reflet-sdk 0.4.3 → 0.5.1

package/dist/handler-CHP0m7KF.js

@@ -0,0 +1,713 @@
+import { a as EDITORS, i as DEVTOOLS_STATUS_MARKER, n as DEVTOOLS_REQUEST_HEADER, o as PROXIED_API_PATHS, r as DEVTOOLS_ROUTE_BASE, t as DEVTOOLS_ENDPOINTS } from "./protocol-Bn6Bg_0r.js";
+import "./client-BWEBWk1k.js";
+import { SourceMap } from "node:module";
+import { dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { execFile } from "node:child_process";
+import { existsSync, realpathSync } from "node:fs";
+import { readFile, realpath, stat } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+//#region src/devtools/server/json-response.ts
+const JSON_RESPONSE_HEADERS = {
+	"cache-control": "no-store",
+	"content-type": "application/json; charset=utf-8",
+	"x-content-type-options": "nosniff"
+};
+function jsonTextResponse(text, status) {
+	return new Response(text, {
+		headers: JSON_RESPONSE_HEADERS,
+		status
+	});
+}
+function jsonResponse(body, status = 200) {
+	return jsonTextResponse(JSON.stringify(body), status);
+}
+function errorResponse(error, status) {
+	return jsonResponse({ error }, status);
+}
+function failure(error, status) {
+	return {
+		error,
+		ok: false,
+		status
+	};
+}
+//#endregion
+//#region src/devtools/server/options.ts
+const DEFAULT_EDITOR = "vscode";
+const TRAILING_SLASHES$1 = /\/+$/;
+function isEditorId(value) {
+	return EDITORS.some((editor) => editor === value);
+}
+function presentValue(value) {
+	const trimmed = value?.trim();
+	return trimmed ? trimmed : void 0;
+}
+function resolveEditor(optionEditor, envEditor) {
+	if (isEditorId(optionEditor)) return optionEditor;
+	const normalizedEnvEditor = presentValue(envEditor)?.toLowerCase();
+	return isEditorId(normalizedEnvEditor) ? normalizedEnvEditor : DEFAULT_EDITOR;
+}
+function resolveDevtoolsOptions(options, env) {
+	const apiUrl = presentValue(options.apiUrl) ?? presentValue(env.REFLET_API_URL) ?? "https://harmless-clam-802.convex.site";
+	return {
+		allowedHosts: (options.allowedHosts ?? presentValue(env.REFLET_DEVTOOLS_HOSTS)?.split(",") ?? []).map((host) => host.trim().toLowerCase()).filter(Boolean),
+		apiUrl: apiUrl.replace(TRAILING_SLASHES$1, ""),
+		editor: resolveEditor(options.editor, env.REFLET_EDITOR),
+		root: resolve(presentValue(options.root) ?? process.cwd()),
+		secretKey: presentValue(options.secretKey) ?? presentValue(env.REFLET_SECRET_KEY) ?? null
+	};
+}
+//#endregion
+//#region src/devtools/server/reflet-proxy.ts
+const CREATE_FEEDBACK_PATH = "/api/v1/feedback/create";
+const MISSING_SECRET_KEY_ERROR = "Set REFLET_SECRET_KEY in the dev server environment to reach your Reflet board.";
+const BODYLESS_STATUSES = [
+	204,
+	205,
+	304
+];
+function isProxiedApiPath(path) {
+	return PROXIED_API_PATHS.some((proxiedPath) => proxiedPath === path);
+}
+function isJsonObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function readForwardedBody(request, apiPath) {
+	if (request.method !== "POST") return { body: void 0 };
+	const text = await request.text();
+	if (apiPath !== CREATE_FEEDBACK_PATH) return { body: text || void 0 };
+	let payload;
+	try {
+		payload = JSON.parse(text);
+	} catch {
+		return { error: "Feedback must be a JSON object." };
+	}
+	if (!isJsonObject(payload)) return { error: "Feedback must be a JSON object." };
+	return { body: JSON.stringify({
