tempest-react-sdk 0.77.0 → 0.79.0

package/dist/vision/use-live-luminance.js.map

@@ -1 +1 @@
-{"version":3,"file":"use-live-luminance.js","names":[],"sources":["../../src/vision/use-live-luminance.ts"],"sourcesContent":["import { useEffect, useRef, useState, type RefObject } from \"react\";\nimport { computeImageLuminance } from \"./luminance\";\n\n/** Options for {@link useLiveLuminance}. */\nexport interface UseLiveLuminanceOptions {\n    /** When `false` the loop is paused (e.g. while a capture is in flight). Default: `true`. */\n    enabled?: boolean;\n    /** Throttle measurements in milliseconds. Default: `160` (~6 fps), plenty for UX. */\n    intervalMs?: number;\n}\n\n/**\n * Sample mean luminance from a `<video>` source on a `requestAnimationFrame`\n * loop and expose the rolling value. Sampling is throttled by `intervalMs` and\n * paused whenever `enabled` is `false` or the video is not ready yet\n * (`readyState < 2` or `videoWidth === 0`).\n *\n * One offscreen canvas is reused across frames to avoid GC pressure. Designed\n * to feed a live brightness bar / border color on a camera page.\n *\n * @param videoRef - ref to the `<video>` element to sample.\n * @param options - optional configuration (see {@link UseLiveLuminanceOptions}).\n * @returns The rolling mean luminance in `0..255` (`0` until the first sample).\n */\nexport function useLiveLuminance(\n    videoRef: RefObject<HTMLVideoElement | null>,\n    { enabled = true, intervalMs = 160 }: UseLiveLuminanceOptions = {},\n): number {\n    const [luminance, setLuminance] = useState(0);\n    const canvasRef = useRef<HTMLCanvasElement | null>(null);\n\n    useEffect(() => {\n        if (!enabled) return;\n        if (typeof window === \"undefined\") return;\n        if (!canvasRef.current) canvasRef.current = document.createElement(\"canvas\");\n\n        let rafId = 0;\n        let lastSampledAt = 0;\n\n        const tick = (timestamp: number): void => {\n            const video = videoRef.current;\n            if (!video || video.readyState < 2 || video.videoWidth === 0) {\n                rafId = window.requestAnimationFrame(tick);\n                return;\n            }\n            if (timestamp - lastSampledAt >= intervalMs) {\n                lastSampledAt = timestamp;\n                setLuminance(computeImageLuminance(video, canvasRef.current ?? undefined));\n            }\n            rafId = window.requestAnimationFrame(tick);\n        };\n\n        rafId = window.requestAnimationFrame(tick);\n        return () => window.cancelAnimationFrame(rafId);\n    }, [videoRef, enabled, intervalMs]);\n\n    return luminance;\n}\n"],"mappings":";;;AAwBA,SAAgB,EACZ,GACA,EAAE,aAAU,IAAM,gBAAa,QAAiC,CAAC,GAC3D;CACN,IAAM,CAAC,GAAW,KAAgB,EAAS,CAAC,GACtC,IAAY,EAAiC,IAAI;CA2BvD,OAzBA,QAAgB;EAEZ,IADI,CAAC,KACD,OAAO,SAAW,KAAa;EACnC,AAAwB,EAAU,YAAU,SAAS,cAAc,QAAQ;EAE3E,IAAI,IAAQ,GACR,IAAgB,GAEd,KAAQ,MAA4B;GACtC,IAAM,IAAQ,EAAS;GACvB,IAAI,CAAC,KAAS,EAAM,aAAa,KAAK,EAAM,eAAe,GAAG;IAC1D,IAAQ,OAAO,sBAAsB,CAAI;IACzC;GACJ;GAKA,AAJI,IAAY,KAAiB,MAC7B,IAAgB,GAChB,EAAa,EAAsB,GAAO,EAAU,WAAW,KAAA,CAAS,CAAC,IAE7E,IAAQ,OAAO,sBAAsB,CAAI;EAC7C;EAGA,OADA,IAAQ,OAAO,sBAAsB,CAAI,SAC5B,OAAO,qBAAqB,CAAK;CAClD,GAAG;EAAC;EAAU;EAAS;CAAU,CAAC,GAE3B;AACX"}
+{"version":3,"file":"use-live-luminance.js","names":["useLiveLuminance","luminance","setLuminance","useState","canvasRef","useRef","useEffect","enabled","rafId","lastSampledAt","tick","video","videoRef","timestamp","intervalMs","computeImageLuminance"],"sources":["../../src/vision/use-live-luminance.ts"],"sourcesContent":["import { useEffect, useRef, useState, type RefObject } from \"react\";\nimport { computeImageLuminance } from \"./luminance\";\n\n/** Options for {@link useLiveLuminance}. */\nexport interface UseLiveLuminanceOptions {\n    /** When `false` the loop is paused (e.g. while a capture is in flight). Default: `true`. */\n    enabled?: boolean;\n    /** Throttle measurements in milliseconds. Default: `160` (~6 fps), plenty for UX. */\n    intervalMs?: number;\n}\n\n/**\n * Sample mean luminance from a `<video>` source on a `requestAnimationFrame`\n * loop and expose the rolling value. Sampling is throttled by `intervalMs` and\n * paused whenever `enabled` is `false` or the video is not ready yet\n * (`readyState < 2` or `videoWidth === 0`).\n *\n * One offscreen canvas is reused across frames to avoid GC pressure. Designed\n * to feed a live brightness bar / border color on a camera page.\n *\n * @param videoRef - ref to the `<video>` element to sample.\n * @param options - optional configuration (see {@link UseLiveLuminanceOptions}).\n * @returns The rolling mean luminance in `0..255` (`0` until the first sample).\n */\nexport function useLiveLuminance(\n    videoRef: RefObject<HTMLVideoElement | null>,\n    { enabled = true, intervalMs = 160 }: UseLiveLuminanceOptions = {},\n): number {\n    const [luminance, setLuminance] = useState(0);\n    const canvasRef = useRef<HTMLCanvasElement | null>(null);\n\n    useEffect(() => {\n        if (!enabled) return;\n        if (typeof window === \"undefined\") return;\n        if (!canvasRef.current) canvasRef.current = document.createElement(\"canvas\");\n\n        let rafId = 0;\n        let lastSampledAt = 0;\n\n        const tick = (timestamp: number): void => {\n            const video = videoRef.current;\n            if (!video || video.readyState < 2 || video.videoWidth === 0) {\n                rafId = window.requestAnimationFrame(tick);\n                return;\n            }\n            if (timestamp - lastSampledAt >= intervalMs) {\n                lastSampledAt = timestamp;\n                setLuminance(computeImageLuminance(video, canvasRef.current ?? undefined));\n            }\n            rafId = window.requestAnimationFrame(tick);\n        };\n\n        rafId = window.requestAnimationFrame(tick);\n        return () => window.cancelAnimationFrame(rafId);\n    }, [videoRef, enabled, intervalMs]);\n\n    return luminance;\n}\n"],"mappings":";;;AAwBA,SAAgBA,EACZ,GACA,EAAE,aAAU,IAAM,gBAAa,QAAiC,CAAC,GAC3D;CACN,IAAM,CAACC,GAAWC,KAAgBC,EAAS,CAAC,GACtCC,IAAYC,EAAiC,IAAI;CA2BvD,OAzBAC,QAAgB;EAEZ,IADI,CAACC,KACD,OAAO,SAAW,KAAa;EACnC,AAAwBH,EAAU,YAAU,SAAS,cAAc,QAAQ;EAE3E,IAAII,IAAQ,GACRC,IAAgB,GAEdC,KAAQ,MAA4B;GACtC,IAAMC,IAAQC,EAAS;GACvB,AAAI,CAACD,KAASA,EAAM,aAAa,KAAKA,EAAM,eAAe,KAIvDE,IAAYJ,KAAiBK,MAC7B,IAAgBD,GAChBX,EAAaa,EAAsBJ,GAAOP,EAAU,WAAW,KAAA,CAAS,CAAC,IAE7E,IAAQ,OAAO,sBAAsBM,CAAI;EAC7C;EAGA,OADA,IAAQ,OAAO,sBAAsBA,CAAI,SAC5B,OAAO,qBAAqBF,CAAK;CAClD,GAAG;EAACI;EAAUL;EAASO;CAAU,CAAC,GAE3Bb;AACX"}

package/dist/vite/base-url.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"base-url.cjs","names":[],"sources":["../../src/vite/base-url.ts"],"sourcesContent":["/**\n * The resolved Vite `base` as a prefix that always ends in a slash.\n *\n * One rule, three call sites: the manifest prefixes the URLs it precaches, and\n * the dev middleware matches the paths the browser asks for. They have to agree\n * by definition — when they drift, dev serves `/app/sw.js` while the manifest\n * precached `/sw.js`, and the symptom only appears on a subpath deploy, which is\n * the least exercised configuration there is.\n *\n * @param base - Vite's resolved `base`, with or without a trailing slash.\n * @returns The same base, guaranteed to end in `/`.\n */\nexport function basePrefix(base: string): string {\n    return base.endsWith(\"/\") ? base : `${base}/`;\n}\n"],"mappings":"AAYA,SAAgB,EAAW,EAAsB,CAC7C,OAAO,EAAK,SAAS,GAAG,EAAI,EAAO,GAAG,EAAK,EAC/C"}
+{"version":3,"file":"base-url.cjs","names":["basePrefix","base"],"sources":["../../src/vite/base-url.ts"],"sourcesContent":["/**\n * The resolved Vite `base` as a prefix that always ends in a slash.\n *\n * One rule, three call sites: the manifest prefixes the URLs it precaches, and\n * the dev middleware matches the paths the browser asks for. They have to agree\n * by definition — when they drift, dev serves `/app/sw.js` while the manifest\n * precached `/sw.js`, and the symptom only appears on a subpath deploy, which is\n * the least exercised configuration there is.\n *\n * @param base - Vite's resolved `base`, with or without a trailing slash.\n * @returns The same base, guaranteed to end in `/`.\n */\nexport function basePrefix(base: string): string {\n    return base.endsWith(\"/\") ? base : `${base}/`;\n}\n"],"mappings":"AAYA,SAAgBA,EAAW,EAAsB,CAC7C,OAAOC,EAAK,SAAS,GAAG,EAAIA,EAAO,GAAGA,EAAK,EAC/C,C"}

package/dist/vite/base-url.js.map

@@ -1 +1 @@
-{"version":3,"file":"base-url.js","names":[],"sources":["../../src/vite/base-url.ts"],"sourcesContent":["/**\n * The resolved Vite `base` as a prefix that always ends in a slash.\n *\n * One rule, three call sites: the manifest prefixes the URLs it precaches, and\n * the dev middleware matches the paths the browser asks for. They have to agree\n * by definition — when they drift, dev serves `/app/sw.js` while the manifest\n * precached `/sw.js`, and the symptom only appears on a subpath deploy, which is\n * the least exercised configuration there is.\n *\n * @param base - Vite's resolved `base`, with or without a trailing slash.\n * @returns The same base, guaranteed to end in `/`.\n */\nexport function basePrefix(base: string): string {\n    return base.endsWith(\"/\") ? base : `${base}/`;\n}\n"],"mappings":";AAYA,SAAgB,EAAW,GAAsB;CAC7C,OAAO,EAAK,SAAS,GAAG,IAAI,IAAO,GAAG,EAAK;AAC/C"}
+{"version":3,"file":"base-url.js","names":["basePrefix","base"],"sources":["../../src/vite/base-url.ts"],"sourcesContent":["/**\n * The resolved Vite `base` as a prefix that always ends in a slash.\n *\n * One rule, three call sites: the manifest prefixes the URLs it precaches, and\n * the dev middleware matches the paths the browser asks for. They have to agree\n * by definition — when they drift, dev serves `/app/sw.js` while the manifest\n * precached `/sw.js`, and the symptom only appears on a subpath deploy, which is\n * the least exercised configuration there is.\n *\n * @param base - Vite's resolved `base`, with or without a trailing slash.\n * @returns The same base, guaranteed to end in `/`.\n */\nexport function basePrefix(base: string): string {\n    return base.endsWith(\"/\") ? base : `${base}/`;\n}\n"],"mappings":";AAYA,SAAgBA,EAAW,GAAsB;CAC7C,OAAOC,EAAK,SAAS,GAAG,IAAIA,IAAO,GAAGA,EAAK;AAC/C"}

package/dist/vite/create-vite-config.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"create-vite-config.cjs","names":[],"sources":["../../src/vite/create-vite-config.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport { defineConfig } from \"vite\";\nimport type { PluginOption, ProxyOptions, UserConfig } from \"vite\";\n\nimport { tempestIcons, type TempestIconsOptions } from \"./tempest-icons\";\nimport { tempestVitest } from \"./tempest-vitest\";\n\n/**\n * A Vite proxy entry: either a target URL string (expanded to\n * `{ target, changeOrigin: true }`) or a raw Vite `ProxyOptions` object.\n */\nexport type ProxyEntry = string | Record<string, unknown>;\n\nexport interface CreateViteConfigOptions {\n    /**\n     * Source directory aliased to `@`, relative to the project root.\n     * Default: `\"src\"` (so `@/components/Button` → `<root>/src/components/Button`).\n     */\n    srcDir?: string;\n    /** Dev server port. Default: `5173`. */\n    port?: number;\n    /** Dev server host. Default: `\"127.0.0.1\"`. */\n    host?: string | boolean;\n    /** Open the browser on `dev` start. Default: `false`. */\n    open?: boolean;\n    /**\n     * Dev proxy table. String values are expanded to\n     * `{ target, changeOrigin: true }`; objects are passed through untouched.\n     *\n     * @example { \"/api\": \"http://127.0.0.1:8000\" }\n     */\n    proxy?: Record<string, ProxyEntry>;\n    /** Extra path aliases merged on top of the default `@` → src alias. */\n    alias?: Record<string, string>;\n    /** Vite plugins appended after `@vitejs/plugin-react`. */\n    plugins?: unknown[];\n    /**\n     * The `tempestIcons()` plugin, which generates `virtual:tempest-icons` from the\n     * icon slugs your source mentions. On by default — it only ever removes\n     * requests. Pass `false` to leave it out, or an options object to configure the\n     * scan.\n     */\n    icons?: boolean | TempestIconsOptions;\n    /**\n     * Arbitrary Vite config (a `UserConfig` object) deep-merged last, for\n     * escape-hatch overrides (build target, define, extra `server` keys, …).\n     */\n    overrides?: Record<string, unknown>;\n}\n\n/**\n * The resulting Vite config object. Typed loosely so the SDK's published\n * declarations stay free of `vite`'s internal types; assign it straight to a\n * `vite.config.ts` default export.\n */\nexport type TempestViteConfig = Record<string, unknown>;\n\nfunction normalizeProxy(proxy: Record<string, ProxyEntry>): Record<string, ProxyOptions> {\n    const out: Record<string, ProxyOptions> = {};\n    for (const [path, value] of Object.entries(proxy)) {\n        out[path] =\n            typeof value === \"string\"\n                ? { target: value, changeOrigin: true }\n                : (value as ProxyOptions);\n    }\n    return out;\n}\n\n/**\n * Load `@vitejs/plugin-react` when a config is built, not when this module loads.\n *\n * The plugin is an optional peer, and every helper of `tempest-react-sdk/vite`\n * ships through one barrel. A top-level import made the whole barrel require it:\n * a project without the React plugin could not load a config importing only\n * `tempestVitest` or `tempestCsp` (`ERR_MODULE_NOT_FOUND`, #401). Vite resolves a\n * promise in `plugins` before using it, so {@link createViteConfig} stays\n * synchronous and only it needs the peer.\n *\n * @returns The React plugin, once its module has loaded.\n */\nfunction reactPlugin(): Promise<PluginOption> {\n    return import(\"@vitejs/plugin-react\").then((module) => module.default());\n}\n\n/**\n * Build a Tempest-flavored Vite config for a React app: the `@vitejs/plugin-react`\n * plugin, the `@` → `src` import alias, sane dev-server defaults and\n * {@link tempestVitest}, which lets a Vitest suite import the SDK — so a\n * consuming app's `vite.config.ts` is a single call instead of repeated\n * boilerplate. Everything is overridable.\n *\n * Import it from the dedicated Node entry point:\n *\n * @example\n * // vite.config.ts\n * import { createViteConfig } from \"tempest-react-sdk/vite\";\n *\n * export default createViteConfig({\n *     proxy: { \"/api\": \"http://127.0.0.1:8000\" },\n * });\n */\nexport function createViteConfig(options: CreateViteConfigOptions = {}): TempestViteConfig {\n    const {\n        srcDir = \"src\",\n        port = 5173,\n        host = \"127.0.0.1\",\n        open = false,\n        proxy,\n        alias = {},\n        plugins = [],\n        icons = true,\n        overrides = {},\n    } = options;\n\n    const overridesConfig = overrides as UserConfig;\n    const iconsPlugin = icons\n        ? [tempestIcons({ dir: srcDir, ...(typeof icons === \"object\" ? icons : {}) })]\n        : [];\n\n    const base: UserConfig = {\n        plugins: [\n            reactPlugin(),\n            ...iconsPlugin,\n            tempestVitest(),\n            ...plugins,\n        ] as UserConfig[\"plugins\"],\n        resolve: {\n            alias: {\n                \"@\": resolve(process.cwd(), srcDir),\n                ...alias,\n            },\n        },\n        server: {\n            port,\n            host,\n            open,\n            ...(proxy ? { proxy: normalizeProxy(proxy) } : {}),\n        },\n    };\n\n    const merged: UserConfig = {\n        ...base,\n        ...overridesConfig,\n        plugins: [...(base.plugins ?? []), ...(overridesConfig.plugins ?? [])],\n        resolve: { ...base.resolve, ...overridesConfig.resolve },\n        server: { ...base.server, ...overridesConfig.server },\n    };\n\n    return defineConfig(merged) as TempestViteConfig;\n}\n"],"mappings":"sHAyDA,SAAS,EAAe,EAAiE,CACrF,IAAM,EAAoC,CAAC,EAC3C,IAAK,GAAM,CAAC,EAAM,KAAU,OAAO,QAAQ,CAAK,EAC5C,EAAI,GACA,OAAO,GAAU,SACX,CAAE,OAAQ,EAAO,aAAc,EAAK,EACnC,EAEf,OAAO,CACX,CAcA,SAAS,GAAqC,CAC1C,OAAO,OAAO,uBAAuB,CAAC,KAAM,GAAW,EAAO,QAAQ,CAAC,CAC3E,CAmBA,SAAgB,EAAiB,EAAmC,CAAC,EAAsB,CACvF,GAAM,CACF,SAAS,MACT,OAAO,KACP,OAAO,YACP,OAAO,GACP,QACA,QAAQ,CAAC,EACT,UAAU,CAAC,EACX,QAAQ,GACR,YAAY,CAAC,GACb,EAEE,EAAkB,EAClB,EAAc,EACd,CAAC,EAAA,aAAa,CAAE,IAAK,EAAQ,GAAI,OAAO,GAAU,SAAW,EAAQ,CAAC,CAAG,CAAC,CAAC,EAC3E,CAAC,EAED,EAAmB,CACrB,QAAS,CACL,EAAY,EACZ,GAAG,EACH,EAAA,cAAc,EACd,GAAG,CACP,EACA,QAAS,CACL,MAAO,CACH,KAAA,EAAK,EAAA,QAAA,CAAQ,QAAQ,IAAI,EAAG,CAAM,EAClC,GAAG,CACP,CACJ,EACA,OAAQ,CACJ,OACA,OACA,OACA,GAAI,EAAQ,CAAE,MAAO,EAAe,CAAK,CAAE,EAAI,CAAC,CACpD,CACJ,EAEM,EAAqB,CACvB,GAAG,EACH,GAAG,EACH,QAAS,CAAC,GAAI,EAAK,SAAW,CAAC,EAAI,GAAI,EAAgB,SAAW,CAAC,CAAE,EACrE,QAAS,CAAE,GAAG,EAAK,QAAS,GAAG,EAAgB,OAAQ,EACvD,OAAQ,CAAE,GAAG,EAAK,OAAQ,GAAG,EAAgB,MAAO,CACxD,EAEA,OAAA,EAAO,EAAA,aAAA,CAAa,CAAM,CAC9B"}
+{"version":3,"file":"create-vite-config.cjs","names":["tempestIcons","tempestVitest","resolve","defineConfig","require_tempest_icons","require_tempest_vitest","node_path","vite","normalizeProxy","out","path","value","proxy","reactPlugin","module","createViteConfig","options","overridesConfig","overrides","iconsPlugin","icons","srcDir","base","plugins","alias","merged"],"sources":["../../src/vite/create-vite-config.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport { defineConfig } from \"vite\";\nimport type { PluginOption, ProxyOptions, UserConfig } from \"vite\";\n\nimport { tempestIcons, type TempestIconsOptions } from \"./tempest-icons\";\nimport { tempestVitest } from \"./tempest-vitest\";\n\n/**\n * A Vite proxy entry: either a target URL string (expanded to\n * `{ target, changeOrigin: true }`) or a raw Vite `ProxyOptions` object.\n */\nexport type ProxyEntry = string | Record<string, unknown>;\n\nexport interface CreateViteConfigOptions {\n    /**\n     * Source directory aliased to `@`, relative to the project root.\n     * Default: `\"src\"` (so `@/components/Button` → `<root>/src/components/Button`).\n     */\n    srcDir?: string;\n    /** Dev server port. Default: `5173`. */\n    port?: number;\n    /** Dev server host. Default: `\"127.0.0.1\"`. */\n    host?: string | boolean;\n    /** Open the browser on `dev` start. Default: `false`. */\n    open?: boolean;\n    /**\n     * Dev proxy table. String values are expanded to\n     * `{ target, changeOrigin: true }`; objects are passed through untouched.\n     *\n     * @example { \"/api\": \"http://127.0.0.1:8000\" }\n     */\n    proxy?: Record<string, ProxyEntry>;\n    /** Extra path aliases merged on top of the default `@` → src alias. */\n    alias?: Record<string, string>;\n    /** Vite plugins appended after `@vitejs/plugin-react`. */\n    plugins?: unknown[];\n    /**\n     * The `tempestIcons()` plugin, which generates `virtual:tempest-icons` from the\n     * icon slugs your source mentions. On by default — it only ever removes\n     * requests. Pass `false` to leave it out, or an options object to configure the\n     * scan.\n     */\n    icons?: boolean | TempestIconsOptions;\n    /**\n     * Arbitrary Vite config (a `UserConfig` object) deep-merged last, for\n     * escape-hatch overrides (build target, define, extra `server` keys, …).\n     */\n    overrides?: Record<string, unknown>;\n}\n\n/**\n * The resulting Vite config object. Typed loosely so the SDK's published\n * declarations stay free of `vite`'s internal types; assign it straight to a\n * `vite.config.ts` default export.\n */\nexport type TempestViteConfig = Record<string, unknown>;\n\nfunction normalizeProxy(proxy: Record<string, ProxyEntry>): Record<string, ProxyOptions> {\n    const out: Record<string, ProxyOptions> = {};\n    for (const [path, value] of Object.entries(proxy)) {\n        out[path] =\n            typeof value === \"string\"\n                ? { target: value, changeOrigin: true }\n                : (value as ProxyOptions);\n    }\n    return out;\n}\n\n/**\n * Load `@vitejs/plugin-react` when a config is built, not when this module loads.\n *\n * The plugin is an optional peer, and every helper of `tempest-react-sdk/vite`\n * ships through one barrel. A top-level import made the whole barrel require it:\n * a project without the React plugin could not load a config importing only\n * `tempestVitest` or `tempestCsp` (`ERR_MODULE_NOT_FOUND`, #401). Vite resolves a\n * promise in `plugins` before using it, so {@link createViteConfig} stays\n * synchronous and only it needs the peer.\n *\n * @returns The React plugin, once its module has loaded.\n */\nfunction reactPlugin(): Promise<PluginOption> {\n    return import(\"@vitejs/plugin-react\").then((module) => module.default());\n}\n\n/**\n * Build a Tempest-flavored Vite config for a React app: the `@vitejs/plugin-react`\n * plugin, the `@` → `src` import alias, sane dev-server defaults and\n * {@link tempestVitest}, which lets a Vitest suite import the SDK — so a\n * consuming app's `vite.config.ts` is a single call instead of repeated\n * boilerplate. Everything is overridable.\n *\n * Import it from the dedicated Node entry point:\n *\n * @example\n * // vite.config.ts\n * import { createViteConfig } from \"tempest-react-sdk/vite\";\n *\n * export default createViteConfig({\n *     proxy: { \"/api\": \"http://127.0.0.1:8000\" },\n * });\n */\nexport function createViteConfig(options: CreateViteConfigOptions = {}): TempestViteConfig {\n    const {\n        srcDir = \"src\",\n        port = 5173,\n        host = \"127.0.0.1\",\n        open = false,\n        proxy,\n        alias = {},\n        plugins = [],\n        icons = true,\n        overrides = {},\n    } = options;\n\n    const overridesConfig = overrides as UserConfig;\n    const iconsPlugin = icons\n        ? [tempestIcons({ dir: srcDir, ...(typeof icons === \"object\" ? icons : {}) })]\n        : [];\n\n    const base: UserConfig = {\n        plugins: [\n            reactPlugin(),\n            ...iconsPlugin,\n            tempestVitest(),\n            ...plugins,\n        ] as UserConfig[\"plugins\"],\n        resolve: {\n            alias: {\n                \"@\": resolve(process.cwd(), srcDir),\n                ...alias,\n            },\n        },\n        server: {\n            port,\n            host,\n            open,\n            ...(proxy ? { proxy: normalizeProxy(proxy) } : {}),\n        },\n    };\n\n    const merged: UserConfig = {\n        ...base,\n        ...overridesConfig,\n        plugins: [...(base.plugins ?? []), ...(overridesConfig.plugins ?? [])],\n        resolve: { ...base.resolve, ...overridesConfig.resolve },\n        server: { ...base.server, ...overridesConfig.server },\n    };\n\n    return defineConfig(merged) as TempestViteConfig;\n}\n"],"mappings":"A,sHAyDA,SAASQ,EAAe,EAAiE,CACrF,IAAMC,EAAoC,CAAC,EAC3C,IAAK,GAAM,CAACC,EAAMC,KAAU,OAAO,QAAQC,CAAK,EAC5C,EAAIF,GACA,OAAOC,GAAU,SACX,CAAE,OAAQA,EAAO,aAAc,EAAK,EACnCA,EAEf,OAAOF,CACX,CAcA,SAASI,GAAqC,CAC1C,OAAO,OAAO,uBAAuB,CAAC,KAAM,GAAWC,EAAO,QAAQ,CAAC,CAC3E,CAmBA,SAAgBC,EAAiB,EAAmC,CAAC,EAAsB,CACvF,GAAM,CACF,SAAS,MACT,OAAO,KACP,OAAO,YACP,OAAO,GACP,QACA,QAAQ,CAAC,EACT,UAAU,CAAC,EACX,QAAQ,GACR,YAAY,CAAC,GACbC,EAEEC,EAAkBC,EAClBC,EAAcC,EACd,CAACpB,EAAAA,aAAa,CAAE,IAAKqB,EAAQ,GAAI,OAAOD,GAAU,SAAWA,EAAQ,CAAC,CAAG,CAAC,CAAC,EAC3E,CAAC,EAEDE,EAAmB,CACrB,QAAS,CACLT,EAAY,EACZ,GAAGM,EACHlB,EAAAA,cAAc,EACd,GAAGsB,CACP,EACA,QAAS,CACL,MAAO,CACH,KAAA,EAAKrB,EAAAA,QAAAA,CAAQ,QAAQ,IAAI,EAAGmB,CAAM,EAClC,GAAGG,CACP,CACJ,EACA,OAAQ,CACJ,OACA,OACA,OACA,GAAIZ,EAAQ,CAAE,MAAOJ,EAAeI,CAAK,CAAE,EAAI,CAAC,CACpD,CACJ,EAEMa,EAAqB,CACvB,GAAGH,EACH,GAAGL,EACH,QAAS,CAAC,GAAIK,EAAK,SAAW,CAAC,EAAI,GAAIL,EAAgB,SAAW,CAAC,CAAE,EACrE,QAAS,CAAE,GAAGK,EAAK,QAAS,GAAGL,EAAgB,OAAQ,EACvD,OAAQ,CAAE,GAAGK,EAAK,OAAQ,GAAGL,EAAgB,MAAO,CACxD,EAEA,OAAA,EAAOd,EAAAA,aAAAA,CAAasB,CAAM,CAC9B,C"}

