boltdocs 3.2.2 → 3.3.1

package/bin/boltdocs.js

@@ -2,12 +2,31 @@
 
 // Suppress DEP0205 deprecation warning for module.register() in Node 26+
 const { emitWarning: _emitWarn } = process
-process.emitWarning = function (warning, ...args) {
+process.emitWarning = (warning, ...args) => {
   if (warning && typeof warning === 'object' && warning.code === 'DEP0205')
     return
   if (typeof warning === 'string' && args.includes('DEP0205')) return
   return Reflect.apply(_emitWarn, process, [warning, ...args])
 }
 
+// Point Node's module compile cache at a persistent directory so compiled
+// module bytecode survives process restarts (and, on Node 22.x, survives
+// across reboots instead of being evicted with the tmp dir). This must be
+// set before the first module is imported — any later and the loader has
+// already initialized the cache.
+const _boltdocsHome = process.env.HOME || process.env.USERPROFILE
+if (_boltdocsHome && process.env.MODULE_COMPILE_CACHE_DIR === undefined) {
+  process.env.MODULE_COMPILE_CACHE_DIR = `${_boltdocsHome}/.boltdocs/compile-cache`
+}
+
+// Warm heavy modules before the CLI entry point runs.
+// Resolve preloader relative to THIS file (bin/), not the CWD.
+const urlMod = await import('node:url')
+const pathMod = await import('node:path')
+const __dirname = pathMod.dirname(urlMod.fileURLToPath(import.meta.url))
+await import(
+  urlMod.pathToFileURL(pathMod.join(__dirname, 'preloader.mjs')).href
+).catch(() => {})
+
 // We use dynamic import because the core package is now ESM.
 import('../dist/node/cli-entry.mjs')

package/bin/preloader.mjs

@@ -0,0 +1,28 @@
+/**
+ * Preloader for heavy Node.js modules.
+ *
+ * Loaded via `node --import ./preloader.mjs` in the CLI shebang.
+ * Runs *before* the CLI entry point so that dynamic imports of
+ * Vite, React, and plugins resolve instantly from the warmed module
+ * cache.
+ *
+ * NOTE: @vitejs/plugin-react v6+ uses Oxc (not Babel), so it is
+ * significantly lighter than v5.  We still warm it because it is
+ * imported by createViteConfig.
+ *
+ * All imports are fire-and-forget — errors are silently swallowed
+ * because a preloader failure must never block the CLI.
+ */
+
+// React plugin — v6 uses Oxc, much lighter than v5's Babel.
+import('@vitejs/plugin-react').catch(() => {})
+
+// Vite itself.
+import('vite').catch(() => {})
+
+// React / ReactDOM are imported by boltdocsPlugin and the dev server.
+import('react').catch(() => {})
+import('react-dom/client').catch(() => {})
+
+// Tailwind CSS Vite plugin — loaded by createViteConfig.
+import('@tailwindcss/vite').catch(() => {})

package/dist/{adapters-ByYY44Zy.mjs → adapters-BmB4TKCc.mjs}

@@ -3,4 +3,4 @@
  * Copyright (c) 2026 Jesus Alcala
  * Licensed under the MIT License.
  */
-import{t as e}from"./handler-DzQae4eA.mjs";const t={"Access-Control-Allow-Origin":`*`,"Access-Control-Allow-Methods":`POST, OPTIONS`,"Access-Control-Allow-Headers":`Content-Type`,"Content-Type":`application/json`};async function n(n,r){if(Object.entries(t).forEach(([e,t])=>{r.setHeader(e,t)}),n.method===`OPTIONS`){r.status(200).end();return}if(n.method!==`POST`){r.status(405).json({error:`Method Not Allowed`});return}try{let t=await e(n.body,process.env);r.status(200).json(t)}catch(e){let t=e instanceof Error?e.message:`Failed to submit feedback`;return r.status(500).json({error:t})}}async function r(n,r=process.env){let i=(e,n=200)=>({statusCode:n,headers:t,body:e?JSON.stringify(e):``});if(n.httpMethod===`OPTIONS`)return i(null,200);if(n.httpMethod!==`POST`)return i({error:`Method Not Allowed`},405);try{return i(await e(n.body?JSON.parse(n.body):{},r))}catch(e){return i({error:e instanceof Error?e.message:`Failed to submit feedback`},500)}}async function i(n,r={}){let i=(e,n=200)=>new Response(e?JSON.stringify(e):null,{status:n,headers:t});if(n.method===`OPTIONS`)return i(null);if(n.method!==`POST`)return i({error:`Method Not Allowed`},405);try{return i(await e(await n.json(),{...process.env,...r}))}catch(e){return i({error:e instanceof Error?e.message:`Failed to submit feedback`},500)}}async function a(n,r=process.env){let i=(e,n=200)=>({statusCode:n,headers:t,body:e?JSON.stringify(e):``});if(n.httpMethod===`OPTIONS`)return i(null,200);if(n.httpMethod!==`POST`)return i({error:`Method Not Allowed`},405);try{return i(await e(n.body?JSON.parse(n.body):{},r))}catch(e){return i({error:e instanceof Error?e.message:`Failed to submit feedback`},500)}}export{n as i,i as n,r,a as t};
+import{t as e}from"./handler-D7UyZlPm.mjs";const t={"Access-Control-Allow-Origin":`*`,"Access-Control-Allow-Methods":`POST, OPTIONS`,"Access-Control-Allow-Headers":`Content-Type`,"Content-Type":`application/json`};async function n(n,r){if(Object.entries(t).forEach(([e,t])=>{r.setHeader(e,t)}),n.method===`OPTIONS`){r.status(200).end();return}if(n.method!==`POST`){r.status(405).json({error:`Method Not Allowed`});return}try{let t=await e(n.body,process.env);r.status(200).json(t)}catch(e){let t=e instanceof Error?e.message:`Failed to submit feedback`;return r.status(500).json({error:t})}}async function r(n,r=process.env){let i=(e,n=200)=>({statusCode:n,headers:t,body:e?JSON.stringify(e):``});if(n.httpMethod===`OPTIONS`)return i(null,200);if(n.httpMethod!==`POST`)return i({error:`Method Not Allowed`},405);try{return i(await e(n.body?JSON.parse(n.body):{},r))}catch(e){return i({error:e instanceof Error?e.message:`Failed to submit feedback`},500)}}async function i(n,r={}){let i=(e,n=200)=>new Response(e?JSON.stringify(e):null,{status:n,headers:t});if(n.method===`OPTIONS`)return i(null);if(n.method!==`POST`)return i({error:`Method Not Allowed`},405);try{return i(await e(await n.json(),{...process.env,...r}))}catch(e){return i({error:e instanceof Error?e.message:`Failed to submit feedback`},500)}}async function a(n,r=process.env){let i=(e,n=200)=>({statusCode:n,headers:t,body:e?JSON.stringify(e):``});if(n.httpMethod===`OPTIONS`)return i(null,200);if(n.httpMethod!==`POST`)return i({error:`Method Not Allowed`},405);try{return i(await e(n.body?JSON.parse(n.body):{},r))}catch(e){return i({error:e instanceof Error?e.message:`Failed to submit feedback`},500)}}export{n as i,i as n,r,a as t};

package/dist/{adapters-DvmtpdSF.cjs → adapters-Cp1Maurn.cjs}

@@ -3,4 +3,4 @@
  * Copyright (c) 2026 Jesus Alcala
  * Licensed under the MIT License.
  */
-const e=require(`./handler-XX7cLTqe.cjs`),t={"Access-Control-Allow-Origin":`*`,"Access-Control-Allow-Methods":`POST, OPTIONS`,"Access-Control-Allow-Headers":`Content-Type`,"Content-Type":`application/json`};async function n(n,r){if(Object.entries(t).forEach(([e,t])=>{r.setHeader(e,t)}),n.method===`OPTIONS`){r.status(200).end();return}if(n.method!==`POST`){r.status(405).json({error:`Method Not Allowed`});return}try{let t=await e.t(n.body,process.env);r.status(200).json(t)}catch(e){let t=e instanceof Error?e.message:`Failed to submit feedback`;return r.status(500).json({error:t})}}async function r(n,r=process.env){let i=(e,n=200)=>({statusCode:n,headers:t,body:e?JSON.stringify(e):``});if(n.httpMethod===`OPTIONS`)return i(null,200);if(n.httpMethod!==`POST`)return i({error:`Method Not Allowed`},405);try{return i(await e.t(n.body?JSON.parse(n.body):{},r))}catch(e){return i({error:e instanceof Error?e.message:`Failed to submit feedback`},500)}}async function i(n,r={}){let i=(e,n=200)=>new Response(e?JSON.stringify(e):null,{status:n,headers:t});if(n.method===`OPTIONS`)return i(null);if(n.method!==`POST`)return i({error:`Method Not Allowed`},405);try{return i(await e.t(await n.json(),{...process.env,...r}))}catch(e){return i({error:e instanceof Error?e.message:`Failed to submit feedback`},500)}}async function a(n,r=process.env){let i=(e,n=200)=>({statusCode:n,headers:t,body:e?JSON.stringify(e):``});if(n.httpMethod===`OPTIONS`)return i(null,200);if(n.httpMethod!==`POST`)return i({error:`Method Not Allowed`},405);try{return i(await e.t(n.body?JSON.parse(n.body):{},r))}catch(e){return i({error:e instanceof Error?e.message:`Failed to submit feedback`},500)}}Object.defineProperty(exports,`i`,{enumerable:!0,get:function(){return n}}),Object.defineProperty(exports,`n`,{enumerable:!0,get:function(){return i}}),Object.defineProperty(exports,`r`,{enumerable:!0,get:function(){return r}}),Object.defineProperty(exports,`t`,{enumerable:!0,get:function(){return a}});
+const e=require(`./handler-CDEoKARD.cjs`),t={"Access-Control-Allow-Origin":`*`,"Access-Control-Allow-Methods":`POST, OPTIONS`,"Access-Control-Allow-Headers":`Content-Type`,"Content-Type":`application/json`};async function n(n,r){if(Object.entries(t).forEach(([e,t])=>{r.setHeader(e,t)}),n.method===`OPTIONS`){r.status(200).end();return}if(n.method!==`POST`){r.status(405).json({error:`Method Not Allowed`});return}try{let t=await e.t(n.body,process.env);r.status(200).json(t)}catch(e){let t=e instanceof Error?e.message:`Failed to submit feedback`;return r.status(500).json({error:t})}}async function r(n,r=process.env){let i=(e,n=200)=>({statusCode:n,headers:t,body:e?JSON.stringify(e):``});if(n.httpMethod===`OPTIONS`)return i(null,200);if(n.httpMethod!==`POST`)return i({error:`Method Not Allowed`},405);try{return i(await e.t(n.body?JSON.parse(n.body):{},r))}catch(e){return i({error:e instanceof Error?e.message:`Failed to submit feedback`},500)}}async function i(n,r={}){let i=(e,n=200)=>new Response(e?JSON.stringify(e):null,{status:n,headers:t});if(n.method===`OPTIONS`)return i(null);if(n.method!==`POST`)return i({error:`Method Not Allowed`},405);try{return i(await e.t(await n.json(),{...process.env,...r}))}catch(e){return i({error:e instanceof Error?e.message:`Failed to submit feedback`},500)}}async function a(n,r=process.env){let i=(e,n=200)=>({statusCode:n,headers:t,body:e?JSON.stringify(e):``});if(n.httpMethod===`OPTIONS`)return i(null,200);if(n.httpMethod!==`POST`)return i({error:`Method Not Allowed`},405);try{return i(await e.t(n.body?JSON.parse(n.body):{},r))}catch(e){return i({error:e instanceof Error?e.message:`Failed to submit feedback`},500)}}Object.defineProperty(exports,`i`,{enumerable:!0,get:function(){return n}}),Object.defineProperty(exports,`n`,{enumerable:!0,get:function(){return i}}),Object.defineProperty(exports,`r`,{enumerable:!0,get:function(){return r}}),Object.defineProperty(exports,`t`,{enumerable:!0,get:function(){return a}});