+		...payload,
+		internal: true
+	}) };
+}
+/** Forwards an allowlisted Reflet API call with the secret key; devtools notes are always internal. */
+async function proxyToReflet(request, apiPath, target) {
+	if (!isProxiedApiPath(apiPath)) return errorResponse(`Reflet devtools does not forward ${apiPath || "/"}.`, 404);
+	if (!target.secretKey) return errorResponse(MISSING_SECRET_KEY_ERROR, 503);
+	if (request.method !== "GET" && request.method !== "POST") return errorResponse(`${request.method} is not supported here.`, 405);
+	const forwarded = await readForwardedBody(request, apiPath);
+	if ("error" in forwarded) return errorResponse(forwarded.error, 400);
+	const { search } = new URL(request.url);
+	let upstream;
+	try {
+		upstream = await fetch(`${target.apiUrl}${apiPath}${search}`, {
+			body: forwarded.body,
+			headers: {
+				Accept: "application/json",
+				Authorization: `Bearer ${target.secretKey}`,
+				"Content-Type": "application/json"
+			},
+			method: request.method
+		});
+	} catch {
+		return errorResponse(`Could not reach Reflet at ${target.apiUrl}.`, 502);
+	}
+	const text = await upstream.text();
+	return jsonTextResponse(BODYLESS_STATUSES.includes(upstream.status) ? null : text, upstream.status);
+}
+//#endregion
+//#region src/devtools/server/request-guard.ts
+const LOOPBACK_HOSTNAMES = ["localhost", "[::1]"];
+const LOOPBACK_IPV4 = /^127(?:\.\d{1,3}){3}$/;
+function hostnameOf(host) {
+	try {
+		return new URL(`http://${host}`).hostname.toLowerCase();
+	} catch {
+		return null;
+	}
+}
+function isAllowedHost(hostname, allowedHosts) {
+	return LOOPBACK_HOSTNAMES.includes(hostname) || hostname.endsWith(".localhost") || LOOPBACK_IPV4.test(hostname) || allowedHosts.includes(hostname);
+}
+/**
+* The Host check stops DNS rebinding: a hostile domain resolved to 127.0.0.1
+* is same-origin with itself, so origin checks alone would let it through.
+*/
+function rejectUntrustedRequest(request, allowedHosts) {
+	const hostname = hostnameOf(request.headers.get("host") ?? new URL(request.url).host);
+	if (!(hostname && isAllowedHost(hostname, allowedHosts))) return errorResponse("Reflet devtools only answers on localhost. Add other dev hostnames to allowedHosts or REFLET_DEVTOOLS_HOSTS.", 403);
+	if (request.headers.get("x-reflet-devtools") !== "1") return errorResponse(`Reflet devtools requests must send the ${DEVTOOLS_REQUEST_HEADER} header.`, 403);
+	const fetchSite = request.headers.get("sec-fetch-site");
+	if (!(fetchSite === null || fetchSite === "same-origin" || fetchSite === "none")) return errorResponse("Reflet devtools only answers requests from the app's own origin.", 403);
+	return null;
+}
+//#endregion
+//#region src/devtools/server/source/code-search.ts
+const MIN_QUERY_LENGTH = 2;
+const MAX_QUERY_LENGTH = 200;
+const MAX_MATCHES = 20;
+const PREVIEW_LENGTH = 160;
+const PREVIEW_LEAD = 40;
+const SEARCH_TIMEOUT_MS = 4e3;
+const MAX_OUTPUT_BYTES = 1048576;
+const NO_MATCHES_EXIT_CODE = 1;
+const NOT_A_REPOSITORY_EXIT_CODE = 128;
+const SEARCHED_FILES = [
+	"*.tsx",
+	"*.jsx",
+	"*.ts",
+	"*.js",
+	"*.vue",
+	"*.svelte",
+	"*.astro",
+	"*.mdx"
+];
+const LINE_BREAK = /[\r\n]/;
+function runGitGrep(workspaceRoot, query) {
+	const args = [
+		"grep",
+		"-n",
+		"-z",
+		"-I",
+		"-F",
+		"--no-color",
