) throw "Missing pathname";
-    await this.commander.$transaction(async (prisma) => {
-      this.store = new TiddlerStore(this.commander, prisma);
-      await this.saveArchive();
-      this.store = void 0;
-    });
-    console.log(info4.name, "complete:", this.params[0]);
-    return null;
-  }
-  async getRecipes() {
-    return await this.store.prisma.recipes.findMany({
-      include: { recipe_bags: true, acl: true }
-    });
-  }
-  async getBags() {
-    const bags = await this.store.prisma.bags.findMany({
-      include: { tiddlers: { include: { fields: true } }, acl: true }
-    });
-    return bags.map((e) => ({
-      ...e,
-      tiddlers: e.tiddlers.map((t) => ({
-        ...t,
-        fields: Object.fromEntries(t.fields.map((f) => [f.field_name, f.field_value]))
-      }))
-    }));
-  }
-  async getUsers() {
-    return await this.store.prisma.users.findMany({ include: { roles: true, sessions: true, groups: true } });
-  }
-  async getGroups() {
-    return await this.store.prisma.groups.findMany({ include: { roles: true } });
-  }
-  async getRoles() {
-    return await this.store.prisma.roles.findMany({});
-  }
-  async saveArchive() {
-    if (!this.store) throw new Error("Store not initialized");
-    const uriC = encodeURIComponent;
-    await fsp.mkdir(resolve8(this.archivePath, "recipes"), { recursive: true });
-    const recipes = await this.getRecipes();
-    for (const recipeInfo of recipes) {
-      const recipeFile = `recipes/${uriC(recipeInfo.recipe_name)}.json`;
-      await fsp.writeFile(resolve8(this.archivePath, recipeFile), JSON.stringify(recipeInfo, null, "	"));
-    }
-    await fsp.mkdir(resolve8(this.archivePath, "bags"), { recursive: true });
-    const bags = await this.getBags();
-    await Promise.all(bags.map(async (bagInfo) => {
-      const tiddlersFolder = `bags/${uriC(bagInfo.bag_name)}/tiddlers`;
-      await fsp.mkdir(resolve8(this.archivePath, tiddlersFolder), { recursive: true });
-      const bagFile = `bags/${uriC(bagInfo.bag_name)}/meta.json`;
-      await fsp.writeFile(resolve8(this.archivePath, bagFile), JSON.stringify({ ...bagInfo, tiddlers: void 0 }, null, "	"));
-      for (const tiddler of bagInfo.tiddlers) {
-        const tiddlerFile = `bags/${uriC(bagInfo.bag_name)}/tiddlers/${tiddler.tiddler_id}.json`;
-        await fsp.writeFile(resolve8(this.archivePath, tiddlerFile), JSON.stringify(tiddler, null, "	"));
-      }
-    }));
-    const users = await this.getUsers();
-    await fsp.writeFile(resolve8(this.archivePath, "users.json"), JSON.stringify(users, null, "	"));
-    const groups = await this.getGroups();
-    await fsp.writeFile(resolve8(this.archivePath, "groups.json"), JSON.stringify(groups, null, "	"));
-    const roles = await this.getRoles();
-    await fsp.writeFile(resolve8(this.archivePath, "roles.json"), JSON.stringify(roles, null, "	"));
-    await fsp.writeFile(resolve8(this.archivePath, "index.json"), JSON.stringify({
-      version: 2,
-      comment: "The version is an internal identifier for the archive format. It is not the same as the version of TiddlyWiki or MWS."
-    }, null, "	"));
+var fsp, info4, _Command4, Command4;
+var init_mws_save_archive = __esm({
+  "src/commands/mws-save-archive.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_TiddlerStore();
+    init_utils2();
+    fsp = createStrictAwaitProxy(_fsp);
+    info4 = {
+      name: "mws-save-archive",
+      synchronous: true
+    };
+    _Command4 = class _Command4 {
+      constructor(params, commander, callback) {
+        this.params = params;
+        this.commander = commander;
+        this.callback = callback;
+      }
+      get $tw() {
+        return this.commander.$tw;
+      }
+      get archivePath() {
+        return this.params[0];
+      }
+      async execute() {
+        if (this.params.length < 1) throw "Missing pathname";
+        await this.commander.$transaction(async (prisma) => {
+          this.store = new TiddlerStore(this.commander, prisma);
+          await this.saveArchive();
+          this.store = void 0;
+        });
+        console.log(info4.name, "complete:", this.params[0]);
+        return null;
+      }
+      async getRecipes() {
+        return await this.store.prisma.recipes.findMany({
+          include: { recipe_bags: true, acl: true }
+        });
+      }
+      async getBags() {
+        const bags = await this.store.prisma.bags.findMany({
+          include: { tiddlers: { include: { fields: true } }, acl: true }
+        });
+        return bags.map((e) => ({
+          ...e,
+          tiddlers: e.tiddlers.map((t) => ({
+            ...t,
+            fields: Object.fromEntries(t.fields.map((f) => [f.field_name, f.field_value]))
+          }))
+        }));
+      }
+      async getUsers() {
+        return await this.store.prisma.users.findMany({ include: { roles: true, sessions: true, groups: true } });
+      }
+      async getGroups() {
+        return await this.store.prisma.groups.findMany({ include: { roles: true } });
+      }
+      async getRoles() {
+        return await this.store.prisma.roles.findMany({});
+      }
+      async saveArchive() {
+        if (!this.store) throw new Error("Store not initialized");
+        const uriC = encodeURIComponent;
+        await fsp.mkdir(resolve8(this.archivePath, "recipes"), { recursive: true });
+        const recipes = await this.getRecipes();
+        for (const recipeInfo of recipes) {
+          const recipeFile = `recipes/${uriC(recipeInfo.recipe_name)}.json`;
+          await fsp.writeFile(resolve8(this.archivePath, recipeFile), JSON.stringify(recipeInfo, null, "	"));
+        }
+        await fsp.mkdir(resolve8(this.archivePath, "bags"), { recursive: true });
+        const bags = await this.getBags();
+        await Promise.all(bags.map(async (bagInfo) => {
+          const tiddlersFolder = `bags/${uriC(bagInfo.bag_name)}/tiddlers`;
+          await fsp.mkdir(resolve8(this.archivePath, tiddlersFolder), { recursive: true });
+          const bagFile = `bags/${uriC(bagInfo.bag_name)}/meta.json`;
+          await fsp.writeFile(resolve8(this.archivePath, bagFile), JSON.stringify({ ...bagInfo, tiddlers: void 0 }, null, "	"));
+          for (const tiddler of bagInfo.tiddlers) {
+            const tiddlerFile = `bags/${uriC(bagInfo.bag_name)}/tiddlers/${tiddler.tiddler_id}.json`;
+            await fsp.writeFile(resolve8(this.archivePath, tiddlerFile), JSON.stringify(tiddler, null, "	"));
+          }
+        }));
+        const users = await this.getUsers();
+        await fsp.writeFile(resolve8(this.archivePath, "users.json"), JSON.stringify(users, null, "	"));
+        const groups = await this.getGroups();
+        await fsp.writeFile(resolve8(this.archivePath, "groups.json"), JSON.stringify(groups, null, "	"));
+        const roles = await this.getRoles();
+        await fsp.writeFile(resolve8(this.archivePath, "roles.json"), JSON.stringify(roles, null, "	"));
+        await fsp.writeFile(resolve8(this.archivePath, "index.json"), JSON.stringify({
+          version: 2,
+          comment: "The version is an internal identifier for the archive format. It is not the same as the version of TiddlyWiki or MWS."
