boltdocs 3.3.2 → 3.3.3

package/dist/{adapters-BmB4TKCc.mjs → adapters-BKzKe2mO.mjs}

@@ -3,4 +3,4 @@
  * Copyright (c) 2026 Jesus Alcala
  * Licensed under the MIT License.
  */
-import{t as e}from"./handler-D7UyZlPm.mjs";const t={"Access-Control-Allow-Origin":`*`,"Access-Control-Allow-Methods":`POST, OPTIONS`,"Access-Control-Allow-Headers":`Content-Type`,"Content-Type":`application/json`};async function n(n,r){if(Object.entries(t).forEach(([e,t])=>{r.setHeader(e,t)}),n.method===`OPTIONS`){r.status(200).end();return}if(n.method!==`POST`){r.status(405).json({error:`Method Not Allowed`});return}try{let t=await e(n.body,process.env);r.status(200).json(t)}catch(e){let t=e instanceof Error?e.message:`Failed to submit feedback`;return r.status(500).json({error:t})}}async function r(n,r=process.env){let i=(e,n=200)=>({statusCode:n,headers:t,body:e?JSON.stringify(e):``});if(n.httpMethod===`OPTIONS`)return i(null,200);if(n.httpMethod!==`POST`)return i({error:`Method Not Allowed`},405);try{return i(await e(n.body?JSON.parse(n.body):{},r))}catch(e){return i({error:e instanceof Error?e.message:`Failed to submit feedback`},500)}}async function i(n,r={}){let i=(e,n=200)=>new Response(e?JSON.stringify(e):null,{status:n,headers:t});if(n.method===`OPTIONS`)return i(null);if(n.method!==`POST`)return i({error:`Method Not Allowed`},405);try{return i(await e(await n.json(),{...process.env,...r}))}catch(e){return i({error:e instanceof Error?e.message:`Failed to submit feedback`},500)}}async function a(n,r=process.env){let i=(e,n=200)=>({statusCode:n,headers:t,body:e?JSON.stringify(e):``});if(n.httpMethod===`OPTIONS`)return i(null,200);if(n.httpMethod!==`POST`)return i({error:`Method Not Allowed`},405);try{return i(await e(n.body?JSON.parse(n.body):{},r))}catch(e){return i({error:e instanceof Error?e.message:`Failed to submit feedback`},500)}}export{n as i,i as n,r,a as t};
+import{t as e}from"./handler-Lex5DbvG.mjs";const t={"Access-Control-Allow-Origin":`*`,"Access-Control-Allow-Methods":`POST, OPTIONS`,"Access-Control-Allow-Headers":`Content-Type`,"Content-Type":`application/json`};async function n(n,r){if(Object.entries(t).forEach(([e,t])=>{r.setHeader(e,t)}),n.method===`OPTIONS`){r.status(200).end();return}if(n.method!==`POST`){r.status(405).json({error:`Method Not Allowed`});return}try{let t=await e(n.body,process.env);r.status(200).json(t)}catch(e){let t=e instanceof Error?e.message:`Failed to submit feedback`;return r.status(500).json({error:t})}}async function r(n,r=process.env){let i=(e,n=200)=>({statusCode:n,headers:t,body:e?JSON.stringify(e):``});if(n.httpMethod===`OPTIONS`)return i(null,200);if(n.httpMethod!==`POST`)return i({error:`Method Not Allowed`},405);try{return i(await e(n.body?JSON.parse(n.body):{},r))}catch(e){return i({error:e instanceof Error?e.message:`Failed to submit feedback`},500)}}async function i(n,r={}){let i=(e,n=200)=>new Response(e?JSON.stringify(e):null,{status:n,headers:t});if(n.method===`OPTIONS`)return i(null);if(n.method!==`POST`)return i({error:`Method Not Allowed`},405);try{return i(await e(await n.json(),{...process.env,...r}))}catch(e){return i({error:e instanceof Error?e.message:`Failed to submit feedback`},500)}}async function a(n,r=process.env){let i=(e,n=200)=>({statusCode:n,headers:t,body:e?JSON.stringify(e):``});if(n.httpMethod===`OPTIONS`)return i(null,200);if(n.httpMethod!==`POST`)return i({error:`Method Not Allowed`},405);try{return i(await e(n.body?JSON.parse(n.body):{},r))}catch(e){return i({error:e instanceof Error?e.message:`Failed to submit feedback`},500)}}export{n as i,i as n,r,a as t};

package/dist/{adapters-Cp1Maurn.cjs → adapters-DwDTQoCG.cjs}

@@ -3,4 +3,4 @@
  * Copyright (c) 2026 Jesus Alcala
  * Licensed under the MIT License.
  */
-const e=require(`./handler-CDEoKARD.cjs`),t={"Access-Control-Allow-Origin":`*`,"Access-Control-Allow-Methods":`POST, OPTIONS`,"Access-Control-Allow-Headers":`Content-Type`,"Content-Type":`application/json`};async function n(n,r){if(Object.entries(t).forEach(([e,t])=>{r.setHeader(e,t)}),n.method===`OPTIONS`){r.status(200).end();return}if(n.method!==`POST`){r.status(405).json({error:`Method Not Allowed`});return}try{let t=await e.t(n.body,process.env);r.status(200).json(t)}catch(e){let t=e instanceof Error?e.message:`Failed to submit feedback`;return r.status(500).json({error:t})}}async function r(n,r=process.env){let i=(e,n=200)=>({statusCode:n,headers:t,body:e?JSON.stringify(e):``});if(n.httpMethod===`OPTIONS`)return i(null,200);if(n.httpMethod!==`POST`)return i({error:`Method Not Allowed`},405);try{return i(await e.t(n.body?JSON.parse(n.body):{},r))}catch(e){return i({error:e instanceof Error?e.message:`Failed to submit feedback`},500)}}async function i(n,r={}){let i=(e,n=200)=>new Response(e?JSON.stringify(e):null,{status:n,headers:t});if(n.method===`OPTIONS`)return i(null);if(n.method!==`POST`)return i({error:`Method Not Allowed`},405);try{return i(await e.t(await n.json(),{...process.env,...r}))}catch(e){return i({error:e instanceof Error?e.message:`Failed to submit feedback`},500)}}async function a(n,r=process.env){let i=(e,n=200)=>({statusCode:n,headers:t,body:e?JSON.stringify(e):``});if(n.httpMethod===`OPTIONS`)return i(null,200);if(n.httpMethod!==`POST`)return i({error:`Method Not Allowed`},405);try{return i(await e.t(n.body?JSON.parse(n.body):{},r))}catch(e){return i({error:e instanceof Error?e.message:`Failed to submit feedback`},500)}}Object.defineProperty(exports,`i`,{enumerable:!0,get:function(){return n}}),Object.defineProperty(exports,`n`,{enumerable:!0,get:function(){return i}}),Object.defineProperty(exports,`r`,{enumerable:!0,get:function(){return r}}),Object.defineProperty(exports,`t`,{enumerable:!0,get:function(){return a}});
+const e=require(`./handler-Ch-Q9NAB.cjs`),t={"Access-Control-Allow-Origin":`*`,"Access-Control-Allow-Methods":`POST, OPTIONS`,"Access-Control-Allow-Headers":`Content-Type`,"Content-Type":`application/json`};async function n(n,r){if(Object.entries(t).forEach(([e,t])=>{r.setHeader(e,t)}),n.method===`OPTIONS`){r.status(200).end();return}if(n.method!==`POST`){r.status(405).json({error:`Method Not Allowed`});return}try{let t=await e.t(n.body,process.env);r.status(200).json(t)}catch(e){let t=e instanceof Error?e.message:`Failed to submit feedback`;return r.status(500).json({error:t})}}async function r(n,r=process.env){let i=(e,n=200)=>({statusCode:n,headers:t,body:e?JSON.stringify(e):``});if(n.httpMethod===`OPTIONS`)return i(null,200);if(n.httpMethod!==`POST`)return i({error:`Method Not Allowed`},405);try{return i(await e.t(n.body?JSON.parse(n.body):{},r))}catch(e){return i({error:e instanceof Error?e.message:`Failed to submit feedback`},500)}}async function i(n,r={}){let i=(e,n=200)=>new Response(e?JSON.stringify(e):null,{status:n,headers:t});if(n.method===`OPTIONS`)return i(null);if(n.method!==`POST`)return i({error:`Method Not Allowed`},405);try{return i(await e.t(await n.json(),{...process.env,...r}))}catch(e){return i({error:e instanceof Error?e.message:`Failed to submit feedback`},500)}}async function a(n,r=process.env){let i=(e,n=200)=>({statusCode:n,headers:t,body:e?JSON.stringify(e):``});if(n.httpMethod===`OPTIONS`)return i(null,200);if(n.httpMethod!==`POST`)return i({error:`Method Not Allowed`},405);try{return i(await e.t(n.body?JSON.parse(n.body):{},r))}catch(e){return i({error:e instanceof Error?e.message:`Failed to submit feedback`},500)}}Object.defineProperty(exports,`i`,{enumerable:!0,get:function(){return n}}),Object.defineProperty(exports,`n`,{enumerable:!0,get:function(){return i}}),Object.defineProperty(exports,`r`,{enumerable:!0,get:function(){return r}}),Object.defineProperty(exports,`t`,{enumerable:!0,get:function(){return a}});