package/dist/vite/create-vite-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-vite-config.js","names":[],"sources":["../../src/vite/create-vite-config.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport { defineConfig } from \"vite\";\nimport type { PluginOption, ProxyOptions, UserConfig } from \"vite\";\n\nimport { tempestIcons, type TempestIconsOptions } from \"./tempest-icons\";\nimport { tempestVitest } from \"./tempest-vitest\";\n\n/**\n * A Vite proxy entry: either a target URL string (expanded to\n * `{ target, changeOrigin: true }`) or a raw Vite `ProxyOptions` object.\n */\nexport type ProxyEntry = string | Record<string, unknown>;\n\nexport interface CreateViteConfigOptions {\n    /**\n     * Source directory aliased to `@`, relative to the project root.\n     * Default: `\"src\"` (so `@/components/Button` → `<root>/src/components/Button`).\n     */\n    srcDir?: string;\n    /** Dev server port. Default: `5173`. */\n    port?: number;\n    /** Dev server host. Default: `\"127.0.0.1\"`. */\n    host?: string | boolean;\n    /** Open the browser on `dev` start. Default: `false`. */\n    open?: boolean;\n    /**\n     * Dev proxy table. String values are expanded to\n     * `{ target, changeOrigin: true }`; objects are passed through untouched.\n     *\n     * @example { \"/api\": \"http://127.0.0.1:8000\" }\n     */\n    proxy?: Record<string, ProxyEntry>;\n    /** Extra path aliases merged on top of the default `@` → src alias. */\n    alias?: Record<string, string>;\n    /** Vite plugins appended after `@vitejs/plugin-react`. */\n    plugins?: unknown[];\n    /**\n     * The `tempestIcons()` plugin, which generates `virtual:tempest-icons` from the\n     * icon slugs your source mentions. On by default — it only ever removes\n     * requests. Pass `false` to leave it out, or an options object to configure the\n     * scan.\n     */\n    icons?: boolean | TempestIconsOptions;\n    /**\n     * Arbitrary Vite config (a `UserConfig` object) deep-merged last, for\n     * escape-hatch overrides (build target, define, extra `server` keys, …).\n     */\n    overrides?: Record<string, unknown>;\n}\n\n/**\n * The resulting Vite config object. Typed loosely so the SDK's published\n * declarations stay free of `vite`'s internal types; assign it straight to a\n * `vite.config.ts` default export.\n */\nexport type TempestViteConfig = Record<string, unknown>;\n\nfunction normalizeProxy(proxy: Record<string, ProxyEntry>): Record<string, ProxyOptions> {\n    const out: Record<string, ProxyOptions> = {};\n    for (const [path, value] of Object.entries(proxy)) {\n        out[path] =\n            typeof value === \"string\"\n                ? { target: value, changeOrigin: true }\n                : (value as ProxyOptions);\n    }\n    return out;\n}\n\n/**\n * Load `@vitejs/plugin-react` when a config is built, not when this module loads.\n *\n * The plugin is an optional peer, and every helper of `tempest-react-sdk/vite`\n * ships through one barrel. A top-level import made the whole barrel require it:\n * a project without the React plugin could not load a config importing only\n * `tempestVitest` or `tempestCsp` (`ERR_MODULE_NOT_FOUND`, #401). Vite resolves a\n * promise in `plugins` before using it, so {@link createViteConfig} stays\n * synchronous and only it needs the peer.\n *\n * @returns The React plugin, once its module has loaded.\n */\nfunction reactPlugin(): Promise<PluginOption> {\n    return import(\"@vitejs/plugin-react\").then((module) => module.default());\n}\n\n/**\n * Build a Tempest-flavored Vite config for a React app: the `@vitejs/plugin-react`\n * plugin, the `@` → `src` import alias, sane dev-server defaults and\n * {@link tempestVitest}, which lets a Vitest suite import the SDK — so a\n * consuming app's `vite.config.ts` is a single call instead of repeated\n * boilerplate. Everything is overridable.\n *\n * Import it from the dedicated Node entry point:\n *\n * @example\n * // vite.config.ts\n * import { createViteConfig } from \"tempest-react-sdk/vite\";\n *\n * export default createViteConfig({\n *     proxy: { \"/api\": \"http://127.0.0.1:8000\" },\n * });\n */\nexport function createViteConfig(options: CreateViteConfigOptions = {}): TempestViteConfig {\n    const {\n        srcDir = \"src\",\n        port = 5173,\n        host = \"127.0.0.1\",\n        open = false,\n        proxy,\n        alias = {},\n        plugins = [],\n        icons = true,\n        overrides = {},\n    } = options;\n\n    const overridesConfig = overrides as UserConfig;\n    const iconsPlugin = icons\n        ? [tempestIcons({ dir: srcDir, ...(typeof icons === \"object\" ? icons : {}) })]\n        : [];\n\n    const base: UserConfig = {\n        plugins: [\n            reactPlugin(),\n            ...iconsPlugin,\n            tempestVitest(),\n            ...plugins,\n        ] as UserConfig[\"plugins\"],\n        resolve: {\n            alias: {\n                \"@\": resolve(process.cwd(), srcDir),\n                ...alias,\n            },\n        },\n        server: {\n            port,\n            host,\n            open,\n            ...(proxy ? { proxy: normalizeProxy(proxy) } : {}),\n        },\n    };\n\n    const merged: UserConfig = {\n        ...base,\n        ...overridesConfig,\n        plugins: [...(base.plugins ?? []), ...(overridesConfig.plugins ?? [])],\n        resolve: { ...base.resolve, ...overridesConfig.resolve },\n        server: { ...base.server, ...overridesConfig.server },\n    };\n\n    return defineConfig(merged) as TempestViteConfig;\n}\n"],"mappings":";;;;;AAyDA,SAAS,EAAe,GAAiE;CACrF,IAAM,IAAoC,CAAC;CAC3C,KAAK,IAAM,CAAC,GAAM,MAAU,OAAO,QAAQ,CAAK,GAC5C,EAAI,KACA,OAAO,KAAU,WACX;EAAE,QAAQ;EAAO,cAAc;CAAK,IACnC;CAEf,OAAO;AACX;AAcA,SAAS,IAAqC;CAC1C,OAAO,OAAO,uBAAuB,CAAC,MAAM,MAAW,EAAO,QAAQ,CAAC;AAC3E;AAmBA,SAAgB,EAAiB,IAAmC,CAAC,GAAsB;CACvF,IAAM,EACF,YAAS,OACT,UAAO,MACP,UAAO,aACP,UAAO,IACP,UACA,WAAQ,CAAC,GACT,aAAU,CAAC,GACX,WAAQ,IACR,eAAY,CAAC,MACb,GAEE,IAAkB,GAClB,IAAc,IACd,CAAC,EAAa;EAAE,KAAK;EAAQ,GAAI,OAAO,KAAU,WAAW,IAAQ,CAAC;CAAG,CAAC,CAAC,IAC3E,CAAC,GAED,IAAmB;EACrB,SAAS;GACL,EAAY;GACZ,GAAG;GACH,EAAc;GACd,GAAG;EACP;EACA,SAAS,EACL,OAAO;GACH,KAAK,EAAQ,QAAQ,IAAI,GAAG,CAAM;GAClC,GAAG;EACP,EACJ;EACA,QAAQ;GACJ;GACA;GACA;GACA,GAAI,IAAQ,EAAE,OAAO,EAAe,CAAK,EAAE,IAAI,CAAC;EACpD;CACJ,GAEM,IAAqB;EACvB,GAAG;EACH,GAAG;EACH,SAAS,CAAC,GAAI,EAAK,WAAW,CAAC,GAAI,GAAI,EAAgB,WAAW,CAAC,CAAE;EACrE,SAAS;GAAE,GAAG,EAAK;GAAS,GAAG,EAAgB;EAAQ;EACvD,QAAQ;GAAE,GAAG,EAAK;GAAQ,GAAG,EAAgB;EAAO;CACxD;CAEA,OAAO,EAAa,CAAM;AAC9B"}
+{"version":3,"file":"create-vite-config.js","names":["normalizeProxy","out","path","value","proxy","reactPlugin","module","createViteConfig","options","overridesConfig","overrides","iconsPlugin","icons","tempestIcons","srcDir","base","tempestVitest","plugins","resolve","alias","merged","defineConfig"],"sources":["../../src/vite/create-vite-config.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport { defineConfig } from \"vite\";\nimport type { PluginOption, ProxyOptions, UserConfig } from \"vite\";\n\nimport { tempestIcons, type TempestIconsOptions } from \"./tempest-icons\";\nimport { tempestVitest } from \"./tempest-vitest\";\n\n/**\n * A Vite proxy entry: either a target URL string (expanded to\n * `{ target, changeOrigin: true }`) or a raw Vite `ProxyOptions` object.\n */\nexport type ProxyEntry = string | Record<string, unknown>;\n\nexport interface CreateViteConfigOptions {\n    /**\n     * Source directory aliased to `@`, relative to the project root.\n     * Default: `\"src\"` (so `@/components/Button` → `<root>/src/components/Button`).\n     */\n    srcDir?: string;\n    /** Dev server port. Default: `5173`. */\n    port?: number;\n    /** Dev server host. Default: `\"127.0.0.1\"`. */\n    host?: string | boolean;\n    /** Open the browser on `dev` start. Default: `false`. */\n    open?: boolean;\n    /**\n     * Dev proxy table. String values are expanded to\n     * `{ target, changeOrigin: true }`; objects are passed through untouched.\n     *\n     * @example { \"/api\": \"http://127.0.0.1:8000\" }\n     */\n    proxy?: Record<string, ProxyEntry>;\n    /** Extra path aliases merged on top of the default `@` → src alias. */\n    alias?: Record<string, string>;\n    /** Vite plugins appended after `@vitejs/plugin-react`. */\n    plugins?: unknown[];\n    /**\n     * The `tempestIcons()` plugin, which generates `virtual:tempest-icons` from the\n     * icon slugs your source mentions. On by default — it only ever removes\n     * requests. Pass `false` to leave it out, or an options object to configure the\n     * scan.\n     */\n    icons?: boolean | TempestIconsOptions;\n    /**\n     * Arbitrary Vite config (a `UserConfig` object) deep-merged last, for\n     * escape-hatch overrides (build target, define, extra `server` keys, …).\n     */\n    overrides?: Record<string, unknown>;\n}\n\n/**\n * The resulting Vite config object. Typed loosely so the SDK's published\n * declarations stay free of `vite`'s internal types; assign it straight to a\n * `vite.config.ts` default export.\n */\nexport type TempestViteConfig = Record<string, unknown>;\n\nfunction normalizeProxy(proxy: Record<string, ProxyEntry>): Record<string, ProxyOptions> {\n    const out: Record<string, ProxyOptions> = {};\n    for (const [path, value] of Object.entries(proxy)) {\n        out[path] =\n            typeof value === \"string\"\n                ? { target: value, changeOrigin: true }\n                : (value as ProxyOptions);\n    }\n    return out;\n}\n\n/**\n * Load `@vitejs/plugin-react` when a config is built, not when this module loads.\n *\n * The plugin is an optional peer, and every helper of `tempest-react-sdk/vite`\n * ships through one barrel. A top-level import made the whole barrel require it:\n * a project without the React plugin could not load a config importing only\n * `tempestVitest` or `tempestCsp` (`ERR_MODULE_NOT_FOUND`, #401). Vite resolves a\n * promise in `plugins` before using it, so {@link createViteConfig} stays\n * synchronous and only it needs the peer.\n *\n * @returns The React plugin, once its module has loaded.\n */\nfunction reactPlugin(): Promise<PluginOption> {\n    return import(\"@vitejs/plugin-react\").then((module) => module.default());\n}\n\n/**\n * Build a Tempest-flavored Vite config for a React app: the `@vitejs/plugin-react`\n * plugin, the `@` → `src` import alias, sane dev-server defaults and\n * {@link tempestVitest}, which lets a Vitest suite import the SDK — so a\n * consuming app's `vite.config.ts` is a single call instead of repeated\n * boilerplate. Everything is overridable.\n *\n * Import it from the dedicated Node entry point:\n *\n * @example\n * // vite.config.ts\n * import { createViteConfig } from \"tempest-react-sdk/vite\";\n *\n * export default createViteConfig({\n *     proxy: { \"/api\": \"http://127.0.0.1:8000\" },\n * });\n */\nexport function createViteConfig(options: CreateViteConfigOptions = {}): TempestViteConfig {\n    const {\n        srcDir = \"src\",\n        port = 5173,\n        host = \"127.0.0.1\",\n        open = false,\n        proxy,\n        alias = {},\n        plugins = [],\n        icons = true,\n        overrides = {},\n    } = options;\n\n    const overridesConfig = overrides as UserConfig;\n    const iconsPlugin = icons\n        ? [tempestIcons({ dir: srcDir, ...(typeof icons === \"object\" ? icons : {}) })]\n        : [];\n\n    const base: UserConfig = {\n        plugins: [\n            reactPlugin(),\n            ...iconsPlugin,\n            tempestVitest(),\n            ...plugins,\n        ] as UserConfig[\"plugins\"],\n        resolve: {\n            alias: {\n                \"@\": resolve(process.cwd(), srcDir),\n                ...alias,\n            },\n        },\n        server: {\n            port,\n            host,\n            open,\n            ...(proxy ? { proxy: normalizeProxy(proxy) } : {}),\n        },\n    };\n\n    const merged: UserConfig = {\n        ...base,\n        ...overridesConfig,\n        plugins: [...(base.plugins ?? []), ...(overridesConfig.plugins ?? [])],\n        resolve: { ...base.resolve, ...overridesConfig.resolve },\n        server: { ...base.server, ...overridesConfig.server },\n    };\n\n    return defineConfig(merged) as TempestViteConfig;\n}\n"],"mappings":";;;;;AAyDA,SAASA,EAAe,GAAiE;CACrF,IAAMC,IAAoC,CAAC;CAC3C,KAAK,IAAM,CAACC,GAAMC,MAAU,OAAO,QAAQC,CAAK,GAC5C,EAAIF,KACA,OAAOC,KAAU,WACX;EAAE,QAAQA;EAAO,cAAc;CAAK,IACnCA;CAEf,OAAOF;AACX;AAcA,SAASI,IAAqC;CAC1C,OAAO,OAAO,uBAAuB,CAAC,MAAM,MAAWC,EAAO,QAAQ,CAAC;AAC3E;AAmBA,SAAgBC,EAAiB,IAAmC,CAAC,GAAsB;CACvF,IAAM,EACF,YAAS,OACT,UAAO,MACP,UAAO,aACP,UAAO,IACP,UACA,WAAQ,CAAC,GACT,aAAU,CAAC,GACX,WAAQ,IACR,eAAY,CAAC,MACbC,GAEEC,IAAkBC,GAClBC,IAAcC,IACd,CAACC,EAAa;EAAE,KAAKC;EAAQ,GAAI,OAAOF,KAAU,WAAWA,IAAQ,CAAC;CAAG,CAAC,CAAC,IAC3E,CAAC,GAEDG,IAAmB;EACrB,SAAS;GACLV,EAAY;GACZ,GAAGM;GACHK,EAAc;GACd,GAAGC;EACP;EACA,SAAS,EACL,OAAO;GACH,KAAKC,EAAQ,QAAQ,IAAI,GAAGJ,CAAM;GAClC,GAAGK;EACP,EACJ;EACA,QAAQ;GACJ;GACA;GACA;GACA,GAAIf,IAAQ,EAAE,OAAOJ,EAAeI,CAAK,EAAE,IAAI,CAAC;EACpD;CACJ,GAEMgB,IAAqB;EACvB,GAAGL;EACH,GAAGN;EACH,SAAS,CAAC,GAAIM,EAAK,WAAW,CAAC,GAAI,GAAIN,EAAgB,WAAW,CAAC,CAAE;EACrE,SAAS;GAAE,GAAGM,EAAK;GAAS,GAAGN,EAAgB;EAAQ;EACvD,QAAQ;GAAE,GAAGM,EAAK;GAAQ,GAAGN,EAAgB;EAAO;CACxD;CAEA,OAAOY,EAAaD,CAAM;AAC9B"}

package/dist/vite/narrow-tokens.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"narrow-tokens.cjs","names":[],"sources":["../../src/vite/narrow-tokens.ts"],"sourcesContent":["/**\n * Cut the token sheet down to the tokens a set of stylesheets can reach.\n *\n * Once every component loads its own stylesheet, `tokens.css` stops being a rounding\n * error and becomes the biggest single thing an app downloads: measured on a probe\n * app mounting `Button`, `Card` and `Badge`, the sheet is 2516 B brotli of a 4927 B\n * total. The components read 105 of its 223 tokens, so the other 118 are bytes\n * nothing on the page can consult.\n *\n * The cut is a reachability closure, not a filter: a token's value routinely names\n * another token (`--tempest-primary: var(--tempest-primary-500)`), so keeping only\n * the names a stylesheet mentions literally would keep aliases whose targets were\n * dropped — `var()` would resolve to nothing and the component would render with the\n * property unset, which is worse than shipping the whole sheet.\n */\n\n/** A token block: one selector and the custom properties it declares, in order. */\ninterface TokenBlock {\n    /** The block's selector text, e.g. `:root` or `[data-tempest-theme=dark]`. */\n    selector: string;\n    /** Declaration name → value, in source order. */\n    declarations: Map<string, string>;\n}\n\n/**\n * Any custom property being read, not only the `--tempest-*` ones.\n *\n * Deliberately wider than the tokens this cut is about. `tokens.css` also carries\n * the `--lightningcss-light`/`--lightningcss-dark` pair the compiler emits, which\n * nothing reads today — measured: two declarations, zero reads — and which a\n * `--tempest-`-only scan would therefore always drop. That is the right answer right\n * up until one rule uses `light-dark()`, at which point the compiler emits the read\n * and a narrow scan would drop the pair it depends on. Matching every custom\n * property costs nothing (a name the sheet does not declare is discarded) and makes\n * the closure correct for names this file does not know about.\n */\nconst TOKEN_REFERENCE = /var\\(\\s*(--[A-Za-z0-9-]+)/g;\n\n/**\n * A token name being assembled at runtime rather than written out.\n *\n * `style={{ color: `var(--tempest-${tone})` }}` names a token no static scan can\n * know, so a cut made without it would drop the one the app is about to read. The\n * caller falls back to the whole sheet when this matches — the same shape as the\n * plugin's own namespace-import fallback, and for the same reason: serve more than\n * asked for rather than less than needed.\n */\nconst DYNAMIC_TOKEN = /--tempest-[A-Za-z0-9-]*(?:\\$\\{|[\"'`]\\s*\\+|\\s*\\+\\s*[\"'`])/;\n\n/**\n * Parse a token stylesheet into its blocks.\n *\n * Written against the compiler's own output, which is already valid and flat — every\n * block in `tokens.css` is either a bare selector or one nested inside a single\n * at-rule — so a brace-depth reader is enough and a full parser would not be more\n * correct here.\n *\n * @param css - Contents of `tokens.css`.\n * @returns One entry per block that declares anything.\n */\nexport function parseTokenBlocks(css: string): TokenBlock[] {\n    const blocks: TokenBlock[] = [];\n    for (const match of css.matchAll(/([^{}]+)\\{([^{}]*)\\}/g)) {\n        const declarations = new Map<string, string>();\n        for (const declaration of (match[2] ?? \"\").split(\";\")) {\n            const colon = declaration.indexOf(\":\");\n            if (colon < 0) continue;\n            const name = declaration.slice(0, colon).trim();\n            if (name) declarations.set(name, declaration.slice(colon + 1).trim());\n        }\n        if (declarations.size === 0) continue;\n        blocks.push({ selector: (match[1] ?? \"\").trim(), declarations });\n    }\n    return blocks;\n}\n\n/**\n * Every token a body of CSS reaches, following token-to-token references.\n *\n * @param blocks - The parsed token sheet.\n * @param usage - CSS and source text to scan for `var(--tempest-*)`.\n * @returns The reachable token names.\n */\nexport function reachableTokens(blocks: readonly TokenBlock[], usage: string): Set<string> {\n    const declared = new Set<string>();\n    for (const block of blocks) for (const name of block.declarations.keys()) declared.add(name);\n\n    const reached = new Set<string>();\n    const queue = [...usage.matchAll(TOKEN_REFERENCE)].map((match) => match[1] ?? \"\");\n    while (queue.length > 0) {\n        const token = queue.pop() ?? \"\";\n        if (reached.has(token) || !declared.has(token)) continue;\n        reached.add(token);\n        for (const block of blocks) {\n            const value = block.declarations.get(token);\n            if (value === undefined) continue;\n            for (const match of value.matchAll(TOKEN_REFERENCE)) queue.push(match[1] ?? \"\");\n        }\n    }\n    return reached;\n}\n\n/**\n * Rebuild the token sheet with only the tokens a set of stylesheets reaches.\n *\n * Companion declarations that are not custom properties travel with the block that\n * survives — `color-scheme` is the one, and dropping it would leave the browser\n * painting its own surfaces (scrollbar, `<select>` popup, autofill) in the wrong\n * theme while every `.tempest_*` rule was correct.\n *\n * @param tokensCss - Contents of `tokens.css`.\n * @param usage - The CSS the app will load, plus its own source, scanned for reads.\n * @returns The narrowed sheet, or `null` when a token name is built at runtime and\n *   no static answer is safe.\n */\nexport function narrowTokens(tokensCss: string, usage: string): string | null {\n    if (DYNAMIC_TOKEN.test(usage)) return null;\n\n    const blocks = parseTokenBlocks(tokensCss);\n    const reached = reachableTokens(blocks, usage);\n    if (reached.size === 0) return null;\n\n    const out: string[] = [];\n    for (const block of blocks) {\n        const kept = [...block.declarations].filter(\n            ([name]) => name.startsWith(\"--\") === false || reached.has(name),\n        );\n        if (kept.every(([name]) => name.startsWith(\"--\") === false)) continue;\n        out.push(`${block.selector}{${kept.map(([name, value]) => `${name}:${value}`).join(\";\")}}`);\n    }\n    return out.join(\"\\n\");\n}\n"],"mappings":"AAoCA,IAAM,EAAkB,6BAWlB,EAAgB,2DAatB,SAAgB,EAAiB,EAA2B,CACxD,IAAM,EAAuB,CAAC,EAC9B,IAAK,IAAM,KAAS,EAAI,SAAS,uBAAuB,EAAG,CACvD,IAAM,EAAe,IAAI,IACzB,IAAK,IAAM,KAAgB,EAAM,IAAM,GAAA,CAAI,MAAM,GAAG,EAAG,CACnD,IAAM,EAAQ,EAAY,QAAQ,GAAG,EACrC,GAAI,EAAQ,EAAG,SACf,IAAM,EAAO,EAAY,MAAM,EAAG,CAAK,CAAC,CAAC,KAAK,EAC1C,GAAM,EAAa,IAAI,EAAM,EAAY,MAAM,EAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CACxE,CACI,EAAa,OAAS,GAC1B,EAAO,KAAK,CAAE,UAAW,EAAM,IAAM,GAAA,CAAI,KAAK,EAAG,cAAa,CAAC,CACnE,CACA,OAAO,CACX,CASA,SAAgB,EAAgB,EAA+B,EAA4B,CACvF,IAAM,EAAW,IAAI,IACrB,IAAK,IAAM,KAAS,EAAQ,IAAK,IAAM,KAAQ,EAAM,aAAa,KAAK,EAAG,EAAS,IAAI,CAAI,EAE3F,IAAM,EAAU,IAAI,IACd,EAAQ,CAAC,GAAG,EAAM,SAAS,CAAe,CAAC,CAAC,CAAC,IAAK,GAAU,EAAM,IAAM,EAAE,EAChF,KAAO,EAAM,OAAS,GAAG,CACrB,IAAM,EAAQ,EAAM,IAAI,GAAK,GACzB,MAAQ,IAAI,CAAK,GAAM,EAAS,IAAI,CAAK,EAC7C,GAAQ,IAAI,CAAK,EACjB,IAAK,IAAM,KAAS,EAAQ,CACxB,IAAM,EAAQ,EAAM,aAAa,IAAI,CAAK,EACtC,OAAU,IAAA,GACd,IAAK,IAAM,KAAS,EAAM,SAAS,CAAe,EAAG,EAAM,KAAK,EAAM,IAAM,EAAE,CAClF,CALiB,CAMrB,CACA,OAAO,CACX,CAeA,SAAgB,EAAa,EAAmB,EAA8B,CAC1E,GAAI,EAAc,KAAK,CAAK,EAAG,OAAO,KAEtC,IAAM,EAAS,EAAiB,CAAS,EACnC,EAAU,EAAgB,EAAQ,CAAK,EAC7C,GAAI,EAAQ,OAAS,EAAG,OAAO,KAE/B,IAAM,EAAgB,CAAC,EACvB,IAAK,IAAM,KAAS,EAAQ,CACxB,IAAM,EAAO,CAAC,GAAG,EAAM,YAAY,CAAC,CAAC,QAChC,CAAC,KAAU,EAAK,WAAW,IAAI,IAAM,IAAS,EAAQ,IAAI,CAAI,CACnE,EACI,EAAK,OAAO,CAAC,KAAU,EAAK,WAAW,IAAI,IAAM,EAAK,GAC1D,EAAI,KAAK,GAAG,EAAM,SAAS,GAAG,EAAK,KAAK,CAAC,EAAM,KAAW,GAAG,EAAK,GAAG,GAAO,CAAC,CAAC,KAAK,GAAG,EAAE,EAAE,CAC9F,CACA,OAAO,EAAI,KAAK;CAAI,CACxB"}