+        }, null, "	"));
+      }
+    };
+    __name(_Command4, "Command");
+    Command4 = _Command4;
   }
-};
-__name(_Command4, "Command");
-var Command4 = _Command4;
+});
 
 // src/commands/mws-load-archive.ts
 var mws_load_archive_exports = {};
@@ -15804,237 +15914,244 @@ __export(mws_load_archive_exports, {
   Command: () => Command5,
   info: () => info5
 });
-init_utils2();
-import { join, resolve as resolve9 } from "path";
+import { join as join2, resolve as resolve9 } from "path";
 import * as _fsp2 from "fs/promises";
 import { PrismaClientKnownRequestError } from "@prisma/client/runtime/library";
 import { existsSync as existsSync3 } from "fs";
-var fsp2 = createStrictAwaitProxy(_fsp2);
-var info5 = {
-  name: "mws-load-archive",
-  synchronous: true
-};
-var _Command5 = class _Command5 {
-  constructor(params, commander, callback) {
-    this.params = params;
-    this.commander = commander;
-    this.callback = callback;
-  }
-  async execute() {
-    if (this.params.length < 1) throw "Missing pathname";
-    const archivePath = this.params[0];
-    const index = existsSync3(resolve9(archivePath, "index.json")) ? JSON.parse(await fsp2.readFile(resolve9(archivePath, "index.json"), "utf8")) : { version: 1 };
-    switch (index.version) {
-      case 1:
-        await new Archiver1(this.commander).loadArchive(archivePath);
-        break;
-      case 2:
-        await new Archiver2(this.commander).loadArchive(archivePath);
-        break;
-      default:
-        throw new Error(`Unsupported archive version ${index.version}`);
-    }
-    this.commander.setupRequired = false;
-  }
-};
-__name(_Command5, "Command");
-var Command5 = _Command5;
-var _Archiver = class _Archiver {
-  constructor(commander) {
-    this.commander = commander;
-  }
-};
-__name(_Archiver, "Archiver");
-var Archiver = _Archiver;
-var _Archiver1 = class _Archiver1 extends Archiver {
-  async loadArchive(archivePath) {
-    await this.commander.$transaction(async (prisma) => {
-      const roles = JSON.parse(await fsp2.readFile(resolve9(archivePath, "roles", "roles.json"), "utf8"));
-      await prisma.roles.createMany({ data: roles });
-      const userFiles = await fsp2.readdir(resolve9(archivePath, "users"));
-      const users = await Promise.all(userFiles.map(async (userFile) => {
-        return JSON.parse(await fsp2.readFile(resolve9(archivePath, "users", userFile), "utf8"));
-      }));
-      await prisma.users.createMany({ data: users });
-      const bagNames = await fsp2.readdir(resolve9(archivePath, "bags"));
-      for (const bagFilename of bagNames) {
-        const stat = await fsp2.stat(resolve9(archivePath, "bags", bagFilename));
-        if (!stat.isDirectory()) continue;
-        console.log(`Reading bag ${decodeURIComponent(bagFilename)}`);
-        await this.restoreBag(resolve9(archivePath, "bags", bagFilename), prisma);
-      }
-      const recipeNames = await fsp2.readdir(resolve9(archivePath, "recipes"));
-      for (const recipeFilename of recipeNames) {
-        if (!recipeFilename.endsWith(".json")) continue;
-        console.log(`Reading recipe ${decodeURIComponent(recipeFilename)}`);
-        await this.restoreRecipe(resolve9(archivePath, "recipes", recipeFilename), prisma);
-      }
-    }).catch((e) => {
-      if (e instanceof PrismaClientKnownRequestError) {
-        console.log(e.code, e.meta, e.message);
-        throw e.message;
-      } else {
-        throw e;
+var fsp2, info5, _Command5, Command5, _Archiver, Archiver, _Archiver1, Archiver1, _Archiver2, Archiver2;
+var init_mws_load_archive = __esm({
+  "src/commands/mws-load-archive.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_utils2();
+    fsp2 = createStrictAwaitProxy(_fsp2);
+    info5 = {
+      name: "mws-load-archive",
+      synchronous: true
+    };
+    _Command5 = class _Command5 {
+      constructor(params, commander, callback) {
+        this.params = params;
+        this.commander = commander;
+        this.callback = callback;
+      }
+      async execute() {
+        if (this.params.length < 1) throw "Missing pathname";
+        const archivePath = this.params[0];
+        const index = existsSync3(resolve9(archivePath, "index.json")) ? JSON.parse(await fsp2.readFile(resolve9(archivePath, "index.json"), "utf8")) : { version: 1 };
+        switch (index.version) {
+          case 1:
+            await new Archiver1(this.commander).loadArchive(archivePath);
+            break;
+          case 2:
+            await new Archiver2(this.commander).loadArchive(archivePath);
+            break;
+          default:
+            throw new Error(`Unsupported archive version ${index.version}`);
+        }
+        this.commander.setupRequired = false;
       }
-    });
-  }
-  async restoreRecipe(file, prisma) {
-    const recipeInfo = JSON.parse(await fsp2.readFile(file, "utf8"));
-    await prisma.recipes.create({
-      data: {
-        recipe_id: recipeInfo.recipe_id,
-        recipe_name: recipeInfo.recipe_name,
-        description: recipeInfo.description,
-        owner_id: recipeInfo.owner_id,
-        acl: { createMany: { data: recipeInfo.acl } },
-        recipe_bags: {
-          createMany: {
-            data: recipeInfo.recipe_bags.map((e) => ({
-              bag_id: e.bag_id,
-              position: e.position,
-              with_acl: e.with_acl
-            }))
+    };
+    __name(_Command5, "Command");
+    Command5 = _Command5;
+    _Archiver = class _Archiver {
+      constructor(commander) {
+        this.commander = commander;
+      }
+    };
+    __name(_Archiver, "Archiver");
+    Archiver = _Archiver;
+    _Archiver1 = class _Archiver1 extends Archiver {
+      async loadArchive(archivePath) {
+        await this.commander.$transaction(async (prisma) => {
+          const roles = JSON.parse(await fsp2.readFile(resolve9(archivePath, "roles", "roles.json"), "utf8"));
+          await prisma.roles.createMany({ data: roles });
+          const userFiles = await fsp2.readdir(resolve9(archivePath, "users"));
+          const users = await Promise.all(userFiles.map(async (userFile) => {
+            return JSON.parse(await fsp2.readFile(resolve9(archivePath, "users", userFile), "utf8"));
+          }));
+          await prisma.users.createMany({ data: users });
+          const bagNames = await fsp2.readdir(resolve9(archivePath, "bags"));
+          for (const bagFilename of bagNames) {
+            const stat = await fsp2.stat(resolve9(archivePath, "bags", bagFilename));
+            if (!stat.isDirectory()) continue;
+            console.log(`Reading bag ${decodeURIComponent(bagFilename)}`);
+            await this.restoreBag(resolve9(archivePath, "bags", bagFilename), prisma);
           }
-        }
+          const recipeNames = await fsp2.readdir(resolve9(archivePath, "recipes"));
+          for (const recipeFilename of recipeNames) {
+            if (!recipeFilename.endsWith(".json")) continue;
+            console.log(`Reading recipe ${decodeURIComponent(recipeFilename)}`);
+            await this.restoreRecipe(resolve9(archivePath, "recipes", recipeFilename), prisma);
+          }
+        }).catch((e) => {
+          if (e instanceof PrismaClientKnownRequestError) {
+            console.log(e.code, e.meta, e.message);
+            throw e.message;
+          } else {
+            throw e;
+          }
+        });
       }
-    });
-  }
-  async restoreBag(folder, prisma) {
-    const bagInfo = JSON.parse(await fsp2.readFile(join(folder, "meta.json"), "utf8"));
-    await prisma.bags.create({
-      data: {
-        bag_id: bagInfo.bag_id,
-        bag_name: bagInfo.bag_name,
-        description: bagInfo.description,
-        owner_id: bagInfo.owner_id,
-        is_plugin: bagInfo.bag_name.startsWith("$:/"),
-        acl: { createMany: { data: bagInfo.acl } }
+      async restoreRecipe(file, prisma) {
+        const recipeInfo = JSON.parse(await fsp2.readFile(file, "utf8"));
+        await prisma.recipes.create({
+          data: {
+            recipe_id: recipeInfo.recipe_id,
+            recipe_name: recipeInfo.recipe_name,
+            description: recipeInfo.description,
+            owner_id: recipeInfo.owner_id,
+            acl: { createMany: { data: recipeInfo.acl } },
+            recipe_bags: {
+              createMany: {
+                data: recipeInfo.recipe_bags.map((e) => ({
+                  bag_id: e.bag_id,
+                  position: e.position,
+                  with_acl: e.with_acl
+                }))
+              }
+            }
+          }
+        });
       }
-    });
-    const tiddlerFiles = await fsp2.readdir(join(folder, "tiddlers"));
-    const tiddlers = await Promise.all(tiddlerFiles.map(async (tiddlerFilename) => {
-      if (!tiddlerFilename.endsWith(".json")) return;
-      const value = await fsp2.readFile(join(folder, "tiddlers", tiddlerFilename), "utf8");
-      return JSON.parse(value);
-    }));
-    await prisma.tiddlers.createMany({
-      data: tiddlers.flatMap((tiddler) => ({
-        bag_id: bagInfo.bag_id,