package/dist/{audit-COgjnQ5n.cjs → audit-CHkGiV3c.cjs}

@@ -3,7 +3,7 @@
  * Copyright (c) 2026 Jesus Alcala
  * Licensed under the MIT License.
  */
-const e=require(`./chunk-D1Md3oWO.cjs`),t=require(`./config-files-D9cdBMl2.cjs`),n=require(`./resolve-It1Iug83.cjs`);let r=require(`node:path`);r=e.r(r);let i=require(`node:fs`);i=e.r(i);let a=require(`semver`);a=e.r(a);let o=require(`node:module`),s=require(`picomatch`);s=e.r(s);const c={high:3,warning:2,low:1};function l(e){let t;for(let n of e)(!t||c[n]>c[t])&&(t=n);return t}const u=/\.(?:js|mjs|cjs|ts|tsx|jsx)$/,d=/\.(?:d\.ts|map)$/,f=/\.(?:test|spec)\.(?:js|mjs|cjs|ts|tsx|jsx)$/,p=new Set([`node_modules`,`.git`,`dist`,`coverage`,`test`,`__tests__`,`tests`,`spec`,`fixture`,`fixtures`,`example`,`examples`,`benchmark`,`benchmarks`,`.github`,`docs`]);function m(e){return u.test(e)&&!d.test(e)&&!f.test(e)}function h(e,t,n,a,o){if(o>16)return;let s;try{s=i.default.realpathSync(e)}catch{return}if(a.has(s))return;a.add(s);let c;try{c=i.default.readdirSync(e)}catch{return}for(let s of c){let c=r.default.join(e,s),l;try{l=i.default.statSync(c)}catch{continue}if(l.isDirectory()){if(n&&p.has(s))continue;h(c,t,n,a,o+1)}else m(s)&&t(c)}}function g(e,t){if(typeof e==`string`)t.push(e);else if(e&&typeof e==`object`)for(let n of Object.values(e))g(n,t)}function _(e,t){let n=[];for(let e of[`main`,`module`,`browser`,`bin`,`exports`])g(t[e],n);let a=[],o=new Set;for(let t of n){if(!t)continue;let n=r.default.resolve(e,t);if(!o.has(n)){o.add(n);try{i.default.existsSync(n)&&i.default.statSync(n).isFile()&&m(r.default.basename(n))&&a.push(n)}catch{}}}return a}function v(e,t,n){let a=[],o=new Set,c=e=>{if(a.length>=n)return;let t;try{t=i.default.realpathSync(e)}catch{return}o.has(t)||(o.add(t),a.push(e))};for(let o of t){if(a.length>=n)break;if(o.startsWith(`!`))continue;let t=o.replace(/^\.\//,``);if(t.includes(`*`)){let n=t.slice(0,t.indexOf(`*`)),a=r.default.join(e,n);if(i.default.existsSync(a)){let n=(0,s.default)(t);h(a,t=>{n(r.default.relative(e,t))&&c(t)},!0,new Set,0)}}else{let n=r.default.join(e,t);try{i.default.statSync(n).isDirectory()?h(n,c,!0,new Set,0):m(r.default.basename(n))&&c(n)}catch{}}}return a}function y(e,t,n=300){let r=[],a=new Set,o=e=>{if(r.length>=n)return;let t;try{t=i.default.realpathSync(e)}catch{return}a.has(t)||(a.add(t),r.push(e))};for(let n of _(e,t))o(n);if(Array.isArray(t.files))for(let r of v(e,t.files,n))o(r);else h(e,o,!0,new Set,0);return r.sort()}function b(e,t,n,r,i,a,o){return{id:e,category:t,severity:n,description:r,layer:i,pattern:a,codeGuard:o}}const x=[b(`child-process-call`,`process`,`high`,`Calls a child_process API (exec/spawn/fork) — can run arbitrary commands`,`code`,/child_process\s*\.\s*(?:exec(?:Sync)?|spawn(?:Sync)?|fork|execFile(?:Sync)?)\s*\(/),b(`child-process-exec`,`process`,`high`,`Executes shell commands via exec()`,`code`,/(?<![\w$.])exec(?:Sync)?\s*\(/),b(`child-process-spawn`,`process`,`high`,`Spawns child processes via spawn()`,`code`,/(?<![\w$.])spawn(?:Sync)?\s*\(/),b(`child-process-fork`,`process`,`high`,`Forks child processes via fork()`,`code`,/(?<![\w$.])fork\s*\(/),b(`child-process-execfile`,`process`,`high`,`Executes binaries via execFile()`,`code`,/(?<![\w$.])execFile(?:Sync)?\s*\(/),b(`shell-true`,`process`,`high`,`Enables shell:true — passes strings through a shell`,`code`,/(?<![\w$])shell\s*:\s*true\b/),b(`eval-call`,`dynamic-code`,`high`,`Uses eval() — can execute arbitrary strings`,`code`,/(?<![\w$.])eval\s*\(/),b(`new-function`,`dynamic-code`,`high`,`Uses new Function() — string-compiled code`,`code`,/new\s+Function\s*\(/),b(`function-constructor`,`dynamic-code`,`high`,`Uses the Function constructor — string-compiled code`,`code`,/(?<![\w$.])Function\s*\(/),b(`vm-runtime`,`dynamic-code`,`high`,`Uses the vm module runtime APIs — can execute arbitrary code`,`code`,/vm\s*\.\s*(?:runInThisContext|runInNewContext|runInContext|compileFunction)\s*\(/),b(`hex-escape-run`,`dynamic-code`,`high`,`Long run of hex escapes — likely obfuscated code`,`raw`,/(?:(?:\\x[0-9a-fA-F]{2}){4,}|(?:\\u[0-9a-fA-F]{4}){3,})/),b(`string-fromcharcode`,`dynamic-code`,`high`,`Builds strings from char codes — common obfuscation pattern`,`code`,/String\s*\.\s*fromCharCode\s*\(/),b(`base64-buffer`,`dynamic-code`,`warning`,`Decodes base64 payloads via Buffer.from()`,`raw`,/Buffer\s*\.\s*from\s*\(\s*[^)\n]*?\s*,\s*['"](?:base64|base64url)['"]\s*\)/,/Buffer\s*\.\s*from/),b(`atob-btoa`,`dynamic-code`,`warning`,`Encodes/decodes base64 strings (atob/btoa)`,`code`,/(?<![\w$.])(?:atob|btoa)\s*\(/),b(`fetch-call`,`network`,`warning`,`Makes outbound requests via the global fetch()`,`code`,/(?<![\w$.])fetch\s*\(/),b(`http-request`,`network`,`warning`,`Makes HTTP(S) requests via http/https modules`,`code`,/(?:http|https)\s*\.\s*(?:get|request)\s*\(/),b(`http-client-lib`,`network`,`warning`,`Uses an HTTP client library (axios/got/superagent/…)`,`code`,/(?<![\w$.])(?:axios|got|superagent|needle|undici)\b/),b(`websocket-client`,`network`,`warning`,`Opens WebSocket connections`,`code`,/(?<![\w$.])(?:WebSocket|WebSocketClient)\s*\(/),b(`dns-lookup`,`network`,`warning`,`Performs DNS lookups/resolution`,`code`,/dns\s*\.\s*(?:lookup|resolve(?:4|6)?|reverse)\s*\(/),b(`fs-write`,`filesystem`,`low`,`Writes files via the fs module`,`raw`,/(?:fs\s*\.\s*|require\s*\(\s*['"]fs['"]\s*\)\s*\.\s*)(?:writeFile(?:Sync)?|appendFile(?:Sync)?|createWriteStream)\s*\(/,/\b(?:fs|require)\b/),b(`fs-delete`,`filesystem`,`warning`,`Deletes files via the fs module`,`raw`,/(?:fs\s*\.\s*|require\s*\(\s*['"]fs['"]\s*\)\s*\.\s*)(?:rm(?:Sync)?|unlink(?:Sync)?)\s*\(/,/\b(?:fs|require)\b/),b(`env-access`,`env-secrets`,`low`,`Reads environment variables (process.env)`,`code`,/process\s*\.\s*env\b/),b(`env-secret-name`,`env-secrets`,`warning`,`Reads an environment variable whose name suggests a secret (TOKEN/KEY/SECRET/…)`,`raw`,/process\s*\.\s*env\s*\[\s*['"][A-Za-z0-9_]*?(?:TOKEN|KEY|SECRET|PASSWORD|PASSWD|CREDENTIAL|API_KEY|PRIVATE)[A-Za-z0-9_]*?['"]\s*\]/i,/process\s*\.\s*env/),b(`env-secret-dot`,`env-secrets`,`warning`,`Reads an environment variable whose name suggests a secret (TOKEN/KEY/SECRET/…)`,`code`,/process\s*\.\s*env\s*\.\s*[A-Za-z0-9_]*?(?:TOKEN|KEY|SECRET|PASSWORD|PASSWD|CREDENTIAL|API_KEY|PRIVATE)[A-Za-z0-9_]*/i)],S=/(?:child_process|exec|spawn|fork|shell|eval|Function|vm|fromCharCode|atob|btoa|Buffer|fetch|http|axios|got|superagent|needle|undici|WebSocket|dns|writeFile|appendFile|createWriteStream|\.rm|\.unlink|readFile|createReadStream|\.stat\(|\.lstat\(|\.access\(|\.realpath\(|statSync|lstatSync|realpathSync|process\.env|require|import|from|\\x|\\u|homedir|~[/'"`]|\/etc|\.ssh|\.aws|\.env|\.npmrc|\.git|USERPROFILE|APPDATA|\.\.\/)/,ee=[{id:`import-child-process`,category:`process`,severity:`high`,description:`Imports child_process — arbitrary command execution`,modules:[`child_process`]},{id:`import-vm`,category:`dynamic-code`,severity:`high`,description:`Imports the vm module — can execute arbitrary code`,modules:[`vm`]},{id:`import-net`,category:`network`,severity:`warning`,description:`Imports raw TCP/UDP networking (node:net/dgram)`,modules:[`net`,`dgram`]},{id:`import-dns`,category:`network`,severity:`warning`,description:`Imports DNS resolution (node:dns)`,modules:[`dns`]},{id:`import-http`,category:`network`,severity:`warning`,description:`Imports an HTTP(S) module (node:http/https/http2/tls)`,modules:[`http`,`https`,`http2`,`tls`,`undici`]},{id:`import-websocket`,category:`network`,severity:`warning`,description:`Imports a WebSocket client`,modules:[`ws`,`socket.io-client`,`websocket`]},{id:`import-http-client`,category:`network`,severity:`warning`,description:`Imports an HTTP client library`,modules:[`axios`,`got`,`node-fetch`,`superagent`,`request`,`needle`]},{id:`import-dotenv`,category:`env-secrets`,severity:`low`,description:`Loads environment variables from .env files`,modules:[`dotenv`]},{id:`import-fs`,category:`filesystem`,severity:`low`,description:`Imports the fs module — can read/write files outside the package`,modules:[`fs`]}],te=/(?:os\s*\.\s*homedir\s*\(|~\s*[/'"`]|\/etc(?:\/|\b)|\.ssh(?:\/|\b)|\.aws(?:\/|\b)|(?:^|[\s'"`(])\.env(?:\/|\b)|\.npmrc(?:\b)|\.git\s*\/\s*config|process\s*\.\s*env\s*\.\s*[A-Z_]*HOME|%USERPROFILE%|%APPDATA%|\.\.\s*\/)/i,C=/(?:fs\s*\.\s*|require\s*\(\s*['"]fs['"]\s*\)\s*\.\s*)/,w=RegExp(`${C.source}(?:writeFile(?:Sync)?|appendFile(?:Sync)?|createWriteStream|rm(?:Sync)?|unlink(?:Sync)?)\\s*\\(`),T=RegExp(`${C.source}(?:readFile(?:Sync)?|createReadStream|stat(?:Sync)?|lstat(?:Sync)?|access(?:Sync)?|realpath(?:Sync)?)\\s*\\(`),E={"fs-write-sensitive":{category:`filesystem`,severity:`high`,message:`Writes to a sensitive location (home dir, .env, .ssh, /etc, …)`},"fs-read-sensitive":{category:`filesystem`,severity:`warning`,message:`Reads from a sensitive location (.env, .ssh, .npmrc, /etc, …)`}},D=/^(?:https?:)?\/\//i;function ne(e){return/\b(?:require|import)\s*\(\s*$/.test(e)||/\b(?:from|import)\s+$/.test(e)}function re(e){return e.replace(/\\x([0-9a-fA-F]{2})/g,(e,t)=>String.fromCharCode(Number.parseInt(t,16))).replace(/\\u([0-9a-fA-F]{4})/g,(e,t)=>String.fromCharCode(Number.parseInt(t,16)))}function O(e,t){let n=``,r=``,i=0,a;a=t.inBlockComment?`block`:t.inTemplate?`template`:`code`;let o=[],s=null,c=()=>{s!==null&&(o.push(re(s.slice(0,-1))),s=null)};for(;i<e.length;){let t=e[i],o=e[i+1];if(a===`block`){t===`*`&&o===`/`?(i+=2,a=`code`):i++;continue}if(a===`single`||a===`double`||a===`template`){if(t===`\\`&&o!==void 0){s!==null&&(s+=t+o),r+=t+o,n+=`  `,i+=2;continue}s!==null&&(s+=t),r+=t,n+=` `,i++,(a===`single`&&t===`'`||a===`double`&&t===`"`||a===`template`&&t==="`")&&(a=`code`,c());continue}if(t===`/`&&o===`/`){i=e.length;continue}if(t===`/`&&o===`*`){i+=2,a=`block`;continue}if(t===`'`||t===`"`||t==="`"){let e=s===null&&ne(n);r+=t,n+=` `,i++,a=t===`'`?`single`:t===`"`?`double`:`template`,e&&(s=``);continue}if(t===`/`&&k(n)){let t=i+1,a=!1;for(;t<e.length;){let n=e[t];if(n===`\\`){t+=2;continue}if(n===`[`)a=!0;else if(n===`]`)a=!1;else if(n===`/`&&!a)break;t++}let o=t<e.length?t+1:e.length;for(;o<e.length&&/[dgimsuvy]/.test(e[o]);)o++;n+=` `.repeat(o-i),r+=` `.repeat(o-i),i=o;continue}n+=t,r+=t,i++}return t.inBlockComment=a===`block`,t.inTemplate=a===`template`,{code:n,raw:r,imports:o}}function k(e){let t=e.length-1;for(;t>=0&&/\s/.test(e[t]);)t--;if(t<0||`(=,:[;!&|?{`.includes(e[t]))return!0;let n=e.slice(0,t+1);return/\b(?:return|typeof|instanceof|in|of|new|case|void|delete|do|else|yield)\s*$/.test(n)}function A(e){return e.replace(/^node:/,``)}function j(e,t){try{let n=i.default.openSync(e,`r`);try{let e=new Uint8Array(t),r=i.default.readSync(n,e,0,t,0),a=Buffer.from(e.subarray(0,r)).toString(`utf-8`),o=a.lastIndexOf(`
+const e=require(`./chunk-D1Md3oWO.cjs`),t=require(`./config-files-ph2ZtHWl.cjs`),n=require(`./resolve-C9jGArE_.cjs`);let r=require(`node:path`);r=e.r(r);let i=require(`node:fs`);i=e.r(i);let a=require(`semver`);a=e.r(a);let o=require(`node:module`),s=require(`picomatch`);s=e.r(s);const c={high:3,warning:2,low:1};function l(e){let t;for(let n of e)(!t||c[n]>c[t])&&(t=n);return t}const u=/\.(?:js|mjs|cjs|ts|tsx|jsx)$/,d=/\.(?:d\.ts|map)$/,f=/\.(?:test|spec)\.(?:js|mjs|cjs|ts|tsx|jsx)$/,p=new Set([`node_modules`,`.git`,`dist`,`coverage`,`test`,`__tests__`,`tests`,`spec`,`fixture`,`fixtures`,`example`,`examples`,`benchmark`,`benchmarks`,`.github`,`docs`]);function m(e){return u.test(e)&&!d.test(e)&&!f.test(e)}function h(e,t,n,a,o){if(o>16)return;let s;try{s=i.default.realpathSync(e)}catch{return}if(a.has(s))return;a.add(s);let c;try{c=i.default.readdirSync(e)}catch{return}for(let s of c){let c=r.default.join(e,s),l;try{l=i.default.statSync(c)}catch{continue}if(l.isDirectory()){if(n&&p.has(s))continue;h(c,t,n,a,o+1)}else m(s)&&t(c)}}function g(e,t){if(typeof e==`string`)t.push(e);else if(e&&typeof e==`object`)for(let n of Object.values(e))g(n,t)}function _(e,t){let n=[];for(let e of[`main`,`module`,`browser`,`bin`,`exports`])g(t[e],n);let a=[],o=new Set;for(let t of n){if(!t)continue;let n=r.default.resolve(e,t);if(!o.has(n)){o.add(n);try{i.default.existsSync(n)&&i.default.statSync(n).isFile()&&m(r.default.basename(n))&&a.push(n)}catch{}}}return a}function v(e,t,n){let a=[],o=new Set,c=e=>{if(a.length>=n)return;let t;try{t=i.default.realpathSync(e)}catch{return}o.has(t)||(o.add(t),a.push(e))};for(let o of t){if(a.length>=n)break;if(o.startsWith(`!`))continue;let t=o.replace(/^\.\//,``);if(t.includes(`*`)){let n=t.slice(0,t.indexOf(`*`)),a=r.default.join(e,n);if(i.default.existsSync(a)){let n=(0,s.default)(t);h(a,t=>{n(r.default.relative(e,t))&&c(t)},!0,new Set,0)}}else{let n=r.default.join(e,t);try{i.default.statSync(n).isDirectory()?h(n,c,!0,new Set,0):m(r.default.basename(n))&&c(n)}catch{}}}return a}function y(e,t,n=300){let r=[],a=new Set,o=e=>{if(r.length>=n)return;let t;try{t=i.default.realpathSync(e)}catch{return}a.has(t)||(a.add(t),r.push(e))};for(let n of _(e,t))o(n);if(Array.isArray(t.files))for(let r of v(e,t.files,n))o(r);else h(e,o,!0,new Set,0);return r.sort()}function b(e,t,n,r,i,a,o){return{id:e,category:t,severity:n,description:r,layer:i,pattern:a,codeGuard:o}}const x=[b(`child-process-call`,`process`,`high`,`Calls a child_process API (exec/spawn/fork) — can run arbitrary commands`,`code`,/child_process\s*\.\s*(?:exec(?:Sync)?|spawn(?:Sync)?|fork|execFile(?:Sync)?)\s*\(/),b(`child-process-exec`,`process`,`high`,`Executes shell commands via exec()`,`code`,/(?<![\w$.])exec(?:Sync)?\s*\(/),b(`child-process-spawn`,`process`,`high`,`Spawns child processes via spawn()`,`code`,/(?<![\w$.])spawn(?:Sync)?\s*\(/),b(`child-process-fork`,`process`,`high`,`Forks child processes via fork()`,`code`,/(?<![\w$.])fork\s*\(/),b(`child-process-execfile`,`process`,`high`,`Executes binaries via execFile()`,`code`,/(?<![\w$.])execFile(?:Sync)?\s*\(/),b(`shell-true`,`process`,`high`,`Enables shell:true — passes strings through a shell`,`code`,/(?<![\w$])shell\s*:\s*true\b/),b(`eval-call`,`dynamic-code`,`high`,`Uses eval() — can execute arbitrary strings`,`code`,/(?<![\w$.])eval\s*\(/),b(`new-function`,`dynamic-code`,`high`,`Uses new Function() — string-compiled code`,`code`,/new\s+Function\s*\(/),b(`function-constructor`,`dynamic-code`,`high`,`Uses the Function constructor — string-compiled code`,`code`,/(?<![\w$.])Function\s*\(/),b(`vm-runtime`,`dynamic-code`,`high`,`Uses the vm module runtime APIs — can execute arbitrary code`,`code`,/vm\s*\.\s*(?:runInThisContext|runInNewContext|runInContext|compileFunction)\s*\(/),b(`hex-escape-run`,`dynamic-code`,`high`,`Long run of hex escapes — likely obfuscated code`,`raw`,/(?:(?:\\x[0-9a-fA-F]{2}){4,}|(?:\\u[0-9a-fA-F]{4}){3,})/),b(`string-fromcharcode`,`dynamic-code`,`high`,`Builds strings from char codes — common obfuscation pattern`,`code`,/String\s*\.\s*fromCharCode\s*\(/),b(`base64-buffer`,`dynamic-code`,`warning`,`Decodes base64 payloads via Buffer.from()`,`raw`,/Buffer\s*\.\s*from\s*\(\s*[^)\n]*?\s*,\s*['"](?:base64|base64url)['"]\s*\)/,/Buffer\s*\.\s*from/),b(`atob-btoa`,`dynamic-code`,`warning`,`Encodes/decodes base64 strings (atob/btoa)`,`code`,/(?<![\w$.])(?:atob|btoa)\s*\(/),b(`fetch-call`,`network`,`warning`,`Makes outbound requests via the global fetch()`,`code`,/(?