package/dist/audit-CLXjMzwQ.mjs

@@ -0,0 +1,11 @@
+/**
+ * Boltdocs - https://boltdocs.vercel.app
+ * Copyright (c) 2026 Jesus Alcala
+ * Licensed under the MIT License.
+ */
+import{t as e}from"./config-files-BYHDOrKn.mjs";import{t}from"./resolve-YdTrt_FG.mjs";import{createRequire as n}from"node:module";import r from"node:path";import i from"node:fs";import a from"semver";import o from"picomatch";const s={high:3,warning:2,low:1};function c(e){let t;for(let n of e)(!t||s[n]>s[t])&&(t=n);return t}const l=/\.(?:js|mjs|cjs|ts|tsx|jsx)$/,u=/\.(?:d\.ts|map)$/,d=/\.(?:test|spec)\.(?:js|mjs|cjs|ts|tsx|jsx)$/,f=new Set([`node_modules`,`.git`,`dist`,`coverage`,`test`,`__tests__`,`tests`,`spec`,`fixture`,`fixtures`,`example`,`examples`,`benchmark`,`benchmarks`,`.github`,`docs`]);function p(e){return l.test(e)&&!u.test(e)&&!d.test(e)}function m(e,t,n,a,o){if(o>16)return;let s;try{s=i.realpathSync(e)}catch{return}if(a.has(s))return;a.add(s);let c;try{c=i.readdirSync(e)}catch{return}for(let s of c){let c=r.join(e,s),l;try{l=i.statSync(c)}catch{continue}if(l.isDirectory()){if(n&&f.has(s))continue;m(c,t,n,a,o+1)}else p(s)&&t(c)}}function h(e,t){if(typeof e==`string`)t.push(e);else if(e&&typeof e==`object`)for(let n of Object.values(e))h(n,t)}function g(e,t){let n=[];for(let e of[`main`,`module`,`browser`,`bin`,`exports`])h(t[e],n);let a=[],o=new Set;for(let t of n){if(!t)continue;let n=r.resolve(e,t);if(!o.has(n)){o.add(n);try{i.existsSync(n)&&i.statSync(n).isFile()&&p(r.basename(n))&&a.push(n)}catch{}}}return a}function _(e,t,n){let a=[],s=new Set,c=e=>{if(a.length>=n)return;let t;try{t=i.realpathSync(e)}catch{return}s.has(t)||(s.add(t),a.push(e))};for(let s of t){if(a.length>=n)break;if(s.startsWith(`!`))continue;let t=s.replace(/^\.\//,``);if(t.includes(`*`)){let n=t.slice(0,t.indexOf(`*`)),a=r.join(e,n);if(i.existsSync(a)){let n=o(t);m(a,t=>{n(r.relative(e,t))&&c(t)},!0,new Set,0)}}else{let n=r.join(e,t);try{i.statSync(n).isDirectory()?m(n,c,!0,new Set,0):p(r.basename(n))&&c(n)}catch{}}}return a}function v(e,t,n=300){let r=[],a=new Set,o=e=>{if(r.length>=n)return;let t;try{t=i.realpathSync(e)}catch{return}a.has(t)||(a.add(t),r.push(e))};for(let n of g(e,t))o(n);if(Array.isArray(t.files))for(let r of _(e,t.files,n))o(r);else m(e,o,!0,new Set,0);return r.sort()}function y(e,t,n,r,i,a,o){return{id:e,category:t,severity:n,description:r,layer:i,pattern:a,codeGuard:o}}const b=[y(`child-process-call`,`process`,`high`,`Calls a child_process API (exec/spawn/fork) — can run arbitrary commands`,`code`,/child_process\s*\.\s*(?:exec(?:Sync)?|spawn(?:Sync)?|fork|execFile(?:Sync)?)\s*\(/),y(`child-process-exec`,`process`,`high`,`Executes shell commands via exec()`,`code`,/(?<![\w$.])exec(?:Sync)?\s*\(/),y(`child-process-spawn`,`process`,`high`,`Spawns child processes via spawn()`,`code`,/(?<![\w$.])spawn(?:Sync)?\s*\(/),y(`child-process-fork`,`process`,`high`,`Forks child processes via fork()`,`code`,/(?<![\w$.])fork\s*\(/),y(`child-process-execfile`,`process`,`high`,`Executes binaries via execFile()`,`code`,/(?<![\w$.])execFile(?:Sync)?\s*\(/),y(`shell-true`,`process`,`high`,`Enables shell:true — passes strings through a shell`,`code`,/(?<![\w$])shell\s*:\s*true\b/),y(`eval-call`,`dynamic-code`,`high`,`Uses eval() — can execute arbitrary strings`,`code`,/(?<![\w$.])eval\s*\(/),y(`new-function`,`dynamic-code`,`high`,`Uses new Function() — string-compiled code`,`code`,/new\s+Function\s*\(/),y(`function-constructor`,`dynamic-code`,`high`,`Uses the Function constructor — string-compiled code`,`code`,/(?<![\w$.])Function\s*\(/),y(`vm-runtime`,`dynamic-code`,`high`,`Uses the vm module runtime APIs — can execute arbitrary code`,`code`,/vm\s*\.\s*(?:runInThisContext|runInNewContext|runInContext|compileFunction)\s*\(/),y(`hex-escape-run`,`dynamic-code`,`high`,`Long run of hex escapes — likely obfuscated code`,`raw`,/(?:(?:\\x[0-9a-fA-F]{2}){4,}|(?:\\u[0-9a-fA-F]{4}){3,})/),y(`string-fromcharcode`,`dynamic-code`,`high`,`Builds strings from char codes — common obfuscation pattern`,`code`,/String\s*\.\s*fromCharCode\s*\(/),y(`base64-buffer`,`dynamic-code`,`warning`,`Decodes base64 payloads via Buffer.from()`,`raw`,/Buffer\s*\.\s*from\s*\(\s*[^)\n]*?\s*,\s*['"](?:base64|base64url)['"]\s*\)/,/Buffer\s*\.\s*from/),y(`atob-btoa`,`dynamic-code`,`warning`,`Encodes/decodes base64 strings (atob/btoa)`,`code`,/(?<![\w$.])(?:atob|btoa)\s*\(/),y(`fetch-call`,`network`,`warning`,`Makes outbound requests via the global fetch()`,`code`,/(?<![\w$.])fetch\s*\(/),y(`http-request`,`network`,`warning`,`Makes HTTP(S) requests via http/https modules`,`code`,/(?:http|https)\s*\.\s*(?:get|request)\s*\(/),y(`http-client-lib`,`network`,`warning`,`Uses an HTTP client library (axios/got/superagent/…)`,`code`,/(?<![\w$.])(?:axios|got|superagent|needle|undici)\b/),y(`websocket-client`,`network`,`warning`,`Opens WebSocket connections`,`code`,/(?<![\w$.])(?:WebSocket|WebSocketClient)\s*\(/),y(`dns-lookup`,`network`,`warning`,`Performs DNS lookups/resolution`,`code`,/dns\s*\.\s*(?:lookup|resolve(?:4|6)?|reverse)\s*\(/),y(`fs-write`,`filesystem`,`low`,`Writes files via the fs module`,`raw`,/(?:fs\s*\.\s*|require\s*\(\s*['"]fs['"]\s*\)\s*\.\s*)(?:writeFile(?:Sync)?|appendFile(?:Sync)?|createWriteStream)\s*\(/,/\b(?:fs|require)\b/),y(`fs-delete`,`filesystem`,`warning`,`Deletes files via the fs module`,`raw`,/(?:fs\s*\.\s*|require\s*\(\s*['"]fs['"]\s*\)\s*\.\s*)(?:rm(?:Sync)?|unlink(?:Sync)?)\s*\(/,/\b(?:fs|require)\b/),y(`env-access`,`env-secrets`,`low`,`Reads environment variables (process.env)`,`code`,/process\s*\.\s*env\b/),y(`env-secret-name`,`env-secrets`,`warning`,`Reads an environment variable whose name suggests a secret (TOKEN/KEY/SECRET/…)`,`raw`,/process\s*\.\s*env\s*\[\s*['"][A-Za-z0-9_]*?(?:TOKEN|KEY|SECRET|PASSWORD|PASSWD|CREDENTIAL|API_KEY|PRIVATE)[A-Za-z0-9_]*?['"]\s*\]/i,/process\s*\.\s*env/),y(`env-secret-dot`,`env-secrets`,`warning`,`Reads an environment variable whose name suggests a secret (TOKEN/KEY/SECRET/…)`,`code`,/process\s*\.\s*env\s*\.\s*[A-Za-z0-9_]*?(?:TOKEN|KEY|SECRET|PASSWORD|PASSWD|CREDENTIAL|API_KEY|PRIVATE)[A-Za-z0-9_]*/i)],x=/(?:child_process|exec|spawn|fork|shell|eval|Function|vm|fromCharCode|atob|btoa|Buffer|fetch|http|axios|got|superagent|needle|undici|WebSocket|dns|writeFile|appendFile|createWriteStream|\.rm|\.unlink|readFile|createReadStream|\.stat\(|\.lstat\(|\.access\(|\.realpath\(|statSync|lstatSync|realpathSync|process\.env|require|import|from|\\x|\\u|homedir|~[/'"`]|\/etc|\.ssh|\.aws|\.env|\.npmrc|\.git|USERPROFILE|APPDATA|\.\.\/)/,ee=[{id:`import-child-process`,category:`process`,severity:`high`,description:`Imports child_process — arbitrary command execution`,modules:[`child_process`]},{id:`import-vm`,category:`dynamic-code`,severity:`high`,description:`Imports the vm module — can execute arbitrary code`,modules:[`vm`]},{id:`import-net`,category:`network`,severity:`warning`,description:`Imports raw TCP/UDP networking (node:net/dgram)`,modules:[`net`,`dgram`]},{id:`import-dns`,category:`network`,severity:`warning`,description:`Imports DNS resolution (node:dns)`,modules:[`dns`]},{id:`import-http`,category:`network`,severity:`warning`,description:`Imports an HTTP(S) module (node:http/https/http2/tls)`,modules:[`http`,`https`,`http2`,`tls`,`undici`]},{id:`import-websocket`,category:`network`,severity:`warning`,description:`Imports a WebSocket client`,modules:[`ws`,`socket.io-client`,`websocket`]},{id:`import-http-client`,category:`network`,severity:`warning`,description:`Imports an HTTP client library`,modules:[`axios`,`got`,`node-fetch`,`superagent`,`request`,`needle`]},{id:`import-dotenv`,category:`env-secrets`,severity:`low`,description:`Loads environment variables from .env files`,modules:[`dotenv`]},{id:`import-fs`,category:`filesystem`,severity:`low`,description:`Imports the fs module — can read/write files outside the package`,modules:[`fs`]}],S=/(?:os\s*\.\s*homedir\s*\(|~\s*[/'"`]|\/etc(?:\/|\b)|\.ssh(?:\/|\b)|\.aws(?:\/|\b)|(?:^|[\s'"`(])\.env(?:\/|\b)|\.npmrc(?:\b)|\.git\s*\/\s*config|process\s*\.\s*env\s*\.\s*[A-Z_]*HOME|%USERPROFILE%|%APPDATA%|\.\.\s*\/)/i,C=/(?:fs\s*\.\s*|require\s*\(\s*['"]fs['"]\s*\)\s*\.\s*)/,w=RegExp(`${C.source}(?:writeFile(?:Sync)?|appendFile(?:Sync)?|createWriteStream|rm(?:Sync)?|unlink(?:Sync)?)\\s*\\(`),T=RegExp(`${C.source}(?:readFile(?:Sync)?|createReadStream|stat(?:Sync)?|lstat(?:Sync)?|access(?:Sync)?|realpath(?:Sync)?)\\s*\\(`),E={"fs-write-sensitive":{category:`filesystem`,severity:`high`,message:`Writes to a sensitive location (home dir, .env, .ssh, /etc, …)`},"fs-read-sensitive":{category:`filesystem`,severity:`warning`,message:`Reads from a sensitive location (.env, .ssh, .npmrc, /etc, …)`}},te=/^(?:https?:)?\/\//i;function ne(e){return/\b(?:require|import)\s*\(\s*$/.test(e)||/\b(?:from|import)\s+$/.test(e)}function re(e){return e.replace(/\\x([0-9a-fA-F]{2})/g,(e,t)=>String.fromCharCode(Number.parseInt(t,16))).replace(/\\u([0-9a-fA-F]{4})/g,(e,t)=>String.fromCharCode(Number.parseInt(t,16)))}function D(e,t){let n=``,r=``,i=0,a;a=t.inBlockComment?`block`:t.inTemplate?`template`:`code`;let o=[],s=null,c=()=>{s!==null&&(o.push(re(s.slice(0,-1))),s=null)};for(;i<e.length;){let t=e[i],o=e[i+1];if(a===`block`){t===`*`&&o===`/`?(i+=2,a=`code`):i++;continue}if(a===`single`||a===`double`||a===`template`){if(t===`\\`&&o!==void 0){s!==null&&(s+=t+o),r+=t+o,n+=`  `,i+=2;continue}s!==null&&(s+=t),r+=t,n+=` `,i++,(a===`single`&&t===`'`||a===`double`&&t===`"`||a===`template`&&t==="`")&&(a=`code`,c());continue}if(t===`/`&&o===`/`){i=e.length;continue}if(t===`/`&&o===`*`){i+=2,a=`block`;continue}if(t===`'`||t===`"`||t==="`"){let e=s===null&&ne(n);r+=t,n+=` `,i++,a=t===`'`?`single`:t===`"`?`double`:`template`,e&&(s=``);continue}if(t===`/`&&O(n)){let t=i+1,a=!1;for(;t<e.length;){let n=e[t];if(n===`\\`){t+=2;continue}if(n===`[`)a=!0;else if(n===`]`)a=!1;else if(n===`/`&&!a)break;t++}let o=t<e.length?t+1:e.length;for(;o<e.length&&/[dgimsuvy]/.test(e[o]);)o++;n+=` `.repeat(o-i),r+=` `.repeat(o-i),i=o;continue}n+=t,r+=t,i++}return t.inBlockComment=a===`block`,t.inTemplate=a===`template`,{code:n,raw:r,imports:o}}function O(e){let t=e.length-1;for(;t>=0&&/\s/.test(e[t]);)t--;if(t<0||`(=,:[;!&|?{`.includes(e[t]))return!0;let n=e.slice(0,t+1);return/\b(?:return|typeof|instanceof|in|of|new|case|void|delete|do|else|yield)\s*$/.test(n)}function k(e){return e.replace(/^node:/,``)}function A(e,t){try{let n=i.openSync(e,`r`);try{let e=new Uint8Array(t),r=i.readSync(n,e,0,t,0),a=Buffer.from(e.subarray(0,r)).toString(`utf-8`),o=a.lastIndexOf(`
