seemore 1.10.9 → 1.11.0

package/dist/cli/index.js

@@ -19,43 +19,43 @@ __export(paths_exports, {
   packageRoot: () => packageRoot,
   resolveContentRoot: () => resolveContentRoot
 });
-import { existsSync as existsSync2, readFileSync as readFileSync2, realpathSync } from "fs";
-import { createHash as createHash2 } from "crypto";
+import { existsSync, readFileSync, realpathSync } from "fs";
+import { createHash } from "crypto";
 import { tmpdir } from "os";
-import { dirname as dirname3, join as join2, resolve as resolve3 } from "path";
+import { dirname as dirname2, join as join3, resolve } from "path";
 import { fileURLToPath } from "url";
 function packageRoot() {
-  let dir = dirname3(fileURLToPath(import.meta.url));
+  let dir = dirname2(fileURLToPath(import.meta.url));
   for (let depth = 0; depth < 10; depth++) {
-    if (existsSync2(join2(dir, "package.json"))) return dir;
-    const parent = dirname3(dir);
+    if (existsSync(join3(dir, "package.json"))) return dir;
+    const parent = dirname2(dir);
     if (parent === dir) break;
     dir = parent;
   }
   throw new Error("seemore: could not locate its own package root.");
 }
 function appRoot() {
-  return join2(packageRoot(), "src", "app");
+  return join3(packageRoot(), "src", "app");
 }
 function packageDirOf(name, fromFile) {
-  let dir = dirname3(fromFile);
+  let dir = dirname2(fromFile);
   for (let depth = 0; depth < 10; depth++) {
-    const manifest = join2(dir, "package.json");
-    if (existsSync2(manifest) && JSON.parse(readFileSync2(manifest, "utf8")).name === name) {
+    const manifest = join3(dir, "package.json");
+    if (existsSync(manifest) && JSON.parse(readFileSync(manifest, "utf8")).name === name) {
       return dir;
     }
-    const parent = dirname3(dir);
+    const parent = dirname2(dir);
     if (parent === dir) break;
     dir = parent;
   }
   throw new Error(`seemore: could not locate the "${name}" package directory.`);
 }
 function cacheDir(contentRoot) {
-  const key = createHash2("sha256").update(resolve3(contentRoot)).digest("hex").slice(0, 12);
-  return join2(tmpdir(), "seemore", key);
+  const key = createHash("sha256").update(resolve(contentRoot)).digest("hex").slice(0, 12);
+  return join3(tmpdir(), "seemore", key);
 }
 function resolveContentRoot(cwd, explicit) {
-  return explicit !== void 0 ? canonicalise(resolve3(cwd, explicit)) : canonicalise(cwd);
+  return explicit !== void 0 ? canonicalise(resolve(cwd, explicit)) : canonicalise(cwd);
 }
 function canonicalise(dir) {
   try {
@@ -75,18 +75,102 @@ import { parseArgs } from "util";
 import pc5 from "picocolors";
 
 // src/cli/build.ts
-import { mkdirSync as mkdirSync3, mkdtempSync, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync5 } from "fs";
-import { createRequire as createRequire3 } from "module";
-import { tmpdir as tmpdir2 } from "os";
-import { isAbsolute as isAbsolute2, join as join8, relative as relative2, resolve as resolve5 } from "path";
+import { mkdirSync as mkdirSync3, mkdtempSync, readFileSync as readFileSync7, rmSync, writeFileSync as writeFileSync7 } from "fs";
+import { createRequire as createRequire4 } from "module";
+import { tmpdir as tmpdir3 } from "os";
+import { isAbsolute as isAbsolute2, join as join12, relative as relative2, resolve as resolve5 } from "path";
 import pc2 from "picocolors";
 import { build as viteBuild } from "vite";
 
-// src/node/config/load.ts
-import { existsSync } from "fs";
-import { dirname, isAbsolute, resolve } from "path";
-import { createJiti } from "jiti";
-import "zod";
+// src/node/auth/build.ts
+import { writeFileSync as writeFileSync4 } from "fs";
+import { join as join7 } from "path";
+
+// src/shared/auth/crypto.ts
+var KDF_ITERATIONS = 6e5;
+var MAGIC = new Uint8Array([83, 77, 80, 49]);
+var IV_BYTES = 12;
+var HEADER_BYTES = MAGIC.length + IV_BYTES;
+var SALT_PREFIX = "seemore-auth-v1\0";
+var encoder = new TextEncoder();
+function subtle() {
+  return globalThis.crypto.subtle;
+}
+function normalisePassword(password) {
+  return password.normalize("NFC");
+}
+async function deriveSalt(id) {
+  return new Uint8Array(await subtle().digest("SHA-256", encoder.encode(SALT_PREFIX + id)));
+}
+async function deriveKek(password, salt, iterations = KDF_ITERATIONS) {
+  const material = await subtle().importKey("raw", encoder.encode(normalisePassword(password)), "PBKDF2", false, [
+    "deriveKey"
+  ]);
+  return await subtle().deriveKey(
+    { name: "PBKDF2", hash: "SHA-256", salt, iterations },
+    material,
+    { name: "AES-KW", length: 256 },
+    false,
+    ["wrapKey", "unwrapKey"]
+  );
+}
+async function generateContentKey() {
+  return await subtle().generateKey({ name: "AES-GCM", length: 256 }, true, ["encrypt", "decrypt"]);
+}
+async function wrapContentKey(contentKey, kek) {
+  return new Uint8Array(await subtle().wrapKey("raw", contentKey, kek, "AES-KW"));
+}
+async function encryptFile(key, path, plaintext) {
+  const iv = globalThis.crypto.getRandomValues(new Uint8Array(IV_BYTES));
+  const sealed = await subtle().encrypt(
+    { name: "AES-GCM", iv, additionalData: encoder.encode(path), tagLength: 128 },
+    key,
+    plaintext
+  );
+  const out = new Uint8Array(HEADER_BYTES + sealed.byteLength);
+  out.set(MAGIC, 0);
+  out.set(iv, MAGIC.length);
+  out.set(new Uint8Array(sealed), HEADER_BYTES);
+  return out;
+}
+function isEncrypted(bytes) {
+  return bytes.length > HEADER_BYTES && MAGIC.every((byte, index) => bytes[index] === byte);
+}
+async function createManifest(options) {
+  const iterations = options.iterations ?? KDF_ITERATIONS;
+  const salt = await deriveSalt(options.id);
+  const kek = await deriveKek(options.password, salt, iterations);
+  const contentKey = await generateContentKey();
+  return {
+    contentKey,
+    manifest: {
+      v: 1,
+      kdf: { name: "PBKDF2", hash: "SHA-256", iterations, salt: encodeBase64(salt) },
+      key: encodeBase64(await wrapContentKey(contentKey, kek)),
+      remember: options.remember
+    }
+  };
+}
+function encodeBase64(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
+
+// src/shared/auth/files.ts
+var PUBLIC_FILES = [
+  "index.html",
+  "404.html",
+  "200.html",
+  "_redirects",
+  ".nojekyll",
+  "_headers",
+  "sw.js",
+  "auth.json"
+];
+var MANIFEST_FILE = "auth.json";
+var WORKER_FILE = "sw.js";
+var APP_FILE = "app.html";
 
 // src/shared/base.ts
 var EXTERNAL = /^(?:[a-z][a-z0-9+.-]*:|\/\/)/i;
@@ -114,6 +198,386 @@ function withBase(base, href) {
   return b + href.replace(/^\/+/, "");
 }
 