+		"--untracked",
+		"-e",
+		query,
+		"--",
+		...SEARCHED_FILES
+	];
+	return new Promise((resolveRun) => {
+		execFile("git", args, {
+			cwd: workspaceRoot,
+			encoding: "utf8",
+			maxBuffer: MAX_OUTPUT_BYTES,
+			timeout: SEARCH_TIMEOUT_MS
+		}, (error, stdout) => resolveRun({
+			error,
+			stdout
+		}));
+	});
+}
+function previewLine(content, query) {
+	const text = content.trim();
+	if (text.length <= PREVIEW_LENGTH) return text;
+	const matchIndex = text.indexOf(query);
+	const start = Math.max(0, Math.min(matchIndex - PREVIEW_LEAD, text.length - PREVIEW_LENGTH));
+	const end = start + PREVIEW_LENGTH;
+	const head = start > 0 ? "…" : "";
+	const tail = end < text.length ? "…" : "";
+	return `${head}${text.slice(start, end)}${tail}`;
+}
+function parseMatches(stdout, workspaceRoot, query) {
+	const matches = [];
+	for (const record of stdout.split("\n")) {
+		const [path, lineText, content] = record.split("\0");
+		const line = Number(lineText);
+		if (path !== void 0 && content !== void 0 && Number.isInteger(line) && !path.split("/").includes("node_modules")) {
+			matches.push({
+				absolutePath: join(workspaceRoot, path),
+				line,
+				path,
+				preview: previewLine(content, query)
+			});
+			if (matches.length === MAX_MATCHES) break;
+		}
+	}
+	return matches;
+}
+function describeGitFailure(error) {
+	if (error.code === "ENOENT") return failure("Code search needs git installed on the dev server.", 503);
+	if (error.code === NOT_A_REPOSITORY_EXIT_CODE) return failure("Code search needs the app to live in a git repository.", 503);
+	if (error.killed) return failure("Code search timed out.", 504);
+	return failure(`Code search failed: ${error.message}`, 500);
+}
+async function searchCode(workspaceRoot, rawQuery) {
+	const query = rawQuery.trim();
+	if (query.length < MIN_QUERY_LENGTH || query.length > MAX_QUERY_LENGTH) return failure(`Search for ${MIN_QUERY_LENGTH} to ${MAX_QUERY_LENGTH} characters.`, 400);
+	if (LINE_BREAK.test(query)) return failure("Search for a single line of text.", 400);
+	const { error, stdout } = await runGitGrep(workspaceRoot, query);
+	const matches = parseMatches(stdout, workspaceRoot, query);
+	const hasNoMatches = error?.code === NO_MATCHES_EXIT_CODE;
+	if (!error || hasNoMatches || matches.length > 0) return {
+		ok: true,
+		value: { matches }
+	};
+	return describeGitFailure(error);
+}
+//#endregion
+//#region src/devtools/server/source/project-roots.ts
+function resolveProjectRoots(appRoot) {
+	const resolvedRoot = resolve(appRoot);
+	const root = existsSync(resolvedRoot) ? realpathSync(resolvedRoot) : resolvedRoot;
+	for (let directory = root;; directory = dirname(directory)) {
+		if (existsSync(join(directory, ".git"))) return {
+			root,
+			workspaceRoot: directory
+		};
+		if (dirname(directory) === directory) return {
+			root,
+			workspaceRoot: root
+		};
+	}
+}
+//#endregion
+//#region src/devtools/server/source/jsx-range.ts
+const FAILED = -1;
+const MAX_TAG_LOOKBACK = 2;
+const TAG_NAME_START = /[A-Za-z_$]/;
+const TAG_NAME_CHAR = /[\w$.:-]/;
+const IDENTIFIER_CHAR = /[\w$]/;
+const WHITESPACE = /\s/;
+const JSX_EXPRESSION_LEAD = /[([{,;=?:&|!>]/;
+const JSX_KEYWORD_LEADS = [
+	"return",
+	"yield",
+	"default",
+	"await"
+];
+function isTagStart(code, index) {
+	if (code.charAt(index) !== "<") return false;