+`);return o!==-1&&(a=a.slice(0,o)),a}finally{i.closeSync(n)}}catch{return null}}function j(e,t,n={}){let a=n.maxFiles??300,o=n.maxTotalBytes??8388608,s=v(e,t,a),c=[],l=new Set,u=0,d=(e,t,n,r,i,a,o,s=``)=>{let u=`${e}|${i}|${a}|${s}`;l.has(u)||(l.add(u),c.push({ruleId:e,category:t,severity:n,message:r,file:i,line:a,snippet:o}))},f=(e,t)=>{let n=e.split(`
+`),r={inBlockComment:!1,inTemplate:!1};for(let e=0;e<n.length;e++){let i=n[e],{code:a,raw:o,imports:s}=D(i,r),c=e+1,l=i.trim().slice(0,120);if(x.test(o)){let e=[];for(let t of b){let n=t.layer===`raw`?o:a;t.pattern.test(n)&&(!t.codeGuard||t.codeGuard.test(a))&&e.push(t)}let n=e.some(e=>e.id===`new-function`);for(let r of e)n&&r.id===`function-constructor`||d(r.id,r.category,r.severity,r.description,t,c,l);if(S.test(o)&&/\b(?:fs|require)\b/.test(a)){if(w.test(o)){let e=E[`fs-write-sensitive`];d(`fs-write-sensitive`,e.category,e.severity,e.message,t,c,l)}if(T.test(o)){let e=E[`fs-read-sensitive`];d(`fs-read-sensitive`,e.category,e.severity,e.message,t,c,l)}}}for(let e of s){if(te.test(e)){d(`remote-code-import`,`dynamic-code`,`high`,`Loads code from a remote URL at runtime: ${e.slice(0,80)}`,t,c,l,e);continue}let n=k(e);for(let r of ee)if(r.modules.includes(n)){d(r.id,r.category,r.severity,r.description,t,c,l,e);break}}}},p=0,m=!1;for(let t of s){let n=r.relative(e,t),a;try{a=i.statSync(t).size}catch{continue}let s=o-p;if(a>s){if(s>0){let e=A(t,s);e!==null&&(u++,f(e,n))}m=!0;break}let c;try{c=i.readFileSync(t,`utf-8`)}catch{continue}u++,p+=a,f(c,n)}return m&&d(`scan-truncated`,`metadata`,`warning`,`Scan truncated at ${o} bytes — remaining files were not inspected. Increase maxTotalBytes to audit the full package.`,`package.json`,0),{findings:c,filesScanned:u}}const M=/^(?:git(?:\+[a-z]+)?|https?|file|link|ssh|github):/i;function N(e,t={name:`plugin`}){let n=[],r=e.scripts||{};for(let e of[`preinstall`,`install`,`postinstall`]){let t=r[e];typeof t==`string`&&t.trim().length>0&&n.push({ruleId:`install-script`,category:`metadata`,severity:`high`,message:`Runs a ${e} script during installation — a common supply-chain attack vector`,file:`package.json`,line:0,snippet:`${e}: ${t.trim().slice(0,120)}`})}let i=e.bundledDependencies??e.bundleDependencies;Array.isArray(i)&&i.length>0&&n.push({ruleId:`bundled-deps`,category:`metadata`,severity:`warning`,message:`Bundles dependencies: ${i.join(`, `)} — vendored code that bypasses the registry audit`,file:`package.json`,line:0,snippet:`bundledDependencies: [${i.join(`, `)}]`});let o=[];for(let t of[`dependencies`,`devDependencies`,`optionalDependencies`,`peerDependencies`]){let n=e[t];if(!(!n||typeof n!=`object`))for(let[e,t]of Object.entries(n))typeof t==`string`&&M.test(t)&&o.push(`${e}@${t}`)}if(o.length>0&&n.push({ruleId:`remote-deps`,category:`metadata`,severity:`warning`,message:`Dependencies loaded from non-registry sources (git/file/URL): ${o.join(`, `)}`,file:`package.json`,line:0,snippet:o.slice(0,3).join(`, `)}),!e.license&&!e.licenses&&n.push({ruleId:`no-license`,category:`metadata`,severity:`low`,message:`Package declares no license`,file:`package.json`,line:0}),!e.repository&&!e.homepage&&n.push({ruleId:`no-provenance`,category:`metadata`,severity:`low`,message:`Package declares no repository or homepage — harder to verify provenance`,file:`package.json`,line:0}),t.boltdocsVersion&&typeof e.version==`string`)try{a.satisfies(e.version,t.boltdocsVersion)||n.push({ruleId:`version-mismatch`,category:`metadata`,severity:`low`,message:`Installed version ${e.version} does not satisfy the declared boltdocsVersion range ${t.boltdocsVersion}`,file:`package.json`,line:0,snippet:`boltdocsVersion: ${t.boltdocsVersion}`})}catch{}return n}function P(e,n,r={},i){let a=t(i?.packageName??e,n);if(!a)return{name:e,status:`unresolved`,filesScanned:0,findings:[]};let o;try{o=j(a.dir,a.pkg,r)}catch(t){return{name:e,status:`error`,pluginDir:a.dir,version:a.version,filesScanned:0,findings:[{ruleId:`scan-error`,category:`metadata`,severity:`warning`,message:`Static scan failed: ${t instanceof Error?t.message:String(t)}`,file:`package.json`,line:0}]}}let s=[...o.findings];s.push(...N(a.pkg,{name:e,boltdocsVersion:i?.boltdocsVersion}));let l=c(s.map(e=>e.severity));return{name:e,status:s.length===0?`clean`:`warning`,severity:l,pluginDir:a.dir,version:a.version,filesScanned:o.filesScanned,findings:s}}function F(e,t,n={}){let r=[];for(let i of e)!i||typeof i.name!=`string`||!i.name||r.push(P(i.name,t,n,i));return r}const I=/from\s+(['"])([^'"]+)\1/g;function L(e){let t=[];I.lastIndex=0;for(let n=I.exec(e);n!==null;n=I.exec(e))t.push(n[2]);return t}function R(e){let t=e.lastIndexOf(`/`);return t>=0?e.slice(t+1):e}function z(e,t,n){let r=0;if(t.pkgName===e)r=100;else{let n=R(t.pkgName);n===e?r=60:e.endsWith(n)&&(r=40)}return r>0&&n&&t.version===n&&(r+=15),r}function B(e,t){let a;try{a=i.readFileSync(e,`utf-8`)}catch{return[]}let o=n(e),s=[],c=new Set;for(let e of L(a)){if(e.startsWith(`.`)||e.startsWith(`/`))continue;let n=null;try{n=o.resolve(`${e}/package.json`)}catch{let a=r.resolve(t,`node_modules`,e,`package.json`);i.existsSync(a)&&(n=a)}if(!n||!i.existsSync(n))continue;let a;try{a=JSON.parse(i.readFileSync(n,`utf-8`))}catch{continue}let l=typeof a.name==`string`?a.name:e;l!==`boltdocs`&&(c.has(l)||(c.add(l),s.push({pkgName:l,version:typeof a.version==`string`?a.version:void 0})))}return s}function V(e,t,n){if(n.length===0)return;let r=B(e,t);if(r.length!==0)for(let e of n){if(!e||typeof e.name!=`string`||!e.name)continue;let t=null,n=0;for(let i of r){let r=z(e.name,i,e.version);r>n&&(n=r,t=i)}t&&(e.packageName=t.pkgName)}}async function ie(t){let n;for(let a of e){let e=r.resolve(t,a);if(i.existsSync(e))try{let{createJiti:n}=await import(`jiti`),r=await n(t,{interopDefault:!0}).import(e)??{},i=r.default??r.config??r;if(!i||typeof i!=`object`)throw Error(`config file did not export an object`);if(!(`plugins`in i))return{plugins:[],configFile:e};if(!Array.isArray(i.plugins))throw Error(`config.plugins must be an array, got ${typeof i.plugins}`);let a=i.plugins;return V(e,t,a),{plugins:a,configFile:e}}catch(e){n=e}}if(n!==void 0)throw Error(`Failed to load Boltdocs configuration: ${n instanceof Error?n.message:String(n)}`,{cause:n});return{plugins:[]}}const H=!(`NO_COLOR`in process.env)&&(process.stdout?.isTTY??!1),U=RegExp(`\x1B\\[[0-9;]*m`,`g`);function W(e){return e.replace(U,``).length}function G(e,t){return H?`\u001b[${e}m${t}\u001b[0m`:t}const K={red:e=>G(31,e),yellow:e=>G(33,e),cyan:e=>G(36,e),green:e=>G(32,e),gray:e=>G(90,e),bold:e=>G(1,e),dim:e=>G(2,e)},q=e=>G(`38;2;235;88;40`,e);function J(e,t,n,r){let i=n.match(/^\n+/)?.[0]??``,a=n.slice(i.length),o=`${K.bold(`[boltdocs]`)} ${a}`,s=e===`stderr`?console.error:console.log;i&&s(i),s(t(o)),r!==void 0&&s(r)}const Y=e=>J(`stdout`,K.gray,e),X=e=>J(`stdout`,K.yellow,e),Z=e=>J(`stdout`,K.green,e),ae=(e,t)=>J(`stderr`,K.red,e,t);function oe(e,t){let n=Math.max(e.length,...t.map(e=>e.length)),r=[];for(let i=0;i<n;i++){let n=e[i]?W(e[i]):0;for(let e of t)n=Math.max(n,W(e[i]??``));r[i]=n+2}let i={h:`─`,v:`│`,tl:`┌`,tm:`┬`,tr:`┐`,ml:`├`,mm:`┼`,mr:`┤`,bl:`└`,bm:`┴`,br:`┘`},a=(e,t,n)=>q(e+r.map(e=>i.h.repeat(e)).join(t)+n),o=e=>q(i.v)+e.map((e,t)=>{let n=e??``;return` `.repeat(1)+n+` `.repeat(r[t]-W(n)-1)}).join(q(i.v))+q(i.v),s=[a(i.tl,i.tm,i.tr)];e.length>0&&(s.push(o(e.map(e=>K.bold(e)))),s.push(a(i.ml,i.mm,i.mr)));for(let e of t)s.push(o(e));return s.push(a(i.bl,i.bm,i.br)),s.join(`
+`)}function Q(e,t){return e+` `.repeat(Math.max(0,t-W(e)))}function $(e){return e.status===`error`?`✖ Scan error`:e.status===`unresolved`?`❓ Unresolved`:e.severity===`high`?`⚠️ High risk`:e.severity===`warning`?`⚠️ Warning`:e.severity===`low`?`ℹ️ Low risk`:`✅ Clean`}function se(e){return e.status===`error`||e.severity===`high`?K.red:e.severity===`warning`?K.yellow:e.severity===`low`?q:K.green}async function ce(e=process.cwd()){Y(`Starting static security audit of Boltdocs plugins...`);let t;try{t=(await ie(e)).plugins}catch(e){ae(`Failed to load Boltdocs configuration for audit:`,e),process.exit(1)}if(t.length===0){Z(`No plugins configured. Nothing to audit.`);return}let n=[...F(t,e)].sort((e,t)=>s[t.severity||`low`]-s[e.severity||`low`]||e.name.localeCompare(t.name));for(let e of n){let t=e.version?`${e.name}@${e.version}`:e.name;if(e.status===`unresolved`){X(`\n${q(t)} — ${K.yellow(`❓ Unresolved`)} (could not locate the package in node_modules)`);continue}let n=e.findings.length===0?`no findings`:`${e.findings.length} finding${e.findings.length===1?``:`s`}`;console.log(`\n${K.bold(q(t))} — ${se(e)($(e))} (${n} · ${e.filesScanned} file${e.filesScanned===1?``:`s`} scanned)`);let r=[...e.findings].sort((e,t)=>s[t.severity]-s[e.severity]||e.file.localeCompare(t.file)||e.line-t.line);for(let e of r){let t=e.file===`package.json`?`package.json`:`${e.file}:${e.line}`,n=e.severity===`high`?K.red(e.severity):e.severity===`warning`?K.yellow(e.severity):K.dim(e.severity);console.log(`  ${Q(K.dim(t),36)}${Q(n,9)}[${K.dim(e.category)}] ${K.bold(e.ruleId)} — ${e.message}${e.snippet?K.dim(`  (${e.snippet})`):``}`)}}console.log(`
+`+oe([`Plugin`,`Status`,`Findings`],n.map(e=>[e.name,$(e),e.status===`unresolved`?`—`:String(e.findings.length)]))+`
+`);let r=n.some(e=>e.status===`error`),i=n.some(e=>e.status===`unresolved`),a=n.some(e=>e.severity===`high`),o=n.some(e=>e.findings.length>0),c=n.some(e=>e.findings.some(e=>e.ruleId===`scan-truncated`));(r||i)&&X(`✖ One or more plugins could not be scanned (unresolved or scan error). Treat them as untrusted until they are re-audited.`),a?X(`⚠️  One or more plugins contain HIGH-risk findings (arbitrary code execution, sensitive file access). Review them before using the plugin.`):o&&!r&&!i&&X(`⚠️  One or more plugins have findings. Review the details above.`),!r&&!i&&!a&&!o&&Z(`✓ All plugins passed the static security check!`),(a||r||i||c)&&(process.exitCode=1)}export{ce as auditAction};