+{"version":3,"file":"narrow-tokens.cjs","names":["TOKEN_REFERENCE","DYNAMIC_TOKEN","parseTokenBlocks","blocks","match","css","declarations","declaration","colon","name","reachableTokens","declared","block","reached","queue","usage","token","value","narrowTokens","tokensCss","out","kept"],"sources":["../../src/vite/narrow-tokens.ts"],"sourcesContent":["/**\n * Cut the token sheet down to the tokens a set of stylesheets can reach.\n *\n * Once every component loads its own stylesheet, `tokens.css` stops being a rounding\n * error and becomes the biggest single thing an app downloads: measured on a probe\n * app mounting `Button`, `Card` and `Badge`, the sheet is 2516 B brotli of a 4927 B\n * total. The components read 105 of its 223 tokens, so the other 118 are bytes\n * nothing on the page can consult.\n *\n * The cut is a reachability closure, not a filter: a token's value routinely names\n * another token (`--tempest-primary: var(--tempest-primary-500)`), so keeping only\n * the names a stylesheet mentions literally would keep aliases whose targets were\n * dropped — `var()` would resolve to nothing and the component would render with the\n * property unset, which is worse than shipping the whole sheet.\n */\n\n/** A token block: one selector and the custom properties it declares, in order. */\ninterface TokenBlock {\n    /** The block's selector text, e.g. `:root` or `[data-tempest-theme=dark]`. */\n    selector: string;\n    /** Declaration name → value, in source order. */\n    declarations: Map<string, string>;\n}\n\n/**\n * Any custom property being read, not only the `--tempest-*` ones.\n *\n * Deliberately wider than the tokens this cut is about. `tokens.css` also carries\n * the `--lightningcss-light`/`--lightningcss-dark` pair the compiler emits, which\n * nothing reads today — measured: two declarations, zero reads — and which a\n * `--tempest-`-only scan would therefore always drop. That is the right answer right\n * up until one rule uses `light-dark()`, at which point the compiler emits the read\n * and a narrow scan would drop the pair it depends on. Matching every custom\n * property costs nothing (a name the sheet does not declare is discarded) and makes\n * the closure correct for names this file does not know about.\n */\nconst TOKEN_REFERENCE = /var\\(\\s*(--[A-Za-z0-9-]+)/g;\n\n/**\n * A token name being assembled at runtime rather than written out.\n *\n * `style={{ color: `var(--tempest-${tone})` }}` names a token no static scan can\n * know, so a cut made without it would drop the one the app is about to read. The\n * caller falls back to the whole sheet when this matches — the same shape as the\n * plugin's own namespace-import fallback, and for the same reason: serve more than\n * asked for rather than less than needed.\n */\nconst DYNAMIC_TOKEN = /--tempest-[A-Za-z0-9-]*(?:\\$\\{|[\"'`]\\s*\\+|\\s*\\+\\s*[\"'`])/;\n\n/**\n * Parse a token stylesheet into its blocks.\n *\n * Written against the compiler's own output, which is already valid and flat — every\n * block in `tokens.css` is either a bare selector or one nested inside a single\n * at-rule — so a brace-depth reader is enough and a full parser would not be more\n * correct here.\n *\n * @param css - Contents of `tokens.css`.\n * @returns One entry per block that declares anything.\n */\nexport function parseTokenBlocks(css: string): TokenBlock[] {\n    const blocks: TokenBlock[] = [];\n    for (const match of css.matchAll(/([^{}]+)\\{([^{}]*)\\}/g)) {\n        const declarations = new Map<string, string>();\n        for (const declaration of (match[2] ?? \"\").split(\";\")) {\n            const colon = declaration.indexOf(\":\");\n            if (colon < 0) continue;\n            const name = declaration.slice(0, colon).trim();\n            if (name) declarations.set(name, declaration.slice(colon + 1).trim());\n        }\n        if (declarations.size === 0) continue;\n        blocks.push({ selector: (match[1] ?? \"\").trim(), declarations });\n    }\n    return blocks;\n}\n\n/**\n * Every token a body of CSS reaches, following token-to-token references.\n *\n * @param blocks - The parsed token sheet.\n * @param usage - CSS and source text to scan for `var(--tempest-*)`.\n * @returns The reachable token names.\n */\nexport function reachableTokens(blocks: readonly TokenBlock[], usage: string): Set<string> {\n    const declared = new Set<string>();\n    for (const block of blocks) for (const name of block.declarations.keys()) declared.add(name);\n\n    const reached = new Set<string>();\n    const queue = [...usage.matchAll(TOKEN_REFERENCE)].map((match) => match[1] ?? \"\");\n    while (queue.length > 0) {\n        const token = queue.pop() ?? \"\";\n        if (reached.has(token) || !declared.has(token)) continue;\n        reached.add(token);\n        for (const block of blocks) {\n            const value = block.declarations.get(token);\n            if (value === undefined) continue;\n            for (const match of value.matchAll(TOKEN_REFERENCE)) queue.push(match[1] ?? \"\");\n        }\n    }\n    return reached;\n}\n\n/**\n * Rebuild the token sheet with only the tokens a set of stylesheets reaches.\n *\n * Companion declarations that are not custom properties travel with the block that\n * survives — `color-scheme` is the one, and dropping it would leave the browser\n * painting its own surfaces (scrollbar, `<select>` popup, autofill) in the wrong\n * theme while every `.tempest_*` rule was correct.\n *\n * @param tokensCss - Contents of `tokens.css`.\n * @param usage - The CSS the app will load, plus its own source, scanned for reads.\n * @returns The narrowed sheet, or `null` when a token name is built at runtime and\n *   no static answer is safe.\n */\nexport function narrowTokens(tokensCss: string, usage: string): string | null {\n    if (DYNAMIC_TOKEN.test(usage)) return null;\n\n    const blocks = parseTokenBlocks(tokensCss);\n    const reached = reachableTokens(blocks, usage);\n    if (reached.size === 0) return null;\n\n    const out: string[] = [];\n    for (const block of blocks) {\n        const kept = [...block.declarations].filter(\n            ([name]) => name.startsWith(\"--\") === false || reached.has(name),\n        );\n        if (kept.every(([name]) => name.startsWith(\"--\") === false)) continue;\n        out.push(`${block.selector}{${kept.map(([name, value]) => `${name}:${value}`).join(\";\")}}`);\n    }\n    return out.join(\"\\n\");\n}\n"],"mappings":"AAoCA,IAAMA,EAAkB,6BAWlBC,EAAgB,2DAatB,SAAgBC,EAAiB,EAA2B,CACxD,IAAMC,EAAuB,CAAC,EAC9B,IAAK,IAAMC,KAASC,EAAI,SAAS,uBAAuB,EAAG,CACvD,IAAMC,EAAe,IAAI,IACzB,IAAK,IAAMC,KAAgBH,EAAM,IAAM,GAAA,CAAI,MAAM,GAAG,EAAG,CACnD,IAAMI,EAAQD,EAAY,QAAQ,GAAG,EACrC,GAAIC,EAAQ,EAAG,SACf,IAAMC,EAAOF,EAAY,MAAM,EAAGC,CAAK,CAAC,CAAC,KAAK,EAC1CC,GAAMH,EAAa,IAAIG,EAAMF,EAAY,MAAMC,EAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CACxE,CACIF,EAAa,OAAS,GAC1BH,EAAO,KAAK,CAAE,UAAWC,EAAM,IAAM,GAAA,CAAI,KAAK,EAAG,cAAa,CAAC,CACnE,CACA,OAAOD,CACX,CASA,SAAgBO,EAAgB,EAA+B,EAA4B,CACvF,IAAMC,EAAW,IAAI,IACrB,IAAK,IAAMC,KAAST,EAAQ,IAAK,IAAMM,KAAQG,EAAM,aAAa,KAAK,EAAGD,EAAS,IAAIF,CAAI,EAE3F,IAAMI,EAAU,IAAI,IACdC,EAAQ,CAAC,GAAGC,EAAM,SAASf,CAAe,CAAC,CAAC,CAAC,IAAK,GAAUI,EAAM,IAAM,EAAE,EAChF,KAAOU,EAAM,OAAS,GAAG,CACrB,IAAME,EAAQF,EAAM,IAAI,GAAK,GAC7B,GAAI,GAAQ,IAAIE,CAAK,GAAML,EAAS,IAAIK,CAAK,EAC7C,GAAQ,IAAIA,CAAK,EACjB,IAAK,IAAMJ,KAAST,EAAQ,CACxB,IAAMc,EAAQL,EAAM,aAAa,IAAII,CAAK,EAC1C,GAAIC,IAAU,IAAA,GACd,IAAK,IAAMb,KAASa,EAAM,SAASjB,CAAe,EAAGc,EAAM,KAAKV,EAAM,IAAM,EAAE,CAClF,CALiB,CAMrB,CACA,OAAOS,CACX,CAeA,SAAgBK,EAAa,EAAmB,EAA8B,CAC1E,GAAIjB,EAAc,KAAKc,CAAK,EAAG,OAAO,KAEtC,IAAMZ,EAASD,EAAiBiB,CAAS,EACnCN,EAAUH,EAAgBP,EAAQY,CAAK,EAC7C,GAAIF,EAAQ,OAAS,EAAG,OAAO,KAE/B,IAAMO,EAAgB,CAAC,EACvB,IAAK,IAAMR,KAAST,EAAQ,CACxB,IAAMkB,EAAO,CAAC,GAAGT,EAAM,YAAY,CAAC,CAAC,QAChC,CAACH,KAAUA,EAAK,WAAW,IAAI,IAAM,IAASI,EAAQ,IAAIJ,CAAI,CACnE,EACIY,EAAK,OAAO,CAACZ,KAAUA,EAAK,WAAW,IAAI,IAAM,EAAK,GAC1DW,EAAI,KAAK,GAAGR,EAAM,SAAS,GAAGS,EAAK,KAAK,CAACZ,EAAMQ,KAAW,GAAGR,EAAK,GAAGQ,GAAO,CAAC,CAAC,KAAK,GAAG,EAAE,EAAE,CAC9F,CACA,OAAOG,EAAI,KAAK;CAAI,CACxB,C"}

package/dist/vite/narrow-tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"narrow-tokens.js","names":[],"sources":["../../src/vite/narrow-tokens.ts"],"sourcesContent":["/**\n * Cut the token sheet down to the tokens a set of stylesheets can reach.\n *\n * Once every component loads its own stylesheet, `tokens.css` stops being a rounding\n * error and becomes the biggest single thing an app downloads: measured on a probe\n * app mounting `Button`, `Card` and `Badge`, the sheet is 2516 B brotli of a 4927 B\n * total. The components read 105 of its 223 tokens, so the other 118 are bytes\n * nothing on the page can consult.\n *\n * The cut is a reachability closure, not a filter: a token's value routinely names\n * another token (`--tempest-primary: var(--tempest-primary-500)`), so keeping only\n * the names a stylesheet mentions literally would keep aliases whose targets were\n * dropped — `var()` would resolve to nothing and the component would render with the\n * property unset, which is worse than shipping the whole sheet.\n */\n\n/** A token block: one selector and the custom properties it declares, in order. */\ninterface TokenBlock {\n    /** The block's selector text, e.g. `:root` or `[data-tempest-theme=dark]`. */\n    selector: string;\n    /** Declaration name → value, in source order. */\n    declarations: Map<string, string>;\n}\n\n/**\n * Any custom property being read, not only the `--tempest-*` ones.\n *\n * Deliberately wider than the tokens this cut is about. `tokens.css` also carries\n * the `--lightningcss-light`/`--lightningcss-dark` pair the compiler emits, which\n * nothing reads today — measured: two declarations, zero reads — and which a\n * `--tempest-`-only scan would therefore always drop. That is the right answer right\n * up until one rule uses `light-dark()`, at which point the compiler emits the read\n * and a narrow scan would drop the pair it depends on. Matching every custom\n * property costs nothing (a name the sheet does not declare is discarded) and makes\n * the closure correct for names this file does not know about.\n */\nconst TOKEN_REFERENCE = /var\\(\\s*(--[A-Za-z0-9-]+)/g;\n\n/**\n * A token name being assembled at runtime rather than written out.\n *\n * `style={{ color: `var(--tempest-${tone})` }}` names a token no static scan can\n * know, so a cut made without it would drop the one the app is about to read. The\n * caller falls back to the whole sheet when this matches — the same shape as the\n * plugin's own namespace-import fallback, and for the same reason: serve more than\n * asked for rather than less than needed.\n */\nconst DYNAMIC_TOKEN = /--tempest-[A-Za-z0-9-]*(?:\\$\\{|[\"'`]\\s*\\+|\\s*\\+\\s*[\"'`])/;\n\n/**\n * Parse a token stylesheet into its blocks.\n *\n * Written against the compiler's own output, which is already valid and flat — every\n * block in `tokens.css` is either a bare selector or one nested inside a single\n * at-rule — so a brace-depth reader is enough and a full parser would not be more\n * correct here.\n *\n * @param css - Contents of `tokens.css`.\n * @returns One entry per block that declares anything.\n */\nexport function parseTokenBlocks(css: string): TokenBlock[] {\n    const blocks: TokenBlock[] = [];\n    for (const match of css.matchAll(/([^{}]+)\\{([^{}]*)\\}/g)) {\n        const declarations = new Map<string, string>();\n        for (const declaration of (match[2] ?? \"\").split(\";\")) {\n            const colon = declaration.indexOf(\":\");\n            if (colon < 0) continue;\n            const name = declaration.slice(0, colon).trim();\n            if (name) declarations.set(name, declaration.slice(colon + 1).trim());\n        }\n        if (declarations.size === 0) continue;\n        blocks.push({ selector: (match[1] ?? \"\").trim(), declarations });\n    }\n    return blocks;\n}\n\n/**\n * Every token a body of CSS reaches, following token-to-token references.\n *\n * @param blocks - The parsed token sheet.\n * @param usage - CSS and source text to scan for `var(--tempest-*)`.\n * @returns The reachable token names.\n */\nexport function reachableTokens(blocks: readonly TokenBlock[], usage: string): Set<string> {\n    const declared = new Set<string>();\n    for (const block of blocks) for (const name of block.declarations.keys()) declared.add(name);\n\n    const reached = new Set<string>();\n    const queue = [...usage.matchAll(TOKEN_REFERENCE)].map((match) => match[1] ?? \"\");\n    while (queue.length > 0) {\n        const token = queue.pop() ?? \"\";\n        if (reached.has(token) || !declared.has(token)) continue;\n        reached.add(token);\n        for (const block of blocks) {\n            const value = block.declarations.get(token);\n            if (value === undefined) continue;\n            for (const match of value.matchAll(TOKEN_REFERENCE)) queue.push(match[1] ?? \"\");\n        }\n    }\n    return reached;\n}\n\n/**\n * Rebuild the token sheet with only the tokens a set of stylesheets reaches.\n *\n * Companion declarations that are not custom properties travel with the block that\n * survives — `color-scheme` is the one, and dropping it would leave the browser\n * painting its own surfaces (scrollbar, `<select>` popup, autofill) in the wrong\n * theme while every `.tempest_*` rule was correct.\n *\n * @param tokensCss - Contents of `tokens.css`.\n * @param usage - The CSS the app will load, plus its own source, scanned for reads.\n * @returns The narrowed sheet, or `null` when a token name is built at runtime and\n *   no static answer is safe.\n */\nexport function narrowTokens(tokensCss: string, usage: string): string | null {\n    if (DYNAMIC_TOKEN.test(usage)) return null;\n\n    const blocks = parseTokenBlocks(tokensCss);\n    const reached = reachableTokens(blocks, usage);\n    if (reached.size === 0) return null;\n\n    const out: string[] = [];\n    for (const block of blocks) {\n        const kept = [...block.declarations].filter(\n            ([name]) => name.startsWith(\"--\") === false || reached.has(name),\n        );\n        if (kept.every(([name]) => name.startsWith(\"--\") === false)) continue;\n        out.push(`${block.selector}{${kept.map(([name, value]) => `${name}:${value}`).join(\";\")}}`);\n    }\n    return out.join(\"\\n\");\n}\n"],"mappings":";AAoCA,IAAM,IAAkB,8BAWlB,IAAgB;AAatB,SAAgB,EAAiB,GAA2B;CACxD,IAAM,IAAuB,CAAC;CAC9B,KAAK,IAAM,KAAS,EAAI,SAAS,uBAAuB,GAAG;EACvD,IAAM,oBAAe,IAAI,IAAoB;EAC7C,KAAK,IAAM,MAAgB,EAAM,MAAM,GAAA,CAAI,MAAM,GAAG,GAAG;GACnD,IAAM,IAAQ,EAAY,QAAQ,GAAG;GACrC,IAAI,IAAQ,GAAG;GACf,IAAM,IAAO,EAAY,MAAM,GAAG,CAAK,CAAC,CAAC,KAAK;GAC9C,AAAI,KAAM,EAAa,IAAI,GAAM,EAAY,MAAM,IAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;EACxE;EACI,EAAa,SAAS,KAC1B,EAAO,KAAK;GAAE,WAAW,EAAM,MAAM,GAAA,CAAI,KAAK;GAAG;EAAa,CAAC;CACnE;CACA,OAAO;AACX;AASA,SAAgB,EAAgB,GAA+B,GAA4B;CACvF,IAAM,oBAAW,IAAI,IAAY;CACjC,KAAK,IAAM,KAAS,GAAQ,KAAK,IAAM,KAAQ,EAAM,aAAa,KAAK,GAAG,EAAS,IAAI,CAAI;CAE3F,IAAM,oBAAU,IAAI,IAAY,GAC1B,IAAQ,CAAC,GAAG,EAAM,SAAS,CAAe,CAAC,CAAC,CAAC,KAAK,MAAU,EAAM,MAAM,EAAE;CAChF,OAAO,EAAM,SAAS,IAAG;EACrB,IAAM,IAAQ,EAAM,IAAI,KAAK;EACzB,OAAQ,IAAI,CAAK,KAAM,EAAS,IAAI,CAAK,GAC7C;KAAQ,IAAI,CAAK;GACjB,KAAK,IAAM,KAAS,GAAQ;IACxB,IAAM,IAAQ,EAAM,aAAa,IAAI,CAAK;IACtC,UAAU,KAAA,GACd,KAAK,IAAM,KAAS,EAAM,SAAS,CAAe,GAAG,EAAM,KAAK,EAAM,MAAM,EAAE;GAClF;EALiB;CAMrB;CACA,OAAO;AACX;AAeA,SAAgB,EAAa,GAAmB,GAA8B;CAC1E,IAAI,EAAc,KAAK,CAAK,GAAG,OAAO;CAEtC,IAAM,IAAS,EAAiB,CAAS,GACnC,IAAU,EAAgB,GAAQ,CAAK;CAC7C,IAAI,EAAQ,SAAS,GAAG,OAAO;CAE/B,IAAM,IAAgB,CAAC;CACvB,KAAK,IAAM,KAAS,GAAQ;EACxB,IAAM,IAAO,CAAC,GAAG,EAAM,YAAY,CAAC,CAAC,QAChC,CAAC,OAAU,EAAK,WAAW,IAAI,MAAM,MAAS,EAAQ,IAAI,CAAI,CACnE;EACI,EAAK,OAAO,CAAC,OAAU,EAAK,WAAW,IAAI,MAAM,EAAK,KAC1D,EAAI,KAAK,GAAG,EAAM,SAAS,GAAG,EAAK,KAAK,CAAC,GAAM,OAAW,GAAG,EAAK,GAAG,GAAO,CAAC,CAAC,KAAK,GAAG,EAAE,EAAE;CAC9F;CACA,OAAO,EAAI,KAAK,IAAI;AACxB"}