<![\w$.])fetch\s*\(/),b(`http-request`,`network`,`warning`,`Makes HTTP(S) requests via http/https modules`,`code`,/(?:http|https)\s*\.\s*(?:get|request)\s*\(/),b(`http-client-lib`,`network`,`warning`,`Uses an HTTP client library (axios/got/superagent/…)`,`code`,/(?<![\w$.])(?:axios|got|superagent|needle|undici)\b/),b(`websocket-client`,`network`,`warning`,`Opens WebSocket connections`,`code`,/(?<![\w$.])(?:WebSocket|WebSocketClient)\s*\(/),b(`dns-lookup`,`network`,`warning`,`Performs DNS lookups/resolution`,`code`,/dns\s*\.\s*(?:lookup|resolve(?:4|6)?|reverse)\s*\(/),b(`fs-write`,`filesystem`,`low`,`Writes files via the fs module`,`raw`,/(?:fs\s*\.\s*|require\s*\(\s*['"]fs['"]\s*\)\s*\.\s*)(?:writeFile(?:Sync)?|appendFile(?:Sync)?|createWriteStream)\s*\(/,/\b(?:fs|require)\b/),b(`fs-delete`,`filesystem`,`warning`,`Deletes files via the fs module`,`raw`,/(?:fs\s*\.\s*|require\s*\(\s*['"]fs['"]\s*\)\s*\.\s*)(?:rm(?:Sync)?|unlink(?:Sync)?)\s*\(/,/\b(?:fs|require)\b/),b(`env-access`,`env-secrets`,`low`,`Reads environment variables (process.env)`,`code`,/process\s*\.\s*env\b/),b(`env-secret-name`,`env-secrets`,`warning`,`Reads an environment variable whose name suggests a secret (TOKEN/KEY/SECRET/…)`,`raw`,/process\s*\.\s*env\s*\[\s*['"][A-Za-z0-9_]*?(?:TOKEN|KEY|SECRET|PASSWORD|PASSWD|CREDENTIAL|API_KEY|PRIVATE)[A-Za-z0-9_]*?['"]\s*\]/i,/process\s*\.\s*env/),b(`env-secret-dot`,`env-secrets`,`warning`,`Reads an environment variable whose name suggests a secret (TOKEN/KEY/SECRET/…)`,`code`,/process\s*\.\s*env\s*\.\s*[A-Za-z0-9_]*?(?:TOKEN|KEY|SECRET|PASSWORD|PASSWD|CREDENTIAL|API_KEY|PRIVATE)[A-Za-z0-9_]*/i)],S=/(?:child_process|exec|spawn|fork|shell|eval|Function|vm|fromCharCode|atob|btoa|Buffer|fetch|http|axios|got|superagent|needle|undici|WebSocket|dns|writeFile|appendFile|createWriteStream|\.rm|\.unlink|readFile|createReadStream|\.stat\(|\.lstat\(|\.access\(|\.realpath\(|statSync|lstatSync|realpathSync|process\.env|require|import|from|\\x|\\u|homedir|~[/'"`]|\/etc|\.ssh|\.aws|\.env|\.npmrc|\.git|USERPROFILE|APPDATA|\.\.\/)/,ee=[{id:`import-child-process`,category:`process`,severity:`high`,description:`Imports child_process — arbitrary command execution`,modules:[`child_process`]},{id:`import-vm`,category:`dynamic-code`,severity:`high`,description:`Imports the vm module — can execute arbitrary code`,modules:[`vm`]},{id:`import-net`,category:`network`,severity:`warning`,description:`Imports raw TCP/UDP networking (node:net/dgram)`,modules:[`net`,`dgram`]},{id:`import-dns`,category:`network`,severity:`warning`,description:`Imports DNS resolution (node:dns)`,modules:[`dns`]},{id:`import-http`,category:`network`,severity:`warning`,description:`Imports an HTTP(S) module (node:http/https/http2/tls)`,modules:[`http`,`https`,`http2`,`tls`,`undici`]},{id:`import-websocket`,category:`network`,severity:`warning`,description:`Imports a WebSocket client`,modules:[`ws`,`socket.io-client`,`websocket`]},{id:`import-http-client`,category:`network`,severity:`warning`,description:`Imports an HTTP client library`,modules:[`axios`,`got`,`node-fetch`,`superagent`,`request`,`needle`]},{id:`import-dotenv`,category:`env-secrets`,severity:`low`,description:`Loads environment variables from .env files`,modules:[`dotenv`]},{id:`import-fs`,category:`filesystem`,severity:`low`,description:`Imports the fs module — can read/write files outside the package`,modules:[`fs`]}],te=/(?:os\s*\.\s*homedir\s*\(|~\s*[/'"`]|\/etc(?:\/|\b)|\.ssh(?:\/|\b)|\.aws(?:\/|\b)|(?:^|[\s'"`(])\.env(?:\/|\b)|\.npmrc(?:\b)|\.git\s*\/\s*config|process\s*\.\s*env\s*\.\s*[A-Z_]*HOME|%USERPROFILE%|%APPDATA%|\.\.\s*\/)/i,C=/(?:fs\s*\.\s*|require\s*\(\s*['"]fs['"]\s*\)\s*\.\s*)/,w=RegExp(`${C.source}(?:writeFile(?:Sync)?|appendFile(?:Sync)?|createWriteStream|rm(?:Sync)?|unlink(?:Sync)?)\\s*\\(`),T=RegExp(`${C.source}(?:readFile(?:Sync)?|createReadStream|stat(?:Sync)?|lstat(?:Sync)?|access(?:Sync)?|realpath(?:Sync)?)\\s*\\(`),E={"fs-write-sensitive":{category:`filesystem`,severity:`high`,message:`Writes to a sensitive location (home dir, .env, .ssh, /etc, …)`},"fs-read-sensitive":{category:`filesystem`,severity:`warning`,message:`Reads from a sensitive location (.env, .ssh, .npmrc, /etc, …)`}},D=/^(?:https?:)?\/\//i;function ne(e){return/\b(?:require|import)\s*\(\s*$/.test(e)||/\b(?:from|import)\s+$/.test(e)}function re(e){return e.replace(/\\x([0-9a-fA-F]{2})/g,(e,t)=>String.fromCharCode(Number.parseInt(t,16))).replace(/\\u([0-9a-fA-F]{4})/g,(e,t)=>String.fromCharCode(Number.parseInt(t,16)))}function O(e,t){let n=``,r=``,i=0,a;a=t.inBlockComment?`block`:t.inTemplate?`template`:`code`;let o=[],s=null,c=()=>{s!==null&&(o.push(re(s.slice(0,-1))),s=null)};for(;i<e.length;){let t=e[i],o=e[i+1];if(a===`block`){t===`*`&&o===`/`?(i+=2,a=`code`):i++;continue}if(a===`single`||a===`double`||a===`template`){if(t===`\\`&&o!==void 0){s!==null&&(s+=t+o),r+=t+o,n+=`  `,i+=2;continue}s!==null&&(s+=t),r+=t,n+=` `,i++,(a===`single`&&t===`'`||a===`double`&&t===`"`||a===`template`&&t==="`")&&(a=`code`,c());continue}if(t===`/`&&o===`/`){i=e.length;continue}if(t===`/`&&o===`*`){i+=2,a=`block`;continue}if(t===`'`||t===`"`||t==="`"){let e=s===null&&ne(n);r+=t,n+=` `,i++,a=t===`'`?`single`:t===`"`?`double`:`template`,e&&(s=``);continue}if(t===`/`&&k(n)){let t=i+1,a=!1;for(;t<e.length;){let n=e[t];if(n===`\\`){t+=2;continue}if(n===`[`)a=!0;else if(n===`]`)a=!1;else if(n===`/`&&!a)break;t++}let o=t<e.length?t+1:e.length;for(;o<e.length&&/[dgimsuvy]/.test(e[o]);)o++;n+=` `.repeat(o-i),r+=` `.repeat(o-i),i=o;continue}n+=t,r+=t,i++}return t.inBlockComment=a===`block`,t.inTemplate=a===`template`,{code:n,raw:r,imports:o}}function k(e){let t=e.length-1;for(;t>=0&&/\s/.test(e[t]);)t--;if(t<0||`(=,:[;!&|?{`.includes(e[t]))return!0;let n=e.slice(0,t+1);return/\b(?:return|typeof|instanceof|in|of|new|case|void|delete|do|else|yield)\s*$/.test(n)}function A(e){return e.replace(/^node:/,``)}function j(e,t){try{let n=i.default.openSync(e,`r`);try{let e=new Uint8Array(t),r=i.default.readSync(n,e,0,t,0),a=Buffer.from(e.subarray(0,r)).toString(`utf-8`),o=a.lastIndexOf(`
 `);return o!==-1&&(a=a.slice(0,o)),a}finally{i.default.closeSync(n)}}catch{return null}}function M(e,t,n={}){let a=n.maxFiles??300,o=n.maxTotalBytes??8388608,s=y(e,t,a),c=[],l=new Set,u=0,d=(e,t,n,r,i,a,o,s=``)=>{let u=`${e}|${i}|${a}|${s}`;l.has(u)||(l.add(u),c.push({ruleId:e,category:t,severity:n,message:r,file:i,line:a,snippet:o}))},f=(e,t)=>{let n=e.split(`
 `),r={inBlockComment:!1,inTemplate:!1};for(let e=0;e<n.length;e++){let i=n[e],{code:a,raw:o,imports:s}=O(i,r),c=e+1,l=i.trim().slice(0,120);if(S.test(o)){let e=[];for(let t of x){let n=t.layer===`raw`?o:a;t.pattern.test(n)&&(!t.codeGuard||t.codeGuard.test(a))&&e.push(t)}let n=e.some(e=>e.id===`new-function`);for(let r of e)n&&r.id===`function-constructor`||d(r.id,r.category,r.severity,r.description,t,c,l);if(te.test(o)&&/\b(?:fs|require)\b/.test(a)){if(w.test(o)){let e=E[`fs-write-sensitive`];d(`fs-write-sensitive`,e.category,e.severity,e.message,t,c,l)}if(T.test(o)){let e=E[`fs-read-sensitive`];d(`fs-read-sensitive`,e.category,e.severity,e.message,t,c,l)}}}for(let e of s){if(D.test(e)){d(`remote-code-import`,`dynamic-code`,`high`,`Loads code from a remote URL at runtime: ${e.slice(0,80)}`,t,c,l,e);continue}let n=A(e);for(let r of ee)if(r.modules.includes(n)){d(r.id,r.category,r.severity,r.description,t,c,l,e);break}}}},p=0,m=!1;for(let t of s){let n=r.default.relative(e,t),a;try{a=i.default.statSync(t).size}catch{continue}let s=o-p;if(a>s){if(s>0){let e=j(t,s);e!==null&&(u++,f(e,n))}m=!0;break}let c;try{c=i.default.readFileSync(t,`utf-8`)}catch{continue}u++,p+=a,f(c,n)}return m&&d(`scan-truncated`,`metadata`,`warning`,`Scan truncated at ${o} bytes — remaining files were not inspected. Increase maxTotalBytes to audit the full package.`,`package.json`,0),{findings:c,filesScanned:u}}const N=/^(?:git(?:\+[a-z]+)?|https?|file|link|ssh|github):/i;function P(e,t={name:`plugin`}){let n=[],r=e.scripts||{};for(let e of[`preinstall`,`install`,`postinstall`]){let t=r[e];typeof t==`string`&&t.trim().length>0&&n.push({ruleId:`install-script`,category:`metadata`,severity:`high`,message:`Runs a ${e} script during installation — a common supply-chain attack vector`,file:`package.json`,line:0,snippet:`${e}: ${t.trim().slice(0,120)}`})}let i=e.bundledDependencies??e.bundleDependencies;Array.isArray(i)&&i.length>0&&n.push({ruleId:`bundled-deps`,category:`metadata`,severity:`warning`,message:`Bundles dependencies: ${i.join(`, `)} — vendored code that bypasses the registry audit`,file:`package.json`,line:0,snippet:`bundledDependencies: [${i.join(`, `)}]`});let o=[];for(let t of[`dependencies`,`devDependencies`,`optionalDependencies`,`peerDependencies`]){let n=e[t];if(!(!n||typeof n!=`object`))for(let[e,t]of Object.entries(n))typeof t==`string`&&N.test(t)&&o.push(`${e}@${t}`)}if(o.length>0&&n.push({ruleId:`remote-deps`,category:`metadata`,severity:`warning`,message:`Dependencies loaded from non-registry sources (git/file/URL): ${o.join(`, `)}`,file:`package.json`,line:0,snippet:o.slice(0,3).join(`, `)}),!e.license&&!e.licenses&&n.push({ruleId:`no-license`,category:`metadata`,severity:`low`,message:`Package declares no license`,file:`package.json`,line:0}),!e.repository&&!e.homepage&&n.push({ruleId:`no-provenance`,category:`metadata`,severity:`low`,message:`Package declares no repository or homepage — harder to verify provenance`,file:`package.json`,line:0}),t.boltdocsVersion&&typeof e.version==`string`)try{a.default.satisfies(e.version,t.boltdocsVersion)||n.push({ruleId:`version-mismatch`,category:`metadata`,severity:`low`,message:`Installed version ${e.version} does not satisfy the declared boltdocsVersion range ${t.boltdocsVersion}`,file:`package.json`,line:0,snippet:`boltdocsVersion: ${t.boltdocsVersion}`})}catch{}return n}function F(e,t,r={},i){let a=n.t(i?.packageName??e,t);if(!a)return{name:e,status:`unresolved`,filesScanned:0,findings:[]};let o;try{o=M(a.dir,a.pkg,r)}catch(t){return{name:e,status:`error`,pluginDir:a.dir,version:a.version,filesScanned:0,findings:[{ruleId:`scan-error`,category:`metadata`,severity:`warning`,message:`Static scan failed: ${t instanceof Error?t.message:String(t)}`,file:`package.json`,line:0}]}}let s=[...o.findings];s.push(...P(a.pkg,{name:e,boltdocsVersion:i?.boltdocsVersion}));let c=l(s.map(e=>e.severity));return{name:e,status:s.length===0?`clean`:`warning`,severity:c,pluginDir:a.dir,version:a.version,filesScanned:o.filesScanned,findings:s}}function I(e,t,n={}){let r=[];for(let i of e)!i||typeof i.name!=`string`||!i.name||r.push(F(i.name,t,n,i));return r}const L=/from\s+(['"])([^'"]+)\1/g;function R(e){let t=[];L.lastIndex=0;for(let n=L.exec(e);n!==null;n=L.exec(e))t.push(n[2]);return t}function z(e){let t=e.lastIndexOf(`/`);return t>=0?e.slice(t+1):e}function B(e,t,n){let r=0;if(t.pkgName===e)r=100;else{let n=z(t.pkgName);n===e?r=60:e.endsWith(n)&&(r=40)}return r>0&&n&&t.version===n&&(r+=15),r}function V(e,t){let n;try{n=i.default.readFileSync(e,`utf-8`)}catch{return[]}let a=(0,o.createRequire)(e),s=[],c=new Set;for(let e of R(n)){if(e.startsWith(`.`)||e.startsWith(`/`))continue;let n=null;try{n=a.resolve(`${e}/package.json`)}catch{let a=r.default.resolve(t,`node_modules`,e,`package.json`);i.default.existsSync(a)&&(n=a)}if(!n||!i.default.existsSync(n))continue;let o;try{o=JSON.parse(i.default.readFileSync(n,`utf-8`))}catch{continue}let l=typeof o.name==`string`?o.name:e;l!==`boltdocs`&&(c.has(l)||(c.add(l),s.push({pkgName:l,version:typeof o.version==`string`?o.version:void 0})))}return s}function H(e,t,n){if(n.length===0)return;let r=V(e,t);if(r.length!==0)for(let e of n){if(!e||typeof e.name!=`string`||!e.name)continue;let t=null,n=0;for(let i of r){let r=B(e.name,i,e.version);r>n&&(n=r,t=i)}t&&(e.packageName=t.pkgName)}}async function ie(e){let n;for(let a of t.t){let t=r.default.resolve(e,a);if(i.default.existsSync(t))try{let{createJiti:n}=await import(`jiti`),r=await n(e,{interopDefault:!0}).import(t)??{},i=r.default??r.config??r;if(!i||typeof i!=`object`)throw Error(`config file did not export an object`);if(!(`plugins`in i))return{plugins:[],configFile:t};if(!Array.isArray(i.plugins))throw Error(`config.plugins must be an array, got ${typeof i.plugins}`);let a=i.plugins;return H(t,e,a),{plugins:a,configFile:t}}catch(e){n=e}}if(n!==void 0)throw Error(`Failed to load Boltdocs configuration: ${n instanceof Error?n.message:String(n)}`,{cause:n});return{plugins:[]}}const U=!(`NO_COLOR`in process.env)&&(process.stdout?.isTTY??!1),W=RegExp(`\x1B\\[[0-9;]*m`,`g`);function G(e){return e.replace(W,``).length}function K(e,t){return U?`\u001b[${e}m${t}\u001b[0m`:t}const q={red:e=>K(31,e),yellow:e=>K(33,e),cyan:e=>K(36,e),green:e=>K(32,e),gray:e=>K(90,e),bold:e=>K(1,e),dim:e=>K(2,e)},J=e=>K(`38;2;235;88;40`,e);function Y(e,t,n,r){let i=n.match(/^\n+/)?.[0]??``,a=n.slice(i.length),o=`${q.bold(`[boltdocs]`)} ${a}`,s=e===`stderr`?console.error:console.log;i&&s(i),s(t(o)),r!==void 0&&s(r)}const ae=e=>Y(`stdout`,q.gray,e),X=e=>Y(`stdout`,q.yellow,e),Z=e=>Y(`stdout`,q.green,e),oe=(e,t)=>Y(`stderr`,q.red,e,t);function se(e,t){let n=Math.max(e.length,...t.map(e=>e.length)),r=[];for(let i=0;i<n;i++){let n=e[i]?G(e[i]):0;for(let e of t)n=Math.max(n,G(e[i]??``));r[i]=n+2}let i={h:`─`,v:`│`,tl:`┌`,tm:`┬`,tr:`┐`,ml:`├`,mm:`┼`,mr:`┤`,bl:`└`,bm:`┴`,br:`┘`},a=(e,t,n)=>J(e+r.map(e=>i.h.repeat(e)).join(t)+n),o=e=>J(i.v)+e.map((e,t)=>{let n=e??``;return` `.repeat(1)+n+` `.repeat(r[t]-G(n)-1)}).join(J(i.v))+J(i.v),s=[a(i.tl,i.tm,i.tr)];e.length>0&&(s.push(o(e.map(e=>q.bold(e)))),s.push(a(i.ml,i.mm,i.mr)));for(let e of t)s.push(o(e));return s.push(a(i.bl,i.bm,i.br)),s.join(`
 `)}function Q(e,t){return e+` `.repeat(Math.max(0,t-G(e)))}function $(e){return e.status===`error`?`✖ Scan error`:e.status===`unresolved`?`❓ Unresolved`:e.severity===`high`?`⚠️ High risk`:e.severity===`warning`?`⚠️ Warning`:e.severity===`low`?`ℹ️ Low risk`:`✅ Clean`}function ce(e){return e.status===`error`||e.severity===`high`?q.red:e.severity===`warning`?q.yellow:e.severity===`low`?J:q.green}async function le(e=process.cwd()){ae(`Starting static security audit of Boltdocs plugins...`);let t;try{t=(await ie(e)).plugins}catch(e){oe(`Failed to load Boltdocs configuration for audit:`,e),process.exit(1)}if(t.length===0){Z(`No plugins configured. Nothing to audit.`);return}let n=[...I(t,e)].sort((e,t)=>c[t.severity||`low`]-c[e.severity||`low`]||e.name.localeCompare(t.name));for(let e of n){let t=e.version?`${e.name}@${e.version}`:e.name;if(e.status===`unresolved`){X(`\n${J(t)} — ${q.yellow(`❓ Unresolved`)} (could not locate the package in node_modules)`);continue}let n=e.findings.length===0?`no findings`:`${e.findings.length} finding${e.findings.length===1?``:`s`}`;console.log(`\n${q.bold(J(t))} — ${ce(e)($(e))} (${n} · ${e.filesScanned} file${e.filesScanned===1?``:`s`} scanned)`);let r=[...e.findings].sort((e,t)=>c[t.severity]-c[e.severity]||e.file.localeCompare(t.file)||e.line-t.line);for(let e of r){let t=e.file===`package.json`?`package.json`:`${e.file}:${e.line}`,n=e.severity===`high`?q.red(e.severity):e.severity===`warning`?q.yellow(e.severity):q.dim(e.severity);console.log(`  ${Q(q.dim(t),36)}${Q(n,9)}[${q.dim(e.category)}] ${q.bold(e.ruleId)} — ${e.message}${e.snippet?q.dim(`  (${e.snippet})`):``}`)}}console.log(`