+	const next = code.charAt(index + 1);
+	return next === ">" || TAG_NAME_START.test(next);
+}
+function startsJsxInExpression(code, index) {
+	let cursor = index - 1;
+	while (cursor >= 0 && WHITESPACE.test(code.charAt(cursor))) cursor -= 1;
+	if (cursor < 0) return true;
+	const previous = code.charAt(cursor);
+	if (JSX_EXPRESSION_LEAD.test(previous)) return true;
+	let wordStart = cursor;
+	while (wordStart > 0 && IDENTIFIER_CHAR.test(code.charAt(wordStart - 1))) wordStart -= 1;
+	return JSX_KEYWORD_LEADS.includes(code.slice(wordStart, cursor + 1));
+}
+function skipJsString(code, index) {
+	const quote = code.charAt(index);
+	let cursor = index + 1;
+	while (cursor < code.length) {
+		const char = code.charAt(cursor);
+		if (char === "\\") cursor += 2;
+		else if (char === quote) return cursor + 1;
+		else if (char === "\n") return index + 1;
+		else cursor += 1;
+	}
+	return index + 1;
+}
+function skipTemplate(code, index) {
+	let cursor = index + 1;
+	while (cursor < code.length) {
+		const char = code.charAt(cursor);
+		if (char === "\\") cursor += 2;
+		else if (char === "`") return cursor + 1;
+		else if (char === "$" && code.charAt(cursor + 1) === "{") {
+			cursor = skipJsExpression(code, cursor + 1);
+			if (cursor === FAILED) return FAILED;
+		} else cursor += 1;
+	}
+	return FAILED;
+}
+function skipJsToken(code, index) {
+	const char = code.charAt(index);
+	const next = code.charAt(index + 1);
+	if (char === "\"" || char === "'") return skipJsString(code, index);
+	if (char === "`") return skipTemplate(code, index);
+	if (char === "/" && next === "/") {
+		const lineEnd = code.indexOf("\n", index);
+		return lineEnd === -1 ? code.length : lineEnd;
+	}
+	if (char === "/" && next === "*") {
+		const commentEnd = code.indexOf("*/", index + 2);
+		return commentEnd === -1 ? FAILED : commentEnd + 2;
+	}
+	if (isTagStart(code, index) && startsJsxInExpression(code, index)) return skipElement(code, index);
+	return index + 1;
+}
+function skipJsExpression(code, index) {
+	let depth = 0;
+	let cursor = index;
+	while (cursor < code.length) {
+		const char = code.charAt(cursor);
+		if (char === "{" || char === "}") {
+			depth += char === "{" ? 1 : -1;
+			cursor += 1;
+			if (depth === 0) return cursor;
+		} else {
+			cursor = skipJsToken(code, cursor);
+			if (cursor === FAILED) return FAILED;
+		}
+	}
+	return FAILED;
+}
+function skipTypeArguments(code, index) {
+	let depth = 0;
+	for (let cursor = index; cursor < code.length; cursor += 1) {
+		const char = code.charAt(cursor);
+		if (char === "<") depth += 1;
+		else if (char === ">") {
+			depth -= 1;
+			if (depth === 0) return cursor + 1;
+		}
+	}
+	return FAILED;
+}
+function skipAttributeToken(code, index) {
+	const char = code.charAt(index);
+	if (char === "{") return skipJsExpression(code, index);
+	if (char === "\"" || char === "'") {
+		const closingQuote = code.indexOf(char, index + 1);
+		return closingQuote === -1 ? FAILED : closingQuote + 1;
+	}
+	return index + 1;
+}
+function readTagName(code, index) {
+	let cursor = index;
+	while (TAG_NAME_CHAR.test(code.charAt(cursor))) cursor += 1;
+	return cursor;
+}
+function readOpeningTag(code, index) {
+	const nameEnd = readTagName(code, index + 1);
+	const name = code.slice(index + 1, nameEnd);