+{"version":3,"file":"narrow-tokens.js","names":["TOKEN_REFERENCE","DYNAMIC_TOKEN","parseTokenBlocks","blocks","match","css","declarations","declaration","colon","name","reachableTokens","declared","block","reached","queue","usage","token","value","narrowTokens","tokensCss","out","kept"],"sources":["../../src/vite/narrow-tokens.ts"],"sourcesContent":["/**\n * Cut the token sheet down to the tokens a set of stylesheets can reach.\n *\n * Once every component loads its own stylesheet, `tokens.css` stops being a rounding\n * error and becomes the biggest single thing an app downloads: measured on a probe\n * app mounting `Button`, `Card` and `Badge`, the sheet is 2516 B brotli of a 4927 B\n * total. The components read 105 of its 223 tokens, so the other 118 are bytes\n * nothing on the page can consult.\n *\n * The cut is a reachability closure, not a filter: a token's value routinely names\n * another token (`--tempest-primary: var(--tempest-primary-500)`), so keeping only\n * the names a stylesheet mentions literally would keep aliases whose targets were\n * dropped — `var()` would resolve to nothing and the component would render with the\n * property unset, which is worse than shipping the whole sheet.\n */\n\n/** A token block: one selector and the custom properties it declares, in order. */\ninterface TokenBlock {\n    /** The block's selector text, e.g. `:root` or `[data-tempest-theme=dark]`. */\n    selector: string;\n    /** Declaration name → value, in source order. */\n    declarations: Map<string, string>;\n}\n\n/**\n * Any custom property being read, not only the `--tempest-*` ones.\n *\n * Deliberately wider than the tokens this cut is about. `tokens.css` also carries\n * the `--lightningcss-light`/`--lightningcss-dark` pair the compiler emits, which\n * nothing reads today — measured: two declarations, zero reads — and which a\n * `--tempest-`-only scan would therefore always drop. That is the right answer right\n * up until one rule uses `light-dark()`, at which point the compiler emits the read\n * and a narrow scan would drop the pair it depends on. Matching every custom\n * property costs nothing (a name the sheet does not declare is discarded) and makes\n * the closure correct for names this file does not know about.\n */\nconst TOKEN_REFERENCE = /var\\(\\s*(--[A-Za-z0-9-]+)/g;\n\n/**\n * A token name being assembled at runtime rather than written out.\n *\n * `style={{ color: `var(--tempest-${tone})` }}` names a token no static scan can\n * know, so a cut made without it would drop the one the app is about to read. The\n * caller falls back to the whole sheet when this matches — the same shape as the\n * plugin's own namespace-import fallback, and for the same reason: serve more than\n * asked for rather than less than needed.\n */\nconst DYNAMIC_TOKEN = /--tempest-[A-Za-z0-9-]*(?:\\$\\{|[\"'`]\\s*\\+|\\s*\\+\\s*[\"'`])/;\n\n/**\n * Parse a token stylesheet into its blocks.\n *\n * Written against the compiler's own output, which is already valid and flat — every\n * block in `tokens.css` is either a bare selector or one nested inside a single\n * at-rule — so a brace-depth reader is enough and a full parser would not be more\n * correct here.\n *\n * @param css - Contents of `tokens.css`.\n * @returns One entry per block that declares anything.\n */\nexport function parseTokenBlocks(css: string): TokenBlock[] {\n    const blocks: TokenBlock[] = [];\n    for (const match of css.matchAll(/([^{}]+)\\{([^{}]*)\\}/g)) {\n        const declarations = new Map<string, string>();\n        for (const declaration of (match[2] ?? \"\").split(\";\")) {\n            const colon = declaration.indexOf(\":\");\n            if (colon < 0) continue;\n            const name = declaration.slice(0, colon).trim();\n            if (name) declarations.set(name, declaration.slice(colon + 1).trim());\n        }\n        if (declarations.size === 0) continue;\n        blocks.push({ selector: (match[1] ?? \"\").trim(), declarations });\n    }\n    return blocks;\n}\n\n/**\n * Every token a body of CSS reaches, following token-to-token references.\n *\n * @param blocks - The parsed token sheet.\n * @param usage - CSS and source text to scan for `var(--tempest-*)`.\n * @returns The reachable token names.\n */\nexport function reachableTokens(blocks: readonly TokenBlock[], usage: string): Set<string> {\n    const declared = new Set<string>();\n    for (const block of blocks) for (const name of block.declarations.keys()) declared.add(name);\n\n    const reached = new Set<string>();\n    const queue = [...usage.matchAll(TOKEN_REFERENCE)].map((match) => match[1] ?? \"\");\n    while (queue.length > 0) {\n        const token = queue.pop() ?? \"\";\n        if (reached.has(token) || !declared.has(token)) continue;\n        reached.add(token);\n        for (const block of blocks) {\n            const value = block.declarations.get(token);\n            if (value === undefined) continue;\n            for (const match of value.matchAll(TOKEN_REFERENCE)) queue.push(match[1] ?? \"\");\n        }\n    }\n    return reached;\n}\n\n/**\n * Rebuild the token sheet with only the tokens a set of stylesheets reaches.\n *\n * Companion declarations that are not custom properties travel with the block that\n * survives — `color-scheme` is the one, and dropping it would leave the browser\n * painting its own surfaces (scrollbar, `<select>` popup, autofill) in the wrong\n * theme while every `.tempest_*` rule was correct.\n *\n * @param tokensCss - Contents of `tokens.css`.\n * @param usage - The CSS the app will load, plus its own source, scanned for reads.\n * @returns The narrowed sheet, or `null` when a token name is built at runtime and\n *   no static answer is safe.\n */\nexport function narrowTokens(tokensCss: string, usage: string): string | null {\n    if (DYNAMIC_TOKEN.test(usage)) return null;\n\n    const blocks = parseTokenBlocks(tokensCss);\n    const reached = reachableTokens(blocks, usage);\n    if (reached.size === 0) return null;\n\n    const out: string[] = [];\n    for (const block of blocks) {\n        const kept = [...block.declarations].filter(\n            ([name]) => name.startsWith(\"--\") === false || reached.has(name),\n        );\n        if (kept.every(([name]) => name.startsWith(\"--\") === false)) continue;\n        out.push(`${block.selector}{${kept.map(([name, value]) => `${name}:${value}`).join(\";\")}}`);\n    }\n    return out.join(\"\\n\");\n}\n"],"mappings":";AAoCA,IAAMA,IAAkB,8BAWlBC,IAAgB;AAatB,SAAgBC,EAAiB,GAA2B;CACxD,IAAMC,IAAuB,CAAC;CAC9B,KAAK,IAAMC,KAASC,EAAI,SAAS,uBAAuB,GAAG;EACvD,IAAMC,oBAAe,IAAI,IAAoB;EAC7C,KAAK,IAAMC,MAAgBH,EAAM,MAAM,GAAA,CAAI,MAAM,GAAG,GAAG;GACnD,IAAMI,IAAQD,EAAY,QAAQ,GAAG;GACrC,IAAIC,IAAQ,GAAG;GACf,IAAMC,IAAOF,EAAY,MAAM,GAAGC,CAAK,CAAC,CAAC,KAAK;GAC9C,AAAIC,KAAMH,EAAa,IAAIG,GAAMF,EAAY,MAAMC,IAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;EACxE;EACA,AAAIF,EAAa,SAAS,KAC1BH,EAAO,KAAK;GAAE,WAAWC,EAAM,MAAM,GAAA,CAAI,KAAK;GAAG;EAAa,CAAC;CACnE;CACA,OAAOD;AACX;AASA,SAAgBO,EAAgB,GAA+B,GAA4B;CACvF,IAAMC,oBAAW,IAAI,IAAY;CACjC,KAAK,IAAMC,KAAST,GAAQ,KAAK,IAAMM,KAAQG,EAAM,aAAa,KAAK,GAAG,EAAS,IAAIH,CAAI;CAE3F,IAAMI,oBAAU,IAAI,IAAY,GAC1BC,IAAQ,CAAC,GAAGC,EAAM,SAASf,CAAe,CAAC,CAAC,CAAC,KAAK,MAAUI,EAAM,MAAM,EAAE;CAChF,OAAOU,EAAM,SAAS,IAAG;EACrB,IAAME,IAAQF,EAAM,IAAI,KAAK;EAC7B,IAAI,GAAQ,IAAIE,CAAK,KAAML,EAAS,IAAIK,CAAK,GAC7C;KAAQ,IAAIA,CAAK;GACjB,KAAK,IAAMJ,KAAST,GAAQ;IACxB,IAAMc,IAAQL,EAAM,aAAa,IAAII,CAAK;IAC1C,IAAIC,MAAU,KAAA,GACd,KAAK,IAAMb,KAASa,EAAM,SAASjB,CAAe,GAAG,EAAM,KAAKI,EAAM,MAAM,EAAE;GAClF;EALiB;CAMrB;CACA,OAAOS;AACX;AAeA,SAAgBK,EAAa,GAAmB,GAA8B;CAC1E,IAAIjB,EAAc,KAAKc,CAAK,GAAG,OAAO;CAEtC,IAAMZ,IAASD,EAAiBiB,CAAS,GACnCN,IAAUH,EAAgBP,GAAQY,CAAK;CAC7C,IAAIF,EAAQ,SAAS,GAAG,OAAO;CAE/B,IAAMO,IAAgB,CAAC;CACvB,KAAK,IAAMR,KAAST,GAAQ;EACxB,IAAMkB,IAAO,CAAC,GAAGT,EAAM,YAAY,CAAC,CAAC,QAChC,CAACH,OAAUA,EAAK,WAAW,IAAI,MAAM,MAASI,EAAQ,IAAIJ,CAAI,CACnE;EACA,AAAIY,EAAK,OAAO,CAACZ,OAAUA,EAAK,WAAW,IAAI,MAAM,EAAK,KAC1DW,EAAI,KAAK,GAAGR,EAAM,SAAS,GAAGS,EAAK,KAAK,CAACZ,GAAMQ,OAAW,GAAGR,EAAK,GAAGQ,GAAO,CAAC,CAAC,KAAK,GAAG,EAAE,EAAE;CAC9F;CACA,OAAOG,EAAI,KAAK,IAAI;AACxB"}

package/dist/vite/tempest-csp.cjs

@@ -1,3 +1,3 @@
-let e=require("node:crypto");var t=new Set([`frame-ancestors`,`report-uri`,`sandbox`]),n=[{module:/[\\/]forms[\\/]use-viacep\.(?:[cm]?js|tsx?)$/,origin:`https://viacep.com.br`,from:`tempest-react-sdk useViaCEP`}],r={"script-src-elem":[`script-src`,`default-src`],"script-src-attr":[`script-src`,`default-src`],"style-src-elem":[`style-src`,`default-src`],"style-src-attr":[`style-src`,`default-src`],"worker-src":[`child-src`,`script-src`,`default-src`],"frame-src":[`child-src`,`default-src`],"fenced-frame-src":[`frame-src`,`child-src`,`default-src`],"child-src":[`default-src`],"connect-src":[`default-src`],"font-src":[`default-src`],"img-src":[`default-src`],"manifest-src":[`default-src`],"media-src":[`default-src`],"object-src":[`default-src`],"prefetch-src":[`default-src`],"script-src":[`default-src`],"style-src":[`default-src`]};function i(e,t){for(let n of r[t]??[])if(n in e)return e[n]}var a=/^(?:https?|wss?):\/\//i,o=/^((?:https?|wss?):\/\/\*\.[a-z0-9.-]+(?::\d+)?)(?:[/?#].*)?$/i;function s(e,t){let n=e.trim();if(n.startsWith(`/`)&&!n.startsWith(`//`))return;let r=o.exec(n);if(r)return r[1].toLowerCase();if(a.test(n))try{let e=new URL(n);return`${e.protocol}//${e.host}`}catch{throw Error(`tempestCsp: ${t} is not a valid URL: "${e}"`)}throw Error(`tempestCsp: ${t} must be an absolute http(s)/ws(s) URL or a root-relative path, got "${e}"`)}function c(e){let t={};for(let n of e.split(`;`)){let[e,...r]=n.trim().split(/\s+/);if(!e)continue;let i=e.toLowerCase();i in t||(t[i]=r)}return t}function l(e,n){return Object.entries(e).filter(([e])=>n===`header`||!t.has(e)).map(([e,t])=>[e,...t].join(` `)).join(`; `)}function u(e,t){let n=e.filter(e=>e!==`'none'`||t.length===0);for(let e of t)n.includes(e)||n.push(e);return n.length===0?[`'none'`]:n}function d(t){return`'sha256-${(0,e.createHash)(`sha256`).update(t,`utf8`).digest(`base64`)}'`}function f(e){return e.replace(/&#39;|&#x27;|&apos;/gi,`'`).replace(/&quot;/gi,`"`).replace(/&amp;/gi,`&`)}function p(e){let t={};for(let n of e.matchAll(/([^\s=<>/]+)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/g))t[n[1].toLowerCase()]=f(n[2]??n[3]??n[4]??``);return t}function m(e){let t=[...e.matchAll(/<meta\b[^>]*>/gi)].filter(e=>p(e[0])[`http-equiv`]?.toLowerCase()===`content-security-policy`);if(t.length===0)return{html:e};if(t.length>1)throw Error(`tempestCsp: index.html declares more than one Content-Security-Policy <meta>; merge them into one`);let n=t[0];return{html:e.slice(0,n.index)+e.slice(n.index+n[0].length).replace(/^[ \t]*\r?\n/,``),declared:c(p(n[0]).content??``)}}function h(e,t){let n=RegExp(`<${t}\\b([^>]*)>([\\s\\S]*?)</${t}>`,`gi`),r=[];for(let i of e.matchAll(n)){let e=p(`<x ${i[1]}>`);if(t===`script`&&`src`in e||i[2].length===0)continue;let n=d(i[2]);r.includes(n)||r.push(n)}return r}function g(e,t){let n=`<meta http-equiv="Content-Security-Policy" content="${t.replace(/&/g,`&amp;`).replace(/"/g,`&quot;`)}" />`,r=/<meta\b[^>]*\bcharset\s*=[^>]*>/i.exec(e),i=/<head\b[^>]*>/i.exec(e),a=r!==null&&i!==null&&/<(?:script|link|style)\b/i.test(e.slice(i.index,r.index)),o=r&&i&&r.index>i.index&&!a?r:i;if(!o)return`${n}\n${e}`;let s=o.index+o[0].length;return`${e.slice(0,s)}\n    ${n}${e.slice(s)}`}function _(e){let t=[];for(let n of Object.values(e.bundle??{}))n.type===`chunk`&&t.push(...n.moduleIds??Object.keys(n.modules??{}));return t}function v(e={}){let{connect:t=[],env:r=!0,sockets:o=!0,wasm:c=!0,inlineStyles:d=!0,directives:f={},dev:p=!0,log:v=!0,onPolicy:y}=e,b=Object.fromEntries(Object.entries(f).map(([e,t])=>[e.toLowerCase(),t])),x,S=[],C=``;function w(e,t,n){t===void 0||e.some(e=>e.origin===t)||e.push({origin:t,from:n})}function T(e){let n=[],i=e.env??{},o=[e.envPrefix??`VITE_`].flat();if(r===!0)for(let[e,t]of Object.entries(i))o.some(t=>e.startsWith(t))&&typeof t==`string`&&a.test(t.trim())&&w(n,s(t,`env ${e}`),`env ${e}`);else if(Array.isArray(r))for(let t of r){let r=i[t];if(typeof r!=`string`||r.trim()===``){e.logger.warn(`tempestCsp: env ${t} is empty — nothing added to connect-src`);continue}w(n,s(r,`env ${t}`),`env ${t}`)}return t.forEach((t,r)=>{if(!t||t.trim()===``){e.logger.warn(`tempestCsp: connect[${r}] is empty — skipped, nothing added to connect-src`);return}w(n,s(t,`connect[${r}]`),`connect[${r}]`)}),n}function E(e){let t=[...e];if(!o)return t;for(let{origin:n}of e){let e=n.replace(/^http(s?):/i,`ws$1:`);e!==n&&w(t,e,`sockets (${n})`)}return t}function D(e,t){let n=e?[`'self'`,e]:[`'self'`],r={"default-src":[...n],"script-src":c?[...n,`'wasm-unsafe-eval'`]:[...n],"style-src":d||t?[...n,`'unsafe-inline'`]:[...n],"img-src":[...n,`data:`,`blob:`],"font-src":[...n,`data:`],"media-src":[...n,`blob:`],"connect-src":[`'self'`,`blob:`,`data:`],"worker-src":[...n,`blob:`],"manifest-src":[...n],"object-src":[`'none'`],"base-uri":[`'self'`],"form-action":[`'self'`]};for(let[e,t]of Object.entries(b))t===!1?delete r[e]:r[e]=u(r[e]??[],t);return r}function O(e,t){let n={};for(let[r,a]of Object.entries(e)){if(r in t){n[r]=t[r];continue}let e=i(t,r),o=b[r];e===void 0?n[r]=a:Array.isArray(o)?n[r]=u(e,o):a.length===1&&a[0]===`'none'`&&(n[r]=a)}for(let[e,r]of Object.entries(t))n[e]??=r;for(let[e,r]of Object.entries(b)){if(!(e in t))continue;if(r===!1){delete n[e];continue}let i=r.filter(n=>!t[e].includes(n));i.length>0&&x?.logger.warn(`tempestCsp: index.html declares ${e}, so directives["${e}"] is not added to it (${i.join(` `)}); the plugin never loosens a declared policy — add them to the <meta> instead`)}return n}function k(e,t,n){if(!n||!x||n.includes(`'unsafe-inline'`)&&!n.some(e=>/^'(?:sha\d{3}|nonce)-/.test(e)))return;let r=h(e,`script`).filter(e=>!n.includes(e));r.length!==0&&x.logger.warn(`tempestCsp: the Content-Security-Policy declared in index.html blocks ${r.length} inline <script> (${t} ${n.join(` `)}); the plugin never loosens a declared policy, so add ${r.join(` `)} to ${t}`)}return{name:`tempest-csp`,configResolved(e){x=e,S=T(e)},transformIndexHtml:{order:`post`,handler(e,t){let r=x?.command===`serve`;if(r&&!p)return e;let o=E(S),c=x?.base??`/`,d=a.test(c)?s(c,`base`):void 0;d&&w(o,d,`base`);let f=r?[]:_(t);for(let e of n)(r||f.some(t=>e.module.test(t)))&&w(o,e.origin,e.from);let b=o,{html:T,declared:A={}}=m(e),j=D(d,r),M=e=>!(e in A)&&i(A,e)===void 0;M(`script-src`)&&!(`script-src-elem`in A)&&(j[`script-src`]=u(j[`script-src`]??[],h(T,`script`))),M(`style-src`)&&!(`style-src-elem`in A)&&!j[`style-src`]?.includes(`'unsafe-inline'`)&&(j[`style-src`]=u(j[`style-src`]??[],h(T,`style`)));let N=O(j,A),P=b.map(e=>e.origin),F=i(A,`connect-src`),I=N[`connect-src`]??F;I?.length===1&&I[0]===`'none'`&&(`connect-src`in A||F!==void 0)?P.length>0&&x?.logger.warn(`tempestCsp: index.html declares connect-src 'none'${`connect-src`in A?``:` (through default-src)`}, so these origins stay out and requests to them will be blocked: ${P.join(` `)}`):(`connect-src`in N||P.length>0||F===void 0)&&(N[`connect-src`]=u(I??[`'self'`],P));let L=`script-src-elem`in A?`script-src-elem`:`script-src`;k(T,L,N[L]??i(A,L));let R={directives:N,meta:l(N,`meta`),header:l(N,`header`),connect:b,command:r?`serve`:`build`};if(v&&x&&R.header!==C){C=R.header;let e=b.map(e=>`  ${e.origin}  ← ${e.from}`);x.logger.info([`tempest-csp: connect-src ${(N[`connect-src`]??F??[]).join(` `)}`,...e.length>0?e:[`  (no cross-origin endpoint: only 'self')`]].join(`
-`))}return y?.(R),g(T,R.meta)}}}}exports.cspOrigin=s,exports.parseCsp=c,exports.serializeCsp=l,exports.tempestCsp=v;
+let e=require("node:crypto");var t=new Set([`frame-ancestors`,`report-uri`,`sandbox`]),n=[{module:/[\\/]forms[\\/]use-viacep\.(?:[cm]?js|tsx?)$/,origin:`https://viacep.com.br`,from:`tempest-react-sdk useViaCEP`}],r={"script-src-elem":[`script-src`,`default-src`],"script-src-attr":[`script-src`,`default-src`],"style-src-elem":[`style-src`,`default-src`],"style-src-attr":[`style-src`,`default-src`],"worker-src":[`child-src`,`script-src`,`default-src`],"frame-src":[`child-src`,`default-src`],"fenced-frame-src":[`frame-src`,`child-src`,`default-src`],"child-src":[`default-src`],"connect-src":[`default-src`],"font-src":[`default-src`],"img-src":[`default-src`],"manifest-src":[`default-src`],"media-src":[`default-src`],"object-src":[`default-src`],"prefetch-src":[`default-src`],"script-src":[`default-src`],"style-src":[`default-src`]};function i(e,t){for(let n of r[t]??[])if(n in e)return e[n]}var a=/^(?:https?|wss?):\/\//i,o=/^((?:https?|wss?):\/\/\*\.[a-z0-9.-]+(?::\d+)?)(?:[/?#].*)?$/i;function s(e,t){let n=e.trim();if(n.startsWith(`/`)&&!n.startsWith(`//`))return;let r=o.exec(n);if(r)return r[1].toLowerCase();if(a.test(n))try{let e=new URL(n);return`${e.protocol}//${e.host}`}catch{throw Error(`tempestCsp: ${t} is not a valid URL: "${e}"`)}throw Error(`tempestCsp: ${t} must be an absolute http(s)/ws(s) URL or a root-relative path, got "${e}"`)}function c(e){let t={};for(let n of e.split(`;`)){let[e,...r]=n.trim().split(/\s+/);if(!e)continue;let i=e.toLowerCase();i in t||(t[i]=r)}return t}function l(e,n){return Object.entries(e).filter(([e])=>n===`header`||!t.has(e)).map(([e,t])=>[e,...t].join(` `)).join(`; `)}function u(e,t){return e.toLowerCase()===t}function d(e){return e.every(e=>u(e,`'none'`))}function f(e){return e.replace(/^'(?:sha\d{3}|nonce)-/i,e=>e.toLowerCase())}function p(e,t){let n=e.filter(e=>!u(e,`'none'`)||t.length===0);for(let e of t)n.includes(e)||n.push(e);return n.length===0?[`'none'`]:n}function m(t){return`'sha256-${(0,e.createHash)(`sha256`).update(t,`utf8`).digest(`base64`)}'`}function h(e){return e.replace(/&#39;|&#x27;|&apos;/gi,`'`).replace(/&quot;/gi,`"`).replace(/&amp;/gi,`&`)}function g(e){let t={};for(let n of e.matchAll(/([^\s=<>/]+)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/g))t[n[1].toLowerCase()]=h(n[2]??n[3]??n[4]??``);return t}function _(e){let t=[...e.matchAll(/<meta\b[^>]*>/gi)].filter(e=>g(e[0])[`http-equiv`]?.toLowerCase()===`content-security-policy`);if(t.length===0)return{html:e};if(t.length>1)throw Error(`tempestCsp: index.html declares more than one Content-Security-Policy <meta>; merge them into one`);let n=t[0];return{html:e.slice(0,n.index)+e.slice(n.index+n[0].length).replace(/^[ \t]*\r?\n/,``),declared:c(g(n[0]).content??``)}}function v(e,t){let n=RegExp(`<${t}\\b([^>]*)>([\\s\\S]*?)</${t}>`,`gi`),r=[];for(let i of e.matchAll(n)){let e=g(`<x ${i[1]}>`);if(t===`script`&&`src`in e||i[2].length===0)continue;let n=m(i[2]);r.includes(n)||r.push(n)}return r}function y(e,t){let n=`<meta http-equiv="Content-Security-Policy" content="${t.replace(/&/g,`&amp;`).replace(/"/g,`&quot;`)}" />`,r=/<meta\b[^>]*\bcharset\s*=[^>]*>/i.exec(e),i=/<head\b[^>]*>/i.exec(e),a=r!==null&&i!==null&&/<(?:script|link|style)\b/i.test(e.slice(i.index,r.index)),o=r&&i&&r.index>i.index&&!a?r:i;if(!o)return`${n}\n${e}`;let s=o.index+o[0].length;return`${e.slice(0,s)}\n    ${n}${e.slice(s)}`}function b(e){let t=[];for(let n of Object.values(e.bundle??{}))n.type===`chunk`&&t.push(...n.moduleIds??Object.keys(n.modules??{}));return t}function x(e={}){let{connect:t=[],env:r=!0,sockets:o=!0,wasm:c=!0,inlineStyles:m=!0,directives:h={},dev:g=!0,log:x=!0,onPolicy:S}=e,C=Object.fromEntries(Object.entries(h).map(([e,t])=>[e.toLowerCase(),t])),w,T=[],E=``;function D(e,t,n){t===void 0||e.some(e=>e.origin===t)||e.push({origin:t,from:n})}function O(e){let n=[],i=e.env??{},o=[e.envPrefix??`VITE_`].flat();if(r===!0)for(let[e,t]of Object.entries(i))o.some(t=>e.startsWith(t))&&typeof t==`string`&&a.test(t.trim())&&D(n,s(t,`env ${e}`),`env ${e}`);else if(Array.isArray(r))for(let t of r){let r=i[t];typeof r!=`string`||r.trim()===``?e.logger.warn(`tempestCsp: env ${t} is empty — nothing added to connect-src`):D(n,s(r,`env ${t}`),`env ${t}`)}return t.forEach((t,r)=>{!t||t.trim()===``?e.logger.warn(`tempestCsp: connect[${r}] is empty — skipped, nothing added to connect-src`):D(n,s(t,`connect[${r}]`),`connect[${r}]`)}),n}function k(e){let t=[...e];if(!o)return t;for(let{origin:n}of e){let e=n.replace(/^http(s?):/i,`ws$1:`);e!==n&&D(t,e,`sockets (${n})`)}return t}function A(e,t){let n=e?[`'self'`,e]:[`'self'`],r={"default-src":[...n],"script-src":c?[...n,`'wasm-unsafe-eval'`]:[...n],"style-src":m||t?[...n,`'unsafe-inline'`]:[...n],"img-src":[...n,`data:`,`blob:`],"font-src":[...n,`data:`],"media-src":[...n,`blob:`],"connect-src":[`'self'`,`blob:`,`data:`],"worker-src":[...n,`blob:`],"manifest-src":[...n],"object-src":[`'none'`],"base-uri":[`'self'`],"form-action":[`'self'`]};for(let[e,t]of Object.entries(C))t===!1?delete r[e]:r[e]=p(r[e]??[],t);return r}function j(e,t){let n={};for(let[r,a]of Object.entries(e)){if(r in t){n[r]=t[r];continue}let e=i(t,r),o=C[r];e===void 0?n[r]=a:Array.isArray(o)?n[r]=p(e,o):a.length>0&&d(a)&&(n[r]=a)}for(let[e,r]of Object.entries(t))n[e]??=r;for(let[e,r]of Object.entries(C)){if(!(e in t))continue;if(r===!1){delete n[e];continue}let i=r.filter(n=>!t[e].includes(n));i.length>0&&w?.logger.warn(`tempestCsp: index.html declares ${e}, so directives["${e}"] is not added to it (${i.join(` `)}); the plugin never loosens a declared policy — add them to the <meta> instead`)}return n}function M(e,t,n){if(!n||!w)return;let r=n.map(f);if(n.some(e=>u(e,`'unsafe-inline'`))&&!r.some(e=>/^'(?:sha\d{3}|nonce)-/.test(e)))return;let i=v(e,`script`).filter(e=>!r.includes(e));i.length!==0&&w.logger.warn(`tempestCsp: the Content-Security-Policy declared in index.html blocks ${i.length} inline <script> (${t} ${n.join(` `)}); the plugin never loosens a declared policy, so add ${i.join(` `)} to ${t}`)}return{name:`tempest-csp`,configResolved(e){w=e,T=O(e)},transformIndexHtml:{order:`post`,handler(e,t){let r=w?.command===`serve`;if(r&&!g)return e;let o=k(T),c=w?.base??`/`,f=a.test(c)?s(c,`base`):void 0;f&&D(o,f,`base`);let m=r?[]:b(t);for(let e of n)(r||m.some(t=>e.module.test(t)))&&D(o,e.origin,e.from);let h=o,{html:C,declared:O={}}=_(e),N=A(f,r),P=e=>!(e in O)&&i(O,e)===void 0;P(`script-src`)&&!(`script-src-elem`in O)&&(N[`script-src`]=p(N[`script-src`]??[],v(C,`script`))),P(`style-src`)&&!(`style-src-elem`in O)&&!N[`style-src`]?.some(e=>u(e,`'unsafe-inline'`))&&(N[`style-src`]=p(N[`style-src`]??[],v(C,`style`)));let F=j(N,O),I=h.map(e=>e.origin),L=i(O,`connect-src`),R=F[`connect-src`]??L;R!==void 0&&d(R)&&(`connect-src`in O||L!==void 0)?I.length>0&&w?.logger.warn(`tempestCsp: index.html declares connect-src ${R.join(` `)||`with no source`}${`connect-src`in O?``:` (through default-src)`}, so these origins stay out and requests to them will be blocked: ${I.join(` `)}`):(`connect-src`in F||I.length>0||L===void 0)&&(F[`connect-src`]=p(R??[`'self'`],I));let z=`script-src-elem`in O?`script-src-elem`:`script-src`;M(C,z,F[z]??i(O,z));let B={directives:F,meta:l(F,`meta`),header:l(F,`header`),connect:h,command:r?`serve`:`build`};if(x&&w&&B.header!==E){E=B.header;let e=h.map(e=>`  ${e.origin}  ← ${e.from}`);w.logger.info([`tempest-csp: connect-src ${(F[`connect-src`]??L??[]).join(` `)}`,...e.length>0?e:[`  (no cross-origin endpoint: only 'self')`]].join(`
+`))}return S?.(B),y(C,B.meta)}}}}exports.cspOrigin=s,exports.parseCsp=c,exports.serializeCsp=l,exports.tempestCsp=x;
 //# sourceMappingURL=tempest-csp.cjs.map