package/dist/{audit-CLXjMzwQ.mjs → audit-CMc_ydRr.mjs}

@@ -3,7 +3,7 @@
  * Copyright (c) 2026 Jesus Alcala
  * Licensed under the MIT License.
  */
-import{t as e}from"./config-files-BYHDOrKn.mjs";import{t}from"./resolve-YdTrt_FG.mjs";import{createRequire as n}from"node:module";import r from"node:path";import i from"node:fs";import a from"semver";import o from"picomatch";const s={high:3,warning:2,low:1};function c(e){let t;for(let n of e)(!t||s[n]>s[t])&&(t=n);return t}const l=/\.(?:js|mjs|cjs|ts|tsx|jsx)$/,u=/\.(?:d\.ts|map)$/,d=/\.(?:test|spec)\.(?:js|mjs|cjs|ts|tsx|jsx)$/,f=new Set([`node_modules`,`.git`,`dist`,`coverage`,`test`,`__tests__`,`tests`,`spec`,`fixture`,`fixtures`,`example`,`examples`,`benchmark`,`benchmarks`,`.github`,`docs`]);function p(e){return l.test(e)&&!u.test(e)&&!d.test(e)}function m(e,t,n,a,o){if(o>16)return;let s;try{s=i.realpathSync(e)}catch{return}if(a.has(s))return;a.add(s);let c;try{c=i.readdirSync(e)}catch{return}for(let s of c){let c=r.join(e,s),l;try{l=i.statSync(c)}catch{continue}if(l.isDirectory()){if(n&&f.has(s))continue;m(c,t,n,a,o+1)}else p(s)&&t(c)}}function h(e,t){if(typeof e==`string`)t.push(e);else if(e&&typeof e==`object`)for(let n of Object.values(e))h(n,t)}function g(e,t){let n=[];for(let e of[`main`,`module`,`browser`,`bin`,`exports`])h(t[e],n);let a=[],o=new Set;for(let t of n){if(!t)continue;let n=r.resolve(e,t);if(!o.has(n)){o.add(n);try{i.existsSync(n)&&i.statSync(n).isFile()&&p(r.basename(n))&&a.push(n)}catch{}}}return a}function _(e,t,n){let a=[],s=new Set,c=e=>{if(a.length>=n)return;let t;try{t=i.realpathSync(e)}catch{return}s.has(t)||(s.add(t),a.push(e))};for(let s of t){if(a.length>=n)break;if(s.startsWith(`!`))continue;let t=s.replace(/^\.\//,``);if(t.includes(`*`)){let n=t.slice(0,t.indexOf(`*`)),a=r.join(e,n);if(i.existsSync(a)){let n=o(t);m(a,t=>{n(r.relative(e,t))&&c(t)},!0,new Set,0)}}else{let n=r.join(e,t);try{i.statSync(n).isDirectory()?m(n,c,!0,new Set,0):p(r.basename(n))&&c(n)}catch{}}}return a}function v(e,t,n=300){let r=[],a=new Set,o=e=>{if(r.length>=n)return;let t;try{t=i.realpathSync(e)}catch{return}a.has(t)||(a.add(t),r.push(e))};for(let n of g(e,t))o(n);if(Array.isArray(t.files))for(let r of _(e,t.files,n))o(r);else m(e,o,!0,new Set,0);return r.sort()}function y(e,t,n,r,i,a,o){return{id:e,category:t,severity:n,description:r,layer:i,pattern:a,codeGuard:o}}const b=[y(`child-process-call`,`process`,`high`,`Calls a child_process API (exec/spawn/fork) — can run arbitrary commands`,`code`,/child_process\s*\.\s*(?:exec(?:Sync)?|spawn(?:Sync)?|fork|execFile(?:Sync)?)\s*\(/),y(`child-process-exec`,`process`,`high`,`Executes shell commands via exec()`,`code`,/(?<![\w$.])exec(?:Sync)?\s*\(/),y(`child-process-spawn`,`process`,`high`,`Spawns child processes via spawn()`,`code`,/(?<![\w$.])spawn(?:Sync)?\s*\(/),y(`child-process-fork`,`process`,`high`,`Forks child processes via fork()`,`code`,/(?<![\w$.])fork\s*\(/),y(`child-process-execfile`,`process`,`high`,`Executes binaries via execFile()`,`code`,/(?<![\w$.])execFile(?:Sync)?\s*\(/),y(`shell-true`,`process`,`high`,`Enables shell:true — passes strings through a shell`,`code`,/(?<![\w$])shell\s*:\s*true\b/),y(`eval-call`,`dynamic-code`,`high`,`Uses eval() — can execute arbitrary strings`,`code`,/(?<![\w$.])eval\s*\(/),y(`new-function`,`dynamic-code`,`high`,`Uses new Function() — string-compiled code`,`code`,/new\s+Function\s*\(/),y(`function-constructor`,`dynamic-code`,`high`,`Uses the Function constructor — string-compiled code`,`code`,/(?<![\w$.])Function\s*\(/),y(`vm-runtime`,`dynamic-code`,`high`,`Uses the vm module runtime APIs — can execute arbitrary code`,`code`,/vm\s*\.\s*(?:runInThisContext|runInNewContext|runInContext|compileFunction)\s*\(/),y(`hex-escape-run`,`dynamic-code`,`high`,`Long run of hex escapes — likely obfuscated code`,`raw`,/(?:(?:\\x[0-9a-fA-F]{2}){4,}|(?:\\u[0-9a-fA-F]{4}){3,})/),y(`string-fromcharcode`,`dynamic-code`,`high`,`Builds strings from char codes — common obfuscation pattern`,`code`,/String\s*\.\s*fromCharCode\s*\(/),y(`base64-buffer`,`dynamic-code`,`warning`,`Decodes base64 payloads via Buffer.from()`,`raw`,/Buffer\s*\.\s*from\s*\(\s*[^)\n]*?\s*,\s*['"](?:base64|base64url)['"]\s*\)/,/Buffer\s*\.\s*from/),y(`atob-btoa`,`dynamic-code`,`warning`,`Encodes/decodes base64 strings (atob/btoa)`,`code`,/(?<![\w$.])(?:atob|btoa)\s*\(/),y(`fetch-call`,`network`,`warning`,`Makes outbound requests via the global fetch()`,`code`,/(?<![\w$.])fetch\s*\(/),y(`http-request`,`network`,`warning`,`Makes HTTP(S) requests via http/https modules`,`code`,/(?:http|https)\s*\.\s*(?:get|request)\s*\(/),y(`http-client-lib`,`network`,`warning`,`Uses an HTTP client library (axios/got/superagent/…)`,`code`,/(?<![\w$.])(?:axios|got|superagent|needle|undici)\b/),y(`websocket-client`,`network`,`warning`,`Opens WebSocket connections`,`code`,/(?<![\w$.])(?:WebSocket|WebSocketClient)\s*\(/),y(`dns-lookup`,`network`,`warning`,`Performs DNS lookups/resolution`,`code`,/dns\s*\.\s*(?:lookup|resolve(?:4|6)?|reverse)\s*\(/),y(`fs-write`,`filesystem`,`low`,`Writes files via the fs module`,`raw`,/(?:fs\s*\.\s*|require\s*\(\s*['"]fs['"]\s*\)\s*\.\s*)(?:writeFile(?:Sync)?|appendFile(?:Sync)?|createWriteStream)\s*\(/,/\b(?:fs|require)\b/),y(`fs-delete`,`filesystem`,`warning`,`Deletes files via the fs module`,`raw`,/(?:fs\s*\.\s*|require\s*\(\s*['"]fs['"]\s*\)\s*\.\s*)(?:rm(?:Sync)?|unlink(?:Sync)?)\s*\(/,/\b(?:fs|require)\b/),y(`env-access`,`env-secrets`,`low`,`Reads environment variables (process.env)`,`code`,/process\s*\.\s*env\b/),y(`env-secret-name`,`env-secrets`,`warning`,`Reads an environment variable whose name suggests a secret (TOKEN/KEY/SECRET/…)`,`raw`,/process\s*\.\s*env\s*\[\s*['"][A-Za-z0-9_]*?(?:TOKEN|KEY|SECRET|PASSWORD|PASSWD|CREDENTIAL|API_KEY|PRIVATE)[A-Za-z0-9_]*?['"]\s*\]/i,/process\s*\.\s*env/),y(`env-secret-dot`,`env-secrets`,`warning`,`Reads an environment variable whose name suggests a secret (TOKEN/KEY/SECRET/…)`,`code`,/process\s*\.\s*env\s*\.\s*[A-Za-z0-9_]*?(?:TOKEN|KEY|SECRET|PASSWORD|PASSWD|CREDENTIAL|API_KEY|PRIVATE)[A-Za-z0-9_]*/i)],x=/(?:child_process|exec|spawn|fork|shell|eval|Function|vm|fromCharCode|atob|btoa|Buffer|fetch|http|axios|got|superagent|needle|undici|WebSocket|dns|writeFile|appendFile|createWriteStream|\.rm|\.unlink|readFile|createReadStream|\.stat\(|\.lstat\(|\.access\(|\.realpath\(|statSync|lstatSync|realpathSync|process\.env|require|import|from|\\x|\\u|homedir|~[/'"`]|\/etc|\.ssh|\.aws|\.env|\.npmrc|\.git|USERPROFILE|APPDATA|\.\.\/)/,ee=[{id:`import-child-process`,category:`process`,severity:`high`,description:`Imports child_process — arbitrary command execution`,modules:[`child_process`]},{id:`import-vm`,category:`dynamic-code`,severity:`high`,description:`Imports the vm module — can execute arbitrary code`,modules:[`vm`]},{id:`import-net`,category:`network`,severity:`warning`,description:`Imports raw TCP/UDP networking (node:net/dgram)`,modules:[`net`,`dgram`]},{id:`import-dns`,category:`network`,severity:`warning`,description:`Imports DNS resolution (node:dns)`,modules:[`dns`]},{id:`import-http`,category:`network`,severity:`warning`,description:`Imports an HTTP(S) module (node:http/https/http2/tls)`,modules:[`http`,`https`,`http2`,`tls`,`undici`]},{id:`import-websocket`,category:`network`,severity:`warning`,description:`Imports a WebSocket client`,modules:[`ws`,`socket.io-client`,`websocket`]},{id:`import-http-client`,category:`network`,severity:`warning`,description:`Imports an HTTP client library`,modules:[`axios`,`got`,`node-fetch`,`superagent`,`request`,`needle`]},{id:`import-dotenv`,category:`env-secrets`,severity:`low`,description:`Loads environment variables from .env files`,modules:[`dotenv`]},{id:`import-fs`,category:`filesystem`,severity:`low`,description:`Imports the fs module — can read/write files outside the package`,modules:[`fs`]}],S=/(?:os\s*\.\s*homedir\s*\(|~\s*[/'"`]|\/etc(?:\/|\b)|\.ssh(?:\/|\b)|\.aws(?:\/|\b)|(?:^|[\s'"`(])\.env(?:\/|\b)|\.npmrc(?:\b)|\.git\s*\/\s*config|process\s*\.\s*env\s*\.\s*[A-Z_]*HOME|%USERPROFILE%|%APPDATA%|\.\.\s*\/)/i,C=/(?:fs\s*\.\s*|require\s*\(\s*['"]fs['"]\s*\)\s*\.\s*)/,w=RegExp(`${C.source}(?:writeFile(?:Sync)?|appendFile(?:Sync)?|createWriteStream|rm(?:Sync)?|unlink(?:Sync)?)\\s*\\(`),T=RegExp(`${C.source}(?:readFile(?:Sync)?|createReadStream|stat(?:Sync)?|lstat(?:Sync)?|access(?:Sync)?|realpath(?:Sync)?)\\s*\\(`),E={"fs-write-sensitive":{category:`filesystem`,severity:`high`,message:`Writes to a sensitive location (home dir, .env, .ssh, /etc, …)`},"fs-read-sensitive":{category:`filesystem`,severity:`warning`,message:`Reads from a sensitive location (.env, .ssh, .npmrc, /etc, …)`}},te=/^(?:https?:)?\/\//i;function ne(e){return/\b(?:require|import)\s*\(\s*$/.test(e)||/\b(?:from|import)\s+$/.test(e)}function re(e){return e.replace(/\\x([0-9a-fA-F]{2})/g,(e,t)=>String.fromCharCode(Number.parseInt(t,16))).replace(/\\u([0-9a-fA-F]{4})/g,(e,t)=>String.fromCharCode(Number.parseInt(t,16)))}function D(e,t){let n=``,r=``,i=0,a;a=t.inBlockComment?`block`:t.inTemplate?`template`:`code`;let o=[],s=null,c=()=>{s!==null&&(o.push(re(s.slice(0,-1))),s=null)};for(;i<e.length;){let t=e[i],o=e[i+1];if(a===`block`){t===`*`&&o===`/`?(i+=2,a=`code`):i++;continue}if(a===`single`||a===`double`||a===`template`){if(t===`\\`&&o!==void 0){s!==null&&(s+=t+o),r+=t+o,n+=`  `,i+=2;continue}s!==null&&(s+=t),r+=t,n+=` `,i++,(a===`single`&&t===`'`||a===`double`&&t===`"`||a===`template`&&t==="`")&&(a=`code`,c());continue}if(t===`/`&&o===`/`){i=e.length;continue}if(t===`/`&&o===`*`){i+=2,a=`block`;continue}if(t===`'`||t===`"`||t==="`"){let e=s===null&&ne(n);r+=t,n+=` `,i++,a=t===`'`?`single`:t===`"`?`double`:`template`,e&&(s=``);continue}if(t===`/`&&O(n)){let t=i+1,a=!1;for(;t<e.length;){let n=e[t];if(n===`\\`){t+=2;continue}if(n===`[`)a=!0;else if(n===`]`)a=!1;else if(n===`/`&&!a)break;t++}let o=t<e.length?t+1:e.length;for(;o<e.length&&/[dgimsuvy]/.test(e[o]);)o++;n+=` `.repeat(o-i),r+=` `.repeat(o-i),i=o;continue}n+=t,r+=t,i++}return t.inBlockComment=a===`block`,t.inTemplate=a===`template`,{code:n,raw:r,imports:o}}function O(e){let t=e.length-1;for(;t>=0&&/\s/.test(e[t]);)t--;if(t<0||`(=,:[;!&|?{`.includes(e[t]))return!0;let n=e.slice(0,t+1);return/\b(?:return|typeof|instanceof|in|of|new|case|void|delete|do|else|yield)\s*$/.test(n)}function k(e){return e.replace(/^node:/,``)}function A(e,t){try{let n=i.openSync(e,`r`);try{let e=new Uint8Array(t),r=i.readSync(n,e,0,t,0),a=Buffer.from(e.subarray(0,r)).toString(`utf-8`),o=a.lastIndexOf(`
+import{t as e}from"./config-files-DfwZ3Wot.mjs";import{t}from"./resolve-C8AFoOQL.mjs";import{createRequire as n}from"node:module";import r from"node:path";import i from"node:fs";import a from"semver";import o from"picomatch";const s={high:3,warning:2,low:1};function c(e){let t;for(let n of e)(!t||s[n]>s[t])&&(t=n);return t}const l=/\.(?:js|mjs|cjs|ts|tsx|jsx)$/,u=/\.(?:d\.ts|map)$/,d=/\.(?:test|spec)\.(?:js|mjs|cjs|ts|tsx|jsx)$/,f=new Set([`node_modules`,`.git`,`dist`,`coverage`,`test`,`__tests__`,`tests`,`spec`,`fixture`,`fixtures`,`example`,`examples`,`benchmark`,`benchmarks`,`.github`,`docs`]);function p(e){return l.test(e)&&!u.test(e)&&!d.test(e)}function m(e,t,n,a,o){if(o>16)return;let s;try{s=i.realpathSync(e)}catch{return}if(a.has(s))return;a.add(s);let c;try{c=i.readdirSync(e)}catch{return}for(let s of c){let c=r.join(e,s),l;try{l=i.statSync(c)}catch{continue}if(l.isDirectory()){if(n&&f.has(s))continue;m(c,t,n,a,o+1)}else p(s)&&t(c)}}function h(e,t){if(typeof e==`string`)t.push(e);else if(e&&typeof e==`object`)for(let n of Object.values(e))h(n,t)}function g(e,t){let n=[];for(let e of[`main`,`module`,`browser`,`bin`,`exports`])h(t[e],n);let a=[],o=new Set;for(let t of n){if(!t)continue;let n=r.resolve(e,t);if(!o.has(n)){o.add(n);try{i.existsSync(n)&&i.statSync(n).isFile()&&p(r.basename(n))&&a.push(n)}catch{}}}return a}function _(e,t,n){let a=[],s=new Set,c=e=>{if(a.length>=n)return;let t;try{t=i.realpathSync(e)}catch{return}s.has(t)||(s.add(t),a.push(e))};for(let s of t){if(a.length>=n)break;if(s.startsWith(`!`))continue;let t=s.replace(/^\.\//,``);if(t.includes(`*`)){let n=t.slice(0,t.indexOf(`*`)),a=r.join(e,n);if(i.existsSync(a)){let n=o(t);m(a,t=>{n(r.relative(e,t))&&c(t)},!0,new Set,0)}}else{let n=r.join(e,t);try{i.statSync(n).isDirectory()?m(n,c,!0,new Set,0):p(r.basename(n))&&c(n)}catch{}}}return a}function v(e,t,n=300){let r=[],a=new Set,o=e=>{if(r.length>=n)return;let t;try{t=i.realpathSync(e)}catch{return}a.has(t)||(a.add(t),r.push(e))};for(let n of g(e,t))o(n);if(Array.isArray(t.files))for(let r of _(e,t.files,n))o(r);else m(e,o,!0,new Set,0);return r.sort()}function y(e,t,n,r,i,a,o){return{id:e,category:t,severity:n,description:r,layer:i,pattern:a,codeGuard:o}}const b=[y(`child-process-call`,`process`,`high`,`Calls a child_process API (exec/spawn/fork) — can run arbitrary commands`,`code`,/child_process\s*\.\s*(?:exec(?:Sync)?|spawn(?:Sync)?|fork|execFile(?:Sync)?)\s*\(/),y(`child-process-exec`,`process`,`high`,`Executes shell commands via exec()`,`code`,/(?<![\w$.])exec(?:Sync)?\s*\(/),y(`child-process-spawn`,`process`,`high`,`Spawns child processes via spawn()`,`code`,/(?<![\w$.])spawn(?:Sync)?\s*\(/),y(`child-process-fork`,`process`,`high`,`Forks child processes via fork()`,`code`,/(?<![\w$.])fork\s*\(/),y(`child-process-execfile`,`process`,`high`,`Executes binaries via execFile()`,`code`,/(?<![\w$.])execFile(?:Sync)?\s*\(/),y(`shell-true`,`process`,`high`,`Enables shell:true — passes strings through a shell`,`code`,/(?<![\w$])shell\s*:\s*true\b/),y(`eval-call`,`dynamic-code`,`high`,`Uses eval() — can execute arbitrary strings`,`code`,/(?<![\w$.])eval\s*\(/),y(`new-function`,`dynamic-code`,`high`,`Uses new Function() — string-compiled code`,`code`,/new\s+Function\s*\(/),y(`function-constructor`,`dynamic-code`,`high`,`Uses the Function constructor — string-compiled code`,`code`,/(?<![\w$.])Function\s*\(/),y(`vm-runtime`,`dynamic-code`,`high`,`Uses the vm module runtime APIs — can execute arbitrary code`,`code`,/vm\s*\.\s*(?:runInThisContext|runInNewContext|runInContext|compileFunction)\s*\(/),y(`hex-escape-run`,`dynamic-code`,`high`,`Long run of hex escapes — likely obfuscated code`,`raw`,/(?:(?:\\x[0-9a-fA-F]{2}){4,}|(?:\\u[0-9a-fA-F]{4}){3,})/),y(`string-fromcharcode`,`dynamic-code`,`high`,`Builds strings from char codes — common obfuscation pattern`,`code`,/String\s*\.\s*fromCharCode\s*\(/),y(`base64-buffer`,`dynamic-code`,`warning`,`Decodes base64 payloads via Buffer.from()`,`raw`,/Buffer\s*\.\s*from\s*\(\s*[^)\n]*?\s*,\s*['"](?:base64|base64url)['"]\s*\)/,/Buffer\s*\.\s*from/),y(`atob-btoa`,`dynamic-code`,`warning`,`Encodes/decodes base64 strings (atob/btoa)`,`code`,/(?<![\w$.])(?:atob|btoa)\s*\(/),y(`fetch-call`,`network`,`warning`,`Makes outbound requests via the global fetch()`,`code`,/(?<![\w$.])fetch\s*\(/),y(`http-request`,`network`,`warning`,`Makes HTTP(S) requests via http/https modules`,`code`,/(?:http|https)\s*\.\s*(?:get|request)\s*\(/),y(`http-client-lib`,`network`,`warning`,`Uses an HTTP client library (axios/got/superagent/…)`,`code`,/(?<![\w$.])(?:axios|got|superagent|needle|undici)\b/),y(`websocket-client`,`network`,`warning`,`Opens WebSocket connections`,`code`,/(?<![\w$.])(?:WebSocket|WebSocketClient)\s*\(/),y(`dns-lookup`,`network`,`warning`,`Performs DNS lookups/resolution`,`code`,/dns\s*\.\s*(?:lookup|resolve(?:4|6)?|reverse)\s*\(/),y(`fs-write`,`filesystem`,`low`,`Writes files via the fs module`,`raw`,/(?:fs\s*\.\s*|require\s*\(\s*['"]fs['"]\s*\)\s*\.\s*)(?:writeFile(?:Sync)?|appendFile(?:Sync)?|createWriteStream)\s*\(/,/\b(?:fs|require)\b/),y(`fs-delete`,`filesystem`,`warning`,`Deletes files via the fs module`,`raw`,/(?:fs\s*\.\s*|require\s*\(\s*['"]fs['"]\s*\)\s*\.\s*)(?:rm(?:Sync)?|unlink(?:Sync)?)\s*\(/,/\b(?:fs|require)\b/),y(`env-access`,`env-secrets`,`low`,`Reads environment variables (process.env)`,`code`,/process\s*\.\s*env\b/),y(`env-secret-name`,`env-secrets`,`warning`,`Reads an environment variable whose name suggests a secret (TOKEN/KEY/SECRET/…)`,`raw`,/process\s*\.\s*env\s*\[\s*['"][A-Za-z0-9_]*?(?:TOKEN|KEY|SECRET|PASSWORD|PASSWD|CREDENTIAL|API_KEY|PRIVATE)[A-Za-z0-9_]*?['"]\s*\]/i,/process\s*\.\s*env/),y(`env-secret-dot`,`env-secrets`,`warning`,`Reads an environment variable whose name suggests a secret (TOKEN/KEY/SECRET/…)`,`code`,/process\s*\.\s*env\s*\.\s*[A-Za-z0-9_]*?(?:TOKEN|KEY|SECRET|PASSWORD|PASSWD|CREDENTIAL|API_KEY|PRIVATE)[A-Za-z0-9_]*/i)],x=/(?:child_process|exec|spawn|fork|shell|eval|Function|vm|fromCharCode|atob|btoa|Buffer|fetch|http|axios|got|superagent|needle|undici|WebSocket|dns|writeFile|appendFile|createWriteStream|\.rm|\.unlink|readFile|createReadStream|\.stat\(|\.lstat\(|\.access\(|\.realpath\(|statSync|lstatSync|realpathSync|process\.env|require|import|from|\\x|\\u|homedir|~[/'"`]|\/etc|\.ssh|\.aws|\.env|\.npmrc|\.git|USERPROFILE|APPDATA|\.\.\/)/,ee=[{id:`import-child-process`,category:`process`,severity:`high`,description:`Imports child_process — arbitrary command execution`,modules:[`child_process`]},{id:`import-vm`,category:`dynamic-code`,severity:`high`,description:`Imports the vm module — can execute arbitrary code`,modules:[`vm`]},{id:`import-net`,category:`network`,severity:`warning`,description:`Imports raw TCP/UDP networking (node:net/dgram)`,modules:[`net`,`dgram`]},{id:`import-dns`,category:`network`,severity:`warning`,description:`Imports DNS resolution (node:dns)`,modules:[`dns`]},{id:`import-http`,category:`network`,severity:`warning`,description:`Imports an HTTP(S) module (node:http/https/http2/tls)`,modules:[`http`,`https`,`http2`,`tls`,`undici`]},{id:`import-websocket`,category:`network`,severity:`warning`,description:`Imports a WebSocket client`,modules:[`ws`,`socket.io-client`,`websocket`]},{id:`import-http-client`,category:`network`,severity:`warning`,description:`Imports an HTTP client library`,modules:[`axios`,`got`,`node-fetch`,`superagent`,`request`,`needle`]},{id:`import-dotenv`,category:`env-secrets`,severity:`low`,description:`Loads environment variables from .env files`,modules:[`dotenv`]},{id:`import-fs`,category:`filesystem`,severity:`low`,description:`Imports the fs module — can read/write files outside the package`,modules:[`fs`]}],S=/(?:os\s*\.\s*homedir\s*\(|~\s*[/'"`]|\/etc(?:\/|\b)|\.ssh(?:\/|\b)|\.aws(?:\/|\b)|(?:^|[\s'"`(])\.env(?:\/|\b)|\.npmrc(?:\b)|\.git\s*\/\s*config|process\s*\.\s*env\s*\.\s*[A-Z_]*HOME|%USERPROFILE%|%APPDATA%|\.\.\s*\/)/i,C=/(?:fs\s*\.\s*|require\s*\(\s*['"]fs['"]\s*\)\s*\.\s*)/,w=RegExp(`${C.source}(?:writeFile(?:Sync)?|appendFile(?:Sync)?|createWriteStream|rm(?:Sync)?|unlink(?:Sync)?)\\s*\\(`),T=RegExp(`${C.source}(?:readFile(?:Sync)?|createReadStream|stat(?:Sync)?|lstat(?:Sync)?|access(?:Sync)?|realpath(?:Sync)?)\\s*\\(`),E={"fs-write-sensitive":{category:`filesystem`,severity:`high`,message:`Writes to a sensitive location (home dir, .env, .ssh, /etc, …)`},"fs-read-sensitive":{category:`filesystem`,severity:`warning`,message:`Reads from a sensitive location (.env, .ssh, .npmrc, /etc, …)`}},te=/^(?:https?:)?\/\//i;function ne(e){return/\b(?:require|import)\s*\(\s*$/.test(e)||/\b(?:from|import)\s+$/.test(e)}function re(e){return e.replace(/\\x([0-9a-fA-F]{2})/g,(e,t)=>String.fromCharCode(Number.parseInt(t,16))).replace(/\\u([0-9a-fA-F]{4})/g,(e,t)=>String.fromCharCode(Number.parseInt(t,16)))}function D(e,t){let n=``,r=``,i=0,a;a=t.inBlockComment?`block`:t.inTemplate?`template`:`code`;let o=[],s=null,c=()=>{s!==null&&(o.push(re(s.slice(0,-1))),s=null)};for(;i<e.length;){let t=e[i],o=e[i+1];if(a===`block`){t===`*`&&o===`/`?(i+=2,a=`code`):i++;continue}if(a===`single`||a===`double`||a===`template`){if(t===`\\`&&o!==void 0){s!==null&&(s+=t+o),r+=t+o,n+=`  `,i+=2;continue}s!==null&&(s+=t),r+=t,n+=` `,i++,(a===`single`&&t===`'`||a===`double`&&t===`"`||a===`template`&&t==="`")&&(a=`code`,c());continue}if(t===`/`&&o===`/`){i=e.length;continue}if(t===`/`&&o===`*`){i+=2,a=`block`;continue}if(t===`'`||t===`"`||t==="`"){let e=s===null&&ne(n);r+=t,n+=` `,i++,a=t===`'`?`single`:t===`"`?`double`:`template`,e&&(s=``);continue}if(t===`/`&&O(n)){let t=i+1,a=!1;for(;t<e.length;){let n=e[t];if(n===`\\`){t+=2;continue}if(n===`[`)a=!0;else if(n===`]`)a=!1;else if(n===`/`&&!a)break;t++}let o=t<e.length?t+1:e.length;for(;o<e.length&&/[dgimsuvy]/.test(e[o]);)o++;n+=` `.repeat(o-i),r+=` `.repeat(o-i),i=o;continue}n+=t,r+=t,i++}return t.inBlockComment=a===`block`,t.inTemplate=a===`template`,{code:n,raw:r,imports:o}}function O(e){let t=e.length-1;for(;t>=0&&/\s/.test(e[t]);)t--;if(t<0||`(=,:[;!&|?{`.includes(e[t]))return!0;let n=e.slice(0,t+1);return/\b(?:return|typeof|instanceof|in|of|new|case|void|delete|do|else|yield)\s*$/.test(n)}function k(e){return e.replace(/^node:/,``)}function A(e,t){try{let n=i.openSync(e,`r`);try{let e=new Uint8Array(t),r=i.readSync(n,e,0,t,0),a=Buffer.from(e.subarray(0,r)).toString(`utf-8`),o=a.lastIndexOf(`
 `);return o!==-1&&(a=a.slice(0,o)),a}finally{i.closeSync(n)}}catch{return null}}function j(e,t,n={}){let a=n.maxFiles??300,o=n.maxTotalBytes??8388608,s=v(e,t,a),c=[],l=new Set,u=0,d=(e,t,n,r,i,a,o,s=``)=>{let u=`${e}|${i}|${a}|${s}`;l.has(u)||(l.add(u),c.push({ruleId:e,category:t,severity:n,message:r,file:i,line:a,snippet:o}))},f=(e,t)=>{let n=e.split(`
 `),r={inBlockComment:!1,inTemplate:!1};for(let e=0;e<n.length;e++){let i=n[e],{code:a,raw:o,imports:s}=D(i,r),c=e+1,l=i.trim().slice(0,120);if(x.test(o)){let e=[];for(let t of b){let n=t.layer===`raw`?o:a;t.pattern.test(n)&&(!t.codeGuard||t.codeGuard.test(a))&&e.push(t)}let n=e.some(e=>e.id===`new-function`);for(let r of e)n&&r.id===`function-constructor`||d(r.id,r.category,r.severity,r.description,t,c,l);if(S.test(o)&&/\b(?:fs|require)\b/.test(a)){if(w.test(o)){let e=E[`fs-write-sensitive`];d(`fs-write-sensitive`,e.category,e.severity,e.message,t,c,l)}if(T.test(o)){let e=E[`fs-read-sensitive`];d(`fs-read-sensitive`,e.category,e.severity,e.message,t,c,l)}}}for(let e of s){if(te.test(e)){d(`remote-code-import`,`dynamic-code`,`high`,`Loads code from a remote URL at runtime: ${e.slice(0,80)}`,t,c,l,e);continue}let n=k(e);for(let r of ee)if(r.modules.includes(n)){d(r.id,r.category,r.severity,r.description,t,c,l,e);break}}}},p=0,m=!1;for(let t of s){let n=r.relative(e,t),a;try{a=i.statSync(t).size}catch{continue}let s=o-p;if(a>s){if(s>0){let e=A(t,s);e!==null&&(u++,f(e,n))}m=!0;break}let c;try{c=i.readFileSync(t,`utf-8`)}catch{continue}u++,p+=a,f(c,n)}return m&&d(`scan-truncated`,`metadata`,`warning`,`Scan truncated at ${o} bytes — remaining files were not inspected. Increase maxTotalBytes to audit the full package.`,`package.json`,0),{findings:c,filesScanned:u}}const M=/^(?:git(?:\+[a-z]+)?|https?|file|link|ssh|github):/i;function N(e,t={name:`plugin`}){let n=[],r=e.scripts||{};for(let e of[`preinstall`,`install`,`postinstall`]){let t=r[e];typeof t==`string`&&t.trim().length>0&&n.push({ruleId:`install-script`,category:`metadata`,severity:`high`,message:`Runs a ${e} script during installation — a common supply-chain attack vector`,file:`package.json`,line:0,snippet:`${e}: ${t.trim().slice(0,120)}`})}let i=e.bundledDependencies??e.bundleDependencies;Array.isArray(i)&&i.length>0&&n.push({ruleId:`bundled-deps`,category:`metadata`,severity:`warning`,message:`Bundles dependencies: ${i.join(`, `)} — vendored code that bypasses the registry audit`,file:`package.json`,line:0,snippet:`bundledDependencies: [${i.join(`, `)}]`});let o=[];for(let t of[`dependencies`,`devDependencies`,`optionalDependencies`,`peerDependencies`]){let n=e[t];if(!(!n||typeof n!=`object`))for(let[e,t]of Object.entries(n))typeof t==`string`&&M.test(t)&&o.push(`${e}@${t}`)}if(o.length>0&&n.push({ruleId:`remote-deps`,category:`metadata`,severity:`warning`,message:`Dependencies loaded from non-registry sources (git/file/URL): ${o.join(`, `)}`,file:`package.json`,line:0,snippet:o.slice(0,3).join(`, `)}),!e.license&&!e.licenses&&n.push({ruleId:`no-license`,category:`metadata`,severity:`low`,message:`Package declares no license`,file:`package.json`,line:0}),!e.repository&&!e.homepage&&n.push({ruleId:`no-provenance`,category:`metadata`,severity:`low`,message:`Package declares no repository or homepage — harder to verify provenance`,file:`package.json`,line:0}),t.boltdocsVersion&&typeof e.version==`string`)try{a.satisfies(e.version,t.boltdocsVersion)||n.push({ruleId:`version-mismatch`,category:`metadata`,severity:`low`,message:`Installed version ${e.version} does not satisfy the declared boltdocsVersion range ${t.boltdocsVersion}`,file:`package.json`,line:0,snippet:`boltdocsVersion: ${t.boltdocsVersion}`})}catch{}return n}function P(e,n,r={},i){let a=t(i?.packageName??e,n);if(!a)return{name:e,status:`unresolved`,filesScanned:0,findings:[]};let o;try{o=j(a.dir,a.pkg,r)}catch(t){return{name:e,status:`error`,pluginDir:a.dir,version:a.version,filesScanned:0,findings:[{ruleId:`scan-error`,category:`metadata`,severity:`warning`,message:`Static scan failed: ${t instanceof Error?t.message:String(t)}`,file:`package.json`,line:0}]}}let s=[...o.findings];s.push(...N(a.pkg,{name:e,boltdocsVersion:i?.boltdocsVersion}));let l=c(s.map(e=>e.severity));return{name:e,status:s.length===0?`clean`:`warning`,severity:l,pluginDir:a.dir,version:a.version,filesScanned:o.filesScanned,findings:s}}function F(e,t,n={}){let r=[];for(let i of e)!i||typeof i.name!=`string`||!i.name||r.push(P(i.name,t,n,i));return r}const I=/from\s+(['"])([^'"]+)\1/g;function L(e){let t=[];I.lastIndex=0;for(let n=I.exec(e);n!==null;n=I.exec(e))t.push(n[2]);return t}function R(e){let t=e.lastIndexOf(`/`);return t>=0?e.slice(t+1):e}function z(e,t,n){let r=0;if(t.pkgName===e)r=100;else{let n=R(t.pkgName);n===e?r=60:e.endsWith(n)&&(r=40)}return r>0&&n&&t.version===n&&(r+=15),r}function B(e,t){let a;try{a=i.readFileSync(e,`utf-8`)}catch{return[]}let o=n(e),s=[],c=new Set;for(let e of L(a)){if(e.startsWith(`.`)||e.startsWith(`/`))continue;let n=null;try{n=o.resolve(`${e}/package.json`)}catch{let a=r.resolve(t,`node_modules`,e,`package.json`);i.existsSync(a)&&(n=a)}if(!n||!i.existsSync(n))continue;let a;try{a=JSON.parse(i.readFileSync(n,`utf-8`))}catch{continue}let l=typeof a.name==`string`?a.name:e;l!==`boltdocs`&&(c.has(l)||(c.add(l),s.push({pkgName:l,version:typeof a.version==`string`?a.version:void 0})))}return s}function V(e,t,n){if(n.length===0)return;let r=B(e,t);if(r.length!==0)for(let e of n){if(!e||typeof e.name!=`string`||!e.name)continue;let t=null,n=0;for(let i of r){let r=z(e.name,i,e.version);r>n&&(n=r,t=i)}t&&(e.packageName=t.pkgName)}}async function ie(t){let n;for(let a of e){let e=r.resolve(t,a);if(i.existsSync(e))try{let{createJiti:n}=await import(`jiti`),r=await n(t,{interopDefault:!0}).import(e)??{},i=r.default??r.config??r;if(!i||typeof i!=`object`)throw Error(`config file did not export an object`);if(!(`plugins`in i))return{plugins:[],configFile:e};if(!Array.isArray(i.plugins))throw Error(`config.plugins must be an array, got ${typeof i.plugins}`);let a=i.plugins;return V(e,t,a),{plugins:a,configFile:e}}catch(e){n=e}}if(n!==void 0)throw Error(`Failed to load Boltdocs configuration: ${n instanceof Error?n.message:String(n)}`,{cause:n});return{plugins:[]}}const H=!(`NO_COLOR`in process.env)&&(process.stdout?.isTTY??!1),U=RegExp(`\x1B\\[[0-9;]*m`,`g`);function W(e){return e.replace(U,``).length}function G(e,t){return H?`\u001b[${e}m${t}\u001b[0m`:t}const K={red:e=>G(31,e),yellow:e=>G(33,e),cyan:e=>G(36,e),green:e=>G(32,e),gray:e=>G(90,e),bold:e=>G(1,e),dim:e=>G(2,e)},q=e=>G(`38;2;235;88;40`,e);function J(e,t,n,r){let i=n.match(/^\n+/)?.[0]??``,a=n.slice(i.length),o=`${K.bold(`[boltdocs]`)} ${a}`,s=e===`stderr`?console.error:console.log;i&&s(i),s(t(o)),r!==void 0&&s(r)}const Y=e=>J(`stdout`,K.gray,e),X=e=>J(`stdout`,K.yellow,e),Z=e=>J(`stdout`,K.green,e),ae=(e,t)=>J(`stderr`,K.red,e,t);function oe(e,t){let n=Math.max(e.length,...t.map(e=>e.length)),r=[];for(let i=0;i<n;i++){let n=e[i]?W(e[i]):0;for(let e of t)n=Math.max(n,W(e[i]??``));r[i]=n+2}let i={h:`─`,v:`│`,tl:`┌`,tm:`┬`,tr:`┐`,ml:`├`,mm:`┼`,mr:`┤`,bl:`└`,bm:`┴`,br:`┘`},a=(e,t,n)=>q(e+r.map(e=>i.h.repeat(e)).join(t)+n),o=e=>q(i.v)+e.map((e,t)=>{let n=e??``;return` `.repeat(1)+n+` `.repeat(r[t]-W(n)-1)}).join(q(i.v))+q(i.v),s=[a(i.tl,i.tm,i.tr)];e.length>0&&(s.push(o(e.map(e=>K.bold(e)))),s.push(a(i.ml,i.mm,i.mr)));for(let e of t)s.push(o(e));return s.push(a(i.bl,i.bm,i.br)),s.join(`
 `)}function Q(e,t){return e+` `.repeat(Math.max(0,t-W(e)))}function $(e){return e.status===`error`?`✖ Scan error`:e.status===`unresolved`?`❓ Unresolved`:e.severity===`high`?`⚠️ High risk`:e.severity===`warning`?`⚠️ Warning`:e.severity===`low`?`ℹ️ Low risk`:`✅ Clean`}function se(e){return e.status===`error`||e.severity===`high`?K.red:e.severity===`warning`?K.yellow:e.severity===`low`?q:K.green}async function ce(e=process.cwd()){Y(`Starting static security audit of Boltdocs plugins...`);let t;try{t=(await ie(e)).plugins}catch(e){ae(`Failed to load Boltdocs configuration for audit:`,e),process.exit(1)}if(t.length===0){Z(`No plugins configured. Nothing to audit.`);return}let n=[...F(t,e)].sort((e,t)=>s[t.severity||`low`]-s[e.severity||`low`]||e.name.localeCompare(t.name));for(let e of n){let t=e.version?`${e.name}@${e.version}`:e.name;if(e.status===`unresolved`){X(`\n${q(t)} — ${K.yellow(`❓ Unresolved`)} (could not locate the package in node_modules)`);continue}let n=e.findings.length===0?`no findings`:`${e.findings.length} finding${e.findings.length===1?``:`s`}`;console.log(`\n${K.bold(q(t))} — ${se(e)($(e))} (${n} · ${e.filesScanned} file${e.filesScanned===1?``:`s`} scanned)`);let r=[...e.findings].sort((e,t)=>s[t.severity]-s[e.severity]||e.file.localeCompare(t.file)||e.line-t.line);for(let e of r){let t=e.file===`package.json`?`package.json`:`${e.file}:${e.line}`,n=e.severity===`high`?K.red(e.severity):e.severity===`warning`?K.yellow(e.severity):K.dim(e.severity);console.log(`  ${Q(K.dim(t),36)}${Q(n,9)}[${K.dim(e.category)}] ${K.bold(e.ruleId)} — ${e.message}${e.snippet?K.dim(`  (${e.snippet})`):``}`)}}console.log(`