package/dist/audit-COgjnQ5n.cjs

@@ -0,0 +1,11 @@
+/**
+ * Boltdocs - https://boltdocs.vercel.app
+ * Copyright (c) 2026 Jesus Alcala
+ * Licensed under the MIT License.
+ */
+const e=require(`./chunk-D1Md3oWO.cjs`),t=require(`./config-files-D9cdBMl2.cjs`),n=require(`./resolve-It1Iug83.cjs`);let r=require(`node:path`);r=e.r(r);let i=require(`node:fs`);i=e.r(i);let a=require(`semver`);a=e.r(a);let o=require(`node:module`),s=require(`picomatch`);s=e.r(s);const c={high:3,warning:2,low:1};function l(e){let t;for(let n of e)(!t||c[n]>c[t])&&(t=n);return t}const u=/\.(?:js|mjs|cjs|ts|tsx|jsx)$/,d=/\.(?:d\.ts|map)$/,f=/\.(?:test|spec)\.(?:js|mjs|cjs|ts|tsx|jsx)$/,p=new Set([`node_modules`,`.git`,`dist`,`coverage`,`test`,`__tests__`,`tests`,`spec`,`fixture`,`fixtures`,`example`,`examples`,`benchmark`,`benchmarks`,`.github`,`docs`]);function m(e){return u.test(e)&&!d.test(e)&&!f.test(e)}function h(e,t,n,a,o){if(o>16)return;let s;try{s=i.default.realpathSync(e)}catch{return}if(a.has(s))return;a.add(s);let c;try{c=i.default.readdirSync(e)}catch{return}for(let s of c){let c=r.default.join(e,s),l;try{l=i.default.statSync(c)}catch{continue}if(l.isDirectory()){if(n&&p.has(s))continue;h(c,t,n,a,o+1)}else m(s)&&t(c)}}function g(e,t){if(typeof e==`string`)t.push(e);else if(e&&typeof e==`object`)for(let n of Object.values(e))g(n,t)}function _(e,t){let n=[];for(let e of[`main`,`module`,`browser`,`bin`,`exports`])g(t[e],n);let a=[],o=new Set;for(let t of n){if(!t)continue;let n=r.default.resolve(e,t);if(!o.has(n)){o.add(n);try{i.default.existsSync(n)&&i.default.statSync(n).isFile()&&m(r.default.basename(n))&&a.push(n)}catch{}}}return a}function v(e,t,n){let a=[],o=new Set,c=e=>{if(a.length>=n)return;let t;try{t=i.default.realpathSync(e)}catch{return}o.has(t)||(o.add(t),a.push(e))};for(let o of t){if(a.length>=n)break;if(o.startsWith(`!`))continue;let t=o.replace(/^\.\//,``);if(t.includes(`*`)){let n=t.slice(0,t.indexOf(`*`)),a=r.default.join(e,n);if(i.default.existsSync(a)){let n=(0,s.default)(t);h(a,t=>{n(r.default.relative(e,t))&&c(t)},!0,new Set,0)}}else{let n=r.default.join(e,t);try{i.default.statSync(n).isDirectory()?h(n,c,!0,new Set,0):m(r.default.basename(n))&&c(n)}catch{}}}return a}function y(e,t,n=300){let r=[],a=new Set,o=e=>{if(r.length>=n)return;let t;try{t=i.default.realpathSync(e)}catch{return}a.has(t)||(a.add(t),r.push(e))};for(let n of _(e,t))o(n);if(Array.isArray(t.files))for(let r of v(e,t.files,n))o(r);else h(e,o,!0,new Set,0);return r.sort()}function b(e,t,n,r,i,a,o){return{id:e,category:t,severity:n,description:r,layer:i,pattern:a,codeGuard:o}}const x=[b(`child-process-call`,`process`,`high`,`Calls a child_process API (exec/spawn/fork) — can run arbitrary commands`,`code`,/child_process\s*\.\s*(?:exec(?:Sync)?|spawn(?:Sync)?|fork|execFile(?:Sync)?)\s*\(/),b(`child-process-exec`,`process`,`high`,`Executes shell commands via exec()`,`code`,/(?<![\w$.])exec(?:Sync)?\s*\(/),b(`child-process-spawn`,`process`,`high`,`Spawns child processes via spawn()`,`code`,/(?<![\w$.])spawn(?:Sync)?\s*\(/),b(`child-process-fork`,`process`,`high`,`Forks child processes via fork()`,`code`,/(?<![\w$.])fork\s*\(/),b(`child-process-execfile`,`process`,`high`,`Executes binaries via execFile()`,`code`,/(?<![\w$.])execFile(?:Sync)?\s*\(/),b(`shell-true`,`process`,`high`,`Enables shell:true — passes strings through a shell`,`code`,/(?<![\w$])shell\s*:\s*true\b/),b(`eval-call`,`dynamic-code`,`high`,`Uses eval() — can execute arbitrary strings`,`code`,/(?<![\w$.])eval\s*\(/),b(`new-function`,`dynamic-code`,`high`,`Uses new Function() — string-compiled code`,`code`,/new\s+Function\s*\(/),b(`function-constructor`,`dynamic-code`,`high`,`Uses the Function constructor — string-compiled code`,`code`,/(?<![\w$.])Function\s*\(/),b(`vm-runtime`,`dynamic-code`,`high`,`Uses the vm module runtime APIs — can execute arbitrary code`,`code`,/vm\s*\.\s*(?:runInThisContext|runInNewContext|runInContext|compileFunction)\s*\(/),b(`hex-escape-run`,`dynamic-code`,`high`,`Long run of hex escapes — likely obfuscated code`,`raw`,/(?:(?:\\x[0-9a-fA-F]{2}){4,}|(?:\\u[0-9a-fA-F]{4}){3,})/),b(`string-fromcharcode`,`dynamic-code`,`high`,`Builds strings from char codes — common obfuscation pattern`,`code`,/String\s*\.\s*fromCharCode\s*\(/),b(`base64-buffer`,`dynamic-code`,`warning`,`Decodes base64 payloads via Buffer.from()`,`raw`,/Buffer\s*\.\s*from\s*\(\s*[^)\n]*?\s*,\s*['"](?:base64|base64url)['"]\s*\)/,/Buffer\s*\.\s*from/),b(`atob-btoa`,`dynamic-code`,`warning`,`Encodes/decodes base64 strings (atob/btoa)`,`code`,/(?<![\w$.])(?:atob|btoa)\s*\(/),b(`fetch-call`,`network`,`warning`,`Makes outbound requests via the global fetch()`,`code`,/(?<![\w$.])fetch\s*\(/),b(`http-request`,`network`,`warning`,`Makes HTTP(S) requests via http/https modules`,`code`,/(?:http|https)\s*\.\s*(?:get|request)\s*\(/),b(`http-client-lib`,`network`,`warning`,`Uses an HTTP client library (axios/got/superagent/…)`,`code`,/(?<![\w$.])(?:axios|got|superagent|needle|undici)\b/),b(`websocket-client`,`network`,`warning`,`Opens WebSocket connections`,`code`,/(?<![\w$.])(?:WebSocket|WebSocketClient)\s*\(/),b(`dns-lookup`,`network`,`warning`,`Performs DNS lookups/resolution`,`code`,/dns\s*\.\s*(?:lookup|resolve(?:4|6)?|reverse)\s*\(/),b(`fs-write`,`filesystem`,`low`,`Writes files via the fs module`,`raw`,/(?:fs\s*\.\s*|require\s*\(\s*['"]fs['"]\s*\)\s*\.\s*)(?:writeFile(?:Sync)?|appendFile(?:Sync)?|createWriteStream)\s*\(/,/\b(?:fs|require)\b/),b(`fs-delete`,`filesystem`,`warning`,`Deletes files via the fs module`,`raw`,/(?:fs\s*\.\s*|require\s*\(\s*['"]fs['"]\s*\)\s*\.\s*)(?:rm(?:Sync)?|unlink(?:Sync)?)\s*\(/,/\b(?:fs|require)\b/),b(`env-access`,`env-secrets`,`low`,`Reads environment variables (process.env)`,`code`,/process\s*\.\s*env\b/),b(`env-secret-name`,`env-secrets`,`warning`,`Reads an environment variable whose name suggests a secret (TOKEN/KEY/SECRET/…)`,`raw`,/process\s*\.\s*env\s*\[\s*['"][A-Za-z0-9_]*?(?:TOKEN|KEY|SECRET|PASSWORD|PASSWD|CREDENTIAL|API_KEY|PRIVATE)[A-Za-z0-9_]*?['"]\s*\]/i,/process\s*\.\s*env/),b(`env-secret-dot`,`env-secrets`,`warning`,`Reads an environment variable whose name suggests a secret (TOKEN/KEY/SECRET/…)`,`code`,/process\s*\.\s*env\s*\.\s*[A-Za-z0-9_]*?(?:TOKEN|KEY|SECRET|PASSWORD|PASSWD|CREDENTIAL|API_KEY|PRIVATE)[A-Za-z0-9_]*/i)],S=/(?:child_process|exec|spawn|fork|shell|eval|Function|vm|fromCharCode|atob|btoa|Buffer|fetch|http|axios|got|superagent|needle|undici|WebSocket|dns|writeFile|appendFile|createWriteStream|\.rm|\.unlink|readFile|createReadStream|\.stat\(|\.lstat\(|\.access\(|\.realpath\(|statSync|lstatSync|realpathSync|process\.env|require|import|from|\\x|\\u|homedir|~[/'"`]|\/etc|\.ssh|\.aws|\.env|\.npmrc|\.git|USERPROFILE|APPDATA|\.\.