+// src/node/content/slug.ts
+import { slug as slugify } from "github-slugger";
+var INDEX_NAMES = /* @__PURE__ */ new Set(["index", "readme"]);
+var CONTENT_EXT = /\.mdx?$/i;
+function toPosix(file) {
+  return file.replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+/, "");
+}
+function slugifySegment(segment) {
+  const slugged = slugify(segment);
+  if (slugged !== "") return slugged;
+  const fallback = segment.toLowerCase().replace(/[^\p{L}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "");
+  return fallback === "" ? "untitled" : fallback;
+}
+function toRoute(file) {
+  const posix = toPosix(file);
+  const segments = posix.split("/");
+  const basename3 = segments.pop() ?? "";
+  const stem = basename3.replace(CONTENT_EXT, "");
+  const isIndex = INDEX_NAMES.has(stem.toLowerCase());
+  const slugs = segments.map(slugifySegment);
+  if (!isIndex) slugs.push(slugifySegment(stem));
+  return {
+    file: posix,
+    url: slugs.length === 0 ? "/" : `/${slugs.join("/")}`,
+    slugs,
+    output: [...slugs, "index.html"].join("/"),
+    isIndex
+  };
+}
+function resolveRoutes(files) {
+  const sorted = [...files].map(toPosix).sort();
+  const byUrl = /* @__PURE__ */ new Map();
+  const warnings = [];
+  const errors = [];
+  for (const file of sorted) {
+    const route = toRoute(file);
+    const bucket = byUrl.get(route.url);
+    if (bucket) bucket.push(route);
+    else byUrl.set(route.url, [route]);
+  }
+  const routes = [];
+  for (const [url, candidates] of [...byUrl.entries()].sort(([a], [b]) => a < b ? -1 : 1)) {
+    if (candidates.length === 1) {
+      routes.push(candidates[0]);
+      continue;
+    }
+    const indexes = candidates.filter((c) => c.isIndex);
+    if (indexes.length === candidates.length) {
+      const winner = indexes.find((c) => c.file.split("/").pop()?.toLowerCase().startsWith("index")) ?? indexes[0];
+      const losers = indexes.filter((c) => c !== winner);
+      warnings.push(
+        `${url} has more than one index file: using ${winner.file}, ignoring ${losers.map((l) => l.file).join(", ")}.`
+      );
+      routes.push(winner);
+      continue;
+    }
+    errors.push(
+      `Duplicate route ${url} produced by ${candidates.length} files:
+` + candidates.map((c) => `  - ${c.file}`).join("\n") + `
+Rename one of them, or exclude it with \`exclude\` in seemore.config.ts.`
+    );
+  }
+  return { routes, errors, warnings };
+}
+
+// src/node/prerender/deploy.ts
+import { writeFileSync } from "fs";
+import { join } from "path";
+function writeDeployArtifacts(outDir, base, shell, options = {}) {
+  const prefix = base === "/" ? "" : base.replace(/\/+$/, "");
+  writeFileSync(join(outDir, "_redirects"), `${prefix}/*    ${prefix}/index.html    200
+`, "utf8");
+  writeFileSync(join(outDir, "200.html"), shell, "utf8");
+  writeFileSync(join(outDir, ".nojekyll"), "", "utf8");
+  if (options.auth === true) {
+    writeFileSync(join(outDir, "_headers"), "/*\n  X-Robots-Tag: noindex, nofollow\n", "utf8");
+  }
+}
+
+// src/node/prerender/emit.ts
+import { mkdirSync, writeFileSync as writeFileSync2 } from "fs";
+import { dirname, join as join2 } from "path";
+function outputPathFor(url) {
+  const clean = url.replace(/^\/+|\/+$/g, "");
+  return clean === "" ? "index.html" : join2(clean, "index.html");
+}
+function writeHtml(outDir, relativePath, html) {
+  const target = join2(outDir, relativePath);
+  mkdirSync(dirname(target), { recursive: true });
+  writeFileSync2(target, html, "utf8");
+}
+function applyTemplate(template, { html, head }) {
+  return template.replace("<!--seemore-head-->", () => head).replace("<!--seemore-app-->", () => html);
+}
+
+// src/node/auth/bundle.ts
+init_paths();
+import { tmpdir as tmpdir2 } from "os";
+import { join as join4 } from "path";
+import { build } from "vite";
+var bundles = /* @__PURE__ */ new Map();
+function bundleAuthScript(entry) {
+  let bundle = bundles.get(entry);
+  if (bundle === void 0) {
+    bundle = compile(entry);
+    bundles.set(entry, bundle);
+    bundle.catch(() => bundles.delete(entry));
+  }
+  return bundle;
+}
+async function compile(entry) {
+  const result = await build({
+    root: packageRoot(),
+    configFile: false,
+    envDir: false,
+    publicDir: false,
+    clearScreen: false,
+    logLevel: "warn",
+    cacheDir: join4(tmpdir2(), "seemore", "auth-scripts"),
+    build: {
+      write: false,
+      minify: true,
+      target: "es2020",
+      copyPublicDir: false,
+      reportCompressedSize: false,
+      lib: {
+        entry: join4(packageRoot(), "src", "shared", "auth", `${entry}.ts`),
+        formats: ["iife"],
+        name: "seemoreAuth",
+        fileName: () => `${entry}.js`
+      }
+    }
+  });
+  const outputs = Array.isArray(result) ? result : [result];
+  const chunk = outputs.flatMap((output) => output.output ?? []).find((file) => file.type === "chunk");
+  if (chunk?.code === void 0) throw new Error(`seemore: bundling the ${entry} script produced no code.`);
+  return chunk.code;
+}
+
+// src/node/auth/output.ts
+import { readdirSync, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
+import { join as join5 } from "path";
+function publicFiles(favicon) {
+  return favicon === void 0 ? [...PUBLIC_FILES] : [...PUBLIC_FILES, toPosix(favicon)];
+}
+async function encryptOutput(outDir, contentKey, open) {
+  const isPublic = new Set(open);
+  let encrypted = 0;
+  for (const path of listFiles(outDir)) {
+    if (isPublic.has(path)) continue;
+    const file = join5(outDir, path);
+    writeFileSync3(file, await encryptFile(contentKey, path, new Uint8Array(readFileSync2(file))));
+    encrypted++;
+  }
+  return encrypted;
+}
+function assertOutputEncrypted(outDir, open) {
+  const isPublic = new Set(open);
+  const plaintext = listFiles(outDir).filter((path) => !isPublic.has(path) && !isEncrypted(readFileSync2(join5(outDir, path))));
+  if (plaintext.length === 0) return;
+  throw new Error(
+    `seemore stopped the build: ${plaintext.length === 1 ? "this file was" : "these files were"} about to ship unencrypted, and \`auth\` only allows its public files in plain text:
+${plaintext.map((path) => `  - ${path}`).join("\n")}
+
+This is a bug in seemore. Please report it at https://github.com/arifszn/seemore/issues.`
+  );
+}
+function listFiles(dir, prefix = "") {
+  const files = [];
+  for (const entry of readdirSync(join5(dir, prefix), { withFileTypes: true })) {
+    const path = prefix === "" ? entry.name : `${prefix}/${entry.name}`;
+    if (entry.isDirectory()) files.push(...listFiles(dir, path));
+    else files.push(path);
+  }
+  return files.sort();
+}
+
+// src/node/auth/shell.ts
+function renderLockShell(options) {
+  const title = escapeHtml(options.title);
+  const icon = options.favicon === void 0 ? void 0 : escapeHtml(options.favicon);
+  const config = JSON.stringify({ base: options.base }).replace(/</g, "\\u003c");
+  return [
+    "<!doctype html>",
+    '<html lang="en">',
+    "<head>",
+    '<meta charset="utf-8" />',
+    '<meta name="viewport" content="width=device-width, initial-scale=1" />',
+    // Search engines: nothing past this screen is readable to them anyway.
+    '<meta name="robots" content="noindex, nofollow" />',
+    `<title>${title}</title>`,
+    options.description === void 0 ? "" : `<meta name="description" content="${escapeHtml(options.description)}" />`,
+    icon === void 0 ? "" : `<link rel="icon" href="${icon}" />`,
+    `<style>${styles(options.colours)}</style>`,
+    `<script>${inlineScript(THEME_SCRIPT)}</script>`,
+    "</head>",
+    "<body>",
+    '<main class="lock">',
+    icon === void 0 ? "" : `<img class="lock-icon" src="${icon}" alt="" width="44" height="44" />`,
+    `<h1>${title}</h1>`,
+    options.description === void 0 ? "" : `<p class="lock-desc">${escapeHtml(options.description)}</p>`,
+    '<form id="seemore-auth-form" hidden>',
+    '<label class="lock-label" for="seemore-auth-password">Password</label>',
+    '<input id="seemore-auth-password" name="password" type="password" placeholder="Password" autocomplete="current-password" required />',
+    '<button id="seemore-auth-submit" type="submit">Unlock</button>',
+    '<p id="seemore-auth-status" class="lock-status" role="alert"></p>',
+    "</form>",
+    `<p id="seemore-auth-unsupported" class="lock-note" hidden>This browser can't unlock this site \u2014 it needs service workers. Try a regular (not private) window or another browser.</p>`,
+    '<noscript><p class="lock-note">This site needs JavaScript to unlock.</p></noscript>',
+    "</main>",
+    `<script type="application/json" id="seemore-auth-config">${config}</script>`,
+    `<script>${inlineScript(options.script)}</script>`,
+    "</body>",
+    "</html>",
+    ""
+  ].filter((line) => line !== "").join("\n");
+}
+var THEME_SCRIPT = "try{var t=localStorage.getItem('theme');if(t==='dark'||(t!=='light'&&matchMedia('(prefers-color-scheme: dark)').matches))document.documentElement.classList.add('dark')}catch(e){}";
+function styles(colours) {
+  const vars = (tokens) => Object.entries(tokens).map(([name, value]) => `--${name}:${value}`).join(";");
+  return [
+    `:root{color-scheme:light;${vars(colours.light)}}`,
+    `:root.dark{color-scheme:dark;${vars(colours.dark)}}`,
+    "*{box-sizing:border-box}",
+    "[hidden]{display:none!important}",
+    "html,body{min-height:100%}",
+    'body{margin:0;min-height:100vh;display:grid;place-items:center;padding:24px;background:var(--background);color:var(--foreground);font:15px/1.5 system-ui,-apple-system,"Segoe UI",Roboto,sans-serif}',
+    ".lock{width:100%;max-width:360px;padding:32px;border:1px solid color-mix(in srgb,var(--foreground) 12%,transparent);border-radius:14px;background:color-mix(in srgb,var(--background) 94%,var(--foreground));box-shadow:0 12px 32px color-mix(in srgb,var(--foreground) 8%,transparent);text-align:center;animation:lock-in .24s ease-out both}",
+    ":root:not(.dark) .lock{background:color-mix(in srgb,var(--background) 92%,white)}",
+    ".lock-icon{width:40px;height:40px;margin-bottom:20px}",
+    "h1{margin:0;font-size:22px;line-height:1.2;font-weight:650;letter-spacing:-.015em}",
+    ".lock-site{margin:7px 0 0;color:var(--muted-foreground);font-size:14px}",
+    ".lock-desc{margin:6px 0 0;font-size:14px;color:var(--muted-foreground)}",
+    "form{width:100%;margin-top:24px;text-align:left}",
+    ".lock-label{position:absolute;width:1px;height:1px;overflow:hidden;clip:rect(0 0 0 0);white-space:nowrap}",
+    "input{display:block;width:100%;min-width:0;font:inherit;padding:10px 12px;border-radius:8px;border:1px solid var(--border);background:var(--background);color:inherit}",
+    "input:focus{outline:2px solid var(--ring);outline-offset:2px}",
+    "button{display:block;width:100%;margin-top:18px;font:inherit;font-weight:600;padding:10px 16px;border:0;border-radius:8px;background:var(--primary);color:var(--primary-foreground);cursor:pointer}",
+    "button:disabled{opacity:.6;cursor:progress}",
+    ".lock-status{margin:10px 0 0;min-height:1.5em;font-size:14px;color:var(--error)}",
+    ".lock-note{margin:14px 0 0;font-size:14px;color:var(--muted-foreground);max-width:34ch}",
+    ".lock-shake{animation:lock-shake .3s ease-in-out}",
+    "@keyframes lock-in{from{opacity:0;transform:translateY(6px)}to{opacity:1;transform:none}}",
+    "@keyframes lock-shake{20%,60%{transform:translateX(-5px)}40%,80%{transform:translateX(5px)}}",
+    "@media (max-width:400px){.lock{padding:24px}}",
+    "@media (prefers-reduced-motion:reduce){.lock,.lock-shake{animation:none}}"
+  ].join("\n");
+}
+function inlineScript(code) {
+  return code.replace(/<\/(script)/gi, "<\\/$1");
+}
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+
+// src/node/auth/theme.ts
+import { readFileSync as readFileSync3 } from "fs";
+import { createRequire } from "module";
+import { dirname as dirname3, join as join6 } from "path";
+var TOKENS = [
+  "background",
+  "foreground",
+  "muted-foreground",
+  "card",
+  "border",
+  "primary",
+  "primary-foreground",
+  "ring",
+  "error"
+];
+var FALLBACK = {
+  background: "hsl(0, 0%, 96%)",
+  foreground: "hsl(0, 0%, 3.9%)",
+  "muted-foreground": "hsl(0, 0%, 45.1%)",
+  card: "hsl(0, 0%, 94.7%)",
+  border: "hsla(0, 0%, 80%, 50%)",
+  primary: "hsl(0, 0%, 9%)",
+  "primary-foreground": "hsl(0, 0%, 98%)",
+  ring: "hsl(0, 0%, 63.9%)",
+  error: "oklch(63.7% 0.237 25.331)"
+};
+var require_ = createRequire(import.meta.url);
+function shellColours(theme) {
+  const light = {};
+  const dark = {};
+  let dir;
+  try {
+    dir = join6(dirname3(require_.resolve("fumadocs-ui/package.json")), "css");
+  } catch {
+    dir = void 0;
+  }
+  for (const file of dir === void 0 ? [] : [join6(dir, "lib", "default-colors.css"), join6(dir, `${theme}.css`)]) {
+    let css;
+    try {
+      css = readFileSync3(file, "utf8").replace(/\/\*[\s\S]*?\*\//g, "");
+    } catch {
+      continue;
+    }
+    for (const [, prelude = "", block = ""] of css.matchAll(/([^{}]+)\{([^{}]*)\}/g)) {
+      const selectors = (prelude.split(";").pop() ?? "").split(",").map((selector) => selector.trim());
+      const targets = [];
+      if (selectors.some((selector) => selector.startsWith("@theme") || selector === ":root")) targets.push(light);
+      if (selectors.includes(".dark")) targets.push(dark);
+      for (const [, name = "", value = ""] of block.matchAll(/--color-fd-([\w-]+)\s*:\s*([^;]+);/g)) {
+        if (value.includes("var(")) continue;
+        for (const target of targets) target[name] = value.trim();
+      }
+    }
+  }
+  const pick = (tokens, fallback) => Object.fromEntries(TOKENS.map((token) => [token, tokens[token] ?? fallback[token] ?? FALLBACK[token]]));
+  return { light: pick(light, {}), dark: pick(dark, light) };
+}
+
+// src/node/auth/build.ts
+async function sealSite(ctx, outDir, template, password) {
+  const { config } = ctx;
+  const auth = config.auth;
+  if (auth === void 0) throw new Error("seemore: sealSite needs `auth` in the config.");
+  writeHtml(outDir, APP_FILE, applyTemplate(template, { html: "", head: appHead(config, template) }));
+  const shell = renderLockShell({
+    title: config.title,
+    description: config.description,
+    base: config.base,
+    favicon: faviconHref(config, template),
+    colours: shellColours(config.theme),
+    script: await bundleAuthScript("lock")
+  });
+  writeHtml(outDir, "index.html", shell);
+  writeHtml(outDir, "404.html", shell);
+  writeDeployArtifacts(outDir, config.base, shell, { auth: true });
+  const { manifest, contentKey } = await createManifest({ password, id: auth.id, remember: auth.remember });
+  writeFileSync4(join7(outDir, MANIFEST_FILE), `${JSON.stringify(manifest, null, 2)}
+`, "utf8");
+  const open = publicFiles(config.favicon);
+  writeFileSync4(
+    join7(outDir, WORKER_FILE),
+    `var SEEMORE_AUTH=${JSON.stringify({ publicFiles: open })};
+${await bundleAuthScript("sw")}`,
+    "utf8"
+  );
+  const encrypted = await encryptOutput(outDir, contentKey, open);
+  assertOutputEncrypted(outDir, open);
+  return encrypted;
+}
+function faviconHref(config, template) {
+  if (config.favicon !== void 0) return withBase(config.base, `/${toPosix(config.favicon)}`);
+  return /<link rel="icon" href="(data:[^"]+)"/.exec(template)?.[1];
+}
+function appHead(config, template) {
+  const tags = [`<title>${escapeHtml(config.title)}</title>`, '<meta name="robots" content="noindex, nofollow" />'];
+  if (config.description !== void 0) {
+    tags.push(`<meta name="description" content="${escapeHtml(config.description)}" />`);
+  }
+  const favicon = faviconHref(config, template);
+  if (config.favicon !== void 0 && favicon !== void 0) tags.push(`<link rel="icon" href="${escapeHtml(favicon)}" />`);
+  return tags.join("\n    ");
+}
+
+// src/node/auth/password.ts
+var PASSWORD_ENV = "SEEMORE_PASSWORD";
+function readPassword(command, env = process.env) {
+  const raw = env[PASSWORD_ENV];
+  if (raw === void 0 || raw === "") {
+    throw new Error(
+      `\`auth\` is on, but ${PASSWORD_ENV} is not set. Pass the password through the environment \u2014 in CI, from a secret:
+
+  ${PASSWORD_ENV}='a-long-passphrase' ${command}
+
+Never put it in seemore.config.ts.`
+    );
+  }
+  return normalisePassword(raw);
+}
+
+// src/node/config/load.ts
+import { existsSync as existsSync2 } from "fs";
+import { dirname as dirname4, isAbsolute, resolve as resolve2 } from "path";
+import { createJiti } from "jiti";
+import "zod";
+
 // src/shared/types.ts
 var FEATURES = [
   "navigation.instant.prefetch",
@@ -251,6 +715,14 @@ var searchSchema = z.union([
   })
 ]);
 var pageActionsSchema = z.array(z.enum(ACTION_IDS)).default(["copy-markdown", "export-html"]);
+var REMEMBER_FORMS = "expected a number of hours or days, like '12h' or '7d'.";
+var authSchema = z.preprocess(
+  (input) => input === true ? {} : input === false ? void 0 : input,
+  z.strictObject({
+    id: z.string().trim().min(1, { error: "must not be empty. Leave `id` out to use the site title, or give the site a stable name." }).optional(),
+    remember: z.string({ error: REMEMBER_FORMS }).regex(/^[1-9]\d*[hd]$/, { error: REMEMBER_FORMS }).optional()
+  }).optional()
+);
 var configSchema = z.object({
   /**
    * Optional here, but required whenever a config file exists — load.ts enforces that,
@@ -277,7 +749,8 @@ var configSchema = z.object({
   }).optional(),
   search: searchSchema.default("static"),
   pageActions: pageActionsSchema,
-  exclude: z.array(z.string()).default([])
+  exclude: z.array(z.string()).default([]),
+  auth: authSchema
 });
 