package/dist/{build-DERe6o5Y.cjs → build-Dh61OnDW.cjs}

@@ -3,4 +3,4 @@
  * Copyright (c) 2026 Jesus Alcala
  * Licensed under the MIT License.
  */
-const e=require(`./chunk-D1Md3oWO.cjs`),t=require(`./node-CWf8IF1Q.cjs`),n=require(`./node/cache.cjs`),r=require(`./update-check-BKqmYfwT.cjs`);let i=require(`node:path`);i=e.r(i);let a=require(`node:fs`);a=e.r(a);let o=require(`@bdocs/dui`),s=require(`vite`);const c=new Set([`Client build`,`Server build`,`Render pages`,`Static loader data`,`Build metrics`]);function l(e,t){let n=i.default.join(e,`.boltdocs`,`benchmarks`);a.default.existsSync(n)||a.default.mkdirSync(n,{recursive:!0});let r=i.default.join(n,`phases-report-${new Date().toISOString().replace(/[:.]/g,`-`).slice(0,19)}.json`),o={timestamp:new Date().toISOString(),root:e,...t,error:t.error?.message||t.error?.toString()};return a.default.writeFileSync(r,JSON.stringify(o,null,2)),r}async function u(e=process.cwd(),i={}){process.env.NODE_ENV=`production`,r.t();let a=process.env.BOLTDOCS_BENCHMARK_PHASES===`true`;try{let i=await t.c().run({root:e,timing:{}});if(a&&console.log(`[boltdocs] ${JSON.stringify({name:`Build pipeline`,success:i.success,steps:i.stepResults.map(e=>({name:e.name,duration:Math.round(e.duration),success:e.success,...e.details?{details:e.details}:{}}))})}`),!i.success){if((0,o.error)(`Build failed at step "${i.failedStep}":`,i.error),a){let t=l(e,i);console.log(`[benchmark] failure report written to ${t}`)}await n.flushCache(),process.exit(1)}if(a){let t=l(e,i);console.log(`[benchmark] phase report written to ${t}`),await n.flushCache(),process.exit(0)}let s=i.stepResults.filter(e=>!c.has(e.name)),u=i.stepResults.find(e=>e.name===`Build metrics`)?.metrics,d=e=>(e/1024).toFixed(0),f=e=>(e/1024/1024).toFixed(1),p=e=>e>1024*1024?`${f(e)} MB`:`${d(e)} kB`;console.log(r.a({totalMs:i.timing.total,steps:s.map(e=>({name:e.name,success:e.success,duration:e.duration,details:e.details})),pages:u?.totalPages,jsSize:u?p(u.jsSize):void 0,cssSize:u?p(u.cssSize):void 0,outDir:`dist/`})),await n.flushCache(),process.exit(0)}catch(e){(0,o.error)(`Build failed:`,e),await n.flushCache(),process.exit(1)}}async function d(e=process.cwd(),n={}){try{let i=await t.n(e,`production`,void 0,{skipTypes:!0,skipLinkTree:!0});i.logLevel=`warn`,i.clearScreen=!1,n.port!==void 0&&(i.preview=i.preview||{},i.preview.port=Number(n.port)),n.host!==void 0&&(i.preview=i.preview||{},i.preview.host=n.host);let a=performance.now(),o=(await(0,s.preview)(i)).resolvedUrls;console.log(r.c(o?.local?.[0]??`http://localhost:${n.port??4173}`,o?.network?.[0]??null,{readyIn:performance.now()-a}))}catch(e){(0,o.error)(`Failed to start preview server:`,e),process.exit(1)}}exports.buildAction=u,exports.previewAction=d;
+const e=require(`./chunk-D1Md3oWO.cjs`),t=require(`./node-B4GvEOqF.cjs`),n=require(`./node/cache.cjs`),r=require(`./update-check-DFQZyoSU.cjs`);let i=require(`node:path`);i=e.r(i);let a=require(`node:fs`);a=e.r(a);let o=require(`@bdocs/dui`),s=require(`vite`);const c=new Set([`Client build`,`Server build`,`Render pages`,`Static loader data`,`Build metrics`]);function l(e,t){let n=i.default.join(e,`.boltdocs`,`benchmarks`);a.default.existsSync(n)||a.default.mkdirSync(n,{recursive:!0});let r=i.default.join(n,`phases-report-${new Date().toISOString().replace(/[:.]/g,`-`).slice(0,19)}.json`),o={timestamp:new Date().toISOString(),root:e,...t,error:t.error?.message||t.error?.toString()};return a.default.writeFileSync(r,JSON.stringify(o,null,2)),r}async function u(e=process.cwd(),i={}){process.env.NODE_ENV=`production`,r.t();let a=process.env.BOLTDOCS_BENCHMARK_PHASES===`true`;try{let i=await t.c().run({root:e,timing:{}});if(a&&console.log(`[boltdocs] ${JSON.stringify({name:`Build pipeline`,success:i.success,steps:i.stepResults.map(e=>({name:e.name,duration:Math.round(e.duration),success:e.success,...e.details?{details:e.details}:{}}))})}`),!i.success){if((0,o.error)(`Build failed at step "${i.failedStep}":`,i.error),a){let t=l(e,i);console.log(`[benchmark] failure report written to ${t}`)}await n.flushCache(),process.exit(1)}if(a){let t=l(e,i);console.log(`[benchmark] phase report written to ${t}`),await n.flushCache(),process.exit(0)}let s=i.stepResults.filter(e=>!c.has(e.name)),u=i.stepResults.find(e=>e.name===`Build metrics`)?.metrics,d=e=>(e/1024).toFixed(0),f=e=>(e/1024/1024).toFixed(1),p=e=>e>1024*1024?`${f(e)} MB`:`${d(e)} kB`;console.log(r.a({totalMs:i.timing.total,steps:s.map(e=>({name:e.name,success:e.success,duration:e.duration,details:e.details})),pages:u?.totalPages,jsSize:u?p(u.jsSize):void 0,cssSize:u?p(u.cssSize):void 0,outDir:`dist/`})),await n.flushCache(),process.exit(0)}catch(e){(0,o.error)(`Build failed:`,e),await n.flushCache(),process.exit(1)}}async function d(e=process.cwd(),n={}){try{let i=await t.n(e,`production`,void 0,{skipTypes:!0,skipLinkTree:!0});i.logLevel=`warn`,i.clearScreen=!1,n.port!==void 0&&(i.preview=i.preview||{},i.preview.port=Number(n.port)),n.host!==void 0&&(i.preview=i.preview||{},i.preview.host=n.host);let a=performance.now(),o=(await(0,s.preview)(i)).resolvedUrls;console.log(r.c(o?.local?.[0]??`http://localhost:${n.port??4173}`,o?.network?.[0]??null,{readyIn:performance.now()-a}))}catch(e){(0,o.error)(`Failed to start preview server:`,e),process.exit(1)}}exports.buildAction=u,exports.previewAction=d;

package/dist/{build-Bp5RlslU.mjs → build-WmZDi-TG.mjs}

@@ -3,4 +3,4 @@
  * Copyright (c) 2026 Jesus Alcala
  * Licensed under the MIT License.
  */
-import{c as e,n as t}from"./node-CK5-Ta83.mjs";import{flushCache as n}from"./node/cache.mjs";import{a as r,c as i,t as a}from"./update-check-QnrVR3q1.mjs";import o from"node:path";import s from"node:fs";import{error as c}from"@bdocs/dui";import{preview as l}from"vite";const u=new Set([`Client build`,`Server build`,`Render pages`,`Static loader data`,`Build metrics`]);function d(e,t){let n=o.join(e,`.boltdocs`,`benchmarks`);s.existsSync(n)||s.mkdirSync(n,{recursive:!0});let r=o.join(n,`phases-report-${new Date().toISOString().replace(/[:.]/g,`-`).slice(0,19)}.json`),i={timestamp:new Date().toISOString(),root:e,...t,error:t.error?.message||t.error?.toString()};return s.writeFileSync(r,JSON.stringify(i,null,2)),r}async function f(t=process.cwd(),i={}){process.env.NODE_ENV=`production`,a();let o=process.env.BOLTDOCS_BENCHMARK_PHASES===`true`;try{let i=await e().run({root:t,timing:{}});if(o&&console.log(`[boltdocs] ${JSON.stringify({name:`Build pipeline`,success:i.success,steps:i.stepResults.map(e=>({name:e.name,duration:Math.round(e.duration),success:e.success,...e.details?{details:e.details}:{}}))})}`),!i.success){if(c(`Build failed at step "${i.failedStep}":`,i.error),o){let e=d(t,i);console.log(`[benchmark] failure report written to ${e}`)}await n(),process.exit(1)}if(o){let e=d(t,i);console.log(`[benchmark] phase report written to ${e}`),await n(),process.exit(0)}let a=i.stepResults.filter(e=>!u.has(e.name)),s=i.stepResults.find(e=>e.name===`Build metrics`)?.metrics,l=e=>(e/1024).toFixed(0),f=e=>(e/1024/1024).toFixed(1),p=e=>e>1024*1024?`${f(e)} MB`:`${l(e)} kB`;console.log(r({totalMs:i.timing.total,steps:a.map(e=>({name:e.name,success:e.success,duration:e.duration,details:e.details})),pages:s?.totalPages,jsSize:s?p(s.jsSize):void 0,cssSize:s?p(s.cssSize):void 0,outDir:`dist/`})),await n(),process.exit(0)}catch(e){c(`Build failed:`,e),await n(),process.exit(1)}}async function p(e=process.cwd(),n={}){try{let r=await t(e,`production`,void 0,{skipTypes:!0,skipLinkTree:!0});r.logLevel=`warn`,r.clearScreen=!1,n.port!==void 0&&(r.preview=r.preview||{},r.preview.port=Number(n.port)),n.host!==void 0&&(r.preview=r.preview||{},r.preview.host=n.host);let a=performance.now(),o=(await l(r)).resolvedUrls;console.log(i(o?.local?.[0]??`http://localhost:${n.port??4173}`,o?.network?.[0]??null,{readyIn:performance.now()-a}))}catch(e){c(`Failed to start preview server:`,e),process.exit(1)}}export{f as buildAction,p as previewAction};
+import{l as e,n as t}from"./node-DwgtnlGU.mjs";import{flushCache as n}from"./node/cache.mjs";import{a as r,c as i,t as a}from"./update-check-BXD1atVv.mjs";import o from"node:path";import s from"node:fs";import{error as c}from"@bdocs/dui";import{preview as l}from"vite";const u=new Set([`Client build`,`Server build`,`Render pages`,`Static loader data`,`Build metrics`]);function d(e,t){let n=o.join(e,`.boltdocs`,`benchmarks`);s.existsSync(n)||s.mkdirSync(n,{recursive:!0});let r=o.join(n,`phases-report-${new Date().toISOString().replace(/[:.]/g,`-`).slice(0,19)}.json`),i={timestamp:new Date().toISOString(),root:e,...t,error:t.error?.message||t.error?.toString()};return s.writeFileSync(r,JSON.stringify(i,null,2)),r}async function f(t=process.cwd(),i={}){process.env.NODE_ENV=`production`,a();let o=process.env.BOLTDOCS_BENCHMARK_PHASES===`true`;try{let i=await e().run({root:t,timing:{}});if(o&&console.log(`[boltdocs] ${JSON.stringify({name:`Build pipeline`,success:i.success,steps:i.stepResults.map(e=>({name:e.name,duration:Math.round(e.duration),success:e.success,...e.details?{details:e.details}:{}}))})}`),!i.success){if(c(`Build failed at step "${i.failedStep}":`,i.error),o){let e=d(t,i);console.log(`[benchmark] failure report written to ${e}`)}await n(),process.exit(1)}if(o){let e=d(t,i);console.log(`[benchmark] phase report written to ${e}`),await n(),process.exit(0)}let a=i.stepResults.filter(e=>!u.has(e.name)),s=i.stepResults.find(e=>e.name===`Build metrics`)?.metrics,l=e=>(e/1024).toFixed(0),f=e=>(e/1024/1024).toFixed(1),p=e=>e>1024*1024?`${f(e)} MB`:`${l(e)} kB`;console.log(r({totalMs:i.timing.total,steps:a.map(e=>({name:e.name,success:e.success,duration:e.duration,details:e.details})),pages:s?.totalPages,jsSize:s?p(s.jsSize):void 0,cssSize:s?p(s.cssSize):void 0,outDir:`dist/`})),await n(),process.exit(0)}catch(e){c(`Build failed:`,e),await n(),process.exit(1)}}async function p(e=process.cwd(),n={}){try{let r=await t(e,`production`,void 0,{skipTypes:!0,skipLinkTree:!0});r.logLevel=`warn`,r.clearScreen=!1,n.port!==void 0&&(r.preview=r.preview||{},r.preview.port=Number(n.port)),n.host!==void 0&&(r.preview=r.preview||{},r.preview.host=n.host);let a=performance.now(),o=(await l(r)).resolvedUrls;console.log(i(o?.local?.[0]??`http://localhost:${n.port??4173}`,o?.network?.[0]??null,{readyIn:performance.now()-a}))}catch(e){c(`Failed to start preview server:`,e),process.exit(1)}}export{f as buildAction,p as previewAction};