\/)/,ee=[{id:`import-child-process`,category:`process`,severity:`high`,description:`Imports child_process — arbitrary command execution`,modules:[`child_process`]},{id:`import-vm`,category:`dynamic-code`,severity:`high`,description:`Imports the vm module — can execute arbitrary code`,modules:[`vm`]},{id:`import-net`,category:`network`,severity:`warning`,description:`Imports raw TCP/UDP networking (node:net/dgram)`,modules:[`net`,`dgram`]},{id:`import-dns`,category:`network`,severity:`warning`,description:`Imports DNS resolution (node:dns)`,modules:[`dns`]},{id:`import-http`,category:`network`,severity:`warning`,description:`Imports an HTTP(S) module (node:http/https/http2/tls)`,modules:[`http`,`https`,`http2`,`tls`,`undici`]},{id:`import-websocket`,category:`network`,severity:`warning`,description:`Imports a WebSocket client`,modules:[`ws`,`socket.io-client`,`websocket`]},{id:`import-http-client`,category:`network`,severity:`warning`,description:`Imports an HTTP client library`,modules:[`axios`,`got`,`node-fetch`,`superagent`,`request`,`needle`]},{id:`import-dotenv`,category:`env-secrets`,severity:`low`,description:`Loads environment variables from .env files`,modules:[`dotenv`]},{id:`import-fs`,category:`filesystem`,severity:`low`,description:`Imports the fs module — can read/write files outside the package`,modules:[`fs`]}],te=/(?:os\s*\.\s*homedir\s*\(|~\s*[/'"`]|\/etc(?:\/|\b)|\.ssh(?:\/|\b)|\.aws(?:\/|\b)|(?:^|[\s'"`(])\.env(?:\/|\b)|\.npmrc(?:\b)|\.git\s*\/\s*config|process\s*\.\s*env\s*\.\s*[A-Z_]*HOME|%USERPROFILE%|%APPDATA%|\.\.\s*\/)/i,C=/(?:fs\s*\.\s*|require\s*\(\s*['"]fs['"]\s*\)\s*\.\s*)/,w=RegExp(`${C.source}(?:writeFile(?:Sync)?|appendFile(?:Sync)?|createWriteStream|rm(?:Sync)?|unlink(?:Sync)?)\\s*\\(`),T=RegExp(`${C.source}(?:readFile(?:Sync)?|createReadStream|stat(?:Sync)?|lstat(?:Sync)?|access(?:Sync)?|realpath(?:Sync)?)\\s*\\(`),E={"fs-write-sensitive":{category:`filesystem`,severity:`high`,message:`Writes to a sensitive location (home dir, .env, .ssh, /etc, …)`},"fs-read-sensitive":{category:`filesystem`,severity:`warning`,message:`Reads from a sensitive location (.env, .ssh, .npmrc, /etc, …)`}},D=/^(?:https?:)?\/\//i;function ne(e){return/\b(?:require|import)\s*\(\s*$/.test(e)||/\b(?:from|import)\s+$/.test(e)}function re(e){return e.replace(/\\x([0-9a-fA-F]{2})/g,(e,t)=>String.fromCharCode(Number.parseInt(t,16))).replace(/\\u([0-9a-fA-F]{4})/g,(e,t)=>String.fromCharCode(Number.parseInt(t,16)))}function O(e,t){let n=``,r=``,i=0,a;a=t.inBlockComment?`block`:t.inTemplate?`template`:`code`;let o=[],s=null,c=()=>{s!==null&&(o.push(re(s.slice(0,-1))),s=null)};for(;i<e.length;){let t=e[i],o=e[i+1];if(a===`block`){t===`*`&&o===`/`?(i+=2,a=`code`):i++;continue}if(a===`single`||a===`double`||a===`template`){if(t===`\\`&&o!==void 0){s!==null&&(s+=t+o),r+=t+o,n+=`  `,i+=2;continue}s!==null&&(s+=t),r+=t,n+=` `,i++,(a===`single`&&t===`'`||a===`double`&&t===`"`||a===`template`&&t==="`")&&(a=`code`,c());continue}if(t===`/`&&o===`/`){i=e.length;continue}if(t===`/`&&o===`*`){i+=2,a=`block`;continue}if(t===`'`||t===`"`||t==="`"){let e=s===null&&ne(n);r+=t,n+=` `,i++,a=t===`'`?`single`:t===`"`?`double`:`template`,e&&(s=``);continue}if(t===`/`&&k(n)){let t=i+1,a=!1;for(;t<e.length;){let n=e[t];if(n===`\\`){t+=2;continue}if(n===`[`)a=!0;else if(n===`]`)a=!1;else if(n===`/`&&!a)break;t++}let o=t<e.length?t+1:e.length;for(;o<e.length&&/[dgimsuvy]/.test(e[o]);)o++;n+=` `.repeat(o-i),r+=` `.repeat(o-i),i=o;continue}n+=t,r+=t,i++}return t.inBlockComment=a===`block`,t.inTemplate=a===`template`,{code:n,raw:r,imports:o}}function k(e){let t=e.length-1;for(;t>=0&&/\s/.test(e[t]);)t--;if(t<0||`(=,:[;!&|?{`.includes(e[t]))return!0;let n=e.slice(0,t+1);return/\b(?:return|typeof|instanceof|in|of|new|case|void|delete|do|else|yield)\s*$/.test(n)}function A(e){return e.replace(/^node:/,``)}function j(e,t){try{let n=i.default.openSync(e,`r`);try{let e=new Uint8Array(t),r=i.default.readSync(n,e,0,t,0),a=Buffer.from(e.subarray(0,r)).toString(`utf-8`),o=a.lastIndexOf(`
+`);return o!==-1&&(a=a.slice(0,o)),a}finally{i.default.closeSync(n)}}catch{return null}}function M(e,t,n={}){let a=n.maxFiles??300,o=n.maxTotalBytes??8388608,s=y(e,t,a),c=[],l=new Set,u=0,d=(e,t,n,r,i,a,o,s=``)=>{let u=`${e}|${i}|${a}|${s}`;l.has(u)||(l.add(u),c.push({ruleId:e,category:t,severity:n,message:r,file:i,line:a,snippet:o}))},f=(e,t)=>{let n=e.split(`
+`),r={inBlockComment:!1,inTemplate:!1};for(let e=0;e<n.length;e++){let i=n[e],{code:a,raw:o,imports:s}=O(i,r),c=e+1,l=i.trim().slice(0,120);if(S.test(o)){let e=[];for(let t of x){let n=t.layer===`raw`?o:a;t.pattern.test(n)&&(!t.codeGuard||t.codeGuard.test(a))&&e.push(t)}let n=e.some(e=>e.id===`new-function`);for(let r of e)n&&r.id===`function-constructor`||d(r.id,r.category,r.severity,r.description,t,c,l);if(te.test(o)&&/\b(?:fs|require)\b/.test(a)){if(w.test(o)){let e=E[`fs-write-sensitive`];d(`fs-write-sensitive`,e.category,e.severity,e.message,t,c,l)}if(T.test(o)){let e=E[`fs-read-sensitive`];d(`fs-read-sensitive`,e.category,e.severity,e.message,t,c,l)}}}for(let e of s){if(D.test(e)){d(`remote-code-import`,`dynamic-code`,`high`,`Loads code from a remote URL at runtime: ${e.slice(0,80)}`,t,c,l,e);continue}let n=A(e);for(let r of ee)if(r.modules.includes(n)){d(r.id,r.category,r.severity,r.description,t,c,l,e);break}}}},p=0,m=!1;for(let t of s){let n=r.default.relative(e,t),a;try{a=i.default.statSync(t).size}catch{continue}let s=o-p;if(a>s){if(s>0){let e=j(t,s);e!==null&&(u++,f(e,n))}m=!0;break}let c;try{c=i.default.readFileSync(t,`utf-8`)}catch{continue}u++,p+=a,f(c,n)}return m&&d(`scan-truncated`,`metadata`,`warning`,`Scan truncated at ${o} bytes — remaining files were not inspected. Increase maxTotalBytes to audit the full package.`,`package.json`,0),{findings:c,filesScanned:u}}const N=/^(?:git(?:\+[a-z]+)?|https?|file|link|ssh|github):/i;function P(e,t={name:`plugin`}){let n=[],r=e.scripts||{};for(let e of[`preinstall`,`install`,`postinstall`]){let t=r[e];typeof t==`string`&&t.trim().length>0&&n.push({ruleId:`install-script`,category:`metadata`,severity:`high`,message:`Runs a ${e} script during installation — a common supply-chain attack vector`,file:`package.json`,line:0,snippet:`${e}: ${t.trim().slice(0,120)}`})}let i=e.bundledDependencies??e.bundleDependencies;Array.isArray(i)&&i.length>0&&n.push({ruleId:`bundled-deps`,category:`metadata`,severity:`warning`,message:`Bundles dependencies: ${i.join(`, `)} — vendored code that bypasses the registry audit`,file:`package.json`,line:0,snippet:`bundledDependencies: [${i.join(`, `)}]`});let o=[];for(let t of[`dependencies`,`devDependencies`,`optionalDependencies`,`peerDependencies`]){let n=e[t];if(!(!n||typeof n!