package/dist/vite/tempest-csp.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"tempest-csp.cjs","names":[],"sources":["../../src/vite/tempest-csp.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { IndexHtmlTransformContext, Plugin, ResolvedConfig } from \"vite\";\n\nimport type { TempestVitePlugin } from \"./tempest-pwa-manifest\";\n\n/** Options for {@link tempestCsp}. */\nexport interface TempestCspOptions {\n    /**\n     * Endpoints the app calls at runtime, as full URLs. Only the origin\n     * (`scheme://host[:port]`) enters `connect-src`: a source expression with a path\n     * matches that path alone, so `https://idp/realms/x` would still block\n     * `https://idp/realms/x/protocol/openid-connect/token`.\n     *\n     * Empty entries (`undefined`, `null`, `false`, `\"\"`) are skipped with a build\n     * warning instead of leaving a hole in the directive, so passing an env var\n     * that is not set is safe. A root-relative path (`/api`) is same-origin and\n     * already covered by `'self'`. Anything else that is not an absolute\n     * `http(s)`/`ws(s)` URL throws at config time — failing the build, not\n     * production. A wildcard host (`https://*.example.com`) is kept as written.\n     */\n    connect?: ReadonlyArray<string | null | undefined | false>;\n    /**\n     * Read origins from the same environment the runtime reads. `true` (the\n     * default) adds every variable Vite exposes to `import.meta.env` (the\n     * `envPrefix` ones, `VITE_` by default) whose value is an absolute\n     * `http(s)`/`ws(s)` URL. This is the structural bridge: an origin added to\n     * `.env` for a new runtime call lands in the policy with no second list to\n     * keep in sync. Pass a list of names to include exactly those — a name that\n     * resolves to nothing is reported as a build warning — or `false` to rely on\n     * {@link TempestCspOptions.connect} alone.\n     */\n    env?: boolean | readonly string[];\n    /**\n     * Also allow the WebSocket twin of every `http(s)` origin (`https://api` →\n     * `wss://api`). Measured in Chromium (23/09/2026): `connect-src https://api`\n     * blocks `new WebSocket(\"wss://api\")`, while `'self'` does cover a same-origin\n     * `ws:` — so an app that derives its socket URL from the API URL breaks\n     * without this. Default `true`.\n     */\n    sockets?: boolean;\n    /**\n     * Add `'wasm-unsafe-eval'` to `script-src`, which `onnxruntime-web` (the\n     * `/vision` and `/tabular` subpaths) needs to compile its WebAssembly. Without\n     * it `WebAssembly.compile` throws a `CompileError` naming `script-src`.\n     * It grants WebAssembly compilation only, not `eval`. Default `true`.\n     */\n    wasm?: boolean;\n    /**\n     * Add `'unsafe-inline'` to `style-src`. React's `style` prop does **not** need\n     * it — it writes through the CSSOM, which CSP does not govern (measured in\n     * Chromium, 23/09/2026). What needs it is a `<style>` element or a `style=\"\"`\n     * attribute, and the SDK's own `applyTheme` injects a `<style>`. Pass `false`\n     * when the app never calls `applyTheme`; inline `<style>` blocks in\n     * `index.html` are then hashed instead. Always on under `vite dev`, whose CSS\n     * injection is a `<style>` element. Default `true`.\n     */\n    inlineStyles?: boolean;\n    /**\n     * Extra sources per directive, merged into the defaults (`{ \"img-src\":\n     * [\"https://tiles.example.com\"] }`), or `false` to drop a directive.\n     * `frame-ancestors`, `report-uri` and `sandbox` are ignored by browsers when\n     * delivered by `<meta>`, so they reach {@link TempestCspPolicy.header} only.\n     */\n    directives?: Readonly<Record<string, readonly string[] | false>>;\n    /**\n     * Apply the policy under `vite dev` too. Default `true`: the failure this\n     * plugin exists for is \"works in dev, blocked in production\", and a policy\n     * enforced in dev moves every missing origin to the first page load on the\n     * developer's machine. Dev differs from build only in `style-src\n     * 'unsafe-inline'` and in allowing every SDK-known origin (see\n     * {@link TempestCspPolicy.connect}), because the dev server cannot know which\n     * modules the page will load.\n     */\n    dev?: boolean;\n    /** Print the resolved `connect-src` and where each origin came from. Default `true`. */\n    log?: boolean;\n    /**\n     * Receive the resolved policy — for asserting it in a test, or for writing the\n     * same policy as an HTTP header (the only channel for `frame-ancestors`).\n     */\n    onPolicy?: (policy: TempestCspPolicy) => void;\n}\n\n/** One origin in `connect-src` and the input that put it there. */\nexport interface TempestCspSource {\n    /** The source expression, e.g. `https://api.example.com`. */\n    origin: string;\n    /** Where it came from: `env VITE_API_URL`, `connect[0]`, `sockets`, `base` or an SDK module. */\n    from: string;\n}\n\n/** The policy {@link tempestCsp} resolved for one `index.html`. */\nexport interface TempestCspPolicy {\n    /** Every directive and its sources, including the header-only ones. */\n    directives: Record<string, string[]>;\n    /** The policy as written into the `<meta http-equiv>` tag. */\n    meta: string;\n    /** The full policy for a `Content-Security-Policy` response header. */\n    header: string;\n    /** Every origin added to `connect-src`, with its provenance. */\n    connect: TempestCspSource[];\n    /** `\"serve\"` under `vite dev`, `\"build\"` under `vite build`. */\n    command: \"serve\" | \"build\";\n}\n\n/**\n * Directives a browser ignores when the policy arrives by `<meta>` (CSP3 §3.3),\n * printing a console warning for each.\n */\nconst HEADER_ONLY_DIRECTIVES: ReadonlySet<string> = new Set([\n    \"frame-ancestors\",\n    \"report-uri\",\n    \"sandbox\",\n]);\n\n/**\n * Origins the SDK itself calls, keyed by the module that calls them. In a build\n * the origin enters only when the module is in the bundle; in dev always.\n */\nconst SDK_ORIGINS: ReadonlyArray<{ module: RegExp; origin: string; from: string }> = [\n    {\n        module: /[\\\\/]forms[\\\\/]use-viacep\\.(?:[cm]?js|tsx?)$/,\n        origin: \"https://viacep.com.br\",\n        from: \"tempest-react-sdk useViaCEP\",\n    },\n];\n\n/**\n * Where each fetch directive falls back when a policy does not declare it, in\n * order. Ported from CSP3 §6.8.3, \"Get fetch directive fallback list\"\n * (https://w3c.github.io/webappsec-csp/#directive-fallback-list, checked\n * 11/10/2026), which lists twelve effective directives: `script-src-elem`,\n * `script-src-attr`, `style-src-elem`, `style-src-attr`, `worker-src`,\n * `connect-src`, `manifest-src`, `object-src`, `frame-src`, `media-src`,\n * `font-src` and `img-src`. Four more are listed here on purpose:\n *\n * - `script-src`, `style-src` and `child-src` are never an effective directive,\n *   but every chain that reaches them continues to `default-src`;\n * - `fenced-frame-src` comes from the Fenced Frame spec, which extends the\n *   `frame-src` chain;\n * - `prefetch-src` was in earlier CSP3 drafts (→ `default-src`) and is gone from\n *   the current one; a browser that still resolves it does so through\n *   `default-src`, so it is treated as inherited.\n *\n * A directive absent from this map does not fall back at all (`base-uri`,\n * `form-action`, `frame-ancestors`, …): leaving it out of a policy allows\n * everything, so adding it only ever restricts.\n */\nconst CSP_FALLBACK: Readonly<Record<string, readonly string[]>> = {\n    \"script-src-elem\": [\"script-src\", \"default-src\"],\n    \"script-src-attr\": [\"script-src\", \"default-src\"],\n    \"style-src-elem\": [\"style-src\", \"default-src\"],\n    \"style-src-attr\": [\"style-src\", \"default-src\"],\n    \"worker-src\": [\"child-src\", \"script-src\", \"default-src\"],\n    \"frame-src\": [\"child-src\", \"default-src\"],\n    \"fenced-frame-src\": [\"frame-src\", \"child-src\", \"default-src\"],\n    \"child-src\": [\"default-src\"],\n    \"connect-src\": [\"default-src\"],\n    \"font-src\": [\"default-src\"],\n    \"img-src\": [\"default-src\"],\n    \"manifest-src\": [\"default-src\"],\n    \"media-src\": [\"default-src\"],\n    \"object-src\": [\"default-src\"],\n    \"prefetch-src\": [\"default-src\"],\n    \"script-src\": [\"default-src\"],\n    \"style-src\": [\"default-src\"],\n};\n\n/**\n * The sources a declared policy already applies to a directive it does not\n * name, by walking {@link CSP_FALLBACK}.\n *\n * @param declared - The policy the app declared.\n * @param name - A directive the app did not declare.\n * @returns The inherited sources, or `undefined` when nothing governs the directive.\n */\nfunction inheritedSources(\n    declared: Readonly<Record<string, string[]>>,\n    name: string,\n): string[] | undefined {\n    for (const parent of CSP_FALLBACK[name] ?? []) {\n        if (parent in declared) return declared[parent];\n    }\n    return undefined;\n}\n\nconst ABSOLUTE_URL = /^(?:https?|wss?):\\/\\//i;\nconst WILDCARD_SOURCE = /^((?:https?|wss?):\\/\\/\\*\\.[a-z0-9.-]+(?::\\d+)?)(?:[/?#].*)?$/i;\n\n/**\n * Reduce a URL to the origin a CSP source expression should carry.\n *\n * @param value - The URL as the app configured it.\n * @param from - Its provenance, quoted in the error.\n * @returns The origin, or `undefined` for a root-relative path (covered by `'self'`).\n * @throws {Error} When the value is neither an absolute `http(s)`/`ws(s)` URL nor a path.\n */\nexport function cspOrigin(value: string, from: string): string | undefined {\n    const trimmed = value.trim();\n    if (trimmed.startsWith(\"/\") && !trimmed.startsWith(\"//\")) return undefined;\n    const wildcard = WILDCARD_SOURCE.exec(trimmed);\n    if (wildcard) return wildcard[1]!.toLowerCase();\n    if (ABSOLUTE_URL.test(trimmed)) {\n        try {\n            const url = new URL(trimmed);\n            return `${url.protocol}//${url.host}`;\n        } catch {\n            throw new Error(`tempestCsp: ${from} is not a valid URL: \"${value}\"`);\n        }\n    }\n    throw new Error(\n        `tempestCsp: ${from} must be an absolute http(s)/ws(s) URL or a root-relative path, got \"${value}\"`,\n    );\n}\n\n/**\n * Parse a serialized policy into directives, lowercasing names. A repeated\n * directive keeps its first occurrence, as browsers do.\n *\n * @param policy - A `Content-Security-Policy` value.\n * @returns Directive name → sources.\n */\nexport function parseCsp(policy: string): Record<string, string[]> {\n    const out: Record<string, string[]> = {};\n    for (const part of policy.split(\";\")) {\n        const [name, ...sources] = part.trim().split(/\\s+/);\n        if (!name) continue;\n        const key = name.toLowerCase();\n        if (!(key in out)) out[key] = sources;\n    }\n    return out;\n}\n\n/**\n * Serialize directives into a policy string, dropping header-only directives\n * when the target is a `<meta>` tag.\n *\n * @param directives - Directive name → sources.\n * @param target - `\"meta\"` or `\"header\"`.\n * @returns The policy value.\n */\nexport function serializeCsp(\n    directives: Readonly<Record<string, readonly string[]>>,\n    target: \"meta\" | \"header\",\n): string {\n    return Object.entries(directives)\n        .filter(([name]) => target === \"header\" || !HEADER_ONLY_DIRECTIVES.has(name))\n        .map(([name, sources]) => [name, ...sources].join(\" \"))\n        .join(\"; \");\n}\n\nfunction union(base: readonly string[], extra: readonly string[]): string[] {\n    const out = base.filter((source) => source !== \"'none'\" || extra.length === 0);\n    for (const source of extra) if (!out.includes(source)) out.push(source);\n    return out.length === 0 ? [\"'none'\"] : out;\n}\n\nfunction sha256(content: string): string {\n    return `'sha256-${createHash(\"sha256\").update(content, \"utf8\").digest(\"base64\")}'`;\n}\n\nfunction decodeEntities(value: string): string {\n    return value\n        .replace(/&#39;|&#x27;|&apos;/gi, \"'\")\n        .replace(/&quot;/gi, '\"')\n        .replace(/&amp;/gi, \"&\");\n}\n\nfunction readAttributes(tag: string): Record<string, string> {\n    const out: Record<string, string> = {};\n    const pattern = /([^\\s=<>/]+)\\s*=\\s*(?:\"([^\"]*)\"|'([^']*)'|([^\\s>]+))/g;\n    for (const match of tag.matchAll(pattern)) {\n        out[match[1]!.toLowerCase()] = decodeEntities(match[2] ?? match[3] ?? match[4] ?? \"\");\n    }\n    return out;\n}\n\n/**\n * Find the policy `index.html` already declares and remove its tag, so the merged\n * policy replaces it instead of stacking a second one (two policies are\n * intersected by the browser, so the stricter would win silently).\n *\n * @throws {Error} When the page declares more than one CSP `<meta>`: merging an\n *   intersection into a union would weaken it, so the plugin refuses.\n */\nfunction extractMetaPolicy(html: string): { html: string; declared?: Record<string, string[]> } {\n    const tags = [...html.matchAll(/<meta\\b[^>]*>/gi)].filter(\n        (match) =>\n            readAttributes(match[0])[\"http-equiv\"]?.toLowerCase() === \"content-security-policy\",\n    );\n    if (tags.length === 0) return { html };\n    if (tags.length > 1) {\n        throw new Error(\n            \"tempestCsp: index.html declares more than one Content-Security-Policy <meta>; merge them into one\",\n        );\n    }\n    const tag = tags[0]!;\n    return {\n        html:\n            html.slice(0, tag.index) +\n            html.slice(tag.index! + tag[0].length).replace(/^[ \\t]*\\r?\\n/, \"\"),\n        declared: parseCsp(readAttributes(tag[0]).content ?? \"\"),\n    };\n}\n\nfunction inlineHashes(html: string, element: \"script\" | \"style\"): string[] {\n    const pattern = new RegExp(`<${element}\\\\b([^>]*)>([\\\\s\\\\S]*?)</${element}>`, \"gi\");\n    const hashes: string[] = [];\n    for (const match of html.matchAll(pattern)) {\n        const attributes = readAttributes(`<x ${match[1]}>`);\n        if (element === \"script\" && \"src\" in attributes) continue;\n        if (match[2]!.length === 0) continue;\n        const hash = sha256(match[2]!);\n        if (!hashes.includes(hash)) hashes.push(hash);\n    }\n    return hashes;\n}\n\n/**\n * Write the policy tag where it governs the whole page. A `<meta>` CSP applies\n * only to what follows it, so it goes right after `<meta charset>` — unless a\n * resource precedes the charset, as the React Refresh preamble does under\n * `vite dev` (`head-prepend`), in which case it goes right after `<head>`.\n */\nfunction insertMeta(html: string, policy: string): string {\n    const escaped = policy.replace(/&/g, \"&amp;\").replace(/\"/g, \"&quot;\");\n    const tag = `<meta http-equiv=\"Content-Security-Policy\" content=\"${escaped}\" />`;\n    const charset = /<meta\\b[^>]*\\bcharset\\s*=[^>]*>/i.exec(html);\n    const head = /<head\\b[^>]*>/i.exec(html);\n    const resourceFirst =\n        charset !== null &&\n        head !== null &&\n        /<(?:script|link|style)\\b/i.test(html.slice(head.index, charset.index));\n    const anchor = charset && head && charset.index > head.index && !resourceFirst ? charset : head;\n    if (!anchor) return `${tag}\\n${html}`;\n    const at = anchor.index + anchor[0].length;\n    return `${html.slice(0, at)}\\n    ${tag}${html.slice(at)}`;\n}\n\nfunction bundleModuleIds(ctx: IndexHtmlTransformContext): string[] {\n    const ids: string[] = [];\n    for (const output of Object.values(ctx.bundle ?? {})) {\n        if (output.type !== \"chunk\") continue;\n        ids.push(...(output.moduleIds ?? Object.keys(output.modules ?? {})));\n    }\n    return ids;\n}\n\n/**\n * Vite plugin that writes a Content-Security-Policy `<meta>` into `index.html`\n * and derives `connect-src` from the origins the app actually calls.\n *\n * It exists because of how a missing origin fails: the request is blocked\n * before a connection opens, so there is no entry in the Network tab, nothing in\n * the server log, `curl` succeeds, and the app sees `TypeError: Failed to\n * fetch` — indistinguishable from offline, DNS or CORS. And a hand-written CSP\n * plugin is usually `apply: \"build\"`, so it only fails in production. This\n * plugin closes both ends:\n *\n * - origins come from the same `import.meta.env` the runtime reads\n *   ({@link TempestCspOptions.env}), reduced to `scheme://host[:port]`, with\n *   empty values skipped — no second list to drift;\n * - the policy is enforced under `vite dev` as well ({@link TempestCspOptions.dev});\n * - the build prints every origin and its provenance.\n *\n * Defaults cover what the SDK's stack needs and nothing more: `'self'`\n * everywhere, `'wasm-unsafe-eval'` for ONNX Runtime, `blob:` for workers, object\n * URLs and media, `data:` for images and fonts, `object-src 'none'`,\n * `base-uri 'self'`, `form-action 'self'`. Inline `<script>` blocks left in\n * `index.html` (a `themeInitScript()` anti-flash script, say) are allowed by\n * SHA-256 hash, never by `'unsafe-inline'`.\n *\n * An existing CSP `<meta>` in `index.html` is merged, not overwritten, and the\n * merge never loosens what the app wrote:\n *\n * - a directive it declares is kept verbatim, except `connect-src`, which gains\n *   the resolved origins (the list the plugin exists to maintain) unless it is\n *   `'none'` — declared or inherited from `default-src` — in which case the\n *   origins stay out and each one is reported as a build warning. Sources in\n *   {@link TempestCspOptions.directives} for a declared directive are not added\n *   (a build warning names them); `false` there removes it;\n * - a fetch directive it does not declare but already governs through the CSP3\n *   fallback chain (§6.8.3 — `img-src` → `default-src`,\n *   `worker-src` → `child-src` → `script-src` → `default-src`) is left out, so it\n *   keeps falling back. Filling it from the defaults would replace a\n *   `default-src 'none'` with `'self' data: blob:`. No inline-script hash and no\n *   `'wasm-unsafe-eval'` is added to it, and an inline `<script>` is judged by a\n *   declared `script-src-elem` before `script-src`; `connect-src` starts from the inherited\n *   value, and so does any directive passed in {@link TempestCspOptions.directives};\n * - a default that is exactly `'none'` (`object-src`), or a directive that does\n *   not fall back (`base-uri`, `form-action`), is still added: it can only\n *   restrict;\n * - a directive nothing in the declared policy governs comes from the defaults.\n *\n * @param options - See {@link TempestCspOptions}.\n * @returns A Vite plugin, to be placed in `plugins`. It runs as a `post` HTML\n *   transform, so a plugin that rewrites inline scripts after it would\n *   invalidate the hashes.\n *\n * @example\n * // vite.config.ts\n * import { createViteConfig, tempestCsp } from \"tempest-react-sdk/vite\";\n *\n * export default createViteConfig({\n *     plugins: [tempestCsp({ connect: [\"https://sso.example.com/realms/app\"] })],\n * });\n */\nexport function tempestCsp(options: TempestCspOptions = {}): TempestVitePlugin {\n    const {\n        connect = [],\n        env = true,\n        sockets = true,\n        wasm = true,\n        inlineStyles = true,\n        directives: extra = {},\n        dev = true,\n        log = true,\n        onPolicy,\n    } = options;\n\n    const configured: Record<string, readonly string[] | false> = Object.fromEntries(\n        Object.entries(extra).map(([name, sources]) => [name.toLowerCase(), sources]),\n    );\n    let config: ResolvedConfig | undefined;\n    let resolved: TempestCspSource[] = [];\n    let lastLogged = \"\";\n\n    function add(list: TempestCspSource[], origin: string | undefined, from: string): void {\n        if (origin === undefined || list.some((source) => source.origin === origin)) return;\n        list.push({ origin, from });\n    }\n\n    function resolveSources(resolvedConfig: ResolvedConfig): TempestCspSource[] {\n        const list: TempestCspSource[] = [];\n        const values: Record<string, unknown> = resolvedConfig.env ?? {};\n        const prefixes = [resolvedConfig.envPrefix ?? \"VITE_\"].flat();\n        if (env === true) {\n            for (const [name, value] of Object.entries(values)) {\n                if (!prefixes.some((prefix) => name.startsWith(prefix))) continue;\n                if (typeof value !== \"string\" || !ABSOLUTE_URL.test(value.trim())) continue;\n                add(list, cspOrigin(value, `env ${name}`), `env ${name}`);\n            }\n        } else if (Array.isArray(env)) {\n            for (const name of env) {\n                const value = values[name];\n                if (typeof value !