 // src/node/config/load.ts
@@ -289,9 +762,11 @@ function resolveConfig(input, options) {
     // Nothing to link to without an edit base, so the flag follows the option.
     "content.action.edit": parsed.editLink !== void 0
   });
+  const title = parsed.title ?? "Docs";
+  const auth = parsed.auth === void 0 ? void 0 : { id: parsed.auth.id ?? title, remember: rememberSeconds(parsed.auth.remember) };
+  if (auth !== void 0) assertAuthCompatible(features, search);
   return {
-    // Only reached without a config file (see parseOrThrow): 'Docs' is the best name we can know.
-    title: parsed.title ?? "Docs",
+    title,
     description: parsed.description,
     favicon: parsed.favicon,
     base: normaliseBase(parsed.base),
@@ -304,10 +779,32 @@ function resolveConfig(input, options) {
     search,
     pageActions: parsed.pageActions,
     exclude: parsed.exclude,
+    auth,
     root: options.root,
     configFile: options.configFile
   };
 }
+var DAY_SECONDS = 86400;
+function rememberSeconds(remember) {
+  if (remember === void 0) return DAY_SECONDS;
+  const amount = Number(remember.slice(0, -1));
+  return remember.endsWith("h") ? amount * 3600 : amount * DAY_SECONDS;
+}
+function assertAuthCompatible(features, search) {
+  const problems = [];
+  if (features["social.cards"]) {
+    problems.push("`auth` cannot be combined with `social.cards`: the cards would publish page titles as public images. Remove one of them.");
+  }
+  if (search.provider !== "static") {
+    problems.push(
+      `\`auth\` cannot be combined with \`search.provider: '${search.provider}'\`: the search index would go to a third party in plaintext. Use \`search: 'static'\`, or remove \`auth\`.`
+    );
+  }
+  if (problems.length > 0) {
+    throw new Error(`Incompatible options in seemore config:
+${problems.map((problem) => `  - ${problem}`).join("\n")}`);
+  }
+}
 async function loadConfig(options) {
   const file = findConfigFile(options);
   if (file === void 0) {
@@ -327,21 +824,21 @@ ${error instanceof Error ? error.message : String(error)}`, {
     throw new Error(`${file} must export a config object as its default export, got ${typeof loaded}.`);
   }
   return {
-    config: resolveConfig(loaded, { root: dirname(file), configFile: file }),
+    config: resolveConfig(loaded, { root: dirname4(file), configFile: file }),
     file
   };
 }
 function findConfigFile({ root, configPath }) {
   if (configPath !== void 0) {
     const absolute = resolveFrom(root, configPath);
-    if (!existsSync(absolute)) {
+    if (!existsSync2(absolute)) {
       throw new Error(`Config file not found: ${absolute}`);
     }
     return absolute;
   }
   for (const name of CONFIG_NAMES) {
-    const candidate = resolve(root, name);
-    if (existsSync(candidate)) return candidate;
+    const candidate = resolve2(root, name);
+    if (existsSync2(candidate)) return candidate;
   }
   return void 0;
 }
@@ -349,7 +846,7 @@ function resolveConfigPath(options) {
   return options.configPath === void 0 ? void 0 : resolveFrom(options.cwd, options.configPath);
 }
 function resolveFrom(root, path) {
-  return isAbsolute(path) ? path : resolve(root, path);
+  return isAbsolute(path) ? path : resolve2(root, path);
 }
 function parseOrThrow(input, file) {
   const result = configSchema.safeParse(input);
@@ -383,73 +880,6 @@ function explain(issue) {
 