=`object`))for(let[e,t]of Object.entries(n))typeof t==`string`&&N.test(t)&&o.push(`${e}@${t}`)}if(o.length>0&&n.push({ruleId:`remote-deps`,category:`metadata`,severity:`warning`,message:`Dependencies loaded from non-registry sources (git/file/URL): ${o.join(`, `)}`,file:`package.json`,line:0,snippet:o.slice(0,3).join(`, `)}),!e.license&&!e.licenses&&n.push({ruleId:`no-license`,category:`metadata`,severity:`low`,message:`Package declares no license`,file:`package.json`,line:0}),!e.repository&&!e.homepage&&n.push({ruleId:`no-provenance`,category:`metadata`,severity:`low`,message:`Package declares no repository or homepage — harder to verify provenance`,file:`package.json`,line:0}),t.boltdocsVersion&&typeof e.version==`string`)try{a.default.satisfies(e.version,t.boltdocsVersion)||n.push({ruleId:`version-mismatch`,category:`metadata`,severity:`low`,message:`Installed version ${e.version} does not satisfy the declared boltdocsVersion range ${t.boltdocsVersion}`,file:`package.json`,line:0,snippet:`boltdocsVersion: ${t.boltdocsVersion}`})}catch{}return n}function F(e,t,r={},i){let a=n.t(i?.packageName??e,t);if(!a)return{name:e,status:`unresolved`,filesScanned:0,findings:[]};let o;try{o=M(a.dir,a.pkg,r)}catch(t){return{name:e,status:`error`,pluginDir:a.dir,version:a.version,filesScanned:0,findings:[{ruleId:`scan-error`,category:`metadata`,severity:`warning`,message:`Static scan failed: ${t instanceof Error?t.message:String(t)}`,file:`package.json`,line:0}]}}let s=[...o.findings];s.push(...P(a.pkg,{name:e,boltdocsVersion:i?.boltdocsVersion}));let c=l(s.map(e=>e.severity));return{name:e,status:s.length===0?`clean`:`warning`,severity:c,pluginDir:a.dir,version:a.version,filesScanned:o.filesScanned,findings:s}}function I(e,t,n={}){let r=[];for(let i of e)!i||typeof i.name!=`string`||!i.name||r.push(F(i.name,t,n,i));return r}const L=/from\s+(['"])([^'"]+)\1/g;function R(e){let t=[];L.lastIndex=0;for(let n=L.exec(e);n!==null;n=L.exec(e))t.push(n[2]);return t}function z(e){let t=e.lastIndexOf(`/`);return t>=0?e.slice(t+1):e}function B(e,t,n){let r=0;if(t.pkgName===e)r=100;else{let n=z(t.pkgName);n===e?r=60:e.endsWith(n)&&(r=40)}return r>0&&n&&t.version===n&&(r+=15),r}function V(e,t){let n;try{n=i.default.readFileSync(e,`utf-8`)}catch{return[]}let a=(0,o.createRequire)(e),s=[],c=new Set;for(let e of R(n)){if(e.startsWith(`.`)||e.startsWith(`/`))continue;let n=null;try{n=a.resolve(`${e}/package.json`)}catch{let a=r.default.resolve(t,`node_modules`,e,`package.json`);i.default.existsSync(a)&&(n=a)}if(!n||!i.default.existsSync(n))continue;let o;try{o=JSON.parse(i.default.readFileSync(n,`utf-8`))}catch{continue}let l=typeof o.name==`string`?o.name:e;l!==`boltdocs`&&(c.has(l)||(c.add(l),s.push({pkgName:l,version:typeof o.version==`string`?o.version:void 0})))}return s}function H(e,t,n){if(n.length===0)return;let r=V(e,t);if(r.length!==0)for(let e of n){if(!e||typeof e.name!=`string`||!e.name)continue;let t=null,n=0;for(let i of r){let r=B(e.name,i,e.version);r>n&&(n=r,t=i)}t&&(e.packageName=t.pkgName)}}async function ie(e){let n;for(let a of t.t){let t=r.default.resolve(e,a);if(i.default.existsSync(t))try{let{createJiti:n}=await import(`jiti`),r=await n(e,{interopDefault:!0}).import(t)??{},i=r.default??r.config??r;if(!i||typeof i!=`object`)throw Error(`config file did not export an object`);if(!(`plugins`in i))return{plugins:[],configFile:t};if(!Array.isArray(i.plugins))throw Error(`config.plugins must be an array, got ${typeof i.plugins}`);let a=i.plugins;return H(t,e,a),{plugins:a,configFile:t}}catch(e){n=e}}if(n!==void 0)throw Error(`Failed to load Boltdocs configuration: ${n instanceof Error?n.message:String(n)}`,{cause:n});return{plugins:[]}}const U=!(`NO_COLOR`in process.env)&&(process.stdout?.isTTY??!1),W=RegExp(`\x1B\\[[0-9;]*m`,`g`);function G(e){return e.replace(W,``).length}function K(e,t){return U?`\u001b[${e}m${t}\u001b[0m`:t}const q={red:e=>K(31,e),yellow:e=>K(33,e),cyan:e=>K(36,e),green:e=>K(32,e),gray:e=>K(90,e),bold:e=>K(1,e),dim:e=>K(2,e)},J=e=>K(`38;2;235;88;40`,e);function Y(e,t,n,r){let i=n.match(/^\n+/)?.[0]??``,a=n.slice(i.length),o=`${q.bold(`[boltdocs]`)} ${a}`,s=e===`stderr`?console.error:console.log;i&&s(i),s(t(o)),r!==void 0&&s(r)}const ae=e=>Y(`stdout`,q.gray,e),X=e=>Y(`stdout`,q.yellow,e),Z=e=>Y(`stdout`,q.green,e),oe=(e,t)=>Y(`stderr`,q.red,e,t);function se(e,t){let n=Math.max(e.length,...t.map(e=>e.length)),r=[];for(let i=0;i<n;i++){let n=e[i]?G(e[i]):0;for(let e of t)n=Math.max(n,G(e[i]??``));r[i]=n+2}let i={h:`─`,v:`│`,tl:`┌`,tm:`┬`,tr:`┐`,ml:`├`,mm:`┼`,mr:`┤`,bl:`└`,bm:`┴`,br:`┘`},a=(e,t,n)=>J(e+r.map(e=>i.h.repeat(e)).join(t)+n),o=e=>J(i.v)+e.map((e,t)=>{let n=e??``;return` `.repeat(1)+n+` `.repeat(r[t]-G(n)-1)}).join(J(i.v))+J(i.v),s=[a(i.tl,i.tm,i.tr)];e.length>0&&(s.push(o(e.map(e=>q.bold(e)))),s.push(a(i.ml,i.mm,i.mr)));for(let e of t)s.push(o(e));return s.push(a(i.bl,i.bm,i.br)),s.join(`
+`)}function Q(e,t){return e+` `.repeat(Math.max(0,t-G(e)))}function $(e){return e.status===`error`?`✖ Scan error`:e.status===`unresolved`?`❓ Unresolved`:e.severity===`high`?`⚠️ High risk`:e.severity===`warning`?`⚠️ Warning`:e.severity===`low`?`ℹ️ Low risk`:`✅ Clean`}function ce(e){return e.status===`error`||e.severity===`high`?q.red:e.severity===`warning`?q.yellow:e.severity===`low`?J:q.green}async function le(e=process.cwd()){ae(`Starting static security audit of Boltdocs plugins...`);let t;try{t=(await ie(e)).plugins}catch(e){oe(`Failed to load Boltdocs configuration for audit:`,e),process.exit(1)}if(t.length===0){Z(`No plugins configured. Nothing to audit.`);return}let n=[...I(t,e)].sort((e,t)=>c[t.severity||`low`]-c[e.severity||`low`]||e.name.localeCompare(t.name));for(let e of n){let t=e.version?`${e.name}@${e.version}`:e.name;if(e.status===`unresolved`){X(`\n${J(t)} — ${q.yellow(`❓ Unresolved`)} (could not locate the package in node_modules)`);continue}let n=e.findings.length===0?`no findings`:`${e.findings.length} finding${e.findings.length===1?``:`s`}`;console.log(`\n${q.bold(J(t))} — ${ce(e)($(e))} (${n} · ${e.filesScanned} file${e.filesScanned===1?``:`s`} scanned)`);let r=[...e.findings].sort((e,t)=>c[t.severity]-c[e.severity]||e.file.localeCompare(t.file)||e.line-t.line);for(let e of r){let t=e.file===`package.json`?`package.json`:`${e.file}:${e.line}`,n=e.severity===`high`?q.red(e.severity):e.severity===`warning`?q.yellow(e.severity):q.dim(e.severity);console.log(`  ${Q(q.dim(t),36)}${Q(n,9)}[${q.dim(e.category)}] ${q.bold(e.ruleId)} — ${e.message}${e.snippet?q.dim(`  (${e.snippet})`):``}`)}}console.log(`
+`+se([`Plugin`,`Status`,`Findings`],n.map(e=>[e.name,$(e),e.status===`unresolved`?`—`:String(e.findings.length)]))+`
+`);let r=n.some(e=>e.status===`error`),i=n.some(e=>e.status===`unresolved`),a=n.some(e=>e.severity===`high`),o=n.some(e=>e.findings.length>0),s=n.some(e=>e.findings.some(e=>e.ruleId===`scan-truncated`));(r||i)&&X(`✖ One or more plugins could not be scanned (unresolved or scan error). Treat them as untrusted until they are re-audited.`),a?X(`⚠️  One or more plugins contain HIGH-risk findings (arbitrary code execution, sensitive file access). Review them before using the plugin.`):o&&!r&&!i&&X(`⚠️  One or more plugins have findings. Review the details above.`),!r&&!i&&!a&&!o&&Z(`✓ All plugins passed the static security check!`),(a||r||i||s)&&(process.exitCode=1)}exports.auditAction=le;