== \"string\" || value.trim() === \"\") {\n                    resolvedConfig.logger.warn(\n                        `tempestCsp: env ${name} is empty — nothing added to connect-src`,\n                    );\n                    continue;\n                }\n                add(list, cspOrigin(value, `env ${name}`), `env ${name}`);\n            }\n        }\n        connect.forEach((value, index) => {\n            if (!value || value.trim() === \"\") {\n                resolvedConfig.logger.warn(\n                    `tempestCsp: connect[${index}] is empty — skipped, nothing added to connect-src`,\n                );\n                return;\n            }\n            add(list, cspOrigin(value, `connect[${index}]`), `connect[${index}]`);\n        });\n        return list;\n    }\n\n    function withSockets(list: readonly TempestCspSource[]): TempestCspSource[] {\n        const out = [...list];\n        if (!sockets) return out;\n        for (const { origin } of list) {\n            const twin = origin.replace(/^http(s?):/i, \"ws$1:\");\n            if (twin !== origin) add(out, twin, `sockets (${origin})`);\n        }\n        return out;\n    }\n\n    function defaults(baseOrigin: string | undefined, serve: boolean): Record<string, string[]> {\n        const self = baseOrigin ? [\"'self'\", baseOrigin] : [\"'self'\"];\n        const policy: Record<string, string[]> = {\n            \"default-src\": [...self],\n            \"script-src\": wasm ? [...self, \"'wasm-unsafe-eval'\"] : [...self],\n            \"style-src\": inlineStyles || serve ? [...self, \"'unsafe-inline'\"] : [...self],\n            \"img-src\": [...self, \"data:\", \"blob:\"],\n            \"font-src\": [...self, \"data:\"],\n            \"media-src\": [...self, \"blob:\"],\n            \"connect-src\": [\"'self'\", \"blob:\", \"data:\"],\n            \"worker-src\": [...self, \"blob:\"],\n            \"manifest-src\": [...self],\n            \"object-src\": [\"'none'\"],\n            \"base-uri\": [\"'self'\"],\n            \"form-action\": [\"'self'\"],\n        };\n        for (const [name, sources] of Object.entries(configured)) {\n            if (sources === false) delete policy[name];\n            else policy[name] = union(policy[name] ?? [], sources);\n        }\n        return policy;\n    }\n\n    /**\n     * Merge the defaults, the declared policy and the configured\n     * {@link TempestCspOptions.directives}, never loosening what was declared. A\n     * declared directive is kept verbatim: configured sources for it are not\n     * added — adding would loosen the app's policy — and each ignored source is\n     * reported as a build warning, while a configured `false` removes it, since\n     * removing is an explicit choice. An inherited directive (see\n     * {@link inheritedSources}) is omitted unless the default is `'none'` or the\n     * config adds sources, which then extend the inherited value instead of the\n     * defaults.\n     */\n    function mergePolicy(\n        policy: Readonly<Record<string, string[]>>,\n        declared: Readonly<Record<string, string[]>>,\n    ): Record<string, string[]> {\n        const merged: Record<string, string[]> = {};\n        for (const [name, sources] of Object.entries(policy)) {\n            if (name in declared) {\n                merged[name] = declared[name]!;\n                continue;\n            }\n            const inherited = inheritedSources(declared, name);\n            const added = configured[name];\n            if (inherited === undefined) merged[name] = sources;\n            else if (Array.isArray(added)) merged[name] = union(inherited, added);\n            else if (sources.length === 1 && sources[0] === \"'none'\") merged[name] = sources;\n        }\n        for (const [name, sources] of Object.entries(declared)) merged[name] ??= sources;\n        for (const [name, sources] of Object.entries(configured)) {\n            if (!(name in declared)) continue;\n            if (sources === false) {\n                delete merged[name];\n                continue;\n            }\n            const ignored = sources.filter((source) => !declared[name]!.includes(source));\n            if (ignored.length > 0) {\n                config?.logger.warn(\n                    `tempestCsp: index.html declares ${name}, so directives[\"${name}\"] is not added to it ` +\n                        `(${ignored.join(\" \")}); the plugin never loosens a declared policy — add them to the <meta> instead`,\n                );\n            }\n        }\n        return merged;\n    }\n\n    /**\n     * Report every inline `<script>` the final policy blocks. It only happens when\n     * the app's declared policy governs `script-src` — directly or through\n     * `default-src` — since the plugin then adds no hash, and the symptom would\n     * otherwise be a script that silently never runs (under `vite dev`, the React\n     * Refresh preamble, which takes the page down with it).\n     *\n     * `<script>` elements are governed by `script-src-elem` when the policy has\n     * one, so that is the directive judged and named.\n     *\n     * @param html - The page, without its CSP `<meta>`.\n     * @param directive - `\"script-src-elem\"` when declared, else `\"script-src\"`.\n     * @param effective - The sources the browser will apply to inline `<script>`\n     *   elements, or `undefined` when no directive governs them.\n     */\n    function warnBlockedInlineScripts(\n        html: string,\n        directive: string,\n        effective: readonly string[] | undefined,\n    ): void {\n        if (!effective || !config) return;\n        const unsafeInline =\n            effective.includes(\"'unsafe-inline'\") &&\n            !effective.some((source) => /^'(?:sha\\d{3}|nonce)-/.test(source));\n        if (unsafeInline) return;\n        const blocked = inlineHashes(html, \"script\").filter((hash) => !effective.includes(hash));\n        if (blocked.length === 0) return;\n        config.logger.warn(\n            `tempestCsp: the Content-Security-Policy declared in index.html blocks ${blocked.length} inline <script> ` +\n                `(${directive} ${effective.join(\" \")}); the plugin never loosens a declared policy, so add ${blocked.join(\" \")} to ${directive}`,\n        );\n    }\n\n    const plugin: Plugin = {\n        name: \"tempest-csp\",\n        configResolved(resolvedConfig) {\n            config = resolvedConfig;\n            resolved = resolveSources(resolvedConfig);\n        },\n        transformIndexHtml: {\n            order: \"post\",\n            handler(source, ctx) {\n                const serve = config?.command === \"serve\";\n                if (serve && !dev) return source;\n\n                const connectSources = withSockets(resolved);\n                const base = config?.base ?? \"/\";\n                const baseOrigin = ABSOLUTE_URL.test(base) ? cspOrigin(base, \"base\") : undefined;\n                if (baseOrigin) add(connectSources, baseOrigin, \"base\");\n                const moduleIds = serve ? [] : bundleModuleIds(ctx);\n                for (const known of SDK_ORIGINS) {\n                    if (serve || moduleIds.some((id) => known.module.test(id))) {\n                        add(connectSources, known.origin, known.from);\n                    }\n                }\n                const allSources = connectSources;\n\n                const { html, declared = {} } = extractMetaPolicy(source);\n                const policy = defaults(baseOrigin, serve);\n                const filled = (name: string): boolean =>\n                    !(name in declared) && inheritedSources(declared, name) === undefined;\n                if (filled(\"script-src\") && !(\"script-src-elem\" in declared)) {\n                    policy[\"script-src\"] = union(\n                        policy[\"script-src\"] ?? [],\n                        inlineHashes(html, \"script\"),\n                    );\n                }\n                if (\n                    filled(\"style-src\") &&\n                    !(\"style-src-elem\" in declared) &&\n                    !policy[\"style-src\"]?.includes(\"'unsafe-inline'\")\n                ) {\n                    policy[\"style-src\"] = union(\n                        policy[\"style-src\"] ?? [],\n                        inlineHashes(html, \"style\"),\n                    );\n                }\n                const merged = mergePolicy(policy, declared);\n                const origins = allSources.map((entry) => entry.origin);\n                const inheritedConnect = inheritedSources(declared, \"connect-src\");\n                const declaredConnect = merged[\"connect-src\"] ?? inheritedConnect;\n                const declaredNone =\n                    declaredConnect?.length === 1 &&\n                    declaredConnect[0] === \"'none'\" &&\n                    (\"connect-src\" in declared || inheritedConnect !== undefined);\n                if (declaredNone) {\n                    if (origins.length > 0) {\n                        config?.logger.warn(\n                            `tempestCsp: index.html declares connect-src 'none'${\"connect-src\" in declared ? \"\" : \" (through default-src)\"}, ` +\n                                `so these origins stay out and requests to them will be blocked: ${origins.join(\" \")}`,\n                        );\n                    }\n                } else if (\n                    \"connect-src\" in merged ||\n                    origins.length > 0 ||\n                    inheritedConnect === undefined\n                ) {\n                    merged[\"connect-src\"] = union(declaredConnect ?? [\"'self'\"], origins);\n                }\n\n                const scriptElem = \"script-src-elem\" in declared ? \"script-src-elem\" : \"script-src\";\n                warnBlockedInlineScripts(\n                    html,\n                    scriptElem,\n                    merged[scriptElem] ?? inheritedSources(declared, scriptElem),\n                );\n\n                const result: TempestCspPolicy = {\n                    directives: merged,\n                    meta: serializeCsp(merged, \"meta\"),\n                    header: serializeCsp(merged, \"header\"),\n                    connect: allSources,\n                    command: serve ? \"serve\" : \"build\",\n                };\n\n                if (log && config && result.header !== lastLogged) {\n                    lastLogged = result.header;\n                    const lines = allSources.map((entry) => `  ${entry.origin}  ← ${entry.from}`);\n                    config.logger.info(\n                        [\n                            `tempest-csp: connect-src ${(merged[\"connect-src\"] ?? inheritedConnect ?? []).join(\" \")}`,\n                            ...(lines.length > 0\n                                ? lines\n                                : [\"  (no cross-origin endpoint: only 'self')\"]),\n                        ].join(\"\\n\"),\n                    );\n                }\n                onPolicy?.(result);\n                return insertMeta(html, result.meta);\n            },\n        },\n    };\n\n    return plugin as TempestVitePlugin;\n}\n"],"mappings":"6BA6GA,IAAM,EAA8C,IAAI,IAAI,CACxD,kBACA,aACA,SACJ,CAAC,EAMK,EAA+E,CACjF,CACI,OAAQ,+CACR,OAAQ,wBACR,KAAM,6BACV,CACJ,EAuBM,EAA4D,CAC9D,kBAAmB,CAAC,aAAc,aAAa,EAC/C,kBAAmB,CAAC,aAAc,aAAa,EAC/C,iBAAkB,CAAC,YAAa,aAAa,EAC7C,iBAAkB,CAAC,YAAa,aAAa,EAC7C,aAAc,CAAC,YAAa,aAAc,aAAa,EACvD,YAAa,CAAC,YAAa,aAAa,EACxC,mBAAoB,CAAC,YAAa,YAAa,aAAa,EAC5D,YAAa,CAAC,aAAa,EAC3B,cAAe,CAAC,aAAa,EAC7B,WAAY,CAAC,aAAa,EAC1B,UAAW,CAAC,aAAa,EACzB,eAAgB,CAAC,aAAa,EAC9B,YAAa,CAAC,aAAa,EAC3B,aAAc,CAAC,aAAa,EAC5B,eAAgB,CAAC,aAAa,EAC9B,aAAc,CAAC,aAAa,EAC5B,YAAa,CAAC,aAAa,CAC/B,EAUA,SAAS,EACL,EACA,EACoB,CACpB,IAAK,IAAM,KAAU,EAAa,IAAS,CAAC,EACxC,GAAI,KAAU,EAAU,OAAO,EAAS,EAGhD,CAEA,IAAM,EAAe,yBACf,EAAkB,gEAUxB,SAAgB,EAAU,EAAe,EAAkC,CACvE,IAAM,EAAU,EAAM,KAAK,EAC3B,GAAI,EAAQ,WAAW,GAAG,GAAK,CAAC,EAAQ,WAAW,IAAI,EAAG,OAC1D,IAAM,EAAW,EAAgB,KAAK,CAAO,EAC7C,GAAI,EAAU,OAAO,EAAS,EAAE,CAAE,YAAY,EAC9C,GAAI,EAAa,KAAK,CAAO,EACzB,GAAI,CACA,IAAM,EAAM,IAAI,IAAI,CAAO,EAC3B,MAAO,GAAG,EAAI,SAAS,IAAI,EAAI,MACnC,MAAQ,CACJ,MAAU,MAAM,eAAe,EAAK,wBAAwB,EAAM,EAAE,CACxE,CAEJ,MAAU,MACN,eAAe,EAAK,uEAAuE,EAAM,EACrG,CACJ,CASA,SAAgB,EAAS,EAA0C,CAC/D,IAAM,EAAgC,CAAC,EACvC,IAAK,IAAM,KAAQ,EAAO,MAAM,GAAG,EAAG,CAClC,GAAM,CAAC,EAAM,GAAG,GAAW,EAAK,KAAK,CAAC,CAAC,MAAM,KAAK,EAClD,GAAI,CAAC,EAAM,SACX,IAAM,EAAM,EAAK,YAAY,EACvB,KAAO,IAAM,EAAI,GAAO,EAClC,CACA,OAAO,CACX,CAUA,SAAgB,EACZ,EACA,EACM,CACN,OAAO,OAAO,QAAQ,CAAU,CAAC,CAC5B,QAAQ,CAAC,KAAU,IAAW,UAAY,CAAC,EAAuB,IAAI,CAAI,CAAC,CAAC,CAC5E,KAAK,CAAC,EAAM,KAAa,CAAC,EAAM,GAAG,CAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CACtD,KAAK,IAAI,CAClB,CAEA,SAAS,EAAM,EAAyB,EAAoC,CACxE,IAAM,EAAM,EAAK,OAAQ,GAAW,IAAW,UAAY,EAAM,SAAW,CAAC,EAC7E,IAAK,IAAM,KAAU,EAAY,EAAI,SAAS,CAAM,GAAG,EAAI,KAAK,CAAM,EACtE,OAAO,EAAI,SAAW,EAAI,CAAC,QAAQ,EAAI,CAC3C,CAEA,SAAS,EAAO,EAAyB,CACrC,MAAO,YAAA,EAAW,EAAA,WAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,EAAS,MAAM,CAAC,CAAC,OAAO,QAAQ,EAAE,EACpF,CAEA,SAAS,EAAe,EAAuB,CAC3C,OAAO,EACF,QAAQ,wBAAyB,GAAG,CAAC,CACrC,QAAQ,WAAY,GAAG,CAAC,CACxB,QAAQ,UAAW,GAAG,CAC/B,CAEA,SAAS,EAAe,EAAqC,CACzD,IAAM,EAA8B,CAAC,EAErC,IAAK,IAAM,KAAS,EAAI,SAAS,uDAAO,EACpC,EAAI,EAAM,EAAE,CAAE,YAAY,GAAK,EAAe,EAAM,IAAM,EAAM,IAAM,EAAM,IAAM,EAAE,EAExF,OAAO,CACX,CAUA,SAAS,EAAkB,EAAqE,CAC5F,IAAM,EAAO,CAAC,GAAG,EAAK,SAAS,iBAAiB,CAAC,CAAC,CAAC,OAC9C,GACG,EAAe,EAAM,EAAE,CAAC,CAAC,aAAa,EAAE,YAAY,IAAM,yBAClE,EACA,GAAI,EAAK,SAAW,EAAG,MAAO,CAAE,MAAK,EACrC,GAAI,EAAK,OAAS,EACd,MAAU,MACN,mGACJ,EAEJ,IAAM,EAAM,EAAK,GACjB,MAAO,CACH,KACI,EAAK,MAAM,EAAG,EAAI,KAAK,EACvB,EAAK,MAAM,EAAI,MAAS,EAAI,EAAE,CAAC,MAAM,CAAC,CAAC,QAAQ,eAAgB,EAAE,EACrE,SAAU,EAAS,EAAe,EAAI,EAAE,CAAC,CAAC,SAAW,EAAE,CAC3D,CACJ,CAEA,SAAS,EAAa,EAAc,EAAuC,CACvE,IAAM,EAAc,OAAO,IAAI,EAAQ,2BAA2B,EAAQ,GAAI,IAAI,EAC5E,EAAmB,CAAC,EAC1B,IAAK,IAAM,KAAS,EAAK,SAAS,CAAO,EAAG,CACxC,IAAM,EAAa,EAAe,MAAM,EAAM,GAAG,EAAE,EAEnD,GADI,IAAY,UAAY,QAAS,GACjC,EAAM,EAAE,CAAE,SAAW,EAAG,SAC5B,IAAM,EAAO,EAAO,EAAM,EAAG,EACxB,EAAO,SAAS,CAAI,GAAG,EAAO,KAAK,CAAI,CAChD,CACA,OAAO,CACX,CAQA,SAAS,EAAW,EAAc,EAAwB,CAEtD,IAAM,EAAM,uDADI,EAAO,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,QACO,EAAQ,MACrE,EAAU,mCAAmC,KAAK,CAAI,EACtD,EAAO,iBAAiB,KAAK,CAAI,EACjC,EACF,IAAY,MACZ,IAAS,MACT,4BAA4B,KAAK,EAAK,MAAM,EAAK,MAAO,EAAQ,KAAK,CAAC,EACpE,EAAS,GAAW,GAAQ,EAAQ,MAAQ,EAAK,OAAS,CAAC,EAAgB,EAAU,EAC3F,GAAI,CAAC,EAAQ,MAAO,GAAG,EAAI,IAAI,IAC/B,IAAM,EAAK,EAAO,MAAQ,EAAO,EAAE,CAAC,OACpC,MAAO,GAAG,EAAK,MAAM,EAAG,CAAE,EAAE,QAAQ,IAAM,EAAK,MAAM,CAAE,GAC3D,CAEA,SAAS,EAAgB,EAA0C,CAC/D,IAAM,EAAgB,CAAC,EACvB,IAAK,IAAM,KAAU,OAAO,OAAO,EAAI,QAAU,CAAC,CAAC,EAC3C,EAAO,OAAS,SACpB,EAAI,KAAK,GAAI,EAAO,WAAa,OAAO,KAAK,EAAO,SAAW,CAAC,CAAC,CAAE,EAEvE,OAAO,CACX,CA6DA,SAAgB,EAAW,EAA6B,CAAC,EAAsB,CAC3E,GAAM,CACF,UAAU,CAAC,EACX,MAAM,GACN,UAAU,GACV,OAAO,GACP,eAAe,GACf,WAAY,EAAQ,CAAC,EACrB,MAAM,GACN,MAAM,GACN,YACA,EAEE,EAAwD,OAAO,YACjE,OAAO,QAAQ,CAAK,CAAC,CAAC,KAAK,CAAC,EAAM,KAAa,CAAC,EAAK,YAAY,EAAG,CAAO,CAAC,CAChF,EACI,EACA,EAA+B,CAAC,EAChC,EAAa,GAEjB,SAAS,EAAI,EAA0B,EAA4B,EAAoB,CAC/E,IAAW,IAAA,IAAa,EAAK,KAAM,GAAW,EAAO,SAAW,CAAM,GAC1E,EAAK,KAAK,CAAE,SAAQ,MAAK,CAAC,CAC9B,CAEA,SAAS,EAAe,EAAoD,CACxE,IAAM,EAA2B,CAAC,EAC5B,EAAkC,EAAe,KAAO,CAAC,EACzD,EAAW,CAAC,EAAe,WAAa,OAAO,CAAC,CAAC,KAAK,EAC5D,GAAI,IAAQ,GACR,IAAK,GAAM,CAAC,EAAM,KAAU,OAAO,QAAQ,CAAM,EACxC,EAAS,KAAM,GAAW,EAAK,WAAW,CAAM,CAAC,GAClD,OAAO,GAAU,UAAa,EAAa,KAAK,EAAM,KAAK,CAAC,GAChE,EAAI,EAAM,EAAU,EAAO,OAAO,GAAM,EAAG,OAAO,GAAM,OAEzD,GAAI,MAAM,QAAQ,CAAG,EACxB,IAAK,IAAM,KAAQ,EAAK,CACpB,IAAM,EAAQ,EAAO,GACrB,GAAI,OAAO,GAAU,UAAY,EAAM,KAAK,IAAM,GAAI,CAClD,EAAe,OAAO,KAClB,mBAAmB,EAAK,yCAC5B,EACA,QACJ,CACA,EAAI,EAAM,EAAU,EAAO,OAAO,GAAM,EAAG,OAAO,GAAM,CAC5D,CAWJ,OATA,EAAQ,SAAS,EAAO,IAAU,CAC9B,GAAI,CAAC,GAAS,EAAM,KAAK,IAAM,GAAI,CAC/B,EAAe,OAAO,KAClB,uBAAuB,EAAM,mDACjC,EACA,MACJ,CACA,EAAI,EAAM,EAAU,EAAO,WAAW,EAAM,EAAE,EAAG,WAAW,EAAM,EAAE,CACxE,CAAC,EACM,CACX,CAEA,SAAS,EAAY,EAAuD,CACxE,IAAM,EAAM,CAAC,GAAG,CAAI,EACpB,GAAI,CAAC,EAAS,OAAO,EACrB,IAAK,GAAM,CAAE,YAAY,EAAM,CAC3B,IAAM,EAAO,EAAO,QAAQ,cAAe,OAAO,EAC9C,IAAS,GAAQ,EAAI,EAAK,EAAM,YAAY,EAAO,EAAE,CAC7D,CACA,OAAO,CACX,CAEA,SAAS,EAAS,EAAgC,EAA0C,CACxF,IAAM,EAAO,EAAa,CAAC,SAAU,CAAU,EAAI,CAAC,QAAQ,EACtD,EAAmC,CACrC,cAAe,CAAC,GAAG,CAAI,EACvB,aAAc,EAAO,CAAC,GAAG,EAAM,oBAAoB,EAAI,CAAC,GAAG,CAAI,EAC/D,YAAa,GAAgB,EAAQ,CAAC,GAAG,EAAM,iBAAiB,EAAI,CAAC,GAAG,CAAI,EAC5E,UAAW,CAAC,GAAG,EAAM,QAAS,OAAO,EACrC,WAAY,CAAC,GAAG,EAAM,OAAO,EAC7B,YAAa,CAAC,GAAG,EAAM,OAAO,EAC9B,cAAe,CAAC,SAAU,QAAS,OAAO,EAC1C,aAAc,CAAC,GAAG,EAAM,OAAO,EAC/B,eAAgB,CAAC,GAAG,CAAI,EACxB,aAAc,CAAC,QAAQ,EACvB,WAAY,CAAC,QAAQ,EACrB,cAAe,CAAC,QAAQ,CAC5B,EACA,IAAK,GAAM,CAAC,EAAM,KAAY,OAAO,QAAQ,CAAU,EAC/C,IAAY,GAAO,OAAO,EAAO,GAChC,EAAO,GAAQ,EAAM,EAAO,IAAS,CAAC,EAAG,CAAO,EAEzD,OAAO,CACX,CAaA,SAAS,EACL,EACA,EACwB,CACxB,IAAM,EAAmC,CAAC,EAC1C,IAAK,GAAM,CAAC,EAAM,KAAY,OAAO,QAAQ,CAAM,EAAG,CAClD,GAAI,KAAQ,EAAU,CAClB,EAAO,GAAQ,EAAS,GACxB,QACJ,CACA,IAAM,EAAY,EAAiB,EAAU,CAAI,EAC3C,EAAQ,EAAW,GACrB,IAAc,IAAA,GAAW,EAAO,GAAQ,EACnC,MAAM,QAAQ,CAAK,EAAG,EAAO,GAAQ,EAAM,EAAW,CAAK,EAC3D,EAAQ,SAAW,GAAK,EAAQ,KAAO,WAAU,EAAO,GAAQ,EAC7E,CACA,IAAK,GAAM,CAAC,EAAM,KAAY,OAAO,QAAQ,CAAQ,EAAG,EAAO,KAAU,EACzE,IAAK,GAAM,CAAC,EAAM,KAAY,OAAO,QAAQ,CAAU,EAAG,CACtD,GAAI,EAAE,KAAQ,GAAW,SACzB,GAAI,IAAY,GAAO,CACnB,OAAO,EAAO,GACd,QACJ,CACA,IAAM,EAAU,EAAQ,OAAQ,GAAW,CAAC,EAAS,EAAK,CAAE,SAAS,CAAM,CAAC,EACxE,EAAQ,OAAS,GACjB,GAAQ,OAAO,KACX,mCAAmC,EAAK,mBAAmB,EAAK,yBACxD,EAAQ,KAAK,GAAG,EAAE,+EAC9B,CAER,CACA,OAAO,CACX,CAiBA,SAAS,EACL,EACA,EACA,EACI,CAKJ,GAJI,CAAC,GAAa,CAAC,GAEf,EAAU,SAAS,iBAAiB,GACpC,CAAC,EAAU,KAAM,GAAW,wBAAwB,KAAK,CAAM,CAAC,EAClD,OAClB,IAAM,EAAU,EAAa,EAAM,QAAQ,CAAC,CAAC,OAAQ,GAAS,CAAC,EAAU,SAAS,CAAI,CAAC,EACnF,EAAQ,SAAW,GACvB,EAAO,OAAO,KACV,yEAAyE,EAAQ,OAAO,oBAChF,EAAU,GAAG,EAAU,KAAK,GAAG,EAAE,wDAAwD,EAAQ,KAAK,GAAG,EAAE,MAAM,GAC7H,CACJ,CAsGA,MAAO,CAnGH,KAAM,cACN,eAAe,EAAgB,CAC3B,EAAS,EACT,EAAW,EAAe,CAAc,CAC5C,EACA,mBAAoB,CAChB,MAAO,OACP,QAAQ,EAAQ,EAAK,CACjB,IAAM,EAAQ,GAAQ,UAAY,QAClC,GAAI,GAAS,CAAC,EAAK,OAAO,EAE1B,IAAM,EAAiB,EAAY,CAAQ,EACrC,EAAO,GAAQ,MAAQ,IACvB,EAAa,EAAa,KAAK,CAAI,EAAI,EAAU,EAAM,MAAM,EAAI,IAAA,GACnE,GAAY,EAAI,EAAgB,EAAY,MAAM,EACtD,IAAM,EAAY,EAAQ,CAAC,EAAI,EAAgB,CAAG,EAClD,IAAK,IAAM,KAAS,GACZ,GAAS,EAAU,KAAM,GAAO,EAAM,OAAO,KAAK,CAAE,CAAC,IACrD,EAAI,EAAgB,EAAM,OAAQ,EAAM,IAAI,EAGpD,IAAM,EAAa,EAEb,CAAE,OAAM,WAAW,CAAC,GAAM,EAAkB,CAAM,EAClD,EAAS,EAAS,EAAY,CAAK,EACnC,EAAU,GACZ,EAAE,KAAQ,IAAa,EAAiB,EAAU,CAAI,IAAM,IAAA,GAC5D,EAAO,YAAY,GAAK,EAAE,oBAAqB,KAC/C,EAAO,cAAgB,EACnB,EAAO,eAAiB,CAAC,EACzB,EAAa,EAAM,QAAQ,CAC/B,GAGA,EAAO,WAAW,GAClB,EAAE,mBAAoB,IACtB,CAAC,EAAO,YAAY,EAAE,SAAS,iBAAiB,IAEhD,EAAO,aAAe,EAClB,EAAO,cAAgB,CAAC,EACxB,EAAa,EAAM,OAAO,CAC9B,GAEJ,IAAM,EAAS,EAAY,EAAQ,CAAQ,EACrC,EAAU,EAAW,IAAK,GAAU,EAAM,MAAM,EAChD,EAAmB,EAAiB,EAAU,aAAa,EAC3D,EAAkB,EAAO,gBAAkB,EAE7C,GAAiB,SAAW,GAC5B,EAAgB,KAAO,WACtB,gBAAiB,GAAY,IAAqB,IAAA,IAE/C,EAAQ,OAAS,GACjB,GAAQ,OAAO,KACX,qDAAqD,gBAAiB,EAAW,GAAK,yBAAyB,oEACxC,EAAQ,KAAK,GAAG,GAC3F,GAGJ,gBAAiB,GACjB,EAAQ,OAAS,GACjB,IAAqB,IAAA,MAErB,EAAO,eAAiB,EAAM,GAAmB,CAAC,QAAQ,EAAG,CAAO,GAGxE,IAAM,EAAa,oBAAqB,EAAW,kBAAoB,aACvE,EACI,EACA,EACA,EAAO,IAAe,EAAiB,EAAU,CAAU,CAC/D,EAEA,IAAM,EAA2B,CAC7B,WAAY,EACZ,KAAM,EAAa,EAAQ,MAAM,EACjC,OAAQ,EAAa,EAAQ,QAAQ,EACrC,QAAS,EACT,QAAS,EAAQ,QAAU,OAC/B,EAEA,GAAI,GAAO,GAAU,EAAO,SAAW,EAAY,CAC/C,EAAa,EAAO,OACpB,IAAM,EAAQ,EAAW,IAAK,GAAU,KAAK,EAAM,OAAO,MAAM,EAAM,MAAM,EAC5E,EAAO,OAAO,KACV,CACI,6BAA6B,EAAO,gBAAkB,GAAoB,CAAC,EAAA,CAAG,KAAK,GAAG,IACtF,GAAI,EAAM,OAAS,EACb,EACA,CAAC,2CAA2C,CACtD,CAAC,CAAC,KAAK;CAAI,CACf,CACJ,CAEA,OADA,IAAW,CAAM,EACV,EAAW,EAAM,EAAO,IAAI,CACvC,CACJ,CAGG,CACX"}