-        title: tiddler.title,
-        is_deleted: tiddler.is_deleted,
-        attachment_hash: tiddler.attachment_hash,
-        tiddler_id: tiddler.tiddler_id
-      }))
-    });
-    await prisma.fields.createMany({
-      data: tiddlers.flatMap(
-        ({ tiddler_id, fields }) => Object.entries(fields).map(
-          ([field_name, field_value]) => ({ tiddler_id, field_name, field_value })
-        )
-      )
-    });
-  }
-};
-__name(_Archiver1, "Archiver1");
-var Archiver1 = _Archiver1;
-var _Archiver2 = class _Archiver2 extends Archiver {
-  async loadArchive(archivePath) {
-    await this.commander.$transaction(async (prisma) => {
-      const roles = JSON.parse(await fsp2.readFile(resolve9(archivePath, "roles.json"), "utf8"));
-      await prisma.roles.createMany({ data: roles });
-      const users = JSON.parse(await fsp2.readFile(resolve9(archivePath, "users.json"), "utf8"));
-      await Promise.all(users.map((e) => prisma.users.create({
-        data: {
-          user_id: e.user_id,
-          email: e.email,
-          password: e.password,
-          username: e.username,
-          created_at: e.created_at,
-          last_login: e.last_login,
-          roles: { connect: e.roles.map((e2) => ({ role_id: e2.role_id })) }
-        }
-      })));
-      const bagNames = await fsp2.readdir(resolve9(archivePath, "bags"));
-      for (const bagFilename of bagNames) {
-        const stat = await fsp2.stat(resolve9(archivePath, "bags", bagFilename));
-        if (!stat.isDirectory()) continue;
-        console.log(`Reading bag ${decodeURIComponent(bagFilename)}`);
-        await this.restoreBag(resolve9(archivePath, "bags", bagFilename), prisma);
-      }
-      const recipeNames = await fsp2.readdir(resolve9(archivePath, "recipes"));
-      for (const recipeFilename of recipeNames) {
-        if (!recipeFilename.endsWith(".json")) continue;
-        console.log(`Reading recipe ${decodeURIComponent(recipeFilename)}`);
-        await this.restoreRecipe(resolve9(archivePath, "recipes", recipeFilename), prisma);
-      }
-    }).catch((e) => {
-      if (e instanceof PrismaClientKnownRequestError) {
-        console.log(e.code, e.meta, e.message);
-        throw e.message;
-      } else {
-        throw e;
+      async restoreBag(folder, prisma) {
+        const bagInfo = JSON.parse(await fsp2.readFile(join2(folder, "meta.json"), "utf8"));
+        await prisma.bags.create({
+          data: {
+            bag_id: bagInfo.bag_id,
+            bag_name: bagInfo.bag_name,
+            description: bagInfo.description,
+            owner_id: bagInfo.owner_id,
+            is_plugin: bagInfo.bag_name.startsWith("$:/"),
+            acl: { createMany: { data: bagInfo.acl } }
+          }
+        });
+        const tiddlerFiles = await fsp2.readdir(join2(folder, "tiddlers"));
+        const tiddlers = await Promise.all(tiddlerFiles.map(async (tiddlerFilename) => {
+          if (!tiddlerFilename.endsWith(".json")) return;
+          const value = await fsp2.readFile(join2(folder, "tiddlers", tiddlerFilename), "utf8");
+          return JSON.parse(value);
+        }));
+        await prisma.tiddlers.createMany({
+          data: tiddlers.flatMap((tiddler) => ({
+            bag_id: bagInfo.bag_id,
+            title: tiddler.title,
+            is_deleted: tiddler.is_deleted,
+            attachment_hash: tiddler.attachment_hash,
+            tiddler_id: tiddler.tiddler_id
+          }))
+        });
+        await prisma.fields.createMany({
+          data: tiddlers.flatMap(
+            ({ tiddler_id, fields }) => Object.entries(fields).map(
+              ([field_name, field_value]) => ({ tiddler_id, field_name, field_value })
+            )
+          )
+        });
       }
-    });
-  }
-  async restoreRecipe(file, prisma) {
-    const recipeInfo = JSON.parse(await fsp2.readFile(file, "utf8"));
-    await prisma.recipes.create({
-      data: {
-        recipe_id: recipeInfo.recipe_id,
-        recipe_name: recipeInfo.recipe_name,
-        description: recipeInfo.description,
-        owner_id: recipeInfo.owner_id,
-        acl: { createMany: { data: recipeInfo.acl } },
-        recipe_bags: {
-          createMany: {
-            data: recipeInfo.recipe_bags.map((e) => ({
-              bag_id: e.bag_id,
-              position: e.position,
-              with_acl: e.with_acl
-            }))
+    };
+    __name(_Archiver1, "Archiver1");
+    Archiver1 = _Archiver1;
+    _Archiver2 = class _Archiver2 extends Archiver {
+      async loadArchive(archivePath) {
+        await this.commander.$transaction(async (prisma) => {
+          const roles = JSON.parse(await fsp2.readFile(resolve9(archivePath, "roles.json"), "utf8"));
+          await prisma.roles.createMany({ data: roles });
+          const users = JSON.parse(await fsp2.readFile(resolve9(archivePath, "users.json"), "utf8"));
+          await Promise.all(users.map((e) => prisma.users.create({
+            data: {
+              user_id: e.user_id,
+              email: e.email,
+              password: e.password,
+              username: e.username,
+              created_at: e.created_at,
+              last_login: e.last_login,
+              roles: { connect: e.roles.map((e2) => ({ role_id: e2.role_id })) }
+            }
+          })));
+          const bagNames = await fsp2.readdir(resolve9(archivePath, "bags"));
+          for (const bagFilename of bagNames) {
+            const stat = await fsp2.stat(resolve9(archivePath, "bags", bagFilename));
+            if (!stat.isDirectory()) continue;
+            console.log(`Reading bag ${decodeURIComponent(bagFilename)}`);
+            await this.restoreBag(resolve9(archivePath, "bags", bagFilename), prisma);
           }
-        }
+          const recipeNames = await fsp2.readdir(resolve9(archivePath, "recipes"));
+          for (const recipeFilename of recipeNames) {
+            if (!recipeFilename.endsWith(".json")) continue;
+            console.log(`Reading recipe ${decodeURIComponent(recipeFilename)}`);
+            await this.restoreRecipe(resolve9(archivePath, "recipes", recipeFilename), prisma);
+          }
+        }).catch((e) => {
+          if (e instanceof PrismaClientKnownRequestError) {
+            console.log(e.code, e.meta, e.message);
+            throw e.message;
+          } else {
+            throw e;
+          }
+        });
       }
-    });
-  }
-  async restoreBag(folder, prisma) {
-    const bagInfo = JSON.parse(await fsp2.readFile(join(folder, "meta.json"), "utf8"));
-    await prisma.bags.create({
-      data: {
-        bag_id: bagInfo.bag_id,
-        bag_name: bagInfo.bag_name,
-        description: bagInfo.description,
-        owner_id: bagInfo.owner_id,
-        is_plugin: bagInfo.is_plugin,
-        acl: { createMany: { data: bagInfo.acl } }
+      async restoreRecipe(file, prisma) {
+        const recipeInfo = JSON.parse(await fsp2.readFile(file, "utf8"));
+        await prisma.recipes.create({
+          data: {
+            recipe_id: recipeInfo.recipe_id,
+            recipe_name: recipeInfo.recipe_name,
+            description: recipeInfo.description,
+            owner_id: recipeInfo.owner_id,
+            acl: { createMany: { data: recipeInfo.acl } },
+            recipe_bags: {
+              createMany: {
+                data: recipeInfo.recipe_bags.map((e) => ({
+                  bag_id: e.bag_id,
+                  position: e.position,
+                  with_acl: e.with_acl
+                }))
+              }
+            }
+          }
+        });
       }
-    });
-    const tiddlerFiles = await fsp2.readdir(join(folder, "tiddlers"));
-    const tiddlers = await Promise.all(tiddlerFiles.map(async (tiddlerFilename) => {
-      if (!tiddlerFilename.endsWith(".json")) return;
-      const value = await fsp2.readFile(join(folder, "tiddlers", tiddlerFilename), "utf8");
-      return JSON.parse(value);
-    }));
-    await prisma.tiddlers.createMany({
-      data: tiddlers.flatMap((tiddler) => ({
-        bag_id: bagInfo.bag_id,
-        title: tiddler.title,
-        is_deleted: tiddler.is_deleted,
-        attachment_hash: tiddler.attachment_hash,
-        tiddler_id: tiddler.tiddler_id
-      }))
-    });
-    await prisma.fields.createMany({
-      data: tiddlers.flatMap(
-        ({ tiddler_id, fields }) => Object.entries(fields).map(
-          ([field_name, field_value]) => ({ tiddler_id, field_name, field_value })
-        )
-      )
-    });
+      async restoreBag(folder, prisma) {
+        const bagInfo = JSON.parse(await fsp2.readFile(join2(folder, "meta.json"), "utf8"));
+        await prisma.bags.create({
+          data: {
+            bag_id: bagInfo.bag_id,
+            bag_name: bagInfo.bag_name,
+            description: bagInfo.description,
+            owner_id: bagInfo.owner_id,
+            is_plugin: bagInfo.is_plugin,
+            acl: { createMany: { data: bagInfo.acl } }
+          }
+        });
+        const tiddlerFiles = await fsp2.readdir(join2(folder, "tiddlers"));