 // src/node/content/links.ts
 import { slug as slugify2 } from "github-slugger";
-
-// src/node/content/slug.ts
-import { slug as slugify } from "github-slugger";
-var INDEX_NAMES = /* @__PURE__ */ new Set(["index", "readme"]);
-var CONTENT_EXT = /\.mdx?$/i;
-function toPosix(file) {
-  return file.replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+/, "");
-}
-function slugifySegment(segment) {
-  const slugged = slugify(segment);
-  if (slugged !== "") return slugged;
-  const fallback = segment.toLowerCase().replace(/[^\p{L}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "");
-  return fallback === "" ? "untitled" : fallback;
-}
-function toRoute(file) {
-  const posix = toPosix(file);
-  const segments = posix.split("/");
-  const basename3 = segments.pop() ?? "";
-  const stem = basename3.replace(CONTENT_EXT, "");
-  const isIndex = INDEX_NAMES.has(stem.toLowerCase());
-  const slugs = segments.map(slugifySegment);
-  if (!isIndex) slugs.push(slugifySegment(stem));
-  return {
-    file: posix,
-    url: slugs.length === 0 ? "/" : `/${slugs.join("/")}`,
-    slugs,
-    output: [...slugs, "index.html"].join("/"),
-    isIndex
-  };
-}
-function resolveRoutes(files) {
-  const sorted = [...files].map(toPosix).sort();
-  const byUrl = /* @__PURE__ */ new Map();
-  const warnings = [];
-  const errors = [];
-  for (const file of sorted) {
-    const route = toRoute(file);
-    const bucket = byUrl.get(route.url);
-    if (bucket) bucket.push(route);
-    else byUrl.set(route.url, [route]);
-  }
-  const routes = [];
-  for (const [url, candidates] of [...byUrl.entries()].sort(([a], [b]) => a < b ? -1 : 1)) {
-    if (candidates.length === 1) {
-      routes.push(candidates[0]);
-      continue;
-    }
-    const indexes = candidates.filter((c) => c.isIndex);
-    if (indexes.length === candidates.length) {
-      const winner = indexes.find((c) => c.file.split("/").pop()?.toLowerCase().startsWith("index")) ?? indexes[0];
-      const losers = indexes.filter((c) => c !== winner);
-      warnings.push(
-        `${url} has more than one index file: using ${winner.file}, ignoring ${losers.map((l) => l.file).join(", ")}.`
-      );
-      routes.push(winner);
-      continue;
-    }
-    errors.push(
-      `Duplicate route ${url} produced by ${candidates.length} files:
-` + candidates.map((c) => `  - ${c.file}`).join("\n") + `
-Rename one of them, or exclude it with \`exclude\` in seemore.config.ts.`
-    );
-  }
-  return { routes, errors, warnings };
-}
-
-// src/node/content/links.ts
 var CONTENT_EXT2 = /\.mdx?$/i;
 function createLinkResolver(pages, base) {
   const byPath = /* @__PURE__ */ new Map();
@@ -543,9 +973,9 @@ import { dynamicLoader } from "fumadocs-core/source";
 import { lucideIconsPlugin } from "fumadocs-core/source/plugins/lucide-icons";
 