+{"version":3,"file":"tempest-csp.cjs","names":["createHash","node_crypto","HEADER_ONLY_DIRECTIVES","SDK_ORIGINS","CSP_FALLBACK","inheritedSources","parent","name","declared","ABSOLUTE_URL","WILDCARD_SOURCE","cspOrigin","trimmed","value","wildcard","url","from","parseCsp","out","part","policy","sources","key","serializeCsp","directives","target","isKeyword","source","keyword","matchesNothing","normalizeHashSource","prefix","union","base","extra","sha256","content","decodeEntities","readAttributes","match","tag","extractMetaPolicy","tags","html","inlineHashes","pattern","element","hashes","attributes","hash","insertMeta","charset","head","resourceFirst","anchor","at","bundleModuleIds","ids","output","ctx","tempestCsp","options","configured","config","resolved","lastLogged","add","origin","list","resolveSources","values","resolvedConfig","prefixes","env","connect","index","withSockets","sockets","twin","defaults","self","baseOrigin","wasm","inlineStyles","serve","mergePolicy","merged","inherited","added","ignored","warnBlockedInlineScripts","effective","normalized","blocked","directive","dev","connectSources","moduleIds","known","id","allSources","filled","origins","entry","inheritedConnect","declaredConnect","scriptElem","result","log","lines","onPolicy"],"sources":["../../src/vite/tempest-csp.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { IndexHtmlTransformContext, Plugin, ResolvedConfig } from \"vite\";\n\nimport type { TempestVitePlugin } from \"./tempest-pwa-manifest\";\n\n/** Options for {@link tempestCsp}. */\nexport interface TempestCspOptions {\n    /**\n     * Endpoints the app calls at runtime, as full URLs. Only the origin\n     * (`scheme://host[:port]`) enters `connect-src`: a source expression with a path\n     * matches that path alone, so `https://idp/realms/x` would still block\n     * `https://idp/realms/x/protocol/openid-connect/token`.\n     *\n     * Empty entries (`undefined`, `null`, `false`, `\"\"`) are skipped with a build\n     * warning instead of leaving a hole in the directive, so passing an env var\n     * that is not set is safe. A root-relative path (`/api`) is same-origin and\n     * already covered by `'self'`. Anything else that is not an absolute\n     * `http(s)`/`ws(s)` URL throws at config time — failing the build, not\n     * production. A wildcard host (`https://*.example.com`) is kept as written.\n     */\n    connect?: ReadonlyArray<string | null | undefined | false>;\n    /**\n     * Read origins from the same environment the runtime reads. `true` (the\n     * default) adds every variable Vite exposes to `import.meta.env` (the\n     * `envPrefix` ones, `VITE_` by default) whose value is an absolute\n     * `http(s)`/`ws(s)` URL. This is the structural bridge: an origin added to\n     * `.env` for a new runtime call lands in the policy with no second list to\n     * keep in sync. Pass a list of names to include exactly those — a name that\n     * resolves to nothing is reported as a build warning — or `false` to rely on\n     * {@link TempestCspOptions.connect} alone.\n     */\n    env?: boolean | readonly string[];\n    /**\n     * Also allow the WebSocket twin of every `http(s)` origin (`https://api` →\n     * `wss://api`). Measured in Chromium (23/09/2026): `connect-src https://api`\n     * blocks `new WebSocket(\"wss://api\")`, while `'self'` does cover a same-origin\n     * `ws:` — so an app that derives its socket URL from the API URL breaks\n     * without this. Default `true`.\n     */\n    sockets?: boolean;\n    /**\n     * Add `'wasm-unsafe-eval'` to `script-src`, which `onnxruntime-web` (the\n     * `/vision` and `/tabular` subpaths) needs to compile its WebAssembly. Without\n     * it `WebAssembly.compile` throws a `CompileError` naming `script-src`.\n     * It grants WebAssembly compilation only, not `eval`. Default `true`.\n     */\n    wasm?: boolean;\n    /**\n     * Add `'unsafe-inline'` to `style-src`. React's `style` prop does **not** need\n     * it — it writes through the CSSOM, which CSP does not govern (measured in\n     * Chromium, 23/09/2026). What needs it is a `<style>` element or a `style=\"\"`\n     * attribute, and the SDK's own `applyTheme` injects a `<style>`. Pass `false`\n     * when the app never calls `applyTheme`; inline `<style>` blocks in\n     * `index.html` are then hashed instead. Always on under `vite dev`, whose CSS\n     * injection is a `<style>` element. Default `true`.\n     */\n    inlineStyles?: boolean;\n    /**\n     * Extra sources per directive, merged into the defaults (`{ \"img-src\":\n     * [\"https://tiles.example.com\"] }`), or `false` to drop a directive.\n     * `frame-ancestors`, `report-uri` and `sandbox` are ignored by browsers when\n     * delivered by `<meta>`, so they reach {@link TempestCspPolicy.header} only.\n     */\n    directives?: Readonly<Record<string, readonly string[] | false>>;\n    /**\n     * Apply the policy under `vite dev` too. Default `true`: the failure this\n     * plugin exists for is \"works in dev, blocked in production\", and a policy\n     * enforced in dev moves every missing origin to the first page load on the\n     * developer's machine. Dev differs from build only in `style-src\n     * 'unsafe-inline'` and in allowing every SDK-known origin (see\n     * {@link TempestCspPolicy.connect}), because the dev server cannot know which\n     * modules the page will load.\n     */\n    dev?: boolean;\n    /** Print the resolved `connect-src` and where each origin came from. Default `true`. */\n    log?: boolean;\n    /**\n     * Receive the resolved policy — for asserting it in a test, or for writing the\n     * same policy as an HTTP header (the only channel for `frame-ancestors`).\n     */\n    onPolicy?: (policy: TempestCspPolicy) => void;\n}\n\n/** One origin in `connect-src` and the input that put it there. */\nexport interface TempestCspSource {\n    /** The source expression, e.g. `https://api.example.com`. */\n    origin: string;\n    /** Where it came from: `env VITE_API_URL`, `connect[0]`, `sockets`, `base` or an SDK module. */\n    from: string;\n}\n\n/** The policy {@link tempestCsp} resolved for one `index.html`. */\nexport interface TempestCspPolicy {\n    /** Every directive and its sources, including the header-only ones. */\n    directives: Record<string, string[]>;\n    /** The policy as written into the `<meta http-equiv>` tag. */\n    meta: string;\n    /** The full policy for a `Content-Security-Policy` response header. */\n    header: string;\n    /** Every origin added to `connect-src`, with its provenance. */\n    connect: TempestCspSource[];\n    /** `\"serve\"` under `vite dev`, `\"build\"` under `vite build`. */\n    command: \"serve\" | \"build\";\n}\n\n/**\n * Directives a browser ignores when the policy arrives by `<meta>` (CSP3 §3.3),\n * printing a console warning for each.\n */\nconst HEADER_ONLY_DIRECTIVES: ReadonlySet<string> = new Set([\n    \"frame-ancestors\",\n    \"report-uri\",\n    \"sandbox\",\n]);\n\n/**\n * Origins the SDK itself calls, keyed by the module that calls them. In a build\n * the origin enters only when the module is in the bundle; in dev always.\n */\nconst SDK_ORIGINS: ReadonlyArray<{ module: RegExp; origin: string; from: string }> = [\n    {\n        module: /[\\\\/]forms[\\\\/]use-viacep\\.(?:[cm]?js|tsx?)$/,\n        origin: \"https://viacep.com.br\",\n        from: \"tempest-react-sdk useViaCEP\",\n    },\n];\n\n/**\n * Where each fetch directive falls back when a policy does not declare it, in\n * order. Ported from CSP3 §6.8.3, \"Get fetch directive fallback list\"\n * (https://w3c.github.io/webappsec-csp/#directive-fallback-list, checked\n * 11/10/2026), which lists twelve effective directives: `script-src-elem`,\n * `script-src-attr`, `style-src-elem`, `style-src-attr`, `worker-src`,\n * `connect-src`, `manifest-src`, `object-src`, `frame-src`, `media-src`,\n * `font-src` and `img-src`. Four more are listed here on purpose:\n *\n * - `script-src`, `style-src` and `child-src` are never an effective directive,\n *   but every chain that reaches them continues to `default-src`;\n * - `fenced-frame-src` comes from the Fenced Frame spec, which extends the\n *   `frame-src` chain;\n * - `prefetch-src` was in earlier CSP3 drafts (→ `default-src`) and is gone from\n *   the current one; a browser that still resolves it does so through\n *   `default-src`, so it is treated as inherited.\n *\n * A directive absent from this map does not fall back at all (`base-uri`,\n * `form-action`, `frame-ancestors`, …): leaving it out of a policy allows\n * everything, so adding it only ever restricts.\n */\nconst CSP_FALLBACK: Readonly<Record<string, readonly string[]>> = {\n    \"script-src-elem\": [\"script-src\", \"default-src\"],\n    \"script-src-attr\": [\"script-src\", \"default-src\"],\n    \"style-src-elem\": [\"style-src\", \"default-src\"],\n    \"style-src-attr\": [\"style-src\", \"default-src\"],\n    \"worker-src\": [\"child-src\", \"script-src\", \"default-src\"],\n    \"frame-src\": [\"child-src\", \"default-src\"],\n    \"fenced-frame-src\": [\"frame-src\", \"child-src\", \"default-src\"],\n    \"child-src\": [\"default-src\"],\n    \"connect-src\": [\"default-src\"],\n    \"font-src\": [\"default-src\"],\n    \"img-src\": [\"default-src\"],\n    \"manifest-src\": [\"default-src\"],\n    \"media-src\": [\"default-src\"],\n    \"object-src\": [\"default-src\"],\n    \"prefetch-src\": [\"default-src\"],\n    \"script-src\": [\"default-src\"],\n    \"style-src\": [\"default-src\"],\n};\n\n/**\n * The sources a declared policy already applies to a directive it does not\n * name, by walking {@link CSP_FALLBACK}.\n *\n * @param declared - The policy the app declared.\n * @param name - A directive the app did not declare.\n * @returns The inherited sources, or `undefined` when nothing governs the directive.\n */\nfunction inheritedSources(\n    declared: Readonly<Record<string, string[]>>,\n    name: string,\n): string[] | undefined {\n    for (const parent of CSP_FALLBACK[name] ?? []) {\n        if (parent in declared) return declared[parent];\n    }\n    return undefined;\n}\n\nconst ABSOLUTE_URL = /^(?:https?|wss?):\\/\\//i;\nconst WILDCARD_SOURCE = /^((?:https?|wss?):\\/\\/\\*\\.[a-z0-9.-]+(?::\\d+)?)(?:[/?#].*)?$/i;\n\n/**\n * Reduce a URL to the origin a CSP source expression should carry.\n *\n * @param value - The URL as the app configured it.\n * @param from - Its provenance, quoted in the error.\n * @returns The origin, or `undefined` for a root-relative path (covered by `'self'`).\n * @throws {Error} When the value is neither an absolute `http(s)`/`ws(s)` URL nor a path.\n */\nexport function cspOrigin(value: string, from: string): string | undefined {\n    const trimmed = value.trim();\n    if (trimmed.startsWith(\"/\") && !trimmed.startsWith(\"//\")) return undefined;\n    const wildcard = WILDCARD_SOURCE.exec(trimmed);\n    if (wildcard) return wildcard[1]!.toLowerCase();\n    if (ABSOLUTE_URL.test(trimmed)) {\n        try {\n            const url = new URL(trimmed);\n            return `${url.protocol}//${url.host}`;\n        } catch {\n            throw new Error(`tempestCsp: ${from} is not a valid URL: \"${value}\"`);\n        }\n    }\n    throw new Error(\n        `tempestCsp: ${from} must be an absolute http(s)/ws(s) URL or a root-relative path, got \"${value}\"`,\n    );\n}\n\n/**\n * Parse a serialized policy into directives, lowercasing names. A repeated\n * directive keeps its first occurrence, as browsers do.\n *\n * @param policy - A `Content-Security-Policy` value.\n * @returns Directive name → sources.\n */\nexport function parseCsp(policy: string): Record<string, string[]> {\n    const out: Record<string, string[]> = {};\n    for (const part of policy.split(\";\")) {\n        const [name, ...sources] = part.trim().split(/\\s+/);\n        if (!name) continue;\n        const key = name.toLowerCase();\n        if (!(key in out)) out[key] = sources;\n    }\n    return out;\n}\n\n/**\n * Serialize directives into a policy string, dropping header-only directives\n * when the target is a `<meta>` tag.\n *\n * @param directives - Directive name → sources.\n * @param target - `\"meta\"` or `\"header\"`.\n * @returns The policy value.\n */\nexport function serializeCsp(\n    directives: Readonly<Record<string, readonly string[]>>,\n    target: \"meta\" | \"header\",\n): string {\n    return Object.entries(directives)\n        .filter(([name]) => target === \"header\" || !HEADER_ONLY_DIRECTIVES.has(name))\n        .map(([name, sources]) => [name, ...sources].join(\" \"))\n        .join(\"; \");\n}\n\n/**\n * Compare a source with a CSP keyword (`'self'`, `'none'`, `'unsafe-inline'`…).\n * Keywords are ASCII case-insensitive (CSP3 §2.3.1), so `'NONE'` is `'none'`.\n *\n * @param source - A source expression as written.\n * @param keyword - The keyword, quoted and lowercase.\n * @returns Whether the source is that keyword.\n */\nfunction isKeyword(source: string, keyword: string): boolean {\n    return source.toLowerCase() === keyword;\n}\n\n/**\n * Whether a source list matches nothing: CSP3 §6.7.2.5 gives \"does not match\"\n * for an empty list and for one that holds only `'none'` — in any letter case.\n *\n * @param sources - The directive's sources.\n * @returns `true` for `[]`, `['none']`, `['NONE']`, `['none', 'None']`.\n */\nfunction matchesNothing(sources: readonly string[]): boolean {\n    return sources.every((source) => isKeyword(source, \"'none'\"));\n}\n\n/**\n * Lowercase the algorithm (or `nonce`) prefix of a hash or nonce source,\n * leaving the case-sensitive base64 value alone, so `'SHA256-…'` compares\n * equal to the `'sha256-…'` the plugin computes.\n *\n * @param source - A source expression as written.\n * @returns The source with a normalized prefix.\n */\nfunction normalizeHashSource(source: string): string {\n    return source.replace(/^'(?:sha\\d{3}|nonce)-/i, (prefix) => prefix.toLowerCase());\n}\n\nfunction union(base: readonly string[], extra: readonly string[]): string[] {\n    const out = base.filter((source) => !isKeyword(source, \"'none'\") || extra.length === 0);\n    for (const source of extra) if (!out.includes(source)) out.push(source);\n    return out.length === 0 ? [\"'none'\"] : out;\n}\n\nfunction sha256(content: string): string {\n    return `'sha256-${createHash(\"sha256\").update(content, \"utf8\").digest(\"base64\")}'`;\n}\n\nfunction decodeEntities(value: string): string {\n    return value\n        .replace(/&#39;|&#x27;|&apos;/gi, \"'\")\n        .replace(/&quot;/gi, '\"')\n        .replace(/&amp;/gi, \"&\");\n}\n\nfunction readAttributes(tag: string): Record<string, string> {\n    const out: Record<string, string> = {};\n    const pattern = /([^\\s=<>/]+)\\s*=\\s*(?:\"([^\"]*)\"|'([^']*)'|([^\\s>]+))/g;\n    for (const match of tag.matchAll(pattern)) {\n        out[match[1]!.toLowerCase()] = decodeEntities(match[2] ?? match[3] ?? match[4] ?? \"\");\n    }\n    return out;\n}\n\n/**\n * Find the policy `index.html` already declares and remove its tag, so the merged\n * policy replaces it instead of stacking a second one (two policies are\n * intersected by the browser, so the stricter would win silently).\n *\n * @throws {Error} When the page declares more than one CSP `<meta>`: merging an\n *   intersection into a union would weaken it, so the plugin refuses.\n */\nfunction extractMetaPolicy(html: string): { html: string; declared?: Record<string, string[]> } {\n    const tags = [...html.matchAll(/<meta\\b[^>]*>/gi)].filter(\n        (match) =>\n            readAttributes(match[0])[\"http-equiv\"]?.toLowerCase() === \"content-security-policy\",\n    );\n    if (tags.length === 0) return { html };\n    if (tags.length > 1) {\n        throw new Error(\n            \"tempestCsp: index.html declares more than one Content-Security-Policy <meta>; merge them into one\",\n        );\n    }\n    const tag = tags[0]!;\n    return {\n        html:\n            html.slice(0, tag.index) +\n            html.slice(tag.index! + tag[0].length).replace(/^[ \\t]*\\r?\\n/, \"\"),\n        declared: parseCsp(readAttributes(tag[0]).content ?? \"\"),\n    };\n}\n\nfunction inlineHashes(html: string, element: \"script\" | \"style\"): string[] {\n    const pattern = new RegExp(`<${element}\\\\b([^>]*)>([\\\\s\\\\S]*?)</${element}>`, \"gi\");\n    const hashes: string[] = [];\n    for (const match of html.matchAll(pattern)) {\n        const attributes = readAttributes(`<x ${match[1]}>`);\n        if (element === \"script\" && \"src\" in attributes) continue;\n        if (match[2]!.length === 0) continue;\n        const hash = sha256(match[2]!);\n        if (!hashes.includes(hash)) hashes.push(hash);\n    }\n    return hashes;\n}\n\n/**\n * Write the policy tag where it governs the whole page. A `<meta>` CSP applies\n * only to what follows it, so it goes right after `<meta charset>` — unless a\n * resource precedes the charset, as the React Refresh preamble does under\n * `vite dev` (`head-prepend`), in which case it goes right after `<head>`.\n */\nfunction insertMeta(html: string, policy: string): string {\n    const escaped = policy.replace(/&/g, \"&amp;\").replace(/\"/g, \"&quot;\");\n    const tag = `<meta http-equiv=\"Content-Security-Policy\" content=\"${escaped}\" />`;\n    const charset = /<meta\\b[^>]*\\bcharset\\s*=[^>]*>/i.exec(html);\n    const head = /<head\\b[^>]*>/i.exec(html);\n    const resourceFirst =\n        charset !== null &&\n        head !== null &&\n        /<(?:script|link|style)\\b/i.test(html.slice(head.index, charset.index));\n    const anchor = charset && head && charset.index > head.index && !resourceFirst ? charset : head;\n    if (!anchor) return `${tag}\\n${html}`;\n    const at = anchor.index + anchor[0].length;\n    return `${html.slice(0, at)}\\n    ${tag}${html.slice(at)}`;\n}\n\nfunction bundleModuleIds(ctx: IndexHtmlTransformContext): string[] {\n    const ids: string[] = [];\n    for (const output of Object.values(ctx.bundle ?? {})) {\n        if (output.type !== \"chunk\") continue;\n        ids.push(...(output.moduleIds ?? Object.keys(output.modules ?? {})));\n    }\n    return ids;\n}\n\n/**\n * Vite plugin that writes a Content-Security-Policy `<meta>` into `index.html`\n * and derives `connect-src` from the origins the app actually calls.\n *\n * It exists because of how a missing origin fails: the request is blocked\n * before a connection opens, so there is no entry in the Network tab, nothing in\n * the server log, `curl` succeeds, and the app sees `TypeError: Failed to\n * fetch` — indistinguishable from offline, DNS or CORS. And a hand-written CSP\n * plugin is usually `apply: \"build\"`, so it only fails in production. This\n * plugin closes both ends:\n *\n * - origins come from the same `import.meta.env` the runtime reads\n *   ({@link TempestCspOptions.env}), reduced to `scheme://host[:port]`, with\n *   empty values skipped — no second list to drift;\n * - the policy is enforced under `vite dev` as well ({@link TempestCspOptions.dev});\n * - the build prints every origin and its provenance.\n *\n * Defaults cover what the SDK's stack needs and nothing more: `'self'`\n * everywhere, `'wasm-unsafe-eval'` for ONNX Runtime, `blob:` for workers, object\n * URLs and media, `data:` for images and fonts, `object-src 'none'`,\n * `base-uri 'self'`, `form-action 'self'`. Inline `<script>` blocks left in\n * `index.html` (a `themeInitScript()` anti-flash script, say) are allowed by\n * SHA-256 hash, never by `'unsafe-inline'`.\n *\n * An existing CSP `<meta>` in `index.html` is merged, not overwritten, and the\n * merge never loosens what the app wrote:\n *\n * - a directive it declares is kept verbatim, except `connect-src`, which gains\n *   the resolved origins (the list the plugin exists to maintain) unless it\n *   matches nothing — `'none'` in any letter case, or an empty list, declared or\n *   inherited from `default-src` — in which case the origins stay out and each\n *   one is reported as a build warning. Keywords are compared case-insensitively\n *   throughout, as browsers do. Sources in\n *   {@link TempestCspOptions.directives} for a declared directive are not added\n *   (a build warning names them); `false` there removes it;\n * - a fetch directive it does not declare but already governs through the CSP3\n *   fallback chain (§6.8.3 — `img-src` → `default-src`,\n *   `worker-src` → `child-src` → `script-src` → `default-src`) is left out, so it\n *   keeps falling back. Filling it from the defaults would replace a\n *   `default-src 'none'` with `'self' data: blob:`. No inline-script hash and no\n *   `'wasm-unsafe-eval'` is added to it, and an inline `<script>` is judged by a\n *   declared `script-src-elem` before `script-src`; `connect-src` starts from the inherited\n *   value, and so does any directive passed in {@link TempestCspOptions.directives};\n * - a default that is exactly `'none'` (`object-src`), or a directive that does\n *   not fall back (`base-uri`, `form-action`), is still added: it can only\n *   restrict;\n * - a directive nothing in the declared policy governs comes from the defaults.\n *\n * @param options - See {@link TempestCspOptions}.\n * @returns A Vite plugin, to be placed in `plugins`. It runs as a `post` HTML\n *   transform, so a plugin that rewrites inline scripts after it would\n *   invalidate the hashes.\n *\n * @example\n * // vite.config.ts\n * import { createViteConfig, tempestCsp } from \"tempest-react-sdk/vite\";\n *\n * export default createViteConfig({\n *     plugins: [tempestCsp({ connect: [\"https://sso.example.com/realms/app\"] })],\n * });\n */\nexport function tempestCsp(options: TempestCspOptions = {}): TempestVitePlugin {\n    const {\n        connect = [],\n        env = true,\n        sockets = true,\n        wasm = true,\n        inlineStyles = true,\n        directives: extra = {},\n        dev = true,\n        log = true,\n        onPolicy,\n    } = options;\n\n    const configured: Record<string, readonly string[] | false> = Object.fromEntries(\n        Object.entries(extra).map(([name, sources]) => [name.toLowerCase(), sources]),\n    );\n    let config: ResolvedConfig | undefined;\n    let resolved: TempestCspSource[] = [];\n    let lastLogged = \"\";\n\n    function add(list: TempestCspSource[], origin: string | undefined, from: string): void {\n        if (origin === undefined || list.some((source) => source.origin === origin)) return;\n        list.push({ origin, from });\n    }\n\n    function resolveSources(resolvedConfig: ResolvedConfig): TempestCspSource[] {\n        const list: TempestCspSource[] = [];\n        const values: Record<string, unknown> = resolvedConfig.env ?? {};\n        const prefixes = [resolvedConfig.envPrefix ?? \"VITE_\"].flat();\n        if (env === true) {\n            for (const [name, value] of Object.entries(values)) {\n                if (!prefixes.some((prefix) => name.startsWith(prefix))) continue;\n                if (typeof value !