package/dist/client/index.cjs

@@ -18,6 +18,8 @@ let react_helmet_async = require("react-helmet-async");
 react_helmet_async = require_router.__toESM(react_helmet_async);
 let virtual_boltdocs_mdx_components = require("virtual:boltdocs-mdx-components");
 virtual_boltdocs_mdx_components = require_router.__toESM(virtual_boltdocs_mdx_components);
+let virtual_boltdocs_page_source = require("virtual:boltdocs-page-source");
+virtual_boltdocs_page_source = require_router.__toESM(virtual_boltdocs_page_source);
 let virtual_boltdocs_layout = require("virtual:boltdocs-layout");
 virtual_boltdocs_layout = require_router.__toESM(virtual_boltdocs_layout);
 let _bdocs_ssg = require("@bdocs/ssg");
@@ -723,6 +725,11 @@ function Breadcrumbs({ className }) {
 
 //#endregion
 //#region src/client/components/ui-base/copy-markdown.tsx
+let pageSourcePromise = null;
+function getPageSource() {
+	if (!pageSourcePromise) pageSourcePromise = (0, virtual_boltdocs_page_source.default)().catch(() => ({}));
+	return pageSourcePromise;
+}
 const useCopyMarkdown = (content) => {
 	const [copied, setCopied] = (0, react.useState)(false);
 	const timerRef = (0, react.useRef)(null);
@@ -751,10 +758,37 @@ const useCopyMarkdown = (content) => {
 		handleOpenRaw
 	};
 };
-function CopyMarkdown({ content, mdxRaw, className }) {
-	const displayContent = mdxRaw || content || "";
+function CopyMarkdown({ content, mdxRaw, route, className }) {
+	const routePath = route?.path;
+	const [rawState, setRawState] = (0, react.useState)({
+		path: "",
+		resolved: false
+	});
+	const current = rawState.path === routePath && routePath ? rawState : {
+		path: routePath || "",
+		resolved: false
+	};
+	(0, react.useEffect)(() => {
+		if (mdxRaw || content || !routePath) return;
+		let cancelled = false;
+		getPageSource().then((record) => {
+			if (!cancelled) setRawState({
+				path: routePath,
+				value: record[routePath],
+				resolved: true
+			});
+		});
+		return () => {
+			cancelled = true;
+		};
+	}, [
+		routePath,
+		mdxRaw,
+		content
+	]);
+	const displayContent = mdxRaw || current.value || content || "";
 	const { copied, handleCopy, handleOpenRaw } = useCopyMarkdown(displayContent);
-	if (!displayContent) return null;
+	if (!displayContent && (!!content || !!mdxRaw || current.resolved || !routePath)) return null;
 	return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 		className: require_link.cn("relative inline-flex z-100 shrink-0 w-max", className),
 		children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(require_docs_layout.ButtonGroup, {

package/dist/client/index.d.cts

@@ -1,4 +1,4 @@
 
-import { $ as LazyRouteResult, A as matchRouteBranch, B as useRouteData, C as stripSiteProtocol, D as normalizeBasename, E as hasBasename, F as useLoaderData, G as MatchesContext, H as LocationProvider, I as useLocation, J as PrefetchContext, K as NavigateContext, L as useMatches, M as resolveRouteBranch, N as Outlet, O as stripBasename, P as OutletContext, Q as CreateRoutesResult, R as useNavigate, S as splitUrlReference, T as addBasename, U as LocationProviderProps, V as LocationContext, W as LocationState, X as RouteDataContext, Y as PrefetchFunction, Z as defaultNavigate, _ as isConfiguredVersion, a as UrlRouteHint, at as RouterOptions, b as parseUrlReference, c as buildUrl, d as getConfiguredVersions, dt as BoltdocsRoutePath, et as LoaderFunction, f as getVersionPrefixSegments, ft as BoltdocsRoutePathWithFallback, g as isConfiguredLocale, h as hasUrlBase, ht as BoltdocsVersion, i as UrlContractConfig, it as RouteRendererProps, j as matchRouteBranchWithParams, k as RouteRenderer, l as classifyUrlPath, lt as BoltdocsLocale, m as hasUriScheme, mt as BoltdocsTypes, n as ParsedUrl, nt as RouteMatch, o as UrlRouteKind, p as getVersionSegments, q as NavigateFunction, r as ResolveUrlOptions, rt as RouteRecord, s as addUrlBase, st as BoltdocsConfig, t as BuildUrlOptions, tt as LoaderFunctionArgs, u as getConfiguredLocales, v as normalizeUrlBase, w as stripUrlBase, x as resolveUrlReference, y as normalizeUrlPath, z as usePrefetch } from "../index-CPUUKzxD.cjs";
-import { A as cn, At as useUI, B as NotFound, Bt as CollectionsData, C as createArticleStructuredData, Ct as usePageNav, D as defineStructuredData, Dt as useSearch, E as createWebSiteStructuredData, Et as useTabs, F as TimelineVariant, Ft as BoltdocsShell, G as Breadcrumbs, Gt as ComponentRoute, H as CopyMarkdown, Ht as BoltdocsTab, I as usePost, It as MdxPage, Jt as OnThisPageProps, K as OnThisPage, Kt as LayoutProps, L as usePosts, Lt as createRoutes, M as TimelineBadgeConfig, Mt as useTheme, N as TimelineItemProps, Nt as useConfig, O as getTranslated, Ot as useSidebar, P as TimelineProps, Pt as ViteReactSSG, R as useRecentPosts, Rt as CollectionPost, S as WebSiteStructuredDataOptions, St as useBreadcrumbs, T as createStructuredData, Tt as useVersion, U as ErrorBoundary, Ut as CollectionListLoaderData, V as SearchDialog, Vt as CurrentPostProvider, W as PageNav, Wt as CollectionPostLoaderData, Xt as SiteConfig, Yt as SidebarProps, Zt as TabsProps, _ as StructuredData, _t as useTrackEvent, a as useExpandable, b as BreadcrumbStructuredDataItem, bt as useLocalizedTo, c as getStarsRepo, d as ViewTransitionHandle, dt as Navbar, f as ViewTransitionOptions, ft as DocsLayoutComponent, g as useViewTransition, gt as useAnalytics, h as startViewTransition, ht as useHeadings, i as UseExpandableOptions, j as Timeline, jt as useMdxComponents, k as resolvePublicAssetUrl, kt as useNavbar, l as copyToClipboard, m as ViewTransitionUpdate, mt as useMergedComponents, n as UseCodeBlockFeedbackOptions, o as useCopyButton, p as ViewTransitionRunner, pt as useFeedback, q as Sidebar, qt as NavbarLink, r as useCodeBlockFeedback, s as useCodeBlock, t as CodeBlockFeedbackPayload, u as reactToText, v as StructuredDataProps, vt as useTrackPageView, w as createBreadcrumbStructuredData, wt as useI18n, x as StructuredDataFactoryOptions, xt as useRoutes, y as ArticleStructuredDataOptions, yt as useSearchHighlight, z as Banner, zt as CollectionsContext } from "../index-C56bL-A-.cjs";
+import { $ as LazyRouteResult, A as matchRouteBranch, B as useRouteData, C as stripSiteProtocol, D as normalizeBasename, E as hasBasename, F as useLoaderData, G as MatchesContext, H as LocationProvider, I as useLocation, J as PrefetchContext, K as NavigateContext, L as useMatches, M as resolveRouteBranch, N as Outlet, O as stripBasename, P as OutletContext, Q as CreateRoutesResult, R as useNavigate, S as splitUrlReference, T as addBasename, U as LocationProviderProps, V as LocationContext, W as LocationState, X as RouteDataContext, Y as PrefetchFunction, Z as defaultNavigate, _ as isConfiguredVersion, a as UrlRouteHint, at as RouterOptions, b as parseUrlReference, c as buildUrl, d as getConfiguredVersions, dt as BoltdocsRoutePath, et as LoaderFunction, f as getVersionPrefixSegments, ft as BoltdocsRoutePathWithFallback, g as isConfiguredLocale, h as hasUrlBase, ht as BoltdocsVersion, i as UrlContractConfig, it as RouteRendererProps, j as matchRouteBranchWithParams, k as RouteRenderer, l as classifyUrlPath, lt as BoltdocsLocale, m as hasUriScheme, mt as BoltdocsTypes, n as ParsedUrl, nt as RouteMatch, o as UrlRouteKind, p as getVersionSegments, q as NavigateFunction, r as ResolveUrlOptions, rt as RouteRecord, s as addUrlBase, st as BoltdocsConfig, t as BuildUrlOptions, tt as LoaderFunctionArgs, u as getConfiguredLocales, v as normalizeUrlBase, w as stripUrlBase, x as resolveUrlReference, y as normalizeUrlPath, z as usePrefetch } from "../index-CgWkOCCn.cjs";
+import { A as cn, At as useUI, B as NotFound, Bt as CollectionsData, C as createArticleStructuredData, Ct as usePageNav, D as defineStructuredData, Dt as useSearch, E as createWebSiteStructuredData, Et as useTabs, F as TimelineVariant, Ft as BoltdocsShell, G as Breadcrumbs, Gt as ComponentRoute, H as CopyMarkdown, Ht as BoltdocsTab, I as usePost, It as MdxPage, Jt as OnThisPageProps, K as OnThisPage, Kt as LayoutProps, L as usePosts, Lt as createRoutes, M as TimelineBadgeConfig, Mt as useTheme, N as TimelineItemProps, Nt as useConfig, O as getTranslated, Ot as useSidebar, P as TimelineProps, Pt as ViteReactSSG, R as useRecentPosts, Rt as CollectionPost, S as WebSiteStructuredDataOptions, St as useBreadcrumbs, T as createStructuredData, Tt as useVersion, U as ErrorBoundary, Ut as CollectionListLoaderData, V as SearchDialog, Vt as CurrentPostProvider, W as PageNav, Wt as CollectionPostLoaderData, Xt as SiteConfig, Yt as SidebarProps, Zt as TabsProps, _ as StructuredData, _t as useTrackEvent, a as useExpandable, b as BreadcrumbStructuredDataItem, bt as useLocalizedTo, c as getStarsRepo, d as ViewTransitionHandle, dt as Navbar, f as ViewTransitionOptions, ft as DocsLayoutComponent, g as useViewTransition, gt as useAnalytics, h as startViewTransition, ht as useHeadings, i as UseExpandableOptions, j as Timeline, jt as useMdxComponents, k as resolvePublicAssetUrl, kt as useNavbar, l as copyToClipboard, m as ViewTransitionUpdate, mt as useMergedComponents, n as UseCodeBlockFeedbackOptions, o as useCopyButton, p as ViewTransitionRunner, pt as useFeedback, q as Sidebar, qt as NavbarLink, r as useCodeBlockFeedback, s as useCodeBlock, t as CodeBlockFeedbackPayload, u as reactToText, v as StructuredDataProps, vt as useTrackPageView, w as createBreadcrumbStructuredData, wt as useI18n, x as StructuredDataFactoryOptions, xt as useRoutes, y as ArticleStructuredDataOptions, yt as useSearchHighlight, z as Banner, zt as CollectionsContext } from "../index-CSiMUBhC.cjs";
 export { ArticleStructuredDataOptions, Banner, BoltdocsConfig, BoltdocsLocale, BoltdocsRoutePath, BoltdocsRoutePathWithFallback, BoltdocsShell, BoltdocsTab, BoltdocsTypes, BoltdocsVersion, BreadcrumbStructuredDataItem, Breadcrumbs, BuildUrlOptions, CodeBlockFeedbackPayload, CollectionListLoaderData, CollectionPost, CollectionPostLoaderData, CollectionsContext, CollectionsData, ComponentRoute, CopyMarkdown, CreateRoutesResult, CurrentPostProvider, DocsLayoutComponent as DocsLayout, ErrorBoundary, LayoutProps, LazyRouteResult, LoaderFunction, LoaderFunctionArgs, LocationContext, LocationProvider, LocationProviderProps, LocationState, MatchesContext, MdxPage, Navbar, NavbarLink, NavigateContext, NavigateFunction, NotFound, OnThisPage, OnThisPageProps, Outlet, OutletContext, PageNav, ParsedUrl, PrefetchContext, PrefetchFunction, ResolveUrlOptions, RouteDataContext, RouteMatch, RouteRecord, RouteRenderer, RouteRendererProps, RouterOptions, SearchDialog, Sidebar, SidebarProps, SiteConfig, StructuredData, StructuredDataFactoryOptions, StructuredDataProps, TabsProps, Timeline, TimelineBadgeConfig, TimelineItemProps, TimelineProps, TimelineVariant, UrlContractConfig, UrlRouteHint, UrlRouteKind, UseCodeBlockFeedbackOptions, UseExpandableOptions, ViewTransitionHandle, ViewTransitionOptions, ViewTransitionRunner, ViewTransitionUpdate, ViteReactSSG, WebSiteStructuredDataOptions, addBasename, addUrlBase, buildUrl, classifyUrlPath, cn, copyToClipboard, createArticleStructuredData, createBreadcrumbStructuredData, createRoutes, createStructuredData, createWebSiteStructuredData, defaultNavigate, defineStructuredData, getConfiguredLocales, getConfiguredVersions, getStarsRepo, getTranslated, getVersionPrefixSegments, getVersionSegments, hasBasename, hasUriScheme, hasUrlBase, isConfiguredLocale, isConfiguredVersion, matchRouteBranch, matchRouteBranchWithParams, normalizeBasename, normalizeUrlBase, normalizeUrlPath, parseUrlReference, reactToText, resolvePublicAssetUrl, resolveRouteBranch, resolveUrlReference, splitUrlReference, startViewTransition, stripBasename, stripSiteProtocol, stripUrlBase, useAnalytics, useBreadcrumbs, useCodeBlock, useCodeBlockFeedback, useConfig, useCopyButton, useExpandable, useFeedback, useHeadings, useI18n, useLoaderData, useLocalizedTo, useLocation, useMatches, useMdxComponents, useMergedComponents, useNavbar, useNavigate, usePageNav, usePost, usePosts, usePrefetch, useRecentPosts, useRouteData, useRoutes, useSearch, useSearchHighlight, useSidebar, useTabs, useTheme, useTrackEvent, useTrackPageView, useUI, useVersion, useViewTransition };