+	let cursor = code.charAt(nameEnd) === "<" ? skipTypeArguments(code, nameEnd) : nameEnd;
+	while (cursor !== FAILED && cursor < code.length) {
+		const char = code.charAt(cursor);
+		if (char === ">") return {
+			end: cursor + 1,
+			name,
+			selfClosing: false
+		};
+		if (char === "/" && code.charAt(cursor + 1) === ">") return {
+			end: cursor + 2,
+			name,
+			selfClosing: true
+		};
+		cursor = skipAttributeToken(code, cursor);
+	}
+	return null;
+}
+function readClosingTagEnd(code, index, name) {
+	let cursor = index + 2;
+	while (WHITESPACE.test(code.charAt(cursor))) cursor += 1;
+	const nameEnd = readTagName(code, cursor);
+	if (code.slice(cursor, nameEnd) !== name) return FAILED;
+	cursor = nameEnd;
+	while (WHITESPACE.test(code.charAt(cursor))) cursor += 1;
+	return code.charAt(cursor) === ">" ? cursor + 1 : FAILED;
+}
+function skipChildren(code, index, name) {
+	let cursor = index;
+	while (cursor !== FAILED && cursor < code.length) {
+		const char = code.charAt(cursor);
+		if (char === "<" && code.charAt(cursor + 1) === "/") return readClosingTagEnd(code, cursor, name);
+		if (char === "{") cursor = skipJsExpression(code, cursor);
+		else if (isTagStart(code, cursor)) cursor = skipElement(code, cursor);
+		else cursor += 1;
+	}
+	return FAILED;
+}
+function skipElement(code, index) {
+	const tag = readOpeningTag(code, index);
+	if (!tag) return FAILED;
+	return tag.selfClosing ? tag.end : skipChildren(code, tag.end, tag.name);
+}
+function lineOffset(code, line) {
+	if (!Number.isInteger(line) || line < 1) return FAILED;
+	let offset = 0;
+	for (let current = 1; current < line; current += 1) {
+		const newline = code.indexOf("\n", offset);
+		if (newline === -1) return FAILED;
+		offset = newline + 1;
+	}
+	return offset;
+}
+function findTagStart(code, lineStart, lineEnd, column) {
+	const origin = Math.min(lineStart + Math.max(column, 0), lineEnd);
+	for (let back = 0; back <= MAX_TAG_LOOKBACK; back += 1) {
+		const candidate = origin - back;
+		if (candidate >= lineStart && isTagStart(code, candidate)) return candidate;
+	}
+	for (let candidate = origin + 1; candidate < lineEnd; candidate += 1) if (isTagStart(code, candidate)) return candidate;
+	return FAILED;
+}
+function countNewlines(code, from, to) {
+	let count = 0;
+	let newline = code.indexOf("\n", from);
+	while (newline !== -1 && newline < to) {
+		count += 1;
+		newline = code.indexOf("\n", newline + 1);
+	}
+	return count;
+}
+/** Lines spanned by the JSX element at a 1-based line and 0-based column. */
+function jsxElementLines(code, line, column) {
+	const lineStart = lineOffset(code, line);
+	if (lineStart === FAILED) return null;
+	const newline = code.indexOf("\n", lineStart);
+	const tagStart = findTagStart(code, lineStart, newline === -1 ? code.length : newline, column);
+	if (tagStart === FAILED) return null;
+	const elementEnd = skipElement(code, tagStart);
+	if (elementEnd === FAILED) return null;
+	return {
+		end: line + countNewlines(code, tagStart, elementEnd - 1),
+		start: line
+	};
+}
+//#endregion
+//#region src/devtools/server/source/server-frame.ts
+const SERVER_FRAME_PREFIX = /^(?:about|rsc):\/\/React\/Server\//;
+const QUERY_OR_HASH$1 = /[?#].*$/;
+const SOURCE_MAPPING_URL = /\/\/# sourceMappingURL=(\S+)\s*$/;
+const MAX_MAP_BYTES = 52428800;