+        const tiddlers = await Promise.all(tiddlerFiles.map(async (tiddlerFilename) => {
+          if (!tiddlerFilename.endsWith(".json")) return;
+          const value = await fsp2.readFile(join2(folder, "tiddlers", tiddlerFilename), "utf8");
+          return JSON.parse(value);
+        }));
+        await prisma.tiddlers.createMany({
+          data: tiddlers.flatMap((tiddler) => ({
+            bag_id: bagInfo.bag_id,
+            title: tiddler.title,
+            is_deleted: tiddler.is_deleted,
+            attachment_hash: tiddler.attachment_hash,
+            tiddler_id: tiddler.tiddler_id
+          }))
+        });
+        await prisma.fields.createMany({
+          data: tiddlers.flatMap(
+            ({ tiddler_id, fields }) => Object.entries(fields).map(
+              ([field_name, field_value]) => ({ tiddler_id, field_name, field_value })
+            )
+          )
+        });
+      }
+    };
+    __name(_Archiver2, "Archiver2");
+    Archiver2 = _Archiver2;
   }
-};
-__name(_Archiver2, "Archiver2");
-var Archiver2 = _Archiver2;
+});
 
 // src/commands/mws-init-store.ts
 var mws_init_store_exports = {};
@@ -16042,77 +16159,84 @@ __export(mws_init_store_exports, {
   Command: () => Command6,
   info: () => info6
 });
-init_utils2();
 import { resolve as resolve10 } from "node:path";
-var info6 = {
-  name: "mws-init-store",
-  synchronous: true
-};
-var _Command6 = class _Command6 {
-  constructor(params, commander, callback) {
-    this.params = params;
-    this.commander = commander;
-    this.callback = callback;
-  }
-  get $tw() {
-    return this.commander.$tw;
-  }
-  async execute() {
-    if (!this.commander.setupRequired) return;
-    await this.commander.$transaction(async (prisma) => {
-      const userCount = await prisma.users.count();
-      if (!userCount) {
-        await prisma.roles.createMany({
-          data: [
-            { role_id: 1, role_name: "ADMIN", description: "System Administrator" },
-            { role_id: 2, role_name: "USER", description: "Basic User" }
-          ]
-        });
-        const user = await prisma.users.create({
-          data: { username: "admin", email: "", password: "", roles: { connect: { role_id: 1 } } },
-          select: { user_id: true }
-        });
-        const password = await this.commander.PasswordService.PasswordCreation(user.user_id.toString(), "1234");
-        await prisma.users.update({
-          where: { user_id: user.user_id },
-          data: { password }
+var info6, _Command6, Command6;
+var init_mws_init_store = __esm({
+  "src/commands/mws-init-store.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_utils2();
+    info6 = {
+      name: "mws-init-store",
+      synchronous: true
+    };
+    _Command6 = class _Command6 {
+      constructor(params, commander, callback) {
+        this.params = params;
+        this.commander = commander;
+        this.callback = callback;
+      }
+      get $tw() {
+        return this.commander.$tw;
+      }
+      async execute() {
+        if (!this.commander.setupRequired) return;
+        await this.commander.$transaction(async (prisma) => {
+          const userCount = await prisma.users.count();
+          if (!userCount) {
+            await prisma.roles.createMany({
+              data: [
+                { role_id: 1, role_name: "ADMIN", description: "System Administrator" },
+                { role_id: 2, role_name: "USER", description: "Basic User" }
+              ]
+            });
+            const user = await prisma.users.create({
+              data: { username: "admin", email: "", password: "", roles: { connect: { role_id: 1 } } },
+              select: { user_id: true }
+            });
+            const password = await this.commander.PasswordService.PasswordCreation(user.user_id.toString(), "1234");
+            await prisma.users.update({
+              where: { user_id: user.user_id },
+              data: { password }
+            });
+          }
         });
+        const tweditions = resolve10(dist_require_resolve("tiddlywiki"), "../../editions");
+        this.commander.addCommandTokens([
+          "--mws-load-plugin-bags",
+          "--mws-load-wiki-folder",
+          dist_resolve("../editions/mws-docs"),
+          "mws-docs",
+          "MWS Documentation from https://mws.tiddlywiki.com",
+          "mws-docs",
+          "MWS Documentation from https://mws.tiddlywiki.com",
+          "--mws-load-wiki-folder",
+          resolve10(tweditions, "tw5.com"),
+          "docs",
+          "TiddlyWiki Documentation from https://tiddlywiki.com",
+          "docs",
+          "TiddlyWiki Documentation from https://tiddlywiki.com",
+          "--mws-load-wiki-folder",
+          resolve10(tweditions, "dev"),
+          "dev",
+          "TiddlyWiki Developer Documentation from https://tiddlywiki.com/dev",
+          "dev-docs",
+          "TiddlyWiki Developer Documentation from https://tiddlywiki.com/dev",
+          "--mws-load-wiki-folder",
+          resolve10(tweditions, "tour"),
+          "tour",
+          "TiddlyWiki Interactive Tour from https://tiddlywiki.com",
+          "tour",
+          "TiddlyWiki Interactive Tour from https://tiddlywiki.com",
+          "--divider"
+        ]);
+        this.commander.setupRequired = false;
       }
-    });
-    const tweditions = resolve10(dist_require_resolve("tiddlywiki"), "../../editions");
-    this.commander.addCommandTokens([
-      "--mws-load-plugin-bags",
-      "--mws-load-wiki-folder",
-      dist_resolve("../editions/mws-docs"),
-      "mws-docs",
-      "MWS Documentation from https://mws.tiddlywiki.com",
-      "mws-docs",
-      "MWS Documentation from https://mws.tiddlywiki.com",
-      "--mws-load-wiki-folder",
-      resolve10(tweditions, "tw5.com"),
-      "docs",
-      "TiddlyWiki Documentation from https://tiddlywiki.com",
-      "docs",
-      "TiddlyWiki Documentation from https://tiddlywiki.com",
-      "--mws-load-wiki-folder",
-      resolve10(tweditions, "dev"),
-      "dev",
-      "TiddlyWiki Developer Documentation from https://tiddlywiki.com/dev",
-      "dev-docs",
-      "TiddlyWiki Developer Documentation from https://tiddlywiki.com/dev",
-      "--mws-load-wiki-folder",
-      resolve10(tweditions, "tour"),
-      "tour",
-      "TiddlyWiki Interactive Tour from https://tiddlywiki.com",
-      "tour",
-      "TiddlyWiki Interactive Tour from https://tiddlywiki.com",
-      "--divider"
-    ]);
-    this.commander.setupRequired = false;
+    };
+    __name(_Command6, "Command");
+    Command6 = _Command6;
   }
-};
-__name(_Command6, "Command");
-var Command6 = _Command6;
+});
 
 // src/commands/mws-listen.ts
 var mws_listen_exports = {};
@@ -16123,113 +16247,118 @@ __export(mws_listen_exports, {
   ListenerHTTPS: () => ListenerHTTPS,
   info: () => info7
 });
-init_router();
-init_streamer();
 import { ok as ok6 } from "assert";
 import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
 import { createServer } from "http";
-import * as http22 from "node:http2";
-var _ListenerBase = class _ListenerBase {
-  constructor(server3, router, bindInfo) {
-    this.server = server3;
-    this.router = router;
-    this.bindInfo = bindInfo;
-    this.server.on("request", (req, res) => {
-      this.handleRequest(req, res);
-    });
-    this.server.on("error", (error) => {
-      if (error.syscall !== "listen") {
-        throw error;
+import * as http2 from "node:http2";
+var _ListenerBase, ListenerBase, _ListenerHTTPS, ListenerHTTPS, _ListenerHTTP, ListenerHTTP, info7, _Command7, Command7;
+var init_mws_listen = __esm({
+  "src/commands/mws-listen.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_router();
+    _ListenerBase = class _ListenerBase {
+      constructor(server3, router, bindInfo) {
+        this.server = server3;
+        this.router = router;
+        this.bindInfo = bindInfo;
+        this.server.on("request", (req, res) => {
+          this.handleRequest(req, res);
+        });
+        this.server.on("error", (error) => {
+          if (error.syscall !== "listen") {
+            throw error;
+          }
+          switch (error.code) {
+            case "EACCES":
+              console.error(bindInfo + " requires elevated privileges");
+              process.exit();
+              break;
+            case "EADDRINUSE":
+              console.error(bindInfo + " is already in use");
+              process.exit();
+              break;
+            default:
+              throw error;
+          }
+        });
+        this.server.on("listening", () => {
+          const address = this.server.address();
+          console.log(`Listening on`, address);
+        });
       }
-      switch (error.code) {
-        case "EACCES":
-          console.error(bindInfo + " requires elevated privileges");
-          process.exit();
-          break;
-        case "EADDRINUSE":
-          console.error(bindInfo + " is already in use");
-          process.exit();
-          break;
-        default:
-          throw error;