package/dist/build-D6FfNA8m.cjs

@@ -0,0 +1,6 @@
+/**
+ * Boltdocs - https://boltdocs.vercel.app
+ * Copyright (c) 2026 Jesus Alcala
+ * Licensed under the MIT License.
+ */
+const e=require(`./chunk-D1Md3oWO.cjs`),t=require(`./node-TpmWEqXM.cjs`),n=require(`./node/cache.cjs`),r=require(`./update-check-BKqmYfwT.cjs`);let i=require(`node:path`);i=e.r(i);let a=require(`node:fs`);a=e.r(a);let o=require(`@bdocs/dui`),s=require(`vite`);const c=new Set([`Client build`,`Server build`,`Render pages`,`Static loader data`,`Build metrics`]);function l(e,t){let n=i.default.join(e,`.boltdocs`,`benchmarks`);a.default.existsSync(n)||a.default.mkdirSync(n,{recursive:!0});let r=i.default.join(n,`phases-report-${new Date().toISOString().replace(/[:.]/g,`-`).slice(0,19)}.json`),o={timestamp:new Date().toISOString(),root:e,...t,error:t.error?.message||t.error?.toString()};return a.default.writeFileSync(r,JSON.stringify(o,null,2)),r}async function u(e=process.cwd(),i={}){process.env.NODE_ENV=`production`,r.t();let a=process.env.BOLTDOCS_BENCHMARK_PHASES===`true`;try{let i=await t.c().run({root:e,timing:{}});if(a&&console.log(`[boltdocs] ${JSON.stringify({name:`Build pipeline`,success:i.success,steps:i.stepResults.map(e=>({name:e.name,duration:Math.round(e.duration),success:e.success,...e.details?{details:e.details}:{}}))})}`),!i.success){if((0,o.error)(`Build failed at step "${i.failedStep}":`,i.error),a){let t=l(e,i);console.log(`[benchmark] failure report written to ${t}`)}await n.flushCache(),process.exit(1)}if(a){let t=l(e,i);console.log(`[benchmark] phase report written to ${t}`),await n.flushCache(),process.exit(0)}let s=i.stepResults.filter(e=>!c.has(e.name)),u=i.stepResults.find(e=>e.name===`Build metrics`)?.metrics,d=e=>(e/1024).toFixed(0),f=e=>(e/1024/1024).toFixed(1),p=e=>e>1024*1024?`${f(e)} MB`:`${d(e)} kB`;console.log(r.a({totalMs:i.timing.total,steps:s.map(e=>({name:e.name,success:e.success,duration:e.duration,details:e.details})),pages:u?.totalPages,jsSize:u?p(u.jsSize):void 0,cssSize:u?p(u.cssSize):void 0,outDir:`dist/`})),await n.flushCache(),process.exit(0)}catch(e){(0,o.error)(`Build failed:`,e),await n.flushCache(),process.exit(1)}}async function d(e=process.cwd(),n={}){try{let i=await t.n(e,`production`,void 0,{skipTypes:!0,skipLinkTree:!0});i.logLevel=`warn`,i.clearScreen=!1,n.port!==void 0&&(i.preview=i.preview||{},i.preview.port=Number(n.port)),n.host!==void 0&&(i.preview=i.preview||{},i.preview.host=n.host);let a=performance.now(),o=(await(0,s.preview)(i)).resolvedUrls;console.log(r.c(o?.local?.[0]??`http://localhost:${n.port??4173}`,o?.network?.[0]??null,{readyIn:performance.now()-a}))}catch(e){(0,o.error)(`Failed to start preview server:`,e),process.exit(1)}}exports.buildAction=u,exports.previewAction=d;

package/dist/build-D_7SvwTh.mjs

@@ -0,0 +1,6 @@
+/**
+ * Boltdocs - https://boltdocs.vercel.app
+ * Copyright (c) 2026 Jesus Alcala
+ * Licensed under the MIT License.
+ */
+import{c as e,n as t}from"./node-BFNCsPs3.mjs";import{flushCache as n}from"./node/cache.mjs";import{a as r,c as i,t as a}from"./update-check-QnrVR3q1.mjs";import o from"node:path";import s from"node:fs";import{error as c}from"@bdocs/dui";import{preview as l}from"vite";const u=new Set([`Client build`,`Server build`,`Render pages`,`Static loader data`,`Build metrics`]);function d(e,t){let n=o.join(e,`.boltdocs`,`benchmarks`);s.existsSync(n)||s.mkdirSync(n,{recursive:!0});let r=o.join(n,`phases-report-${new Date().toISOString().replace(/[:.]/g,`-`).slice(0,19)}.json`),i={timestamp:new Date().toISOString(),root:e,...t,error:t.error?.message||t.error?.toString()};return s.writeFileSync(r,JSON.stringify(i,null,2)),r}async function f(t=process.cwd(),i={}){process.env.NODE_ENV=`production`,a();let o=process.env.BOLTDOCS_BENCHMARK_PHASES===`true`;try{let i=await e().run({root:t,timing:{}});if(o&&console.log(`[boltdocs] ${JSON.stringify({name:`Build pipeline`,success:i.success,steps:i.stepResults.map(e=>({name:e.name,duration:Math.round(e.duration),success:e.success,...e.details?{details:e.details}:{}}))})}`),!i.success){if(c(`Build failed at step "${i.failedStep}":`,i.error),o){let e=d(t,i);console.log(`[benchmark] failure report written to ${e}`)}await n(),process.exit(1)}if(o){let e=d(t,i);console.log(`[benchmark] phase report written to ${e}`),await n(),process.exit(0)}let a=i.stepResults.filter(e=>!u.has(e.name)),s=i.stepResults.find(e=>e.name===`Build metrics`)?.metrics,l=e=>(e/1024).toFixed(0),f=e=>(e/1024/1024).toFixed(1),p=e=>e>1024*1024?`${f(e)} MB`:`${l(e)} kB`;console.log(r({totalMs:i.timing.total,steps:a.map(e=>({name:e.name,success:e.success,duration:e.duration,details:e.details})),pages:s?.totalPages,jsSize:s?p(s.jsSize):void 0,cssSize:s?p(s.cssSize):void 0,outDir:`dist/`})),await n(),process.exit(0)}catch(e){c(`Build failed:`,e),await n(),process.exit(1)}}async function p(e=process.cwd(),n={}){try{let r=await t(e,`production`,void 0,{skipTypes:!0,skipLinkTree:!0});r.logLevel=`warn`,r.clearScreen=!1,n.port!==void 0&&(r.preview=r.preview||{},r.preview.port=Number(n.port)),n.host!==void 0&&(r.preview=r.preview||{},r.preview.host=n.host);let a=performance.now(),o=(await l(r)).resolvedUrls;console.log(i(o?.local?.[0]??`http://localhost:${n.port??4173}`,o?.network?.[0]??null,{readyIn:performance.now()-a}))}catch(e){c(`Failed to start preview server:`,e),process.exit(1)}}export{f as buildAction,p as previewAction};