== \"string\" || !ABSOLUTE_URL.test(value.trim())) continue;\n                add(list, cspOrigin(value, `env ${name}`), `env ${name}`);\n            }\n        } else if (Array.isArray(env)) {\n            for (const name of env) {\n                const value = values[name];\n                if (typeof value !== \"string\" || value.trim() === \"\") {\n                    resolvedConfig.logger.warn(\n                        `tempestCsp: env ${name} is empty — nothing added to connect-src`,\n                    );\n                    continue;\n                }\n                add(list, cspOrigin(value, `env ${name}`), `env ${name}`);\n            }\n        }\n        connect.forEach((value, index) => {\n            if (!value || value.trim() === \"\") {\n                resolvedConfig.logger.warn(\n                    `tempestCsp: connect[${index}] is empty — skipped, nothing added to connect-src`,\n                );\n                return;\n            }\n            add(list, cspOrigin(value, `connect[${index}]`), `connect[${index}]`);\n        });\n        return list;\n    }\n\n    function withSockets(list: readonly TempestCspSource[]): TempestCspSource[] {\n        const out = [...list];\n        if (!sockets) return out;\n        for (const { origin } of list) {\n            const twin = origin.replace(/^http(s?):/i, \"ws$1:\");\n            if (twin !== origin) add(out, twin, `sockets (${origin})`);\n        }\n        return out;\n    }\n\n    function defaults(baseOrigin: string | undefined, serve: boolean): Record<string, string[]> {\n        const self = baseOrigin ? [\"'self'\", baseOrigin] : [\"'self'\"];\n        const policy: Record<string, string[]> = {\n            \"default-src\": [...self],\n            \"script-src\": wasm ? [...self, \"'wasm-unsafe-eval'\"] : [...self],\n            \"style-src\": inlineStyles || serve ? [...self, \"'unsafe-inline'\"] : [...self],\n            \"img-src\": [...self, \"data:\", \"blob:\"],\n            \"font-src\": [...self, \"data:\"],\n            \"media-src\": [...self, \"blob:\"],\n            \"connect-src\": [\"'self'\", \"blob:\", \"data:\"],\n            \"worker-src\": [...self, \"blob:\"],\n            \"manifest-src\": [...self],\n            \"object-src\": [\"'none'\"],\n            \"base-uri\": [\"'self'\"],\n            \"form-action\": [\"'self'\"],\n        };\n        for (const [name, sources] of Object.entries(configured)) {\n            if (sources === false) delete policy[name];\n            else policy[name] = union(policy[name] ?? [], sources);\n        }\n        return policy;\n    }\n\n    /**\n     * Merge the defaults, the declared policy and the configured\n     * {@link TempestCspOptions.directives}, never loosening what was declared. A\n     * declared directive is kept verbatim: configured sources for it are not\n     * added — adding would loosen the app's policy — and each ignored source is\n     * reported as a build warning, while a configured `false` removes it, since\n     * removing is an explicit choice. An inherited directive (see\n     * {@link inheritedSources}) is omitted unless the default is `'none'` or the\n     * config adds sources, which then extend the inherited value instead of the\n     * defaults.\n     */\n    function mergePolicy(\n        policy: Readonly<Record<string, string[]>>,\n        declared: Readonly<Record<string, string[]>>,\n    ): Record<string, string[]> {\n        const merged: Record<string, string[]> = {};\n        for (const [name, sources] of Object.entries(policy)) {\n            if (name in declared) {\n                merged[name] = declared[name]!;\n                continue;\n            }\n            const inherited = inheritedSources(declared, name);\n            const added = configured[name];\n            if (inherited === undefined) merged[name] = sources;\n            else if (Array.isArray(added)) merged[name] = union(inherited, added);\n            else if (sources.length > 0 && matchesNothing(sources)) merged[name] = sources;\n        }\n        for (const [name, sources] of Object.entries(declared)) merged[name] ??= sources;\n        for (const [name, sources] of Object.entries(configured)) {\n            if (!(name in declared)) continue;\n            if (sources === false) {\n                delete merged[name];\n                continue;\n            }\n            const ignored = sources.filter((source) => !declared[name]!.includes(source));\n            if (ignored.length > 0) {\n                config?.logger.warn(\n                    `tempestCsp: index.html declares ${name}, so directives[\"${name}\"] is not added to it ` +\n                        `(${ignored.join(\" \")}); the plugin never loosens a declared policy — add them to the <meta> instead`,\n                );\n            }\n        }\n        return merged;\n    }\n\n    /**\n     * Report every inline `<script>` the final policy blocks. It only happens when\n     * the app's declared policy governs `script-src` — directly or through\n     * `default-src` — since the plugin then adds no hash, and the symptom would\n     * otherwise be a script that silently never runs (under `vite dev`, the React\n     * Refresh preamble, which takes the page down with it).\n     *\n     * `<script>` elements are governed by `script-src-elem` when the policy has\n     * one, so that is the directive judged and named.\n     *\n     * @param html - The page, without its CSP `<meta>`.\n     * @param directive - `\"script-src-elem\"` when declared, else `\"script-src\"`.\n     * @param effective - The sources the browser will apply to inline `<script>`\n     *   elements, or `undefined` when no directive governs them.\n     */\n    function warnBlockedInlineScripts(\n        html: string,\n        directive: string,\n        effective: readonly string[] | undefined,\n    ): void {\n        if (!effective || !config) return;\n        const normalized = effective.map(normalizeHashSource);\n        const unsafeInline =\n            effective.some((source) => isKeyword(source, \"'unsafe-inline'\")) &&\n            !normalized.some((source) => /^'(?:sha\\d{3}|nonce)-/.test(source));\n        if (unsafeInline) return;\n        const blocked = inlineHashes(html, \"script\").filter((hash) => !normalized.includes(hash));\n        if (blocked.length === 0) return;\n        config.logger.warn(\n            `tempestCsp: the Content-Security-Policy declared in index.html blocks ${blocked.length} inline <script> ` +\n                `(${directive} ${effective.join(\" \")}); the plugin never loosens a declared policy, so add ${blocked.join(\" \")} to ${directive}`,\n        );\n    }\n\n    const plugin: Plugin = {\n        name: \"tempest-csp\",\n        configResolved(resolvedConfig) {\n            config = resolvedConfig;\n            resolved = resolveSources(resolvedConfig);\n        },\n        transformIndexHtml: {\n            order: \"post\",\n            handler(source, ctx) {\n                const serve = config?.command === \"serve\";\n                if (serve && !dev) return source;\n\n                const connectSources = withSockets(resolved);\n                const base = config?.base ?? \"/\";\n                const baseOrigin = ABSOLUTE_URL.test(base) ? cspOrigin(base, \"base\") : undefined;\n                if (baseOrigin) add(connectSources, baseOrigin, \"base\");\n                const moduleIds = serve ? [] : bundleModuleIds(ctx);\n                for (const known of SDK_ORIGINS) {\n                    if (serve || moduleIds.some((id) => known.module.test(id))) {\n                        add(connectSources, known.origin, known.from);\n                    }\n                }\n                const allSources = connectSources;\n\n                const { html, declared = {} } = extractMetaPolicy(source);\n                const policy = defaults(baseOrigin, serve);\n                const filled = (name: string): boolean =>\n                    !(name in declared) && inheritedSources(declared, name) === undefined;\n                if (filled(\"script-src\") && !(\"script-src-elem\" in declared)) {\n                    policy[\"script-src\"] = union(\n                        policy[\"script-src\"] ?? [],\n                        inlineHashes(html, \"script\"),\n                    );\n                }\n                if (\n                    filled(\"style-src\") &&\n                    !(\"style-src-elem\" in declared) &&\n                    !policy[\"style-src\"]?.some((source) => isKeyword(source, \"'unsafe-inline'\"))\n                ) {\n                    policy[\"style-src\"] = union(\n                        policy[\"style-src\"] ?? [],\n                        inlineHashes(html, \"style\"),\n                    );\n                }\n                const merged = mergePolicy(policy, declared);\n                const origins = allSources.map((entry) => entry.origin);\n                const inheritedConnect = inheritedSources(declared, \"connect-src\");\n                const declaredConnect = merged[\"connect-src\"] ?? inheritedConnect;\n                const declaredNone =\n                    declaredConnect !== undefined &&\n                    matchesNothing(declaredConnect) &&\n                    (\"connect-src\" in declared || inheritedConnect !== undefined);\n                if (declaredNone) {\n                    if (origins.length > 0) {\n                        config?.logger.warn(\n                            `tempestCsp: index.html declares connect-src ${declaredConnect.join(\" \") || \"with no source\"}${\"connect-src\" in declared ? \"\" : \" (through default-src)\"}, ` +\n                                `so these origins stay out and requests to them will be blocked: ${origins.join(\" \")}`,\n                        );\n                    }\n                } else if (\n                    \"connect-src\" in merged ||\n                    origins.length > 0 ||\n                    inheritedConnect === undefined\n                ) {\n                    merged[\"connect-src\"] = union(declaredConnect ?? [\"'self'\"], origins);\n                }\n\n                const scriptElem = \"script-src-elem\" in declared ? \"script-src-elem\" : \"script-src\";\n                warnBlockedInlineScripts(\n                    html,\n                    scriptElem,\n                    merged[scriptElem] ?? inheritedSources(declared, scriptElem),\n                );\n\n                const result: TempestCspPolicy = {\n                    directives: merged,\n                    meta: serializeCsp(merged, \"meta\"),\n                    header: serializeCsp(merged, \"header\"),\n                    connect: allSources,\n                    command: serve ? \"serve\" : \"build\",\n                };\n\n                if (log && config && result.header !== lastLogged) {\n                    lastLogged = result.header;\n                    const lines = allSources.map((entry) => `  ${entry.origin}  ← ${entry.from}`);\n                    config.logger.info(\n                        [\n                            `tempest-csp: connect-src ${(merged[\"connect-src\"] ?? inheritedConnect ?? []).join(\" \")}`,\n                            ...(lines.length > 0\n                                ? lines\n                                : [\"  (no cross-origin endpoint: only 'self')\"]),\n                        ].join(\"\\n\"),\n                    );\n                }\n                onPolicy?.(result);\n                return insertMeta(html, result.meta);\n            },\n        },\n    };\n\n    return plugin as TempestVitePlugin;\n}\n"],"mappings":"A,6BA6GA,IAAME,EAA8C,IAAI,IAAI,CACxD,kBACA,aACA,SACJ,CAAC,EAMKC,EAA+E,CACjF,CACI,OAAQ,+CACR,OAAQ,wBACR,KAAM,6BACV,CACJ,EAuBMC,EAA4D,CAC9D,kBAAmB,CAAC,aAAc,aAAa,EAC/C,kBAAmB,CAAC,aAAc,aAAa,EAC/C,iBAAkB,CAAC,YAAa,aAAa,EAC7C,iBAAkB,CAAC,YAAa,aAAa,EAC7C,aAAc,CAAC,YAAa,aAAc,aAAa,EACvD,YAAa,CAAC,YAAa,aAAa,EACxC,mBAAoB,CAAC,YAAa,YAAa,aAAa,EAC5D,YAAa,CAAC,aAAa,EAC3B,cAAe,CAAC,aAAa,EAC7B,WAAY,CAAC,aAAa,EAC1B,UAAW,CAAC,aAAa,EACzB,eAAgB,CAAC,aAAa,EAC9B,YAAa,CAAC,aAAa,EAC3B,aAAc,CAAC,aAAa,EAC5B,eAAgB,CAAC,aAAa,EAC9B,aAAc,CAAC,aAAa,EAC5B,YAAa,CAAC,aAAa,CAC/B,EAUA,SAASC,EACL,EACA,EACoB,CACpB,IAAK,IAAMC,KAAUF,EAAaG,IAAS,CAAC,EACxC,GAAID,KAAUE,EAAU,OAAOA,EAASF,EAGhD,CAEA,IAAMG,EAAe,yBACfC,EAAkB,gEAUxB,SAAgBC,EAAU,EAAe,EAAkC,CACvE,IAAMC,EAAUC,EAAM,KAAK,EAC3B,GAAID,EAAQ,WAAW,GAAG,GAAK,CAACA,EAAQ,WAAW,IAAI,EAAG,OAC1D,IAAME,EAAWJ,EAAgB,KAAKE,CAAO,EAC7C,GAAIE,EAAU,OAAOA,EAAS,EAAE,CAAE,YAAY,EAC9C,GAAIL,EAAa,KAAKG,CAAO,EACzB,GAAI,CACA,IAAMG,EAAM,IAAI,IAAIH,CAAO,EAC3B,MAAO,GAAGG,EAAI,SAAS,IAAIA,EAAI,MACnC,MAAQ,CACJ,MAAU,MAAM,eAAeC,EAAK,wBAAwBH,EAAM,EAAE,CACxE,CAEJ,MAAU,MACN,eAAeG,EAAK,uEAAuEH,EAAM,EACrG,CACJ,CASA,SAAgBI,EAAS,EAA0C,CAC/D,IAAMC,EAAgC,CAAC,EACvC,IAAK,IAAMC,KAAQC,EAAO,MAAM,GAAG,EAAG,CAClC,GAAM,CAACb,EAAM,GAAGc,GAAWF,EAAK,KAAK,CAAC,CAAC,MAAM,KAAK,EAClD,GAAI,CAACZ,EAAM,SACX,IAAMe,EAAMf,EAAK,YAAY,EACvBe,KAAOJ,IAAM,EAAII,GAAOD,EAClC,CACA,OAAOH,CACX,CAUA,SAAgBK,EACZ,EACA,EACM,CACN,OAAO,OAAO,QAAQC,CAAU,CAAC,CAC5B,QAAQ,CAACjB,KAAUkB,IAAW,UAAY,CAACvB,EAAuB,IAAIK,CAAI,CAAC,CAAC,CAC5E,KAAK,CAACA,EAAMc,KAAa,CAACd,EAAM,GAAGc,CAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CACtD,KAAK,IAAI,CAClB,CAUA,SAASK,EAAU,EAAgB,EAA0B,CACzD,OAAOC,EAAO,YAAY,IAAMC,CACpC,CASA,SAASC,EAAe,EAAqC,CACzD,OAAOR,EAAQ,MAAO,GAAWK,EAAUC,EAAQ,QAAQ,CAAC,CAChE,CAUA,SAASG,EAAoB,EAAwB,CACjD,OAAOH,EAAO,QAAQ,yBAA2B,GAAWI,EAAO,YAAY,CAAC,CACpF,CAEA,SAASC,EAAM,EAAyB,EAAoC,CACxE,IAAMd,EAAMe,EAAK,OAAQ,GAAW,CAACP,EAAUC,EAAQ,QAAQ,GAAKO,EAAM,SAAW,CAAC,EACtF,IAAK,IAAMP,KAAUO,EAAYhB,EAAI,SAASS,CAAM,GAAGT,EAAI,KAAKS,CAAM,EACtE,OAAOT,EAAI,SAAW,EAAI,CAAC,QAAQ,EAAIA,CAC3C,CAEA,SAASiB,EAAO,EAAyB,CACrC,MAAO,YAAA,EAAWnC,EAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAOoC,EAAS,MAAM,CAAC,CAAC,OAAO,QAAQ,EAAE,EACpF,CAEA,SAASC,EAAe,EAAuB,CAC3C,OAAOxB,EACF,QAAQ,wBAAyB,GAAG,CAAC,CACrC,QAAQ,WAAY,GAAG,CAAC,CACxB,QAAQ,UAAW,GAAG,CAC/B,CAEA,SAASyB,EAAe,EAAqC,CACzD,IAAMpB,EAA8B,CAAC,EAErC,IAAK,IAAMqB,KAASC,EAAI,SAAS,uDAAO,EACpC,EAAID,EAAM,EAAE,CAAE,YAAY,GAAKF,EAAeE,EAAM,IAAMA,EAAM,IAAMA,EAAM,IAAM,EAAE,EAExF,OAAOrB,CACX,CAUA,SAASuB,EAAkB,EAAqE,CAC5F,IAAMC,EAAO,CAAC,GAAGC,EAAK,SAAS,iBAAiB,CAAC,CAAC,CAAC,OAC9C,GACGL,EAAeC,EAAM,EAAE,CAAC,CAAC,aAAa,EAAE,YAAY,IAAM,yBAClE,EACA,GAAIG,EAAK,SAAW,EAAG,MAAO,CAAE,MAAK,EACrC,GAAIA,EAAK,OAAS,EACd,MAAU,MACN,mGACJ,EAEJ,IAAMF,EAAME,EAAK,GACjB,MAAO,CACH,KACIC,EAAK,MAAM,EAAGH,EAAI,KAAK,EACvBG,EAAK,MAAMH,EAAI,MAASA,EAAI,EAAE,CAAC,MAAM,CAAC,CAAC,QAAQ,eAAgB,EAAE,EACrE,SAAUvB,EAASqB,EAAeE,EAAI,EAAE,CAAC,CAAC,SAAW,EAAE,CAC3D,CACJ,CAEA,SAASI,EAAa,EAAc,EAAuC,CACvE,IAAMC,EAAc,OAAO,IAAIC,EAAQ,2BAA2BA,EAAQ,GAAI,IAAI,EAC5EC,EAAmB,CAAC,EAC1B,IAAK,IAAMR,KAASI,EAAK,SAASE,CAAO,EAAG,CACxC,IAAMG,EAAaV,EAAe,MAAMC,EAAM,GAAG,EAAE,EAEnD,GADIO,IAAY,UAAY,QAASE,GACjCT,EAAM,EAAE,CAAE,SAAW,EAAG,SAC5B,IAAMU,EAAOd,EAAOI,EAAM,EAAG,EACxBQ,EAAO,SAASE,CAAI,GAAGF,EAAO,KAAKE,CAAI,CAChD,CACA,OAAOF,CACX,CAQA,SAASG,EAAW,EAAc,EAAwB,CAEtD,IAAMV,EAAM,uDADIpB,EAAO,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,QACO,EAAQ,MACrE+B,EAAU,mCAAmC,KAAKR,CAAI,EACtDS,EAAO,iBAAiB,KAAKT,CAAI,EACjCU,EACFF,IAAY,MACZC,IAAS,MACT,4BAA4B,KAAKT,EAAK,MAAMS,EAAK,MAAOD,EAAQ,KAAK,CAAC,EACpEG,EAASH,GAAWC,GAAQD,EAAQ,MAAQC,EAAK,OAAS,CAACC,EAAgBF,EAAUC,EAC3F,GAAI,CAACE,EAAQ,MAAO,GAAGd,EAAI,IAAIG,IAC/B,IAAMY,EAAKD,EAAO,MAAQA,EAAO,EAAE,CAAC,OACpC,MAAO,GAAGX,EAAK,MAAM,EAAGY,CAAE,EAAE,QAAQf,IAAMG,EAAK,MAAMY,CAAE,GAC3D,CAEA,SAASC,EAAgB,EAA0C,CAC/D,IAAMC,EAAgB,CAAC,EACvB,IAAK,IAAMC,KAAU,OAAO,OAAOC,EAAI,QAAU,CAAC,CAAC,EAC3CD,EAAO,OAAS,SACpBD,EAAI,KAAK,GAAIC,EAAO,WAAa,OAAO,KAAKA,EAAO,SAAW,CAAC,CAAC,CAAE,EAEvE,OAAOD,CACX,CA+DA,SAAgBG,EAAW,EAA6B,CAAC,EAAsB,CAC3E,GAAM,CACF,UAAU,CAAC,EACX,MAAM,GACN,UAAU,GACV,OAAO,GACP,eAAe,GACf,WAAY1B,EAAQ,CAAC,EACrB,MAAM,GACN,MAAM,GACN,YACA2B,EAEEC,EAAwD,OAAO,YACjE,OAAO,QAAQ5B,CAAK,CAAC,CAAC,KAAK,CAAC3B,EAAMc,KAAa,CAACd,EAAK,YAAY,EAAGc,CAAO,CAAC,CAChF,EACI0C,EACAC,EAA+B,CAAC,EAChCC,EAAa,GAEjB,SAASC,EAAI,EAA0B,EAA4B,EAAoB,CAC/EC,IAAW,IAAA,IAAaC,EAAK,KAAM,GAAWzC,EAAO,SAAWwC,CAAM,GAC1EC,EAAK,KAAK,CAAE,SAAQ,MAAK,CAAC,CAC9B,CAEA,SAASC,EAAe,EAAoD,CACxE,IAAMD,EAA2B,CAAC,EAC5BE,EAAkCC,EAAe,KAAO,CAAC,EACzDC,EAAW,CAACD,EAAe,WAAa,OAAO,CAAC,CAAC,KAAK,EAC5D,GAAIE,IAAQ,GACR,IAAK,GAAM,CAAClE,EAAMM,KAAU,OAAO,QAAQyD,CAAM,EACxCE,EAAS,KAAM,GAAWjE,EAAK,WAAWwB,CAAM,CAAC,GAClD,OAAOlB,GAAU,UAAaJ,EAAa,KAAKI,EAAM,KAAK,CAAC,GAChEqD,EAAIE,EAAMzD,EAAUE,EAAO,OAAON,GAAM,EAAG,OAAOA,GAAM,OAEzD,GAAI,MAAM,QAAQkE,CAAG,EACxB,IAAK,IAAMlE,KAAQkE,EAAK,CACpB,IAAM5D,EAAQyD,EAAO/D,GACjB,OAAOM,GAAU,UAAYA,EAAM,KAAK,IAAM,GAC9C0D,EAAe,OAAO,KAClB,mBAAmBhE,EAAK,yCAC5B,EAGJ2D,EAAIE,EAAMzD,EAAUE,EAAO,OAAON,GAAM,EAAG,OAAOA,GAAM,CAC5D,CAWJ,OATAmE,EAAQ,SAAS,EAAO,IAAU,CAC1B,CAAC7D,GAASA,EAAM,KAAK,IAAM,GAC3B0D,EAAe,OAAO,KAClB,uBAAuBI,EAAM,mDACjC,EAGJT,EAAIE,EAAMzD,EAAUE,EAAO,WAAW8D,EAAM,EAAE,EAAG,WAAWA,EAAM,EAAE,CACxE,CAAC,EACMP,CACX,CAEA,SAASQ,EAAY,EAAuD,CACxE,IAAM1D,EAAM,CAAC,GAAGkD,CAAI,EACpB,GAAI,CAACS,EAAS,OAAO3D,EACrB,IAAK,GAAM,CAAE,YAAYkD,EAAM,CAC3B,IAAMU,EAAOX,EAAO,QAAQ,cAAe,OAAO,EAC9CW,IAASX,GAAQD,EAAIhD,EAAK4D,EAAM,YAAYX,EAAO,EAAE,CAC7D,CACA,OAAOjD,CACX,CAEA,SAAS6D,EAAS,EAAgC,EAA0C,CACxF,IAAMC,EAAOC,EAAa,CAAC,SAAUA,CAAU,EAAI,CAAC,QAAQ,EACtD7D,EAAmC,CACrC,cAAe,CAAC,GAAG4D,CAAI,EACvB,aAAcE,EAAO,CAAC,GAAGF,EAAM,oBAAoB,EAAI,CAAC,GAAGA,CAAI,EAC/D,YAAaG,GAAgBC,EAAQ,CAAC,GAAGJ,EAAM,iBAAiB,EAAI,CAAC,GAAGA,CAAI,EAC5E,UAAW,CAAC,GAAGA,EAAM,QAAS,OAAO,EACrC,WAAY,CAAC,GAAGA,EAAM,OAAO,EAC7B,YAAa,CAAC,GAAGA,EAAM,OAAO,EAC9B,cAAe,CAAC,SAAU,QAAS,OAAO,EAC1C,aAAc,CAAC,GAAGA,EAAM,OAAO,EAC/B,eAAgB,CAAC,GAAGA,CAAI,EACxB,aAAc,CAAC,QAAQ,EACvB,WAAY,CAAC,QAAQ,EACrB,cAAe,CAAC,QAAQ,CAC5B,EACA,IAAK,GAAM,CAACzE,EAAMc,KAAY,OAAO,QAAQyC,CAAU,EAC/CzC,IAAY,GAAO,OAAOD,EAAOb,GAChC,EAAOA,GAAQyB,EAAMZ,EAAOb,IAAS,CAAC,EAAGc,CAAO,EAEzD,OAAOD,CACX,CAaA,SAASiE,EACL,EACA,EACwB,CACxB,IAAMC,EAAmC,CAAC,EAC1C,IAAK,GAAM,CAAC/E,EAAMc,KAAY,OAAO,QAAQD,CAAM,EAAG,CAClD,GAAIb,KAAQC,EAAU,CAClB,EAAOD,GAAQC,EAASD,GACxB,QACJ,CACA,IAAMgF,EAAYlF,EAAiBG,EAAUD,CAAI,EAC3CiF,EAAQ1B,EAAWvD,GACrBgF,IAAc,IAAA,GAAW,EAAOhF,GAAQc,EACnC,MAAM,QAAQmE,CAAK,EAAG,EAAOjF,GAAQyB,EAAMuD,EAAWC,CAAK,EAC3DnE,EAAQ,OAAS,GAAKQ,EAAeR,CAAO,IAAG,EAAOd,GAAQc,EAC3E,CACA,IAAK,GAAM,CAACd,EAAMc,KAAY,OAAO,QAAQb,CAAQ,EAAG,EAAOD,KAAUc,EACzE,IAAK,GAAM,CAACd,EAAMc,KAAY,OAAO,QAAQyC,CAAU,EAAG,CACtD,GAAI,EAAEvD,KAAQC,GAAW,SACzB,GAAIa,IAAY,GAAO,CACnB,OAAOiE,EAAO/E,GACd,QACJ,CACA,IAAMkF,EAAUpE,EAAQ,OAAQ,GAAW,CAACb,EAASD,EAAK,CAAE,SAASoB,CAAM,CAAC,EACxE8D,EAAQ,OAAS,GACjB1B,GAAQ,OAAO,KACX,mCAAmCxD,EAAK,mBAAmBA,EAAK,yBACxDkF,EAAQ,KAAK,GAAG,EAAE,+EAC9B,CAER,CACA,OAAOH,CACX,CAiBA,SAASI,EACL,EACA,EACA,EACI,CACJ,GAAI,CAACC,GAAa,CAAC5B,EAAQ,OAC3B,IAAM6B,EAAaD,EAAU,IAAI7D,CAAmB,EAIpD,GAFI6D,EAAU,KAAM,GAAWjE,EAAUC,EAAQ,iBAAiB,CAAC,GAC/D,CAACiE,EAAW,KAAM,GAAW,wBAAwB,KAAKjE,CAAM,CAAC,EACnD,OAClB,IAAMkE,EAAUjD,EAAaD,EAAM,QAAQ,CAAC,CAAC,OAAQ,GAAS,CAACiD,EAAW,SAAS3C,CAAI,CAAC,EACpF4C,EAAQ,SAAW,GACvB9B,EAAO,OAAO,KACV,yEAAyE8B,EAAQ,OAAO,oBAChFC,EAAU,GAAGH,EAAU,KAAK,GAAG,EAAE,wDAAwDE,EAAQ,KAAK,GAAG,EAAE,MAAMC,GAC7H,CACJ,CAsGA,MAAO,CAnGH,KAAM,cACN,eAAe,EAAgB,CAC3B,EAASvB,EACT,EAAWF,EAAeE,CAAc,CAC5C,EACA,mBAAoB,CAChB,MAAO,OACP,QAAQ,EAAQ,EAAK,CACjB,IAAMa,EAAQrB,GAAQ,UAAY,QAClC,GAAIqB,GAAS,CAACW,EAAK,OAAOpE,EAE1B,IAAMqE,EAAiBpB,EAAYZ,CAAQ,EACrC/B,EAAO8B,GAAQ,MAAQ,IACvBkB,EAAaxE,EAAa,KAAKwB,CAAI,EAAItB,EAAUsB,EAAM,MAAM,EAAI,IAAA,GACnEgD,GAAYf,EAAI8B,EAAgBf,EAAY,MAAM,EACtD,IAAMgB,EAAYb,EAAQ,CAAC,EAAI5B,EAAgBG,CAAG,EAClD,IAAK,IAAMuC,KAAS/F,GACZiF,GAASa,EAAU,KAAM,GAAOC,EAAM,OAAO,KAAKC,CAAE,CAAC,IACrDjC,EAAI8B,EAAgBE,EAAM,OAAQA,EAAM,IAAI,EAGpD,IAAME,EAAaJ,EAEb,CAAE,OAAM,WAAW,CAAC,GAAMvD,EAAkBd,CAAM,EAClDP,EAAS2D,EAASE,EAAYG,CAAK,EACnCiB,EAAU,GACZ,EAAE9F,KAAQC,IAAaH,EAAiBG,EAAUD,CAAI,IAAM,IAAA,GAC5D8F,EAAO,YAAY,GAAK,EAAE,oBAAqB7F,KAC/C,EAAO,cAAgBwB,EACnBZ,EAAO,eAAiB,CAAC,EACzBwB,EAAaD,EAAM,QAAQ,CAC/B,GAGA0D,EAAO,WAAW,GAClB,EAAE,mBAAoB7F,IACtB,CAACY,EAAO,YAAY,EAAE,KAAM,GAAWM,EAAUC,EAAQ,iBAAiB,CAAC,IAE3E,EAAO,aAAeK,EAClBZ,EAAO,cAAgB,CAAC,EACxBwB,EAAaD,EAAM,OAAO,CAC9B,GAEJ,IAAM2C,EAASD,EAAYjE,EAAQZ,CAAQ,EACrC8F,EAAUF,EAAW,IAAK,GAAUG,EAAM,MAAM,EAChDC,EAAmBnG,EAAiBG,EAAU,aAAa,EAC3DiG,EAAkBnB,EAAO,gBAAkBkB,EAE7CC,IAAoB,IAAA,IACpB5E,EAAe4E,CAAe,IAC7B,gBAAiBjG,GAAYgG,IAAqB,IAAA,IAE/CF,EAAQ,OAAS,GACjBvC,GAAQ,OAAO,KACX,+CAA+C0C,EAAgB,KAAK,GAAG,GAAK,mBAAmB,gBAAiBjG,EAAW,GAAK,yBAAyB,oEAClF8F,EAAQ,KAAK,GAAG,GAC3F,GAGJ,gBAAiBhB,GACjBgB,EAAQ,OAAS,GACjBE,IAAqB,IAAA,MAErB,EAAO,eAAiBxE,EAAMyE,GAAmB,CAAC,QAAQ,EAAGH,CAAO,GAGxE,IAAMI,EAAa,oBAAqBlG,EAAW,kBAAoB,aACvEkF,EACI/C,EACA+D,EACApB,EAAOoB,IAAerG,EAAiBG,EAAUkG,CAAU,CAC/D,EAEA,IAAMC,EAA2B,CAC7B,WAAYrB,EACZ,KAAM/D,EAAa+D,EAAQ,MAAM,EACjC,OAAQ/D,EAAa+D,EAAQ,QAAQ,EACrC,QAASc,EACT,QAAShB,EAAQ,QAAU,OAC/B,EAEA,GAAIwB,GAAO7C,GAAU4C,EAAO,SAAW1C,EAAY,CAC/C,EAAa0C,EAAO,OACpB,IAAME,EAAQT,EAAW,IAAK,GAAU,KAAKG,EAAM,OAAO,MAAMA,EAAM,MAAM,EAC5ExC,EAAO,OAAO,KACV,CACI,6BAA6BuB,EAAO,gBAAkBkB,GAAoB,CAAC,EAAA,CAAG,KAAK,GAAG,IACtF,GAAIK,EAAM,OAAS,EACbA,EACA,CAAC,2CAA2C,CACtD,CAAC,CAAC,KAAK;CAAI,CACf,CACJ,CAEA,OADAC,IAAWH,CAAM,EACVzD,EAAWP,EAAMgE,EAAO,IAAI,CACvC,CACJ,CAGG,CACX,C"}