+      handleRequest(req, res) {
+        this.router.handleIncomingRequest(req, res);
       }
-    });
-    this.server.on("listening", () => {
-      const address = this.server.address();
-      console.log(`Listening on`, address);
-    });
-  }
-  handleRequest(req, res) {
-    const streamer = new Streamer(req, res, this.router);
-    this.router.handle(streamer).catch(streamer.catcher);
-  }
-};
-__name(_ListenerBase, "ListenerBase");
-var ListenerBase = _ListenerBase;
-var _ListenerHTTPS = class _ListenerHTTPS extends ListenerBase {
-  constructor(router, config) {
-    const { port, host } = config;
-    if (port && typeof port !== "number") throw new Error("If specified, port must be a number");
-    const bindInfo = host ? `HTTPS ${host} ${port}` : `HTTPS ${port}`;
-    ok6(config.key && existsSync4(config.key), "Key file not found");
-    ok6(config.cert && existsSync4(config.cert), "Cert file not found");
-    const key = readFileSync3(config.key);
-    const cert = readFileSync3(config.cert);
-    super(http22.createSecureServer({ key, cert, allowHTTP1: true }), router, bindInfo);
-    if (port) this.server.listen(port, host);
-  }
-};
-__name(_ListenerHTTPS, "ListenerHTTPS");
-var ListenerHTTPS = _ListenerHTTPS;
-var _ListenerHTTP = class _ListenerHTTP extends ListenerBase {
-  /** Create an http1 server */
-  constructor(router, config) {
-    const { port, host } = config;
-    if (port && typeof port !== "number") throw new Error("If specified, port must be a number");
-    const bindInfo = host ? `HTTP ${host} ${port}` : `HTTP ${port}`;
-    super(createServer(), router, bindInfo);
-    if (port) this.server.listen(port, host);
-  }
-};
-__name(_ListenerHTTP, "ListenerHTTP");
-var ListenerHTTP = _ListenerHTTP;
-var info7 = {
-  name: "mws-listen",
-  synchronous: true
-};
-var _Command7 = class _Command7 {
-  constructor(params, commander, listenConfig, onListenersCreated) {
-    this.params = params;
-    this.commander = commander;
-    if (this.params.length) throw `${info7.name}: No parameters allowed. Please put listener options in the config file.`;
-    this.execute = async () => {
-      this.commander.addCommandTokens([
-        "--mws-render-tiddlywiki5",
-        "--divider"
-      ]);
-      const router = await Router3.makeRouter(
-        this.commander,
-        this.commander.config.enableDevServer
-      ).catch((e) => {
-        console.log(e.stack);
-        throw "Router failed to load";
-      });
-      const listeners = listenConfig.map((e) => {
-        if (!e.key !== !e.cert) {
-          throw new Error("Both key and cert are required for HTTPS");
-        }
-        const listener = e.key && e.cert ? new ListenerHTTPS(router, e) : new ListenerHTTP(router, e);
-        return listener;
-      });
-      await onListenersCreated?.(listeners);
     };
+    __name(_ListenerBase, "ListenerBase");
+    ListenerBase = _ListenerBase;
+    _ListenerHTTPS = class _ListenerHTTPS extends ListenerBase {
+      constructor(router, config) {
+        const { port, host } = config;
+        if (port && typeof port !== "number") throw new Error("If specified, port must be a number");
+        const bindInfo = host ? `HTTPS ${host} ${port}` : `HTTPS ${port}`;
+        ok6(config.key && existsSync4(config.key), "Key file not found");
+        ok6(config.cert && existsSync4(config.cert), "Cert file not found");
+        const key = readFileSync3(config.key);
+        const cert = readFileSync3(config.cert);
+        super(http2.createSecureServer({ key, cert, allowHTTP1: true }), router, bindInfo);
+        if (port) this.server.listen(port, host);
+      }
+    };
+    __name(_ListenerHTTPS, "ListenerHTTPS");
+    ListenerHTTPS = _ListenerHTTPS;
+    _ListenerHTTP = class _ListenerHTTP extends ListenerBase {
+      /** Create an http1 server */
+      constructor(router, config) {
+        const { port, host } = config;
+        if (port && typeof port !== "number") throw new Error("If specified, port must be a number");
+        const bindInfo = host ? `HTTP ${host} ${port}` : `HTTP ${port}`;
+        super(createServer(), router, bindInfo);
+        if (port) this.server.listen(port, host);
+      }
+    };
+    __name(_ListenerHTTP, "ListenerHTTP");
+    ListenerHTTP = _ListenerHTTP;
+    info7 = {
+      name: "mws-listen",
+      synchronous: true
+    };
+    _Command7 = class _Command7 {
+      constructor(params, commander, listenConfig, onListenersCreated) {
+        this.params = params;
+        this.commander = commander;
+        if (this.params.length) throw `${info7.name}: No parameters allowed. Please put listener options in the config file.`;
+        this.execute = async () => {
+          this.commander.addCommandTokens([
+            "--mws-render-tiddlywiki5",
+            "--divider"
+          ]);
+          const router = await Router2.makeRouter(
+            this.commander,
+            this.commander.config.enableDevServer ?? false
+          ).catch((e) => {
+            console.log(e.stack);
+            throw "Router failed to load";
+          });
+          const listeners = listenConfig.map((e) => {
+            if (!e.key !== !e.cert) {
+              throw new Error("Both key and cert are required for HTTPS");
+            }
+            const listener = e.key && e.cert ? new ListenerHTTPS(router, e) : new ListenerHTTP(router, e);
+            return listener;
+          });
+          await onListenersCreated?.(listeners);
+        };
+      }
+      get $tw() {
+        return this.commander.$tw;
+      }
+    };
+    __name(_Command7, "Command");
+    Command7 = _Command7;
   }
-  get $tw() {
-    return this.commander.$tw;
-  }
-};
-__name(_Command7, "Command");
-var Command7 = _Command7;
+});
 
 // src/commands/divider.ts
 var divider_exports = {};
@@ -16237,21 +16366,28 @@ __export(divider_exports, {
   Command: () => Command8,
   info: () => info8
 });
-var info8 = {
-  name: "divider",
-  synchronous: true
-};
-var _Command8 = class _Command8 {
-  constructor(params, commander) {
-    this.params = params;
-    this.commander = commander;
-    if (this.params.length) throw `${info8.name}: No parameters allowed. This is a no-op command.`;
-  }
-  execute() {
+var info8, _Command8, Command8;
+var init_divider = __esm({
+  "src/commands/divider.ts"() {
+    "use strict";
+    init_esm_shims();
+    info8 = {
+      name: "divider",
+      synchronous: true
+    };
+    _Command8 = class _Command8 {
+      constructor(params, commander) {
+        this.params = params;
+        this.commander = commander;
+        if (this.params.length) throw `${info8.name}: No parameters allowed. This is a no-op command.`;
+      }
+      execute() {
+      }
+    };
+    __name(_Command8, "Command");
+    Command8 = _Command8;
   }
-};
-__name(_Command8, "Command");
-var Command8 = _Command8;
+});
 
 // src/commands/tests-complete.ts
 var tests_complete_exports = {};
@@ -16259,264 +16395,461 @@ __export(tests_complete_exports, {
   Command: () => Command9,
   info: () => info9
 });
-var info9 = {
-  name: "tests-complete",
-  synchronous: true
-};
-var _Command9 = class _Command9 {
-  constructor(params, commander) {
-    this.params = params;
-    this.commander = commander;
+var info9, _Command9, Command9;
+var init_tests_complete = __esm({
+  "src/commands/tests-complete.ts"() {
+    "use strict";
+    init_esm_shims();
+    info9 = {
+      name: "tests-complete",
+      synchronous: true
+    };
+    _Command9 = class _Command9 {
+      constructor(params, commander) {
+        this.params = params;
+        this.commander = commander;
+      }
+      execute() {
+        console.log("Tests completed successfully.");
+        process.exit(0);
+      }
+    };
+    __name(_Command9, "Command");
+    Command9 = _Command9;
   }
-  execute() {
-    console.log("Tests completed successfully.");
-    process.exit(0);
+});
+
+// src/commands/mws-client-build.ts
+var mws_client_build_exports = {};
+__export(mws_client_build_exports, {
+  Command: () => Command10,
+  info: () => info10
+});
+var info10, _Command10, Command10;
+var init_mws_client_build = __esm({
+  "src/commands/mws-client-build.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_setupDevServer();
+    info10 = {
+      name: "mws-client-build",
+      synchronous: true
+    };
+    _Command10 = class _Command10 {
+      constructor(params, commander) {
+        this.params = params;
+        this.commander = commander;
+        if (this.params.length) throw `${info10.name}: No parameters allowed. This is a no-op command.`;
+      }
+      async execute() {
+        if (!this.commander.config.enableDevServer) throw "Dev server is not enabled. Please set enableDevServer to true in the config file.";
+        const { ctx, port, rootdir } = await esbuildStartup();
+        ctx.dispose();
+      }
+    };
+    __name(_Command10, "Command");
+    Command10 = _Command10;
   }
-};
-__name(_Command9, "Command");
-var Command9 = _Command9;
+});
 