 // src/node/content/scan.ts
-import { readFileSync } from "fs";
-import { createHash } from "crypto";
-import { basename, dirname as dirname2, join, resolve as resolve2 } from "path";
+import { readFileSync as readFileSync4 } from "fs";
+import { createHash as createHash2 } from "crypto";
+import { basename, dirname as dirname5, join as join8, resolve as resolve3 } from "path";
 import { globSync } from "tinyglobby";
 import { z as z4 } from "zod";
 
@@ -615,7 +1045,7 @@ var metaSchema = z4.object({
   description: z4.string().optional()
 }).loose();
 function scan(options) {
-  const contentRoot = resolve2(options.contentRoot);
+  const contentRoot = resolve3(options.contentRoot);
   const ignore = [...DEFAULT_EXCLUDES, ...options.exclude ?? []];
   const contentFiles = globSync(["**/*.md", "**/*.mdx"], {
     cwd: contentRoot,
@@ -627,13 +1057,13 @@ function scan(options) {
   const { routes, errors, warnings } = resolveRoutes(contentFiles);
   const pages = [];
   for (const route of routes) {
-    const absPath = join(contentRoot, route.file);
+    const absPath = join8(contentRoot, route.file);
     let data;
     let version;
     try {
-      const text = readFileSync(absPath, "utf8");
+      const text = readFileSync4(absPath, "utf8");
       data = parseFrontmatter(text, route.file).data;
-      version = createHash("sha256").update(text).digest("hex").slice(0, 12);
+      version = createHash2("sha256").update(text).digest("hex").slice(0, 12);
     } catch (error) {
       errors.push(error instanceof Error ? error.message : String(error));
       continue;
@@ -651,9 +1081,9 @@ function scan(options) {
   }));
   const metaDirs = /* @__PURE__ */ new Set();
   for (const file of metaFiles) {
-    const absPath = join(contentRoot, file);
+    const absPath = join8(contentRoot, file);
     try {
-      const parsed = metaSchema.safeParse(JSON.parse(readFileSync(absPath, "utf8")));
+      const parsed = metaSchema.safeParse(JSON.parse(readFileSync4(absPath, "utf8")));
       if (!parsed.success) {
         errors.push(
           `Invalid ${file}:
@@ -661,7 +1091,7 @@ ${parsed.error.issues.map((i) => `  - ${i.path.join(".") || "(root)"}: ${i.messa
         );
         continue;
       }
-      metaDirs.add(dirname2(file));
+      metaDirs.add(dirname5(file));
       files.push({ type: "meta", path: file, absolutePath: absPath, data: parsed.data });
     } catch (error) {
       errors.push(`Invalid ${file}: ${error instanceof Error ? error.message : String(error)}`);
@@ -673,7 +1103,7 @@ ${parsed.error.issues.map((i) => `  - ${i.path.join(".") || "(root)"}: ${i.messa
 function synthesiseOrderMeta(pages, metaDirs) {
   const byDir = /* @__PURE__ */ new Map();
   for (const page of pages) {
-    const dir = dirname2(page.file);
+    const dir = dirname5(page.file);
     const bucket = byDir.get(dir);
     if (bucket) bucket.push(page);
     else byDir.set(dir, [page]);
@@ -795,43 +1225,16 @@ function createContext(options) {
 // src/cli/build.ts
 init_paths();
 
-// src/node/prerender/emit.ts
-import { mkdirSync, writeFileSync } from "fs";
-import { dirname as dirname4, join as join3 } from "path";
-function outputPathFor(url) {
-  const clean = url.replace(/^\/+|\/+$/g, "");
-  return clean === "" ? "index.html" : join3(clean, "index.html");
-}
-function writeHtml(outDir, relativePath, html) {
-  const target = join3(outDir, relativePath);
-  mkdirSync(dirname4(target), { recursive: true });
-  writeFileSync(target, html, "utf8");
-}
-function applyTemplate(template, { html, head }) {
-  return template.replace("<!--seemore-head-->", () => head).replace("<!--seemore-app-->", () => html);
-}
-
-// src/node/prerender/deploy.ts
-import { writeFileSync as writeFileSync2 } from "fs";
-import { join as join4 } from "path";
-function writeDeployArtifacts(outDir, base, shell) {
-  const prefix = base === "/" ? "" : base.replace(/\/+$/, "");
-  writeFileSync2(join4(outDir, "_redirects"), `${prefix}/*    ${prefix}/index.html    200
-`, "utf8");
-  writeFileSync2(join4(outDir, "200.html"), shell, "utf8");
-  writeFileSync2(join4(outDir, ".nojekyll"), "", "utf8");
-}
-
 // src/node/prerender/render.ts
 import { pathToFileURL } from "url";
-import { join as join6 } from "path";
-import { build } from "vite";
+import { join as join10 } from "path";
+import { build as build2 } from "vite";
 
 // src/node/vite/config.ts
 init_paths();
 import { realpathSync as realpathSync2 } from "fs";
-import { createRequire as createRequire2 } from "module";
-import { join as join5 } from "path";
+import { createRequire as createRequire3 } from "module";
+import { join as join9 } from "path";
 import react from "@vitejs/plugin-react";
 import tailwindcss from "@tailwindcss/vite";
 import mdx from "@mdx-js/rollup";
@@ -853,7 +1256,7 @@ import {
 