+const mapCache = /* @__PURE__ */ new Map();
+function isServerFrame(fileName) {
+	return SERVER_FRAME_PREFIX.test(fileName);
+}
+function isInside(path, root) {
+	const fromRoot = relative(root, path);
+	return fromRoot !== "" && !fromRoot.startsWith("..") && !fromRoot.includes(`..${sep}`);
+}
+async function mapPathFor(chunkPath) {
+	const code = await readFile(chunkPath, "utf8");
+	const declared = SOURCE_MAPPING_URL.exec(code)?.[1];
+	return declared ? join(dirname(chunkPath), decodeURIComponent(declared)) : `${chunkPath}.map`;
+}
+async function loadMap(mapPath) {
+	const { mtimeMs, size } = await stat(mapPath);
+	if (size > MAX_MAP_BYTES) throw new Error("source map too large");
+	const cached = mapCache.get(mapPath);
+	if (cached?.mtimeMs === mtimeMs) return cached.map;
+	const map = new SourceMap(JSON.parse(await readFile(mapPath, "utf8")));
+	mapCache.set(mapPath, {
+		map,
+		mtimeMs
+	});
+	return map;
+}
+/**
+* Server Components stamp their elements with frames into the dev server's
+* own chunks (`about://React/Server/file:///…/.next/…`); the browser cannot
+* fetch those maps, so they are resolved here from disk.
+*/
+async function mapServerFrame(request, workspaceRoot) {
+	const unreadable = failure("This element comes from a Server Component whose source map could not be read.", 404);
+	if (request.line === null) return unreadable;
+	try {
+		const chunkUrl = request.fileName.replace(SERVER_FRAME_PREFIX, "").replace(QUERY_OR_HASH$1, "");
+		const chunkPath = await realpath(fileURLToPath(chunkUrl));
+		if (!isInside(chunkPath, workspaceRoot)) return failure("Reflet devtools only reads files inside your repository.", 403);
+		const origin = (await loadMap(await mapPathFor(chunkPath))).findOrigin(request.line, (request.column ?? 0) + 1);
+		if (!("fileName" in origin)) return unreadable;
+		return {
+			ok: true,
+			value: {
+				column: origin.columnNumber - 1,
+				fileName: origin.fileName,
+				line: origin.lineNumber
+			}
+		};
+	} catch {
+		return unreadable;
+	}
+}
+//#endregion
+//#region src/devtools/server/source/source-file.ts
+const MAX_SOURCE_BYTES = 1048576;
+const MAX_FILE_NAME_LENGTH = 2048;
+const MAX_NORMALIZE_PASSES = 8;
+const SOURCE_EXTENSIONS = [
+	".astro",
+	".cjs",
+	".js",
+	".jsx",
+	".mdx",
+	".mjs",
+	".svelte",
+	".ts",
+	".tsx",
+	".vue"
+];
+const EXTENSION_REFUSAL = `Reflet devtools only reads source files (${SOURCE_EXTENSIONS.join(", ")}).`;
+const OUTSIDE_WORKSPACE_REFUSAL = "Reflet devtools only reads files inside your repository.";
+const NODE_MODULES_REFUSAL = "Reflet devtools does not read files inside node_modules.";
+const QUERY_OR_HASH = /[?#].*$/;
+const TURBOPACK_MODULE_SUFFIX = /(?: \[[\w-]+\])+(?: \([\w-]+\))*$/;
+const URL_PREFIXES = [/^file:\/\//, /^https?:\/\/[^/]*/];
+const BUNDLER_PREFIXES = [
+	/^rsc:\/\/React\/[^/]+\//,
+	/^webpack-internal:\/{2,}/,
+	/^webpack:\/\/[^/]*\//,
+	/^turbopack:\/{2,}/,
+	/^\[project\]\//,
+	/^\(app-pages-browser\)\//,
+	/^\([\w-]+\)\/(?=\.\/)/,
+	/^\/@fs(?=\/)/,
+	/^\.\//
+];
+function decodePath(path) {
+	try {
+		return decodeURIComponent(path);
+	} catch {
+		return path;
+	}
+}
+function stripFirstPrefix(fileName, prefixes) {
+	for (const prefix of prefixes) if (prefix.test(fileName)) return fileName.replace(prefix, "");
+	return fileName;
+}