 // src/commands/index.ts
-var commands = {
-  [info.name]: mws_load_plugin_bags_exports,
-  [info2.name]: mws_render_tiddlywiki5_exports,
-  [info3.name]: mws_load_wiki_folder_exports,
-  [info4.name]: mws_save_archive_exports,
-  [info5.name]: mws_load_archive_exports,
-  [info6.name]: mws_init_store_exports,
-  [info7.name]: mws_listen_exports,
-  [info8.name]: divider_exports,
-  [info9.name]: tests_complete_exports
-};
-
-// src/commander.ts
-var _StartupCommander = class _StartupCommander {
-  constructor(config, $tw2, PasswordService) {
-    this.config = config;
-    this.$tw = $tw2;
-    this.PasswordService = PasswordService;
-    /** Signals that database setup is required. May be set to false by any qualified setup command. */
-    this.setupRequired = true;
-    this.wikiPath = config.wikiPath;
-    this.storePath = path4.resolve(this.wikiPath, "store");
-    this.databasePath = path4.resolve(this.storePath, "database.sqlite");
-    this.outputPath = path4.resolve($tw2.boot.wikiPath, $tw2.config.wikiOutputSubDir);
-    this.cachePath = path4.resolve(this.wikiPath, "cache");
-    if (!existsSync5(this.storePath)) {
-      mkdirSync2(this.storePath, { recursive: true });
-      this.setupRequired = true;
-    }
-    this.libsql = createClient({ url: "file:" + this.databasePath });
-    this.engine = new PrismaClient2({
-      log: ["info", "warn"],
-      adapter: new PrismaLibSQL(this.libsql)
-      // datasourceUrl: "file:" + this.databasePath
-    });
-    this.siteConfig = {
-      wikiPath: this.wikiPath,
-      allowAnonReads: !!config.config?.allowAnonReads,
-      allowAnonWrites: !!config.config?.allowAnonWrites,
-      allowUnreadableBags: !!config.config?.allowUnreadableBags,
-      attachmentsEnabled: !!config.config?.saveLargeTextToFileSystem,
-      attachmentSizeLimit: config.config?.saveLargeTextToFileSystem ?? 0,
-      enableBrowserCache: !!config.config?.enableBrowserCache,
-      enableGzip: !!config.config?.enableGzip,
-      contentTypeInfo: $tw2.config.contentTypeInfo,
-      storePath: this.storePath,
-      saveLargeTextToFileSystem: void 0
+var commands;
+var init_commands = __esm({
+  "src/commands/index.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_mws_load_plugin_bags();
+    init_mws_render_tiddlywiki5();
+    init_mws_load_wiki_folder();
+    init_mws_save_archive();
+    init_mws_load_archive();
+    init_mws_init_store();
+    init_mws_listen();
+    init_divider();
+    init_tests_complete();
+    init_mws_client_build();
+    commands = {
+      [info.name]: mws_load_plugin_bags_exports,
+      [info2.name]: mws_render_tiddlywiki5_exports,
+      [info3.name]: mws_load_wiki_folder_exports,
+      [info4.name]: mws_save_archive_exports,
+      [info5.name]: mws_load_archive_exports,
+      [info6.name]: mws_init_store_exports,
+      [info7.name]: mws_listen_exports,
+      [info8.name]: divider_exports,
+      [info9.name]: tests_complete_exports,
+      [info10.name]: mws_client_build_exports
     };
-    this.SessionManager = config.SessionManager || SessionManager;
-    this.AttachmentService = config.AttachmentService || AttachmentService;
-  }
-  async init() {
-    this.setupRequired = false;
-    if (process.env.RUN_OLD_MWS_DB_SETUP_FOR_TESTING) {
-      await this.libsql.executeMultiple(readFileSync4(dist_resolve(
-        "../prisma/migrations/20250406213424_init/migration.sql"
-      ), "utf8"));
-    }
-    const tables = await this.libsql.batch([{
-      sql: `SELECT tbl_name FROM sqlite_master WHERE type='table'`,
-      args: []
-    }]).then((e) => e[0]?.rows);
-    const hasExisting = !!tables?.length;
-    const hasMigrationsTable = !!tables?.length && !!tables?.some((e) => e.tbl_name === "_prisma_migrations");
-    if (!hasMigrationsTable) await this.createMigrationsTable();
-    await this.checkMigrationsTable(hasExisting && !hasMigrationsTable);
-    const users = await this.engine.users.count();
-    if (!users) {
-      this.setupRequired = true;
-    }
   }
-  async createMigrationsTable() {
-    await this.libsql.execute({
-      sql: 'CREATE TABLE "_prisma_migrations" (\n    "id"                    TEXT PRIMARY KEY NOT NULL,\n    "checksum"              TEXT NOT NULL,\n    "finished_at"           DATETIME,\n    "migration_name"        TEXT NOT NULL,\n    "logs"                  TEXT,\n    "rolled_back_at"        DATETIME,\n    "started_at"            DATETIME NOT NULL DEFAULT current_timestamp,\n    "applied_steps_count"   INTEGER UNSIGNED NOT NULL DEFAULT 0\n)',
-      args: []
-    });
-  }
-  async checkMigrationsTable(migrateExisting) {
-    const applied_migrations = new Set(
-      await this.libsql.batch([{
-        sql: `Select migration_name from _prisma_migrations`,
-        args: []
-      }]).then((e) => e[0]?.rows.map((e2) => e2.migration_name))
-    );
-    const migrations = await readdir(dist_resolve("../prisma/migrations"));
-    migrations.sort();
-    const new_migrations = migrations.filter((m) => !applied_migrations.has(m) && m !== "migration_lock.toml");
-    if (!new_migrations.length) return;
-    function generateChecksum(fileContent) {
-      return createHash3("sha256").update(fileContent).digest("hex");
-    }
-    __name(generateChecksum, "generateChecksum");
-    console.log("New migrations found", new_migrations);
-    for (const migration of new_migrations) {
-      const migration_path = dist_resolve(`../prisma/migrations/${migration}/migration.sql`);
-      if (!existsSync5(migration_path)) continue;
-      const fileContent = await readFile(migration_path, "utf-8");
-      if (migrateExisting && migration === "20250406213424_init") {
-        console.log("Existing migration", migration, "is already applied");
-      } else {
-        console.log("Applying migration", migration);
-        await this.libsql.executeMultiple(fileContent);
+});
+
+// src/db/sqlite-adapter.ts
+import { PrismaBetterSQLite3 } from "@prisma/adapter-better-sqlite3";
+import { readdir, readFile as readFile2 } from "fs/promises";
+import { createHash as createHash5, randomUUID } from "crypto";
+import { existsSync as existsSync5 } from "fs";
+var _SqliteAdapter, SqliteAdapter;
+var init_sqlite_adapter = __esm({
+  "src/db/sqlite-adapter.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_utils2();
+    _SqliteAdapter = class _SqliteAdapter {
+      constructor(databasePath) {
+        this.databasePath = databasePath;
+        this.setupRequired = true;
+        this.adapter = new PrismaBetterSQLite3({ url: "file:" + this.databasePath });
+      }
+      async init() {
+        this.setupRequired = false;
+        const libsql = await this.adapter.connect();
+        if (process.env.RUN_OLD_MWS_DB_SETUP_FOR_TESTING) {
+          await libsql.executeScript(await readFile2(dist_resolve(
+            "../prisma/migrations/20250406213424_init/migration.sql"
+          ), "utf8"));
+        }
+        const tables = await libsql.queryRaw({
+          sql: `SELECT tbl_name FROM sqlite_master WHERE type='table'`,
+          args: [],
+          argTypes: []
+        }).then((e) => e?.rows);
+        const hasExisting = !!tables?.length;
+        const hasMigrationsTable = !!tables?.length && !!tables?.some((e) => e[0] === "_prisma_migrations");
+        if (!hasMigrationsTable) await this.createMigrationsTable(libsql);
+        await this.checkMigrationsTable(libsql, hasExisting && !hasMigrationsTable);
+        await libsql.dispose();
+      }
+      async createMigrationsTable(libsql) {
+        await libsql.executeScript(
+          'CREATE TABLE "_prisma_migrations" (\n    "id"                    TEXT PRIMARY KEY NOT NULL,\n    "checksum"              TEXT NOT NULL,\n    "finished_at"           DATETIME,\n    "migration_name"        TEXT NOT NULL,\n    "logs"                  TEXT,\n    "rolled_back_at"        DATETIME,\n    "started_at"            DATETIME NOT NULL DEFAULT current_timestamp,\n    "applied_steps_count"   INTEGER UNSIGNED NOT NULL DEFAULT 0\n)'
+        );
+      }
+      async checkMigrationsTable(libsql, migrateExisting) {
+        const applied_migrations = new Set(
+          await libsql.queryRaw({
+            sql: `Select migration_name from _prisma_migrations`,
+            args: [],
+            argTypes: []
+          }).then((e) => e.rows.map((e2) => e2[0]))
+        );
+        const migrations = await readdir(dist_resolve("../prisma/migrations"));
+        migrations.sort();
+        const new_migrations = migrations.filter((m) => !applied_migrations.has(m) && m !== "migration_lock.toml");
+        if (!new_migrations.length) return;
+        function generateChecksum(fileContent) {
+          return createHash5("sha256").update(fileContent).digest("hex");
+        }
+        __name(generateChecksum, "generateChecksum");
+        console.log("New migrations found", new_migrations);
+        for (const migration of new_migrations) {
+          const migration_path = dist_resolve(`../prisma/migrations/${migration}/migration.sql`);
+          if (!existsSync5(migration_path)) continue;