 // src/node/vite/remark.ts
 import { existsSync as existsSync3 } from "fs";
-import { dirname as dirname5, relative, resolve as resolve4 } from "path";
+import { dirname as dirname6, relative, resolve as resolve4 } from "path";
 import { visit } from "unist-util-visit";
 var WIKILINK = /\[\[([^\]\n]+)\]\]/g;
 var ALERTS = {
@@ -956,7 +1359,7 @@ function remarkSeemoreD2() {
 function remarkSeemoreAssets(options) {
   return (tree, file) => {
     if (typeof file.path !== "string" || file.path === "") return;
-    const dir = dirname5(file.path);
+    const dir = dirname6(file.path);
     const from = virtualPath(options.contentRoot, file);
     visit(tree, "image", (node, index, parent) => {
       if (parent === void 0 || index === void 0) return;
@@ -1093,12 +1496,12 @@ function createRehypePlugins(options = {}) {
 }
 
 // src/node/vite/plugin.ts
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
-import { createRequire } from "module";
-import { dirname as dirname6 } from "path";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+import { createRequire as createRequire2 } from "module";
+import { dirname as dirname7 } from "path";
 
 // src/node/search/build.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync5 } from "fs";
 import { gzipSync } from "zlib";
 import { createFromSource } from "fumadocs-core/search/server";
 import { structure } from "fumadocs-core/mdx-plugins";
@@ -1114,7 +1517,7 @@ async function buildSearchIndex(ctx) {
   const bodies = /* @__PURE__ */ new Map();
   for (const page of ctx.pages()) {
     try {
-      bodies.set(page.url, parseFrontmatter(readFileSync3(page.absPath, "utf8"), page.file).content);
+      bodies.set(page.url, parseFrontmatter(readFileSync5(page.absPath, "utf8"), page.file).content);
     } catch {
     }
   }
@@ -1187,11 +1590,11 @@ var PAGE_PREFIX = "seemore-page:";
 var resolvedId = (id) => `\0${id}`;
 var IMPORTS_MARKER = /\/\* seemore:imports[\s\S]*?\*\//;
 var USER_CSS_MARKER = /\/\* seemore:user-css[\s\S]*?\*\//;
-var require_ = createRequire(import.meta.url);
+var require_2 = createRequire2(import.meta.url);
 function styleImports(ctx) {
   const lines = [`@import 'fumadocs-ui/css/${ctx.config.theme}.css';`];
   try {
-    lines.push(`@source '${dirname6(require_.resolve("fumadocs-ui/package.json"))}/dist';`);
+    lines.push(`@source '${dirname7(require_2.resolve("fumadocs-ui/package.json"))}/dist';`);
   } catch {
   }
   return lines.join("\n");
@@ -1322,7 +1725,7 @@ function handleSourceRead(ctx, req, res) {
   if (page === void 0) return send(res, 404, { error: "That file is not part of this site." });
   const start = Number(query.get("start"));
   const end = Number(query.get("end"));
-  const content = readFileSync4(page.absPath, "utf8");
+  const content = readFileSync6(page.absPath, "utf8");
   if (!Number.isInteger(start) || !Number.isInteger(end) || start < 0 || end < start || end > content.length) {
     return send(res, 400, { error: "The requested range is not inside this file." });
   }
@@ -1340,7 +1743,7 @@ async function handleSourceWrite(ctx, req, res) {
   if (typeof body.expected !== "string" || typeof body.text !== "string") {
     return send(res, 400, { error: "Both `expected` and `text` are required." });
   }
-  const content = readFileSync4(page.absPath, "utf8");
+  const content = readFileSync6(page.absPath, "utf8");
   const result = spliceSource(content, {
     start: body.start,
     end: body.end,
@@ -1348,7 +1751,7 @@ async function handleSourceWrite(ctx, req, res) {
     text: body.text
   });
   if (!result.ok) return send(res, result.status, { error: result.error });
-  writeFileSync3(page.absPath, result.content, "utf8");
+  writeFileSync5(page.absPath, result.content, "utf8");
   return send(res, 200, { ok: true });
 }
 function resolvePage(ctx, file) {
@@ -1431,7 +1834,7 @@ function json(value) {
 }
 function readIfExists(path) {
   try {
-    return readFileSync4(path, "utf8");
+    return readFileSync6(path, "utf8");
   } catch {
     return void 0;
   }
@@ -1514,12 +1917,17 @@ async function reloadById(server, id) {
 }
 
 // src/node/vite/config.ts
-var require_2 = createRequire2(import.meta.url);
+var require_3 = createRequire3(import.meta.url);
 function d2BrowserEntry() {
-  const entry = require_2.resolve("@terrastruct/d2");
-  return join5(packageDirOf("@terrastruct/d2", entry), "dist", "browser", "index.js");
+  const entry = require_3.resolve("@terrastruct/d2");
+  return join9(packageDirOf("@terrastruct/d2", entry), "dist", "browser", "index.js");
 }
-function createViteConfig({ ctx, mode, outDir, ssrOutDir }) {
+var HASHED_NAMES = {
+  entryFileNames: "assets/[hash].js",
+  chunkFileNames: "assets/[hash].js",
+  assetFileNames: "assets/[hash][extname]"
+};
+function createViteConfig({ ctx, mode, outDir, ssrOutDir, auth = false }) {
   const root = appRoot();
   const isSsr = ssrOutDir !== void 0;
   const mdxOptions = {
@@ -1557,11 +1965,17 @@ function createViteConfig({ ctx, mode, outDir, ssrOutDir }) {
       tailwindcss(),
       ...mode === "dev" ? [seemoreWatcherPlugin(ctx)] : []
     ],
+    // A compile-time constant rather than a field of `virtual:seemore/config`, which carries
+    // nothing about protection. Defined either way, so an unprotected bundle drops the auth code.
+    define: { "import.meta.env.SEEMORE_AUTH": JSON.stringify(auth) },
     // Vite bundles workers with the browser export condition, but a worker has no `document`.
     // `decode-named-character-reference` — pulled in through fumadocs' search client, via
     // remark — calls `document.createElement` at module scope in its browser build, so the
     // search worker threw on load. The package ships a DOM-free `worker` entry; use it.
-    worker: { plugins: () => [workerConditionPlugin()] },
+    worker: {
+      plugins: () => [workerConditionPlugin()],
+      rollupOptions: auth ? { output: HASHED_NAMES } : void 0
+    },
     resolve: {
       // The app is compiled from seemore's own sources, so its dependencies must resolve
       // from seemore's directory rather than from the user's project.
@@ -1596,7 +2010,7 @@ function createViteConfig({ ctx, mode, outDir, ssrOutDir }) {
       }
     },
     build: isSsr ? {
-      ssr: join5(root, "entry.prerender.tsx"),
+      ssr: join9(root, "entry.prerender.tsx"),
       outDir: ssrOutDir,
       emptyOutDir: true,
       copyPublicDir: false,
@@ -1605,7 +2019,7 @@ function createViteConfig({ ctx, mode, outDir, ssrOutDir }) {
     } : {
       outDir,
       emptyOutDir: true,
-      rollupOptions: { input: join5(root, "index.html") },
+      rollupOptions: { input: join9(root, "index.html"), output: auth ? HASHED_NAMES : void 0 },
       // The app bundle is seemore's own, not the user's; warning them about a size they
       // cannot act on is noise.
       chunkSizeWarningLimit: 2e3
@@ -1656,8 +2070,8 @@ var WORKER_SAFE_ENTRIES = /* @__PURE__ */ new Set(["decode-named-character-refer
 