package/dist/cache-CJE9nWLE.cjs

@@ -0,0 +1,6 @@
+/**
+ * Boltdocs - https://boltdocs.vercel.app
+ * Copyright (c) 2026 Jesus Alcala
+ * Licensed under the MIT License.
+ */
+const e=require(`./chunk-D1Md3oWO.cjs`),t=require(`./utils-ej6_SjIZ.cjs`),n=require(`./node/cache.cjs`);let r=require(`node:path`);r=e.r(r);let i=require(`node:fs`);i=e.r(i);let a=require(`node:crypto`);a=e.r(a);const o=`v2.5`;var s=class{memoryCache=new Map;cacheDir;constructor(e=process.cwd(),n=`legacy`){let i=t.o();this.cacheDir=r.default.resolve(e,i.dir,`parser-${n}`)}async get(e){if(t.o().noCache)return null;try{let t=await i.default.promises.stat(e),n=this.memoryCache.get(e);if(n&&n.mtime===t.mtimeMs)return n.data;let s=a.default.createHash(`md5`).update(e).digest(`hex`),c=r.default.join(this.cacheDir,`${s}.json`);try{let n=await i.default.promises.readFile(c,`utf-8`),r=JSON.parse(n);return r._mtime!==t.mtimeMs||r._v!==o?null:(this.memoryCache.set(e,{data:r.data,mtime:r._mtime}),r.data)}catch{return null}}catch{return null}}async set(e,s){if(!t.o().noCache)try{let t=await i.default.promises.stat(e);this.memoryCache.set(e,{data:s,mtime:t.mtimeMs});let c=a.default.createHash(`md5`).update(e).digest(`hex`),l=r.default.join(this.cacheDir,`${c}.json`),u=JSON.stringify({_v:o,_mtime:t.mtimeMs,data:s});n.globalBackgroundQueue.add(async()=>{try{await i.default.promises.mkdir(this.cacheDir,{recursive:!0}),await i.default.promises.writeFile(l,u)}catch{}})}catch{}}invalidate(e){this.memoryCache.delete(e)}clear(){this.memoryCache.clear()}get size(){return this.memoryCache.size}};const c=new s;(function(e){e.get=e=>c.get(e),e.set=(e,t)=>c.set(e,t),e.invalidate=e=>c.invalidate(e),e.clear=()=>c.clear()})(s||={}),Object.defineProperty(exports,`t`,{enumerable:!0,get:function(){return s}});

package/dist/cache-OY4HzIXl.mjs

@@ -0,0 +1,6 @@
+/**
+ * Boltdocs - https://boltdocs.vercel.app
+ * Copyright (c) 2026 Jesus Alcala
+ * Licensed under the MIT License.
+ */
+import{o as e}from"./utils-8lzafE49.mjs";import{globalBackgroundQueue as t}from"./node/cache.mjs";import n from"node:path";import r from"node:fs";import i from"node:crypto";const a=`v2.5`;var o=class{memoryCache=new Map;cacheDir;constructor(t=process.cwd(),r=`legacy`){let i=e();this.cacheDir=n.resolve(t,i.dir,`parser-${r}`)}async get(t){if(e().noCache)return null;try{let e=await r.promises.stat(t),o=this.memoryCache.get(t);if(o&&o.mtime===e.mtimeMs)return o.data;let s=i.createHash(`md5`).update(t).digest(`hex`),c=n.join(this.cacheDir,`${s}.json`);try{let n=await r.promises.readFile(c,`utf-8`),i=JSON.parse(n);return i._mtime!==e.mtimeMs||i._v!==a?null:(this.memoryCache.set(t,{data:i.data,mtime:i._mtime}),i.data)}catch{return null}}catch{return null}}async set(o,s){if(!e().noCache)try{let e=await r.promises.stat(o);this.memoryCache.set(o,{data:s,mtime:e.mtimeMs});let c=i.createHash(`md5`).update(o).digest(`hex`),l=n.join(this.cacheDir,`${c}.json`),u=JSON.stringify({_v:a,_mtime:e.mtimeMs,data:s});t.add(async()=>{try{await r.promises.mkdir(this.cacheDir,{recursive:!0}),await r.promises.writeFile(l,u)}catch{}})}catch{}}invalidate(e){this.memoryCache.delete(e)}clear(){this.memoryCache.clear()}get size(){return this.memoryCache.size}};const s=new o;(function(e){e.get=e=>s.get(e),e.set=(e,t)=>s.set(e,t),e.invalidate=e=>s.invalidate(e),e.clear=()=>s.clear()})(o||={});export{o as t};

package/dist/callout-oI_LCbxS.d.ts

@@ -0,0 +1,71 @@
+
+import { HTMLAttributes, ReactNode } from "react";
+import * as _$react_jsx_runtime0 from "react/jsx-runtime";
+
+//#region src/client/components/primitives/callout.d.ts
+type CalloutVariant = 'note' | 'tip' | 'warning' | 'danger' | 'info';
+interface CalloutRootProps extends Omit<HTMLAttributes<HTMLDivElement>, 'title' | 'color'> {
+  /** The callout variant. Exposed as `data-variant` for theme styling. */
+  variant?: CalloutVariant;
+}
+interface CalloutTitleProps extends HTMLAttributes<HTMLElement> {
+  as?: 'div' | 'p' | 'h1' | 'h2' | 'h3' | 'h4' | 'h5' | 'h6';
+}
+interface CalloutProps extends CalloutRootProps {
+  title?: ReactNode;
+  /** Custom leading icon. Replaces the default per-variant icon. */
+  icon?: ReactNode;
+  /** Class name for the leading icon wrapper. */
+  iconClassName?: string;
+  /** Class name for the title element. */
+  titleClassName?: string;
+  /** Class name for the body wrapper. */
+  bodyClassName?: string;
+}
+/**
+ * Style-neutral callout primitives.
+ *
+ * Own structure and expose state via `data-callout-root` / `data-variant`.
+ * No colors, borders, or sizes are baked in — the theme owns all visuals.
+ */
+declare function Callout({
+  children,
+  variant,
+  title,
+  icon,
+  className,
+  iconClassName,
+  titleClassName,
+  bodyClassName,
+  ...props
+}: CalloutProps): _$react_jsx_runtime0.JSX.Element;
+declare namespace Callout {
+  var Root: typeof CalloutRoot;
+  var Icon: typeof CalloutIcon;
+  var Title: typeof CalloutTitle;
+  var Body: typeof CalloutBody;
+}
+declare function CalloutRoot({
+  variant,
+  children,
+  className,
+  ...props
+}: CalloutRootProps): _$react_jsx_runtime0.JSX.Element;
+declare function CalloutIcon({
+  children,
+  className,
+  ...props
+}: Pick<HTMLAttributes<HTMLDivElement>, 'children' | 'className'>): _$react_jsx_runtime0.JSX.Element;
+declare function CalloutTitle({
+  children,
+  className,
+  as: Tag,
+  ...props
+}: CalloutTitleProps): _$react_jsx_runtime0.JSX.Element;
+declare function CalloutBody({
+  children,
+  className,
+  ...props
+}: HTMLAttributes<HTMLDivElement>): _$react_jsx_runtime0.JSX.Element;
+//#endregion
+export { CalloutRoot as a, CalloutTitleProps as c, CalloutProps as i, CalloutVariant as l, CalloutBody as n, CalloutRootProps as o, CalloutIcon as r, CalloutTitle as s, Callout as t };

package/dist/callout-plqx9Dw-.d.cts

@@ -0,0 +1,71 @@
+
+import { HTMLAttributes, ReactNode } from "react";
+import * as _$react_jsx_runtime0 from "react/jsx-runtime";
+
+//#region src/client/components/primitives/callout.d.ts
+type CalloutVariant = 'note' | 'tip' | 'warning' | 'danger' | 'info';
+interface CalloutRootProps extends Omit<HTMLAttributes<HTMLDivElement>, 'title' | 'color'> {
+  /** The callout variant. Exposed as `data-variant` for theme styling. */
+  variant?: CalloutVariant;
+}
+interface CalloutTitleProps extends HTMLAttributes<HTMLElement> {
+  as?: 'div' | 'p' | 'h1' | 'h2' | 'h3' | 'h4' | 'h5' | 'h6';
+}
+interface CalloutProps extends CalloutRootProps {
+  title?: ReactNode;
+  /** Custom leading icon. Replaces the default per-variant icon. */
+  icon?: ReactNode;
+  /** Class name for the leading icon wrapper. */
+  iconClassName?: string;
+  /** Class name for the title element. */
+  titleClassName?: string;
+  /** Class name for the body wrapper. */
+  bodyClassName?: string;
+}
+/**
+ * Style-neutral callout primitives.
+ *
+ * Own structure and expose state via `data-callout-root` / `data-variant`.
+ * No colors, borders, or sizes are baked in — the theme owns all visuals.
+ */
+declare function Callout({
+  children,
+  variant,
+  title,
+  icon,
+  className,
+  iconClassName,
+  titleClassName,
+  bodyClassName,
+  ...props
+}: CalloutProps): _$react_jsx_runtime0.JSX.Element;
+declare namespace Callout {
+  var Root: typeof CalloutRoot;
+  var Icon: typeof CalloutIcon;
+  var Title: typeof CalloutTitle;
+  var Body: typeof CalloutBody;
+}
+declare function CalloutRoot({
+  variant,
+  children,
+  className,
+  ...props
+}: CalloutRootProps): _$react_jsx_runtime0.JSX.Element;
+declare function CalloutIcon({
+  children,
+  className,
+  ...props
+}: Pick<HTMLAttributes<HTMLDivElement>, 'children' | 'className'>): _$react_jsx_runtime0.JSX.Element;
+declare function CalloutTitle({
+  children,
+  className,
+  as: Tag,
+  ...props
+}: CalloutTitleProps): _$react_jsx_runtime0.JSX.Element;
+declare function CalloutBody({
+  children,
+  className,
+  ...props
+}: HTMLAttributes<HTMLDivElement>): _$react_jsx_runtime0.JSX.Element;
+//#endregion
+export { CalloutRoot as a, CalloutTitleProps as c, CalloutProps as i, CalloutVariant as l, CalloutBody as n, CalloutRootProps as o, CalloutIcon as r, CalloutTitle as s, Callout as t };