package/dist/client/index.d.ts

@@ -1,4 +1,4 @@
 
-import { $ as LazyRouteResult, A as matchRouteBranch, B as useRouteData, C as stripSiteProtocol, D as normalizeBasename, E as hasBasename, F as useLoaderData, G as MatchesContext, H as LocationProvider, I as useLocation, J as PrefetchContext, K as NavigateContext, L as useMatches, M as resolveRouteBranch, N as Outlet, O as stripBasename, P as OutletContext, Q as CreateRoutesResult, R as useNavigate, S as splitUrlReference, T as addBasename, U as LocationProviderProps, V as LocationContext, W as LocationState, X as RouteDataContext, Y as PrefetchFunction, Z as defaultNavigate, _ as isConfiguredVersion, a as UrlRouteHint, at as RouterOptions, b as parseUrlReference, c as buildUrl, d as getConfiguredVersions, dt as BoltdocsRoutePath, et as LoaderFunction, f as getVersionPrefixSegments, ft as BoltdocsRoutePathWithFallback, g as isConfiguredLocale, h as hasUrlBase, ht as BoltdocsVersion, i as UrlContractConfig, it as RouteRendererProps, j as matchRouteBranchWithParams, k as RouteRenderer, l as classifyUrlPath, lt as BoltdocsLocale, m as hasUriScheme, mt as BoltdocsTypes, n as ParsedUrl, nt as RouteMatch, o as UrlRouteKind, p as getVersionSegments, q as NavigateFunction, r as ResolveUrlOptions, rt as RouteRecord, s as addUrlBase, st as BoltdocsConfig, t as BuildUrlOptions, tt as LoaderFunctionArgs, u as getConfiguredLocales, v as normalizeUrlBase, w as stripUrlBase, x as resolveUrlReference, y as normalizeUrlPath, z as usePrefetch } from "../index-Ci4kfOHF.js";
-import { A as cn, At as useUI, B as NotFound, Bt as CollectionsData, C as createArticleStructuredData, Ct as usePageNav, D as defineStructuredData, Dt as useSearch, E as createWebSiteStructuredData, Et as useTabs, F as TimelineVariant, Ft as BoltdocsShell, G as Breadcrumbs, Gt as ComponentRoute, H as CopyMarkdown, Ht as BoltdocsTab, I as usePost, It as MdxPage, Jt as OnThisPageProps, K as OnThisPage, Kt as LayoutProps, L as usePosts, Lt as createRoutes, M as TimelineBadgeConfig, Mt as useTheme, N as TimelineItemProps, Nt as useConfig, O as getTranslated, Ot as useSidebar, P as TimelineProps, Pt as ViteReactSSG, R as useRecentPosts, Rt as CollectionPost, S as WebSiteStructuredDataOptions, St as useBreadcrumbs, T as createStructuredData, Tt as useVersion, U as ErrorBoundary, Ut as CollectionListLoaderData, V as SearchDialog, Vt as CurrentPostProvider, W as PageNav, Wt as CollectionPostLoaderData, Xt as SiteConfig, Yt as SidebarProps, Zt as TabsProps, _ as StructuredData, _t as useTrackEvent, a as useExpandable, b as BreadcrumbStructuredDataItem, bt as useLocalizedTo, c as getStarsRepo, d as ViewTransitionHandle, dt as Navbar, f as ViewTransitionOptions, ft as DocsLayoutComponent, g as useViewTransition, gt as useAnalytics, h as startViewTransition, ht as useHeadings, i as UseExpandableOptions, j as Timeline, jt as useMdxComponents, k as resolvePublicAssetUrl, kt as useNavbar, l as copyToClipboard, m as ViewTransitionUpdate, mt as useMergedComponents, n as UseCodeBlockFeedbackOptions, o as useCopyButton, p as ViewTransitionRunner, pt as useFeedback, q as Sidebar, qt as NavbarLink, r as useCodeBlockFeedback, s as useCodeBlock, t as CodeBlockFeedbackPayload, u as reactToText, v as StructuredDataProps, vt as useTrackPageView, w as createBreadcrumbStructuredData, wt as useI18n, x as StructuredDataFactoryOptions, xt as useRoutes, y as ArticleStructuredDataOptions, yt as useSearchHighlight, z as Banner, zt as CollectionsContext } from "../index-Cu9H6CRa.js";
+import { $ as LazyRouteResult, A as matchRouteBranch, B as useRouteData, C as stripSiteProtocol, D as normalizeBasename, E as hasBasename, F as useLoaderData, G as MatchesContext, H as LocationProvider, I as useLocation, J as PrefetchContext, K as NavigateContext, L as useMatches, M as resolveRouteBranch, N as Outlet, O as stripBasename, P as OutletContext, Q as CreateRoutesResult, R as useNavigate, S as splitUrlReference, T as addBasename, U as LocationProviderProps, V as LocationContext, W as LocationState, X as RouteDataContext, Y as PrefetchFunction, Z as defaultNavigate, _ as isConfiguredVersion, a as UrlRouteHint, at as RouterOptions, b as parseUrlReference, c as buildUrl, d as getConfiguredVersions, dt as BoltdocsRoutePath, et as LoaderFunction, f as getVersionPrefixSegments, ft as BoltdocsRoutePathWithFallback, g as isConfiguredLocale, h as hasUrlBase, ht as BoltdocsVersion, i as UrlContractConfig, it as RouteRendererProps, j as matchRouteBranchWithParams, k as RouteRenderer, l as classifyUrlPath, lt as BoltdocsLocale, m as hasUriScheme, mt as BoltdocsTypes, n as ParsedUrl, nt as RouteMatch, o as UrlRouteKind, p as getVersionSegments, q as NavigateFunction, r as ResolveUrlOptions, rt as RouteRecord, s as addUrlBase, st as BoltdocsConfig, t as BuildUrlOptions, tt as LoaderFunctionArgs, u as getConfiguredLocales, v as normalizeUrlBase, w as stripUrlBase, x as resolveUrlReference, y as normalizeUrlPath, z as usePrefetch } from "../index-CuNSD3E2.js";
+import { A as cn, At as useUI, B as NotFound, Bt as CollectionsData, C as createArticleStructuredData, Ct as usePageNav, D as defineStructuredData, Dt as useSearch, E as createWebSiteStructuredData, Et as useTabs, F as TimelineVariant, Ft as BoltdocsShell, G as Breadcrumbs, Gt as ComponentRoute, H as CopyMarkdown, Ht as BoltdocsTab, I as usePost, It as MdxPage, Jt as OnThisPageProps, K as OnThisPage, Kt as LayoutProps, L as usePosts, Lt as createRoutes, M as TimelineBadgeConfig, Mt as useTheme, N as TimelineItemProps, Nt as useConfig, O as getTranslated, Ot as useSidebar, P as TimelineProps, Pt as ViteReactSSG, R as useRecentPosts, Rt as CollectionPost, S as WebSiteStructuredDataOptions, St as useBreadcrumbs, T as createStructuredData, Tt as useVersion, U as ErrorBoundary, Ut as CollectionListLoaderData, V as SearchDialog, Vt as CurrentPostProvider, W as PageNav, Wt as CollectionPostLoaderData, Xt as SiteConfig, Yt as SidebarProps, Zt as TabsProps, _ as StructuredData, _t as useTrackEvent, a as useExpandable, b as BreadcrumbStructuredDataItem, bt as useLocalizedTo, c as getStarsRepo, d as ViewTransitionHandle, dt as Navbar, f as ViewTransitionOptions, ft as DocsLayoutComponent, g as useViewTransition, gt as useAnalytics, h as startViewTransition, ht as useHeadings, i as UseExpandableOptions, j as Timeline, jt as useMdxComponents, k as resolvePublicAssetUrl, kt as useNavbar, l as copyToClipboard, m as ViewTransitionUpdate, mt as useMergedComponents, n as UseCodeBlockFeedbackOptions, o as useCopyButton, p as ViewTransitionRunner, pt as useFeedback, q as Sidebar, qt as NavbarLink, r as useCodeBlockFeedback, s as useCodeBlock, t as CodeBlockFeedbackPayload, u as reactToText, v as StructuredDataProps, vt as useTrackPageView, w as createBreadcrumbStructuredData, wt as useI18n, x as StructuredDataFactoryOptions, xt as useRoutes, y as ArticleStructuredDataOptions, yt as useSearchHighlight, z as Banner, zt as CollectionsContext } from "../index-Cg3TmXIZ.js";
 export { ArticleStructuredDataOptions, Banner, BoltdocsConfig, BoltdocsLocale, BoltdocsRoutePath, BoltdocsRoutePathWithFallback, BoltdocsShell, BoltdocsTab, BoltdocsTypes, BoltdocsVersion, BreadcrumbStructuredDataItem, Breadcrumbs, BuildUrlOptions, CodeBlockFeedbackPayload, CollectionListLoaderData, CollectionPost, CollectionPostLoaderData, CollectionsContext, CollectionsData, ComponentRoute, CopyMarkdown, CreateRoutesResult, CurrentPostProvider, DocsLayoutComponent as DocsLayout, ErrorBoundary, LayoutProps, LazyRouteResult, LoaderFunction, LoaderFunctionArgs, LocationContext, LocationProvider, LocationProviderProps, LocationState, MatchesContext, MdxPage, Navbar, NavbarLink, NavigateContext, NavigateFunction, NotFound, OnThisPage, OnThisPageProps, Outlet, OutletContext, PageNav, ParsedUrl, PrefetchContext, PrefetchFunction, ResolveUrlOptions, RouteDataContext, RouteMatch, RouteRecord, RouteRenderer, RouteRendererProps, RouterOptions, SearchDialog, Sidebar, SidebarProps, SiteConfig, StructuredData, StructuredDataFactoryOptions, StructuredDataProps, TabsProps, Timeline, TimelineBadgeConfig, TimelineItemProps, TimelineProps, TimelineVariant, UrlContractConfig, UrlRouteHint, UrlRouteKind, UseCodeBlockFeedbackOptions, UseExpandableOptions, ViewTransitionHandle, ViewTransitionOptions, ViewTransitionRunner, ViewTransitionUpdate, ViteReactSSG, WebSiteStructuredDataOptions, addBasename, addUrlBase, buildUrl, classifyUrlPath, cn, copyToClipboard, createArticleStructuredData, createBreadcrumbStructuredData, createRoutes, createStructuredData, createWebSiteStructuredData, defaultNavigate, defineStructuredData, getConfiguredLocales, getConfiguredVersions, getStarsRepo, getTranslated, getVersionPrefixSegments, getVersionSegments, hasBasename, hasUriScheme, hasUrlBase, isConfiguredLocale, isConfiguredVersion, matchRouteBranch, matchRouteBranchWithParams, normalizeBasename, normalizeUrlBase, normalizeUrlPath, parseUrlReference, reactToText, resolvePublicAssetUrl, resolveRouteBranch, resolveUrlReference, splitUrlReference, startViewTransition, stripBasename, stripSiteProtocol, stripUrlBase, useAnalytics, useBreadcrumbs, useCodeBlock, useCodeBlockFeedback, useConfig, useCopyButton, useExpandable, useFeedback, useHeadings, useI18n, useLoaderData, useLocalizedTo, useLocation, useMatches, useMdxComponents, useMergedComponents, useNavbar, useNavigate, usePageNav, usePost, usePosts, usePrefetch, useRecentPosts, useRouteData, useRoutes, useSearch, useSearchHighlight, useSidebar, useTabs, useTheme, useTrackEvent, useTrackPageView, useUI, useVersion, useViewTransition };

package/dist/client/index.js

@@ -16,6 +16,7 @@ import { Fragment as Fragment$1, jsx, jsxs } from "react/jsx-runtime";
 import { Button } from "react-aria-components";
 import * as ReactHelmetAsync from "react-helmet-async";
 import virtualCustomComponents from "virtual:boltdocs-mdx-components";
+import fetchPageSource from "virtual:boltdocs-page-source";
 import UserLayout from "virtual:boltdocs-layout";
 
 //#region src/client/app/mdx-components-context.tsx
@@ -719,6 +720,11 @@ function Breadcrumbs({ className }) {
 
 //#endregion
 //#region src/client/components/ui-base/copy-markdown.tsx
+let pageSourcePromise = null;
+function getPageSource() {
+	if (!pageSourcePromise) pageSourcePromise = fetchPageSource().catch(() => ({}));
+	return pageSourcePromise;
+}
 const useCopyMarkdown = (content) => {
 	const [copied, setCopied] = useState(false);
 	const timerRef = useRef(null);
@@ -747,10 +753,37 @@ const useCopyMarkdown = (content) => {
 		handleOpenRaw
 	};
 };
-function CopyMarkdown({ content, mdxRaw, className }) {
-	const displayContent = mdxRaw || content || "";
+function CopyMarkdown({ content, mdxRaw, route, className }) {
+	const routePath = route?.path;
+	const [rawState, setRawState] = useState({
+		path: "",
+		resolved: false
+	});
+	const current = rawState.path === routePath && routePath ? rawState : {
+		path: routePath || "",
+		resolved: false
+	};
+	useEffect(() => {
+		if (mdxRaw || content || !routePath) return;
+		let cancelled = false;
+		getPageSource().then((record) => {
+			if (!cancelled) setRawState({
+				path: routePath,
+				value: record[routePath],
+				resolved: true
+			});
+		});
+		return () => {
+			cancelled = true;
+		};
+	}, [
+		routePath,
+		mdxRaw,
+		content
+	]);
+	const displayContent = mdxRaw || current.value || content || "";
 	const { copied, handleCopy, handleOpenRaw } = useCopyMarkdown(displayContent);
-	if (!displayContent) return null;
+	if (!displayContent && (!!content || !!mdxRaw || current.resolved || !routePath)) return null;
 	return /* @__PURE__ */ jsx("div", {
 		className: cn("relative inline-flex z-100 shrink-0 w-max", className),
 		children: /* @__PURE__ */ jsxs(ButtonGroup, {

package/dist/client/primitives.d.cts

@@ -1,6 +1,6 @@
 
-import { ft as BoltdocsRoutePathWithFallback } from "../index-CPUUKzxD.cjs";
-import { $ as SidebarItem, J as Sidebar, Q as SidebarHeader, X as SidebarGroup, Y as SidebarContent, Z as SidebarGroupRenderProps, at as SidebarLinkProps, ct as SidebarSlots, et as SidebarItemProps, it as SidebarLink, lt as SidebarSubGroup, nt as SidebarItems, ot as SidebarMobile, qt as NavbarLink$1, rt as SidebarItemsProps, st as SidebarRoot, tt as SidebarItemRenderProps, ut as ComponentBase } from "../index-C56bL-A-.cjs";
+import { ft as BoltdocsRoutePathWithFallback } from "../index-CgWkOCCn.cjs";
+import { $ as SidebarItem, J as Sidebar, Q as SidebarHeader, X as SidebarGroup, Y as SidebarContent, Z as SidebarGroupRenderProps, at as SidebarLinkProps, ct as SidebarSlots, et as SidebarItemProps, it as SidebarLink, lt as SidebarSubGroup, nt as SidebarItems, ot as SidebarMobile, qt as NavbarLink$1, rt as SidebarItemsProps, st as SidebarRoot, tt as SidebarItemRenderProps, ut as ComponentBase } from "../index-CSiMUBhC.cjs";
 import { a as CalloutRoot, c as CalloutTitleProps, i as CalloutProps, l as CalloutVariant, n as CalloutBody, o as CalloutRootProps, r as CalloutIcon, s as CalloutTitle, t as Callout } from "../callout-plqx9Dw-.cjs";
 import * as _$react from "react";
 import { CSSProperties, Component, ComponentProps, ComponentType, ErrorInfo, FC, HTMLAttributes, ImgHTMLAttributes, ReactNode, Ref, RefObject } from "react";

package/dist/client/primitives.d.ts

@@ -1,6 +1,6 @@
 
-import { ft as BoltdocsRoutePathWithFallback } from "../index-Ci4kfOHF.js";
-import { $ as SidebarItem, J as Sidebar, Q as SidebarHeader, X as SidebarGroup, Y as SidebarContent, Z as SidebarGroupRenderProps, at as SidebarLinkProps, ct as SidebarSlots, et as SidebarItemProps, it as SidebarLink, lt as SidebarSubGroup, nt as SidebarItems, ot as SidebarMobile, qt as NavbarLink$1, rt as SidebarItemsProps, st as SidebarRoot, tt as SidebarItemRenderProps, ut as ComponentBase } from "../index-Cu9H6CRa.js";
+import { ft as BoltdocsRoutePathWithFallback } from "../index-CuNSD3E2.js";
+import { $ as SidebarItem, J as Sidebar, Q as SidebarHeader, X as SidebarGroup, Y as SidebarContent, Z as SidebarGroupRenderProps, at as SidebarLinkProps, ct as SidebarSlots, et as SidebarItemProps, it as SidebarLink, lt as SidebarSubGroup, nt as SidebarItems, ot as SidebarMobile, qt as NavbarLink$1, rt as SidebarItemsProps, st as SidebarRoot, tt as SidebarItemRenderProps, ut as ComponentBase } from "../index-Cg3TmXIZ.js";
 import { a as CalloutRoot, c as CalloutTitleProps, i as CalloutProps, l as CalloutVariant, n as CalloutBody, o as CalloutRootProps, r as CalloutIcon, s as CalloutTitle, t as Callout } from "../callout-oI_LCbxS.js";
 import * as _$react from "react";
 import { CSSProperties, Component, ComponentProps, ComponentType, ErrorInfo, FC, HTMLAttributes, ImgHTMLAttributes, ReactNode, Ref, RefObject } from "react";

package/dist/client/router.d.cts

@@ -1,3 +1,3 @@
 
-import { $ as LazyRouteResult, A as matchRouteBranch, B as useRouteData, C as stripSiteProtocol, D as normalizeBasename, E as hasBasename, F as useLoaderData, G as MatchesContext, H as LocationProvider, I as useLocation, J as PrefetchContext, K as NavigateContext, L as useMatches, M as resolveRouteBranch, N as Outlet, O as stripBasename, P as OutletContext, Q as CreateRoutesResult, R as useNavigate, S as splitUrlReference, T as addBasename, U as LocationProviderProps, V as LocationContext, W as LocationState, X as RouteDataContext, Y as PrefetchFunction, Z as defaultNavigate, _ as isConfiguredVersion, a as UrlRouteHint, at as RouterOptions, b as parseUrlReference, c as buildUrl, d as getConfiguredVersions, et as LoaderFunction, f as getVersionPrefixSegments, g as isConfiguredLocale, h as hasUrlBase, i as UrlContractConfig, it as RouteRendererProps, j as matchRouteBranchWithParams, k as RouteRenderer, l as classifyUrlPath, m as hasUriScheme, n as ParsedUrl, nt as RouteMatch, o as UrlRouteKind, p as getVersionSegments, q as NavigateFunction, r as ResolveUrlOptions, rt as RouteRecord, s as addUrlBase, t as BuildUrlOptions, tt as LoaderFunctionArgs, u as getConfiguredLocales, v as normalizeUrlBase, w as stripUrlBase, x as resolveUrlReference, y as normalizeUrlPath, z as usePrefetch } from "../index-CPUUKzxD.cjs";
+import { $ as LazyRouteResult, A as matchRouteBranch, B as useRouteData, C as stripSiteProtocol, D as normalizeBasename, E as hasBasename, F as useLoaderData, G as MatchesContext, H as LocationProvider, I as useLocation, J as PrefetchContext, K as NavigateContext, L as useMatches, M as resolveRouteBranch, N as Outlet, O as stripBasename, P as OutletContext, Q as CreateRoutesResult, R as useNavigate, S as splitUrlReference, T as addBasename, U as LocationProviderProps, V as LocationContext, W as LocationState, X as RouteDataContext, Y as PrefetchFunction, Z as defaultNavigate, _ as isConfiguredVersion, a as UrlRouteHint, at as RouterOptions, b as parseUrlReference, c as buildUrl, d as getConfiguredVersions, et as LoaderFunction, f as getVersionPrefixSegments, g as isConfiguredLocale, h as hasUrlBase, i as UrlContractConfig, it as RouteRendererProps, j as matchRouteBranchWithParams, k as RouteRenderer, l as classifyUrlPath, m as hasUriScheme, n as ParsedUrl, nt as RouteMatch, o as UrlRouteKind, p as getVersionSegments, q as NavigateFunction, r as ResolveUrlOptions, rt as RouteRecord, s as addUrlBase, t as BuildUrlOptions, tt as LoaderFunctionArgs, u as getConfiguredLocales, v as normalizeUrlBase, w as stripUrlBase, x as resolveUrlReference, y as normalizeUrlPath, z as usePrefetch } from "../index-CgWkOCCn.cjs";
 export { BuildUrlOptions, CreateRoutesResult, LazyRouteResult, LoaderFunction, LoaderFunctionArgs, LocationContext, LocationProvider, LocationProviderProps, LocationState, MatchesContext, NavigateContext, NavigateFunction, Outlet, OutletContext, ParsedUrl, PrefetchContext, PrefetchFunction, ResolveUrlOptions, RouteDataContext, RouteMatch, RouteRecord, RouteRenderer, RouteRendererProps, RouterOptions, UrlContractConfig, UrlRouteHint, UrlRouteKind, addBasename, addUrlBase, buildUrl, classifyUrlPath, defaultNavigate, getConfiguredLocales, getConfiguredVersions, getVersionPrefixSegments, getVersionSegments, hasBasename, hasUriScheme, hasUrlBase, isConfiguredLocale, isConfiguredVersion, matchRouteBranch, matchRouteBranchWithParams, normalizeBasename, normalizeUrlBase, normalizeUrlPath, parseUrlReference, resolveRouteBranch, resolveUrlReference, splitUrlReference, stripBasename, stripSiteProtocol, stripUrlBase, useLoaderData, useLocation, useMatches, useNavigate, usePrefetch, useRouteData };

package/dist/client/router.d.ts

@@ -1,3 +1,3 @@
 
-import { $ as LazyRouteResult, A as matchRouteBranch, B as useRouteData, C as stripSiteProtocol, D as normalizeBasename, E as hasBasename, F as useLoaderData, G as MatchesContext, H as LocationProvider, I as useLocation, J as PrefetchContext, K as NavigateContext, L as useMatches, M as resolveRouteBranch, N as Outlet, O as stripBasename, P as OutletContext, Q as CreateRoutesResult, R as useNavigate, S as splitUrlReference, T as addBasename, U as LocationProviderProps, V as LocationContext, W as LocationState, X as RouteDataContext, Y as PrefetchFunction, Z as defaultNavigate, _ as isConfiguredVersion, a as UrlRouteHint, at as RouterOptions, b as parseUrlReference, c as buildUrl, d as getConfiguredVersions, et as LoaderFunction, f as getVersionPrefixSegments, g as isConfiguredLocale, h as hasUrlBase, i as UrlContractConfig, it as RouteRendererProps, j as matchRouteBranchWithParams, k as RouteRenderer, l as classifyUrlPath, m as hasUriScheme, n as ParsedUrl, nt as RouteMatch, o as UrlRouteKind, p as getVersionSegments, q as NavigateFunction, r as ResolveUrlOptions, rt as RouteRecord, s as addUrlBase, t as BuildUrlOptions, tt as LoaderFunctionArgs, u as getConfiguredLocales, v as normalizeUrlBase, w as stripUrlBase, x as resolveUrlReference, y as normalizeUrlPath, z as usePrefetch } from "../index-Ci4kfOHF.js";
+import { $ as LazyRouteResult, A as matchRouteBranch, B as useRouteData, C as stripSiteProtocol, D as normalizeBasename, E as hasBasename, F as useLoaderData, G as MatchesContext, H as LocationProvider, I as useLocation, J as PrefetchContext, K as NavigateContext, L as useMatches, M as resolveRouteBranch, N as Outlet, O as stripBasename, P as OutletContext, Q as CreateRoutesResult, R as useNavigate, S as splitUrlReference, T as addBasename, U as LocationProviderProps, V as LocationContext, W as LocationState, X as RouteDataContext, Y as PrefetchFunction, Z as defaultNavigate, _ as isConfiguredVersion, a as UrlRouteHint, at as RouterOptions, b as parseUrlReference, c as buildUrl, d as getConfiguredVersions, et as LoaderFunction, f as getVersionPrefixSegments, g as isConfiguredLocale, h as hasUrlBase, i as UrlContractConfig, it as RouteRendererProps, j as matchRouteBranchWithParams, k as RouteRenderer, l as classifyUrlPath, m as hasUriScheme, n as ParsedUrl, nt as RouteMatch, o as UrlRouteKind, p as getVersionSegments, q as NavigateFunction, r as ResolveUrlOptions, rt as RouteRecord, s as addUrlBase, t as BuildUrlOptions, tt as LoaderFunctionArgs, u as getConfiguredLocales, v as normalizeUrlBase, w as stripUrlBase, x as resolveUrlReference, y as normalizeUrlPath, z as usePrefetch } from "../index-CuNSD3E2.js";
 export { BuildUrlOptions, CreateRoutesResult, LazyRouteResult, LoaderFunction, LoaderFunctionArgs, LocationContext, LocationProvider, LocationProviderProps, LocationState, MatchesContext, NavigateContext, NavigateFunction, Outlet, OutletContext, ParsedUrl, PrefetchContext, PrefetchFunction, ResolveUrlOptions, RouteDataContext, RouteMatch, RouteRecord, RouteRenderer, RouteRendererProps, RouterOptions, UrlContractConfig, UrlRouteHint, UrlRouteKind, addBasename, addUrlBase, buildUrl, classifyUrlPath, defaultNavigate, getConfiguredLocales, getConfiguredVersions, getVersionPrefixSegments, getVersionSegments, hasBasename, hasUriScheme, hasUrlBase, isConfiguredLocale, isConfiguredVersion, matchRouteBranch, matchRouteBranchWithParams, normalizeBasename, normalizeUrlBase, normalizeUrlPath, parseUrlReference, resolveRouteBranch, resolveUrlReference, splitUrlReference, stripBasename, stripSiteProtocol, stripUrlBase, useLoaderData, useLocation, useMatches, useNavigate, usePrefetch, useRouteData };

package/dist/client/theme/reset.css

@@ -174,60 +174,78 @@
 
   /* Shiki dual-theme (light/dark pair) output carries `shiki-themes` plus
      inline `--shiki-light`/`--shiki-dark` variables. Only those blocks are
-     color-driven by this rule — single-theme output is left untouched. */
+     color-driven by this rule — single-theme output is left untouched.
+     `[data-theme-mode="dual"]` is the engine-agnostic equivalent emitted by
+     any highlighter engine; `.shiki.shiki-themes` is kept as a Shiki alias. */
   :root .shiki.shiki-themes,
-  :root .shiki.shiki-themes span {
+  :root .shiki.shiki-themes span,
+  :root [data-theme-mode="dual"],
+  :root [data-theme-mode="dual"] span {
     color: var(--shiki-light, inherit);
     background-color: var(--shiki-light, transparent);
   }
 