 // src/node/prerender/render.ts
 async function loadPrerenderModule(ctx, ssrOutDir) {
-  await build(createViteConfig({ ctx, mode: "build", ssrOutDir }));
-  const entry = join6(ssrOutDir, "entry.prerender.js");
+  await build2(createViteConfig({ ctx, mode: "build", ssrOutDir }));
+  const entry = join10(ssrOutDir, "entry.prerender.js");
   const loaded = await import(pathToFileURL(entry).href);
   if (typeof loaded.render !== "function" || typeof loaded.renderArticle !== "function" || typeof loaded.listRoutes !== "function") {
     throw new Error(`seemore: the prerender build at ${entry} did not export \`render\`, \`renderArticle\` and \`listRoutes\`.`);
@@ -1666,8 +2080,8 @@ async function loadPrerenderModule(ctx, ssrOutDir) {
 }
 
 // src/node/social/cards.ts
-import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname7, join as join7 } from "path";
+import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname8, join as join11 } from "path";
 
 // src/shared/og.ts
 function ogImagePath(url) {
@@ -1690,9 +2104,9 @@ async function generateSocialCards(ctx, outDir) {
   for (const page of ctx.pages()) {
     const png = await renderCard(takumi, ctx.config.title, page.data.title, page.data.description);
     if (png === void 0) continue;
-    const target = join7(outDir, ogImagePath(page.url));
-    mkdirSync2(dirname7(target), { recursive: true });
-    writeFileSync4(target, png);
+    const target = join11(outDir, ogImagePath(page.url));
+    mkdirSync2(dirname8(target), { recursive: true });
+    writeFileSync6(target, png);
     written++;
   }
   return written;
@@ -1734,6 +2148,7 @@ async function runBuild(options) {
   const ctx = createContext({ config, contentRoot });
   const outDir = resolve5(options.cwd, options.outDir ?? "dist");
   assertSafeOutDir(outDir, options.cwd, contentRoot);
+  const password = config.auth === void 0 ? void 0 : readPassword("npx seemore build");
   const scan2 = ctx.source.current();
   failOnErrors(ctx.errors(), contentRoot);
   if (scan2.pages.length === 0) {
@@ -1741,9 +2156,29 @@ async function runBuild(options) {
   }
   for (const warning of scan2.warnings) ctx.warnings.add(warning);
   console.log(pc2.dim(`seemore  ${scan2.pages.length} pages from ${relative2(options.cwd, contentRoot) || "."}`));
-  await viteBuild(createViteConfig({ ctx, mode: "build", outDir }));
-  const template = readFileSync5(join8(outDir, "index.html"), "utf8");
-  const ssrOutDir = mkdtempSync(join8(tmpdir2(), "seemore-ssr-"));
+  await viteBuild(createViteConfig({ ctx, mode: "build", outDir, auth: password !== void 0 }));
+  const template = readFileSync7(join12(outDir, "index.html"), "utf8");
+  const routes = password === void 0 ? await prerenderPages(ctx, outDir, template) : countRoutes(ctx);
+  if (config.search.provider === "static") {
+    const index = await buildSearchIndex(ctx);
+    mkdirSync3(join12(outDir, "api"), { recursive: true });
+    writeFileSync7(join12(outDir, "api", "search.json"), index, "utf8");
+    const size = measureIndex(index);
+    console.log(pc2.dim(`seemore  search index ${formatBytes(size.gzipped)} gzipped`));
+    if (size.warning !== void 0) ctx.warnings.add(size.warning);
+  }
+  if (config.search.provider !== "static") await warnIfSearchSdkMissing(ctx, config.search.provider);
+  if (config.features["social.cards"]) await generateSocialCards(ctx, outDir);
+  if (password !== void 0) {
+    const encrypted = await sealSite(ctx, outDir, template, password);
+    console.log(pc2.dim(`seemore  ${encrypted} files encrypted; visitors unlock them with the password`));
+  }
+  ctx.warnings.flush();
+  console.log(pc2.green(`seemore  ${routes} pages written to ${relative2(options.cwd, outDir) || outDir}`));
+  return { outDir, routes };
+}
+async function prerenderPages(ctx, outDir, template) {
+  const ssrOutDir = mkdtempSync(join12(tmpdir3(), "seemore-ssr-"));
   try {
     const prerender = await loadPrerenderModule(ctx, ssrOutDir);
     const urls = prerender.listRoutes();
@@ -1756,24 +2191,16 @@ async function runBuild(options) {
     }
     const notFound = applyTemplate(template, await prerender.render("/__seemore_not_found"));
     writeHtml(outDir, "404.html", notFound);
-    writeDeployArtifacts(outDir, config.base, notFound);
-    if (config.search.provider === "static") {
-      const index = await buildSearchIndex(ctx);
-      mkdirSync3(join8(outDir, "api"), { recursive: true });
-      writeFileSync5(join8(outDir, "api", "search.json"), index, "utf8");
-      const size = measureIndex(index);
-      console.log(pc2.dim(`seemore  search index ${formatBytes(size.gzipped)} gzipped`));
-      if (size.warning !== void 0) ctx.warnings.add(size.warning);
-    }
-    if (config.search.provider !== "static") await warnIfSearchSdkMissing(ctx, config.search.provider);
-    if (config.features["social.cards"]) await generateSocialCards(ctx, outDir);
-    ctx.warnings.flush();
-    console.log(pc2.green(`seemore  ${routes.length} pages written to ${relative2(options.cwd, outDir) || outDir}`));
-    return { outDir, routes: routes.length };
+    writeDeployArtifacts(outDir, ctx.config.base, notFound);
+    return routes.length;
   } finally {
     rmSync(ssrOutDir, { recursive: true, force: true });
   }
 }
+function countRoutes(ctx) {
+  const pages = ctx.pages();
+  return pages.some((page) => page.url === "/") ? pages.length : pages.length + 1;
+}
 function assertSafeOutDir(outDir, cwd, contentRoot) {
   const contains = (parent, child) => {
     const rel = relative2(parent, child);
@@ -1793,7 +2220,7 @@ function assertSafeOutDir(outDir, cwd, contentRoot) {
 async function warnIfSearchSdkMissing(ctx, provider) {
   const packageName = provider === "algolia" ? "algoliasearch" : "@orama/core";
   try {
-    createRequire3(join8(ctx.config.root, "noop.js")).resolve(packageName);
+    createRequire4(join12(ctx.config.root, "noop.js")).resolve(packageName);
   } catch {
     ctx.warnings.add(
       `\`search.provider\` is '${provider}', which needs ${packageName}. Run \`npm install ${packageName}\` or search will find nothing.`
@@ -1839,6 +2266,9 @@ async function runDev(options) {
   if (scan2.pages.length === 0) {
     ctx.warnings.add(`No Markdown files found under ${contentRoot}. seemore will serve an empty site until there are.`);
   }
+  if (config.auth !== void 0 && options.json !== true) {
+    console.log(pc3.dim("seemore  auth is build-only; the dev server is not password-protected"));
+  }
   const base = createViteConfig({ ctx, mode: "dev" });
   const server = await createServer({
     ...base,
@@ -1873,9 +2303,9 @@ async function runDev(options) {
 }
 