+          const fileContent = await readFile2(migration_path, "utf-8");
+          if (migrateExisting && migration === "20250406213424_init") {
+            console.log("Existing migration", migration, "is already applied");
+          } else {
+            console.log("Applying migration", migration);
+            await libsql.executeScript(fileContent);
+          }
+          await libsql.executeRaw({
+            sql: "INSERT INTO _prisma_migrations (id, migration_name, checksum, finished_at, logs, rolled_back_at, started_at, applied_steps_count) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
+            args: [randomUUID(), migration, generateChecksum(fileContent), Date.now(), null, null, Date.now(), 1],
+            argTypes: []
+            // this doesn't appear to be used at the moment
+          });
+        }
+        console.log("Migrations applied", new_migrations);
       }
-      await this.libsql.execute({
-        sql: "INSERT INTO _prisma_migrations (id, migration_name, checksum, finished_at, logs, rolled_back_at, started_at, applied_steps_count) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
-        args: [randomUUID(), migration, generateChecksum(fileContent), Date.now(), null, null, Date.now(), 1]
-      });
-    }
-    console.log("Migrations applied", new_migrations);
-  }
-  $transaction(fn, options) {
-    return this.engine.$transaction(fn, options);
-  }
-};
-__name(_StartupCommander, "StartupCommander");
-var StartupCommander = _StartupCommander;
-var _Commander = class _Commander extends StartupCommander {
-  constructor(config, $tw2, PasswordService) {
-    super(config, $tw2, PasswordService);
-    this.nextToken = 0;
-    this.verbose = false;
-    const { listeners, onListenersCreated } = config;
-    config.listeners = [];
-    config.onListenersCreated = void 0;
-    this.create_mws_listen = (params) => {
-      return new mws_listen_exports.Command(params, this, listeners, onListenersCreated);
     };
+    __name(_SqliteAdapter, "SqliteAdapter");
+    SqliteAdapter = _SqliteAdapter;
   }
-  static initCommands(moduleType) {
-    if (moduleType) throw new Error("moduleType is not implemented");
-  }
-  /*
-  Add a string of tokens to the command queue
-  */
-  addCommandTokens(params) {
-    if (this.verbose) console.log("Commander addCommandTokens", params);
-    this.commandTokens.splice(this.nextToken, 0, ...params);
-  }
-  /*
-  Execute the sequence of commands and invoke a callback on completion
-  */
-  execute(commandTokens) {
-    console.log("Commander", commandTokens);
-    this.commandTokens = commandTokens;
-    this.promise = new Promise((resolve13, reject) => {
-      this.callback = (err) => {
-        if (err) this.$tw.utils.error("Error: " + err);
-        err ? reject(err) : resolve13();
-      };
-    });
-    this.executeNextCommand();
-    return this.promise;
-  }
-  /*
-  Execute the next command in the sequence
-  */
-  executeNextCommand() {
-    if (this.nextToken >= this.commandTokens.length) {
-      this.callback(null);
-      return;
-    }
-    let commandName = this.commandTokens[this.nextToken++];
-    if (commandName.slice(0, 2) !== "--") {
-      console.log(this.commandTokens);
-      this.callback("Missing command: " + commandName);
-      return;
-    }
-    commandName = commandName.slice(2);
-    var command = commands[commandName], c, err;
-    if (!command) {
-      this.callback("Unknown command: " + commandName);
-      return;
-    }
-    const nextCommand = this.commandTokens.findIndex((token, i) => i >= this.nextToken && token.startsWith("--"));
-    const params = this.commandTokens.slice(this.nextToken, nextCommand === -1 ? void 0 : nextCommand);
-    this.nextToken = nextCommand === -1 ? this.commandTokens.length : nextCommand;
-    if (commandName !== divider_exports.info.name)
-      console.log("Commander executing", commandName, params);
-    const paramsIfMandetory = !command.info.mandatoryParameters ? params : this.extractNamedParameters(params, command.info.mandatoryParameters);
-    if (typeof params === "string") {
-      this.callback(params);
-      return;
-    }
-    new Promise(async (resolve13) => {
-      const { Command: Command10, info: info10 } = command;
-      try {
-        c = info10.name === "mws-listen" ? this.create_mws_listen(paramsIfMandetory) : new Command10(paramsIfMandetory, this, info10.synchronous ? void 0 : resolve13);
-        err = await c.execute();
-        if (err || info10.synchronous) resolve13(err);
-      } catch (e) {
-        resolve13(e);
+});
+
+// src/commander.ts
+import * as path4 from "node:path";
+import { PrismaClient as PrismaClient2 } from "@prisma/client";
+import { existsSync as existsSync6, mkdirSync as mkdirSync2 } from "node:fs";
+import { ok as ok7 } from "node:assert";
+var _StartupCommander, StartupCommander, _Commander, Commander;
+var init_commander = __esm({
+  "src/commander.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_sessions();
+    init_attachments();
+    init_commands();
+    init_sqlite_adapter();
+    _StartupCommander = class _StartupCommander {
+      constructor(config, $tw2, PasswordService) {
+        this.config = config;
+        this.$tw = $tw2;
+        this.PasswordService = PasswordService;
+        if (config.config?.pathPrefix) {
+          ok7(config.config.pathPrefix.startsWith("/"), "pathPrefix must start with a slash");
+          ok7(!config.config.pathPrefix.endsWith("/"), "pathPrefix must not end with a slash");
+        }
+        this.wikiPath = config.wikiPath;
+        this.storePath = path4.resolve(this.wikiPath, "store");
+        this.databasePath = path4.resolve(this.storePath, "database.sqlite");
+        this.outputPath = path4.resolve($tw2.boot.wikiPath, $tw2.config.wikiOutputSubDir);
+        this.cachePath = path4.resolve(this.wikiPath, "cache");
+        if (!existsSync6(this.storePath)) {
+          mkdirSync2(this.storePath, { recursive: true });
+          this.setupRequired = true;
+        }
+        this.siteConfig = {
+          wikiPath: this.wikiPath,
+          allowAnonReads: !!config.config?.allowAnonReads,
+          allowAnonWrites: !!config.config?.allowAnonWrites,
+          allowUnreadableBags: !!config.config?.allowUnreadableBags,
+          attachmentsEnabled: !!config.config?.saveLargeTextToFileSystem,
+          attachmentSizeLimit: config.config?.saveLargeTextToFileSystem ?? 0,
+          enableBrowserCache: !!config.config?.enableBrowserCache,
+          enableGzip: !!config.config?.enableGzip,
+          contentTypeInfo: $tw2.config.contentTypeInfo,
+          storePath: this.storePath,
+          pathPrefix: config.config?.pathPrefix ?? "",
+          saveLargeTextToFileSystem: void 0
+        };
+        this.SessionManager = config.SessionManager || SessionManager;
+        this.AttachmentService = config.AttachmentService || AttachmentService;
+        this.adapter = new SqliteAdapter(this.databasePath);
+        this.engine = new PrismaClient2({ log: ["info", "warn"], adapter: this.adapter.adapter });
+      }
+      async init() {
+        await this.adapter.init();
+        const users = await this.engine.users.count();
+        if (!users) {
+          this.setupRequired = true;
+        }
       }
-    }).then((err2) => {
-      if (err2) {
-        console.log(err2);
-        this.callback(err2);
-      } else {
+      $transaction(fn, options) {
+        return this.engine.$transaction(fn, options);
+      }
+      /** Signals that database setup is required. May be set to false by any qualified setup command. */
+      get setupRequired() {
+        return this.adapter.setupRequired;
+      }
+      set setupRequired(v) {
+        this.adapter.setupRequired = v;
+      }
+    };
+    __name(_StartupCommander, "StartupCommander");
+    StartupCommander = _StartupCommander;
+    _Commander = class _Commander extends StartupCommander {
+      constructor(config, $tw2, PasswordService) {
+        super(config, $tw2, PasswordService);
+        this.nextToken = 0;
+        this.verbose = false;
+        const { listeners, onListenersCreated } = config;
+        config.listeners = [];
+        config.onListenersCreated = void 0;
+        this.create_mws_listen = (params) => {
+          return new mws_listen_exports.Command(params, this, listeners, onListenersCreated);
+        };
+      }
+      static initCommands(moduleType) {
+        if (moduleType) throw new Error("moduleType is not implemented");
+      }
+      /*
+      Add a string of tokens to the command queue
+      */
+      addCommandTokens(params) {
+        if (this.verbose) console.log("Commander addCommandTokens", params);
+        this.commandTokens.splice(this.nextToken, 0, ...params);
+      }
+      /*
+      Execute the sequence of commands and invoke a callback on completion
+      */
+      execute(commandTokens) {
+        console.log("Commander", commandTokens);
+        this.commandTokens = commandTokens;
+        this.promise = new Promise((resolve13, reject) => {