+/** Turns a file name from a React debug stack into a filesystem path. */
+function normalizeSourceFileName(rawFileName) {
+	let fileName = rawFileName.trim().replace(QUERY_OR_HASH, "").replace(TURBOPACK_MODULE_SUFFIX, "");
+	let isUrlEncoded = false;
+	for (let pass = 0; pass < MAX_NORMALIZE_PASSES; pass += 1) {
+		const withoutUrl = stripFirstPrefix(fileName, URL_PREFIXES);
+		isUrlEncoded ||= withoutUrl !== fileName;
+		const stripped = stripFirstPrefix(withoutUrl, BUNDLER_PREFIXES);
+		if (stripped === fileName) break;
+		fileName = stripped;
+	}
+	return isUrlEncoded ? decodePath(fileName) : fileName;
+}
+function candidatePaths(fileName, roots) {
+	const candidates = [join(roots.root, fileName), join(roots.workspaceRoot, fileName)];
+	if (isAbsolute(fileName)) candidates.unshift(fileName);
+	return [...new Set(candidates)];
+}
+function isSourceExtension(path) {
+	return SOURCE_EXTENSIONS.includes(extname(path).toLowerCase());
+}
+function workspaceRelativePath(realPath, workspaceRoot) {
+	const relativePath = relative(workspaceRoot, realPath);
+	return relativePath === "" || relativePath === ".." || relativePath.startsWith(`..${sep}`) || isAbsolute(relativePath) ? null : relativePath.split(sep).join("/");
+}
+async function checkCandidate(candidate, workspaceRoot) {
+	let realPath;
+	let size;
+	try {
+		realPath = await realpath(candidate);
+		const stats = await stat(realPath);
+		if (!stats.isFile()) return { kind: "missing" };
+		size = stats.size;
+	} catch {
+		return { kind: "missing" };
+	}
+	const relativePath = workspaceRelativePath(realPath, workspaceRoot);
+	if (relativePath === null) return {
+		kind: "refused",
+		reason: OUTSIDE_WORKSPACE_REFUSAL
+	};
+	if (relativePath.split("/").includes("node_modules")) return {
+		kind: "refused",
+		reason: NODE_MODULES_REFUSAL
+	};
+	if (!isSourceExtension(realPath)) return {
+		kind: "refused",
+		reason: EXTENSION_REFUSAL
+	};
+	return {
+		kind: "found",
+		realPath,
+		relativePath,
+		size
+	};
+}
+async function locateSourceFile(fileName, roots) {
+	let refusal = null;
+	for (const candidate of candidatePaths(fileName, roots)) {
+		const check = await checkCandidate(candidate, roots.workspaceRoot);
+		if (check.kind === "found") return {
+			ok: true,
+			value: check
+		};
+		if (check.kind === "refused") refusal ??= check.reason;
+	}
+	if (refusal) return failure(refusal, 403);
+	return failure(`Could not find ${fileName} in ${roots.workspaceRoot}.`, 404);
+}
+/** Server-map columns can point past the line; the element then starts at its first tag. */
+function columnWithinLine(code, line, column) {
+	const text = code.split("\n")[line - 1] ?? "";
+	return column !== null && column < text.length ? column : null;
+}
+async function readSourceFile(frame, roots) {
+	if (frame.fileName.length > MAX_FILE_NAME_LENGTH || frame.fileName.includes("\0")) return failure("That source file name is not a valid path.", 400);
+	const mapped = isServerFrame(frame.fileName) ? await mapServerFrame(frame, roots.workspaceRoot) : {
+		ok: true,
+		value: frame
+	};
+	if (!mapped.ok) return mapped;
+	const request = mapped.value;
+	const fileName = normalizeSourceFileName(request.fileName);
+	if (!fileName) return failure("A source file name is required.", 400);
+	if (!isSourceExtension(fileName)) return failure(EXTENSION_REFUSAL, 403);