 // src/cli/export.ts
-import { existsSync as existsSync4, mkdtempSync as mkdtempSync2, readFileSync as readFileSync6, readdirSync, rmSync as rmSync2, statSync, writeFileSync as writeFileSync6, mkdirSync as mkdirSync4 } from "fs";
-import { basename as basename2, dirname as dirname8, extname, join as join9, relative as relative3, resolve as resolve6 } from "path";
-import { tmpdir as tmpdir3 } from "os";
+import { existsSync as existsSync4, mkdtempSync as mkdtempSync2, readFileSync as readFileSync8, readdirSync as readdirSync2, rmSync as rmSync2, statSync, writeFileSync as writeFileSync8, mkdirSync as mkdirSync4 } from "fs";
+import { basename as basename2, dirname as dirname9, extname, join as join13, relative as relative3, resolve as resolve6 } from "path";
+import { tmpdir as tmpdir4 } from "os";
 import pc4 from "picocolors";
 import { build as viteBuild2 } from "vite";
 init_paths();
@@ -1913,7 +2343,7 @@ async function runExport(options) {
   if (!existsSync4(target) || !statSync(target).isFile()) {
     throw new Error(`No such file: ${options.file}`);
   }
-  const contentRoot = resolveContentRoot(options.cwd, dirname8(target));
+  const contentRoot = resolveContentRoot(options.cwd, dirname9(target));
   const loaded = await loadConfig({ root: contentRoot, configPath: resolveConfigPath(options) });
   const config = {
     ...loaded.config,
@@ -1935,23 +2365,23 @@ ${errors.join("\n\n")}`);
   if (page === void 0) {
     throw new Error(`${options.file} is not part of this site \u2014 excluded in the config, or outside ${relative3(options.cwd, contentRoot) || "."}.`);
   }
-  const outDir = mkdtempSync2(join9(tmpdir3(), "seemore-export-"));
-  const ssrOutDir = mkdtempSync2(join9(tmpdir3(), "seemore-export-ssr-"));
+  const outDir = mkdtempSync2(join13(tmpdir4(), "seemore-export-"));
+  const ssrOutDir = mkdtempSync2(join13(tmpdir4(), "seemore-export-ssr-"));
   try {
     await viteBuild2(createViteConfig({ ctx, mode: "build", outDir }));
     const css = readBuiltCss(outDir);
-    const template = readFileSync6(join9(outDir, "index.html"), "utf8");
+    const template = readFileSync8(join13(outDir, "index.html"), "utf8");
     const prerender = await loadPrerenderModule(ctx, ssrOutDir);
     const article = await prerender.renderArticle(page.url);
     const runtime = await bundleRuntime();
     const html = assemble({ article, css, runtime, config, outDir, contentRoot, template });
     const filename = `${basename2(target).replace(/\.(?:md|mdx)$/i, "")}.html`;
-    const targetPath = options.out === void 0 ? join9(dirname8(target), filename) : join9(resolve6(options.cwd, options.out), filename);
+    const targetPath = options.out === void 0 ? join13(dirname9(target), filename) : join13(resolve6(options.cwd, options.out), filename);
     if (existsSync4(targetPath)) {
       console.log(pc4.yellow(`seemore  replacing existing ${relative3(options.cwd, targetPath) || targetPath}`));
     }
-    mkdirSync4(dirname8(targetPath), { recursive: true });
-    writeFileSync6(targetPath, html, "utf8");
+    mkdirSync4(dirname9(targetPath), { recursive: true });
+    writeFileSync8(targetPath, html, "utf8");
     ctx.warnings.flush();
     console.log(pc4.green(`seemore  wrote ${relative3(options.cwd, targetPath) || targetPath} (${formatBytes2(html.length)})`));
   } finally {
@@ -1960,13 +2390,13 @@ ${errors.join("\n\n")}`);
   }
 }
 function readBuiltCss(outDir) {
-  const assets = join9(outDir, "assets");
-  const files = existsSync4(assets) ? readdirSync(assets).filter((file) => file.endsWith(".css")) : [];
+  const assets = join13(outDir, "assets");
+  const files = existsSync4(assets) ? readdirSync2(assets).filter((file) => file.endsWith(".css")) : [];
   if (files.length === 0) throw new Error("The build produced no stylesheet \u2014 the export would be unstyled.");
-  return files.map((file) => readFileSync6(join9(assets, file), "utf8")).join("\n");
+  return files.map((file) => readFileSync8(join13(assets, file), "utf8")).join("\n");
 }
 async function bundleRuntime() {
-  const dir = mkdtempSync2(join9(tmpdir3(), "seemore-export-runtime-"));
+  const dir = mkdtempSync2(join13(tmpdir4(), "seemore-export-runtime-"));
   try {
     await viteBuild2({
       configFile: false,
@@ -1977,14 +2407,14 @@ async function bundleRuntime() {
         minify: true,
         target: "es2018",
         lib: {
-          entry: join9(appRoot(), "export", "standalone.ts"),
+          entry: join13(appRoot(), "export", "standalone.ts"),
           name: "seemoreExport",
           formats: ["iife"],
           fileName: () => "runtime.js"
         }
       }
     });
-    return readFileSync6(join9(dir, "runtime.js"), "utf8");
+    return readFileSync8(join13(dir, "runtime.js"), "utf8");
   } finally {
     rmSync2(dir, { recursive: true, force: true });
   }
@@ -2001,8 +2431,8 @@ function assemble(input) {
     "<head>",
     '<meta charset="utf-8">',
     '<meta name="viewport" content="width=device-width, initial-scale=1">',
-    `<title>${escapeHtml(title)}</title>`,
-    description === void 0 ? "" : `<meta name="description" content="${escapeHtml(description)}">`,
+    `<title>${escapeHtml2(title)}</title>`,
+    description === void 0 ? "" : `<meta name="description" content="${escapeHtml2(description)}">`,
     '<meta name="generator" content="seemore">',
     THEME_INIT,
     favicon,
@@ -2051,7 +2481,7 @@ function resolveAsset(src, base, outDir, contentRoot) {
   if (base !== "/" && path.startsWith(base)) path = path.slice(base.length - 1);
   const suffix = path.replace(/^\/+/, "");
   for (const root of [outDir, contentRoot]) {
-    const candidate = join9(root, suffix);
+    const candidate = join13(root, suffix);
     if (existsSync4(candidate) && statSync(candidate).isFile()) return candidate;
   }
   return void 0;
@@ -2075,11 +2505,11 @@ var MIME = {
 };
 function dataUriFor(file) {
   const mime = MIME[extname(file).toLowerCase()] ?? "application/octet-stream";
-  return `data:${mime};base64,${readFileSync6(file).toString("base64")}`;
+  return `data:${mime};base64,${readFileSync8(file).toString("base64")}`;
 }
 function faviconLink(config, contentRoot, template) {
   if (config.favicon !== void 0) {
-    const file = join9(contentRoot, config.favicon);
+    const file = join13(contentRoot, config.favicon);
     if (existsSync4(file)) {
       try {
         return `<link rel="icon" href="${dataUriFor(file)}" />`;
@@ -2108,9 +2538,9 @@ function withExportToc(html) {
     }
   }
   const items = sections.map((section) => {
-    const self = `<a href="#${section.id}">${escapeHtml(section.text)}</a>`;
+    const self = `<a href="#${section.id}">${escapeHtml2(section.text)}</a>`;
     if (section.children.length === 0) return `<li>${self}</li>`;
-    const kids = section.children.map((child) => `<li><a href="#${child.id}">${escapeHtml(child.text)}</a></li>`).join("");
+    const kids = section.children.map((child) => `<li><a href="#${child.id}">${escapeHtml2(child.text)}</a></li>`).join("");
     return `<li>${self}<ul>${kids}</ul></li>`;
   }).join("");
   const toc = `<nav class="seemore-export-toc"><details><summary>On this page</summary><ul>${items}</ul></details></nav>`;
@@ -2120,7 +2550,7 @@ function withExportToc(html) {
 function decodeEntities(text) {
   return text.replaceAll("&amp;", "&").replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&quot;", '"').replaceAll("&#39;", "'");
 }
-function escapeHtml(value) {
+function escapeHtml2(value) {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 }
 function formatBytes2(size) {
@@ -2177,10 +2607,10 @@ async function main(argv = process.argv.slice(2)) {
     return;
   }
   if (values.version === true) {
-    const { readFileSync: readFileSync7 } = await import("fs");
-    const { join: join10 } = await import("path");
+    const { readFileSync: readFileSync9 } = await import("fs");
+    const { join: join14 } = await import("path");
     const { packageRoot: packageRoot2 } = await Promise.resolve().then(() => (init_paths(), paths_exports));
-    const pkg = JSON.parse(readFileSync7(join10(packageRoot2(), "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync9(join14(packageRoot2(), "package.json"), "utf8"));
     console.log(pkg.version);
     return;
   }