+          this.callback = (err) => {
+            if (err) this.$tw.utils.error("Error: " + err);
+            err ? reject(err) : resolve13();
+          };
+        });
         this.executeNextCommand();
+        return this.promise;
       }
-    });
+      /*
+      Execute the next command in the sequence
+      */
+      executeNextCommand() {
+        if (this.nextToken >= this.commandTokens.length) {
+          this.callback(null);
+          return;
+        }
+        let commandName = this.commandTokens[this.nextToken++];
+        if (commandName.slice(0, 2) !== "--") {
+          console.log(this.commandTokens);
+          this.callback("Missing command: " + commandName);
+          return;
+        }
+        commandName = commandName.slice(2);
+        var command = commands[commandName], c, err;
+        if (!command) {
+          this.callback("Unknown command: " + commandName);
+          return;
+        }
+        const nextCommand = this.commandTokens.findIndex((token, i) => i >= this.nextToken && token.startsWith("--"));
+        const params = this.commandTokens.slice(this.nextToken, nextCommand === -1 ? void 0 : nextCommand);
+        this.nextToken = nextCommand === -1 ? this.commandTokens.length : nextCommand;
+        if (commandName !== divider_exports.info.name)
+          console.log("Commander executing", commandName, params);
+        const paramsIfMandetory = !command.info.mandatoryParameters ? params : this.extractNamedParameters(params, command.info.mandatoryParameters);
+        if (typeof params === "string") {
+          this.callback(params);
+          return;
+        }
+        new Promise(async (resolve13) => {
+          const { Command: Command11, info: info11 } = command;
+          try {
+            c = info11.name === "mws-listen" ? this.create_mws_listen(paramsIfMandetory) : new Command11(paramsIfMandetory, this, info11.synchronous ? void 0 : resolve13);
+            err = await c.execute();
+            if (err || info11.synchronous) resolve13(err);
+          } catch (e) {
+            resolve13(e);
+          }
+        }).then((err2) => {
+          if (err2) {
+            console.log(err2);
+            this.callback(err2);
+          } else {
+            this.executeNextCommand();
+          }
+        });
+      }
+      /*
+      Given an array of parameter strings `params` in name=value format, and an array of mandatory parameter names in `mandatoryParameters`, returns a hashmap of values or a string if error
+      */
+      extractNamedParameters(params, mandatoryParameters) {
+        mandatoryParameters = mandatoryParameters || [];
+        var errors = [], paramsByName = /* @__PURE__ */ Object.create(null);
+        each(params, function(param) {
+          var index = param.indexOf("=");
+          if (index < 1) {
+            errors.push("malformed named parameter: '" + param + "'");
+          }
+          paramsByName[param.slice(0, index)] = param.slice(index + 1).trim();
+        });
+        each(mandatoryParameters, function(mandatoryParameter) {
+          if (!hop(paramsByName, mandatoryParameter)) {
+            errors.push("missing mandatory parameter: '" + mandatoryParameter + "'");
+          }
+        });
+        if (errors.length > 0) {
+          return errors.join(" and\n");
+        } else {
+          return paramsByName;
+        }
+      }
+    };
+    __name(_Commander, "Commander");
+    Commander = _Commander;
   }
-  /*
-  Given an array of parameter strings `params` in name=value format, and an array of mandatory parameter names in `mandatoryParameters`, returns a hashmap of values or a string if error
-  */
-  extractNamedParameters(params, mandatoryParameters) {
-    mandatoryParameters = mandatoryParameters || [];
-    var errors = [], paramsByName = /* @__PURE__ */ Object.create(null);
-    each(params, function(param) {
-      var index = param.indexOf("=");
-      if (index < 1) {
-        errors.push("malformed named parameter: '" + param + "'");
-      }
-      paramsByName[param.slice(0, index)] = param.slice(index + 1).trim();
+});
+
+// src/services/PasswordService.ts
+import * as opaque from "@serenity-kit/opaque";
+import { randomBytes as randomBytes2 } from "node:crypto";
+async function createPasswordService(serverSetup) {
+  await opaque.ready;
+  const serverState = /* @__PURE__ */ new Map();
+  const LoginGenerator = TypedGenerator.wrapper()(async function* ({
+    user_id,
+    startLoginRequest,
+    registrationRecord
+  }) {
+    const { asV, asY } = TypedGenerator.checker();
+    const { serverLoginState, loginResponse } = opaque.server.startLogin({
+      serverSetup,
+      userIdentifier: user_id.toString(),
+      registrationRecord,
+      startLoginRequest
     });
-    each(mandatoryParameters, function(mandatoryParameter) {
-      if (!hop(paramsByName, mandatoryParameter)) {
-        errors.push("missing mandatory parameter: '" + mandatoryParameter + "'");
-      }
+    const timestamp = Date.now();
+    const finishLoginRequest = asV(1, yield asY(0, loginResponse));
+    if (timestamp + 1e3 * 60 * 5 < Date.now()) return;
+    return asY(1, {
+      session: opaque.server.finishLogin({
+        finishLoginRequest,
+        serverLoginState
+      }),
+      user_id
     });
-    if (errors.length > 0) {
-      return errors.join(" and\n");
-    } else {
-      return paramsByName;
-    }
+  });
+  async function PasswordCreation(userID, password) {
+    const { clientRegistrationState, registrationRequest } = opaque.client.startRegistration({ password });
+    const userIdentifier = userID;
+    const { registrationResponse } = opaque.server.createRegistrationResponse({
+      serverSetup,
+      userIdentifier,
+      registrationRequest
+    });
+    const { registrationRecord } = opaque.client.finishRegistration({
+      clientRegistrationState,
+      registrationResponse,
+      password
+    });
+    return registrationRecord;
   }
-};
-__name(_Commander, "Commander");
-var Commander = _Commander;
+  __name(PasswordCreation, "PasswordCreation");
+  async function createRegistrationResponse({ userID, registrationRequest }) {
+    const { registrationResponse } = opaque.server.createRegistrationResponse({
+      serverSetup,
+      userIdentifier: userID.toString(),
+      registrationRequest
+    });
+    return registrationResponse;
+  }
+  __name(createRegistrationResponse, "createRegistrationResponse");
+  async function startLoginSession(stater) {
+    let loginSession;
+    do {
+      loginSession = randomBytes2(16).toString("base64url");
+    } while (serverState.has(loginSession));
+    serverState.set(loginSession, stater);
+    return loginSession;
+  }
+  __name(startLoginSession, "startLoginSession");
+  async function finishLoginSession(loginSession) {
+    const stater = serverState.get(loginSession);
+    if (stater) serverState.delete(loginSession);
+    return stater;
+  }
+  __name(finishLoginSession, "finishLoginSession");
+  return {
+    serverState,
+    LoginGenerator,
+    PasswordCreation,
+    createRegistrationResponse,
+    startLoginSession,
+    finishLoginSession
+  };
+}
+var init_PasswordService = __esm({
+  "src/services/PasswordService.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_utils2();
+    __name(createPasswordService, "createPasswordService");
+  }
+});
 
 // src/server.ts
-init_PasswordService();
-init_sessions();
+import * as opaque2 from "@serenity-kit/opaque";
+import { existsSync as existsSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
 import { resolve as resolve12 } from "node:path";
 async function startServer(config) {
   await opaque2.ready;
   if (!["string", "number"].includes(typeof config.passwordMasterKeyFile)) {
     throw new Error("passwordMasterKeyFile must be a string or number");
   }
-  if (typeof config.passwordMasterKeyFile === "string" && config.passwordMasterKeyFile && !existsSync6(config.passwordMasterKeyFile)) {
-    writeFileSync3(config.passwordMasterKeyFile, opaque2.server.createSetup());
+  if (typeof config.passwordMasterKeyFile === "string" && config.passwordMasterKeyFile && !existsSync7(config.passwordMasterKeyFile)) {
+    writeFileSync4(config.passwordMasterKeyFile, opaque2.server.createSetup());
     console.log("Password master key created at", config.passwordMasterKeyFile);
   }
   const passwordMasterKey = readFileSync5(config.passwordMasterKeyFile, "utf8").trim();
@@ -16540,10 +16873,25 @@ async function startServer(config) {
     process.exit(1);
   }
 }
-__name(startServer, "startServer");
+var init_server = __esm({
+  "src/server.ts"() {
+    init_esm_shims();
+    init_router();
+    init_StateObject();
+    init_streamer();
+    init_global();
+    init_tiddlywiki();
+    init_commander();
+    init_PasswordService();
+    init_sessions();
+    __name(startServer, "startServer");
+  }
+});
+init_server();
 export {
   SessionKeyMap,
   SessionManager,
+  assertSignature,
   startServer as default,
   zodSession
 };