+	const located = await locateSourceFile(fileName, roots);
+	if (!located.ok) return located;
+	const { realPath, relativePath, size } = located.value;
+	if (size > MAX_SOURCE_BYTES) return failure(`${relativePath} is larger than 1 MB, too big to preview.`, 413);
+	const code = await readFile(realPath, "utf8");
+	const column = request.line === null ? request.column : columnWithinLine(code, request.line, request.column);
+	return {
+		ok: true,
+		value: {
+			absolutePath: realPath,
+			code,
+			column,
+			elementLines: request.line === null ? null : jsxElementLines(code, request.line, column ?? 0),
+			line: request.line,
+			path: relativePath
+		}
+	};
+}
+//#endregion
+//#region src/devtools/server/handler.ts
+const TRAILING_SLASHES = /\/+$/;
+function outcomeResponse(outcome) {
+	return outcome.ok ? jsonResponse(outcome.value) : errorResponse(outcome.error, outcome.status);
+}
+function routeSubPath(pathname) {
+	const baseIndex = pathname.indexOf(DEVTOOLS_ROUTE_BASE);
+	if (baseIndex === -1) return null;
+	return pathname.slice(baseIndex + DEVTOOLS_ROUTE_BASE.length).replace(TRAILING_SLASHES, "");
+}
+function readInteger(value, minimum) {
+	if (value === null || value === "") return null;
+	const parsed = Number(value);
+	return Number.isInteger(parsed) && parsed >= minimum ? parsed : null;
+}
+async function routeRequest(request, settings, projectRoots) {
+	const url = new URL(request.url);
+	const subPath = routeSubPath(url.pathname);
+	if (subPath?.startsWith(`${DEVTOOLS_ENDPOINTS.proxy}/`)) return await proxyToReflet(request, subPath.slice(DEVTOOLS_ENDPOINTS.proxy.length), settings);
+	if ((subPath === DEVTOOLS_ENDPOINTS.status || subPath === DEVTOOLS_ENDPOINTS.source || subPath === DEVTOOLS_ENDPOINTS.search) && request.method !== "GET") return errorResponse(`${subPath} only answers GET requests.`, 405);
+	switch (subPath) {
+		case DEVTOOLS_ENDPOINTS.status: return jsonResponse({
+			editor: settings.editor,
+			hasSecretKey: settings.secretKey !== null,
+			marker: DEVTOOLS_STATUS_MARKER
+		});
+		case DEVTOOLS_ENDPOINTS.source: return outcomeResponse(await readSourceFile({
+			column: readInteger(url.searchParams.get("column"), 0),
+			fileName: url.searchParams.get("file") ?? "",
+			line: readInteger(url.searchParams.get("line"), 1)
+		}, projectRoots()));
+		case DEVTOOLS_ENDPOINTS.search: return outcomeResponse(await searchCode(projectRoots().workspaceRoot, url.searchParams.get("q") ?? ""));
+		default: return errorResponse(`No Reflet devtools endpoint at ${url.pathname}.`, 404);
+	}
+}
+function createDevtoolsHandler(options = {}, env = process.env) {
+	const settings = resolveDevtoolsOptions(options, env);
+	let roots = null;
+	const projectRoots = () => {
+		roots ??= resolveProjectRoots(settings.root);
+		return roots;
+	};
+	return async (request) => {
+		const rejection = rejectUntrustedRequest(request, settings.allowedHosts);
+		if (rejection) return rejection;
+		try {
+			return await routeRequest(request, settings, projectRoots);
+		} catch (error) {
+			return errorResponse(`Reflet devtools route failed: ${error instanceof Error ? error.message : String(error)}`, 500);
+		}
+	};
+}
+//#endregion
+export { errorResponse as n, createDevtoolsHandler as t };
+
+//# sourceMappingURL=handler-CHP0m7KF.js.map