   :root.dark .shiki.shiki-themes,
-  :root.dark .shiki.shiki-themes span {
+  :root.dark .shiki.shiki-themes span,
+  :root.dark [data-theme-mode="dual"],
+  :root.dark [data-theme-mode="dual"] span {
     color: var(--shiki-dark, inherit);
     background-color: var(--shiki-dark, transparent);
   }
 
   /* Base Shiki Pre & Span Styles */
-  pre.shiki {
+  pre.shiki,
+  pre[data-highlighted="true"],
+  pre[data-highlighted="false"] {
     @apply py-2 text-[12px] leading-[1.6];
     overflow-x: auto;
     -webkit-overflow-scrolling: touch;
   }
 
-  pre.shiki span.line {
+  pre.shiki span.line,
+  pre[data-highlighted] span.line {
     @apply relative block px-4 py-0;
     white-space: pre;
     min-height: 1.6em;
   }
 
-  /* Shiki Word Wrap */
-  pre.shiki-word-wrap {
+  /* Word Wrap (engine-agnostic `data-word-wrap` + Shiki alias) */
+  pre.shiki-word-wrap,
+  pre[data-word-wrap="true"] {
     @apply whitespace-pre-wrap break-words;
   }
 
-  pre.shiki-word-wrap span.line {
+  pre.shiki-word-wrap span.line,
+  pre[data-word-wrap="true"] span.line {
     @apply block w-full;
   }
 
-  /* Shiki Line Numbers */
-  pre.shiki-line-numbers code {
+  /* Line Numbers (engine-agnostic `data-line-numbers` + Shiki alias) */
+  pre.shiki-line-numbers code,
+  pre[data-line-numbers="true"] code {
     counter-reset: step;
     counter-increment: step 0;
   }
 
-  pre.shiki-line-numbers .line {
+  pre.shiki-line-numbers .line,
+  pre[data-line-numbers="true"] .line {
     @apply !pl-12;
   }
 
   /* Hide the last line if it is completely empty to avoid extra numbers or spacing */
   pre.shiki .line:last-child:empty,
   pre.shiki .line:last-child:has(> :empty),
+  pre[data-highlighted] .line:last-child:empty,
+  pre[data-highlighted] .line:last-child:has(> :empty),
   pre.shiki-line-numbers .line:last-child:empty,
-  pre.shiki-line-numbers .line:last-child:has(> :empty) {
+  pre.shiki-line-numbers .line:last-child:has(> :empty),
+  pre[data-line-numbers="true"] .line:last-child:empty,
+  pre[data-line-numbers="true"] .line:last-child:has(> :empty) {
     display: none;
   }
 
-  pre.shiki-line-numbers .line::before {
+  pre.shiki-line-numbers .line::before,
+  pre[data-line-numbers="true"] .line::before {
     counter-increment: step;
     content: counter(step);
     @apply absolute left-0 top-0 inline-flex w-10 justify-end pr-3;

package/dist/config-CrsQJHQz.cjs

@@ -0,0 +1,7 @@
+/**
+ * Boltdocs - https://boltdocs.vercel.app
+ * Copyright (c) 2026 Jesus Alcala
+ * Licensed under the MIT License.
+ */
+const e=require(`./chunk-D1Md3oWO.cjs`),t=require(`./errors-vKw8CkiX.cjs`),n=require(`./config-files-ph2ZtHWl.cjs`);let r=require(`node:path`);r=e.r(r);let i=require(`node:fs`);i=e.r(i);let a=require(`node:crypto`);a=e.r(a);let o=require(`zod`),s=require(`@bdocs/dui`);function c(e){return e}const l=o.z.object({icon:o.z.string().max(50),link:o.z.string().url()}),u=o.z.object({processor:o.z.enum([`satteri`]).default(`satteri`)}),d=o.z.object({name:o.z.string(),enforce:o.z.enum([`pre`,`post`]).optional(),version:o.z.string().optional(),boltdocsVersion:o.z.string().optional(),clientEntry:o.z.string().optional(),remarkPlugins:o.z.array(o.z.unknown()).optional(),rehypePlugins:o.z.array(o.z.unknown()).optional(),vitePlugins:o.z.array(o.z.unknown()).optional(),components:o.z.record(o.z.string(),o.z.string()).optional(),codeHighlighter:o.z.unknown().optional(),metadata:o.z.record(o.z.string(),o.z.unknown()).optional(),css:o.z.object({cssFiles:o.z.array(o.z.string()).optional(),headStyles:o.z.array(o.z.string()).optional(),postcssPlugins:o.z.array(o.z.unknown()).optional(),preprocessorOptions:o.z.record(o.z.string(),o.z.unknown()).optional()}).optional(),middleware:o.z.array(o.z.object({name:o.z.string().optional(),enforce:o.z.enum([`pre`,`post`]).optional()}).passthrough()).optional(),hooks:o.z.record(o.z.string(),o.z.unknown()).optional()}),f=o.z.object({title:o.z.union([o.z.string(),o.z.record(o.z.string(),o.z.string())]).optional(),description:o.z.union([o.z.string(),o.z.record(o.z.string(),o.z.string())]).optional(),logo:o.z.union([o.z.string(),o.z.object({dark:o.z.string(),light:o.z.string(),alt:o.z.string().optional(),width:o.z.number().optional(),height:o.z.number().optional()})]).optional(),navbar:o.z.array(o.z.object({label:o.z.union([o.z.string(),o.z.record(o.z.string(),o.z.string())]),href:o.z.string(),items:o.z.array(o.z.object({label:o.z.union([o.z.string(),o.z.record(o.z.string(),o.z.string())]),href:o.z.string()})).optional()})).optional(),sidebar:o.z.record(o.z.string(),o.z.array(o.z.object({text:o.z.string(),link:o.z.string()}))).optional(),sidebarGroups:o.z.record(o.z.string(),o.z.object({title:o.z.union([o.z.string(),o.z.record(o.z.string(),o.z.string())]).optional(),icon:o.z.string().optional()})).optional(),socialLinks:o.z.array(l).optional(),editLink:o.z.string().refine(e=>!e||e.includes(`:path`),{message:`editLink must contain ':path' placeholder if specified`}).optional(),communityHelp:o.z.string().url().optional(),version:o.z.string().max(50).optional(),githubRepo:o.z.string().max(100).optional(),favicon:o.z.string().optional(),tabs:o.z.array(o.z.object({id:o.z.string(),text:o.z.union([o.z.string(),o.z.record(o.z.string(),o.z.string())]),icon:o.z.string().optional()})).optional(),codeTheme:o.z.union([o.z.string(),o.z.object({light:o.z.string(),dark:o.z.string()})]).optional(),codeHighlighting:o.z.union([o.z.string(),o.z.object({engine:o.z.union([o.z.string(),o.z.unknown(),o.z.function()]).optional(),theme:o.z.union([o.z.string(),o.z.object({light:o.z.string(),dark:o.z.string()})]).optional(),options:o.z.record(o.z.string(),o.z.unknown()).optional()})]).optional()}),p=o.z.union([o.z.string(),o.z.object({rules:o.z.array(o.z.object({userAgent:o.z.string(),allow:o.z.union([o.z.string(),o.z.array(o.z.string())]).optional(),disallow:o.z.union([o.z.string(),o.z.array(o.z.string())]).optional()})).optional(),sitemaps:o.z.array(o.z.string().url()).optional()})]),m=o.z.object({defaultLocale:o.z.string(),locales:o.z.union([o.z.record(o.z.string(),o.z.string()),o.z.array(o.z.string())]).transform(e=>Array.isArray(e)?Object.fromEntries(e.map(e=>[e,e])):e),localeConfigs:o.z.record(o.z.string(),o.z.object({label:o.z.string().optional(),direction:o.z.enum([`ltr`,`rtl`]).optional(),htmlLang:o.z.string().optional(),calendar:o.z.string().optional()})).optional()}),h=o.z.object({defaultVersion:o.z.string(),prefix:o.z.string().optional(),versions:o.z.array(o.z.object({label:o.z.string(),path:o.z.string()}))}),g=o.z.object({headers:o.z.record(o.z.string(),o.z.string()).optional(),enableCSP:o.z.boolean().optional(),customHeaders:o.z.record(o.z.string(),o.z.string()).optional()}),_=o.z.object({google:o.z.string().optional(),bing:o.z.string().optional(),yandex:o.z.string().optional(),pinterest:o.z.string().optional(),facebook:o.z.string().optional()}),v=o.z.lazy(()=>o.z.union([o.z.string(),o.z.number(),o.z.boolean(),o.z.null(),o.z.array(v),o.z.record(o.z.string(),v)])),y=o.z.union([o.z.record(o.z.string(),v),o.z.array(o.z.record(o.z.string(),v))]),b=o.z.object({metatags:o.z.record(o.z.string(),o.z.string()).optional(),indexing:o.z.enum([`all`,`public`]).optional(),thumbnails:o.z.object({background:o.z.string().optional()}).optional(),verification:_.optional(),structuredData:y.optional()}),x=o.z.object({viewTransitions:o.z.union([o.z.boolean(),o.z.object({enabled:o.z.boolean().optional(),types:o.z.array(o.z.string()).optional()})]).optional(),fileRouting:o.z.boolean().optional()}),S=o.z.object({measurementId:o.z.string().min(1,`Measurement ID is required for GA4`),debug:o.z.boolean().optional(),anonymizeIp:o.z.boolean().optional(),sendPageView:o.z.boolean().optional(),cookieFlags:o.z.string().optional(),autoTrack:o.z.object({pageViews:o.z.boolean().optional(),downloads:o.z.boolean().optional(),externalLinks:o.z.boolean().optional(),search:o.z.boolean().optional()}).optional()}),C=o.z.object({tagId:o.z.string().min(1,`Tag ID is required for GTM`),dataLayerName:o.z.string().optional(),preview:o.z.string().optional()}),w=o.z.object({appId:o.z.string().min(1,`Algolia App ID is required`),apiKey:o.z.string().min(1,`Algolia API Key is required`),indexName:o.z.string().min(1,`Algolia Index Name is required`)}),T=o.z.object({repo:o.z.string().min(1,`Giscus repository is required`),repoId:o.z.string().min(1,`Giscus repository ID is required`),category:o.z.string().optional(),categoryId:o.z.string().optional(),mapping:o.z.enum([`pathname`,`url`,`title`,`og:title`,`specific`,`number`]).optional(),strict:o.z.union([o.z.enum([`0`,`1`]),o.z.boolean()]).optional(),reactionsEnabled:o.z.union([o.z.enum([`0`,`1`]),o.z.boolean()]).optional(),emitMetadata:o.z.union([o.z.enum([`0`,`1`]),o.z.boolean()]).optional(),inputPosition:o.z.enum([`top`,`bottom`]).optional(),theme:o.z.string().optional(),darkTheme:o.z.string().optional(),lang:o.z.string().optional(),loading:o.z.enum([`lazy`,`eager`]).optional()}),E=o.z.object({enabled:o.z.boolean(),owner:o.z.string().min(1,`GitHub owner is required`),repo:o.z.string().min(1,`GitHub repository name is required`),categorySlug:o.z.string().optional(),endpoint:o.z.string().optional()}),D=o.z.object({analytics:o.z.boolean().optional(),speedInsights:o.z.boolean().optional()}),O=o.z.object({apiKey:o.z.string().min(1,`API key is required for PostHog`),host:o.z.string().url().optional(),capturePageview:o.z.boolean().optional(),capturePageleave:o.z.boolean().optional(),sessionRecording:o.z.boolean().optional(),autocapture:o.z.boolean().optional()}),k=o.z.object({ga4:S.optional(),gtm:C.optional(),vercel:D.optional(),posthog:O.optional()}),A=o.z.object({algolia:w.optional()}),j=o.z.object({giscus:T.optional(),custom:E.optional()}),M=o.z.object({analytics:k.optional(),search:A.optional(),feedback:j.optional()}),N=o.z.object({criticalCss:o.z.enum([`zig-critters`,`beasties`,`none`]).optional(),criticalCssMaxSize:o.z.number().int().min(0).optional()}),P=o.z.object({labels:o.z.record(o.z.string(),o.z.union([o.z.string(),o.z.record(o.z.string(),o.z.string())])).optional(),positions:o.z.record(o.z.string(),o.z.number()).optional(),postsPerPage:o.z.number().int().positive().optional(),defaultCollection:o.z.string().optional(),dateFormat:o.z.string().optional(),sortBy:o.z.enum([`date`,`title`,`sidebarPosition`]).optional()}),F=o.z.object({visible:o.z.boolean().optional(),environments:o.z.array(o.z.string()).optional()}),I=o.z.object({turbo:o.z.boolean().optional(),siteUrl:o.z.string().url().optional(),docsDir:o.z.string().optional(),base:o.z.string().optional(),theme:f.optional(),i18n:m.optional(),versions:h.optional(),mdx:u.optional(),ssg:N.optional(),plugins:o.z.array(d).optional(),collections:P.optional(),robots:p.optional(),security:g.optional(),seo:b.optional(),integrations:M.optional(),drafts:F.optional(),experimental:x.optional(),aliases:o.z.custom().optional(),featureFlags:o.z.record(o.z.string(),o.z.union([o.z.boolean(),o.z.string()])).optional(),vite:o.z.custom().optional()}),L=new Map;function R(e,t,n,r){return`${e}::${t}::${n}::${r}`}function z(e){return r.default.join(e,`.boltdocs`,`cache`,`config.json`)}function B(e,t,n,r,i){return a.default.createHash(`sha256`).update(`${e}:${t}:${n}:${r}:${i}`).digest(`hex`)}function V(e,t,n){let a=z(e);if(!i.default.existsSync(a))return null;try{let o=i.default.readFileSync(a,`utf-8`),s=JSON.parse(o),c=r.default.resolve(e,s.filename);if(!i.default.existsSync(c))return null;let l=i.default.statSync(c);if(B(s.filename,l.mtimeMs,l.size,t,n)!==B(s.filename,s.mtimeMs,s.size,s.command,s.mode))return null;let u=I.safeParse(s.config);return u.success?{config:u.data,configFile:c}:null}catch{return null}}function H(e,t,n,a,o,s,c){try{let l=z(e);i.default.mkdirSync(r.default.dirname(l),{recursive:!0});let u={filename:t,mtimeMs:n,size:a,command:o,mode:s,config:{...c,plugins:[]}};i.default.writeFileSync(l,JSON.stringify(u),`utf-8`)}catch(e){process.env.BOLTDOCS_DEBUG===`true`&&console.warn(`[boltdocs] Failed to write config cache:`,e)}}async function U(e,t){let{createJiti:n}=await import(`jiti`),r=await n(t,{interopDefault:!0}).import(e);return r.default??r.config??r}async function W(e,a=process.cwd(),o=`serve`,c=`development`){let l=a,u=R(e,l,o,c);{let e=L.get(u);if(e)return e}let d=V(l,o,c);if(d){try{let e=await U(d.configFile,l);e?.plugins&&(d.config.plugins=e.plugins)}catch{}return L.set(u,d.config),d.config}let f={docsDir:r.default.resolve(l,e),theme:{title:`Boltdocs`,description:`A Vite documentation framework`,navbar:[{label:`Home`,href:`/`},{label:`Documentation`,href:`/docs`}],codeTheme:{light:`github-light`,dark:`github-dark`}}},p={},m=null;for(let e of n.t){let t=r.default.resolve(l,e);if(i.default.existsSync(t))try{let n;try{n=await U(t,l)}catch(r){process.env.BOLTDOCS_DEBUG===`true`&&console.warn(`[boltdocs] jiti config load failed for ${e}, falling back to Vite: ${r instanceof Error?r.message:String(r)}`);let{loadConfigFromFile:i}=await import(`vite`);n=(await i({command:o,mode:c},t,l))?.config}if(n){p=n;let r=i.default.statSync(t);m={filename:e,mtimeMs:r.mtimeMs,size:r.size};break}}catch(t){t instanceof Error&&(console.error(`\x1b[31m[boltdocs] ✖ Failed to load config from ${e}: ${t.message}\x1b[0m`),(0,s.warn)(`Failed to load config from ${e}: ${t.message}`))}}let h={title:p.title,description:p.description,logo:p.logo,favicon:p.favicon,navbar:p.navbar,sidebar:p.sidebar,sidebarGroups:p.theme?.sidebarGroups,socialLinks:p.socialLinks,githubRepo:p.githubRepo,tabs:p.tabs,codeTheme:p.codeTheme,codeHighlighting:p.theme?.codeHighlighting,communityHelp:p.communityHelp,version:p.version,editLink:p.editLink,...p.theme||{}},g=Object.fromEntries(Object.entries(h).filter(([e,t])=>t!==void 0));g.navbar&&=g.navbar.map(e=>({label:e.label||``,href:e.href||``,items:e.items}));let _={docsDir:r.default.resolve(l,p.docsDir||e),theme:{...f.theme,...g},i18n:p.i18n?{...p.i18n,locales:Array.isArray(p.i18n.locales)?Object.fromEntries(p.i18n.locales.map(e=>[e,e])):p.i18n.locales}:void 0,versions:p.versions,siteUrl:p.siteUrl,base:p.base,ssg:p.ssg,seo:p.seo,plugins:p.plugins||[],robots:p.robots,security:p.security,integrations:p.integrations,experimental:p.experimental,featureFlags:p.featureFlags,aliases:p.aliases,drafts:p.drafts,collections:p.collections,vite:p.vite},v=I.safeParse(_);if(!v.success)throw new t.r(`Invalid Boltdocs configuration:\n${v.error.issues.map(e=>`  - ${e.path.join(`.`)}: ${e.message}`).join(`
+`)}`);let y=v.data;return m&&H(l,m.filename,m.mtimeMs,m.size,o,c,y),L.set(u,y),y}Object.defineProperty(exports,`n`,{enumerable:!0,get:function(){return d}}),Object.defineProperty(exports,`r`,{enumerable:!0,get:function(){return c}}),Object.defineProperty(exports,`t`,{enumerable:!0,get:function(){return W}});