tempest-react-sdk 0.77.0 → 0.79.0

package/dist/vite/tempest-csp.js

@@ -66,93 +66,94 @@ function l(e, n) {
 	return Object.entries(e).filter(([e]) => n === "header" || !t.has(e)).map(([e, t]) => [e, ...t].join(" ")).join("; ");
 }
 function u(e, t) {
-	let n = e.filter((e) => e !== "'none'" || t.length === 0);
+	return e.toLowerCase() === t;
+}
+function d(e) {
+	return e.every((e) => u(e, "'none'"));
+}
+function f(e) {
+	return e.replace(/^'(?:sha\d{3}|nonce)-/i, (e) => e.toLowerCase());
+}
+function p(e, t) {
+	let n = e.filter((e) => !u(e, "'none'") || t.length === 0);
 	for (let e of t) n.includes(e) || n.push(e);
 	return n.length === 0 ? ["'none'"] : n;
 }
-function d(t) {
+function m(t) {
 	return `'sha256-${e("sha256").update(t, "utf8").digest("base64")}'`;
 }
-function f(e) {
+function h(e) {
 	return e.replace(/'|'|'/gi, "'").replace(/"/gi, "\"").replace(/&/gi, "&");
 }
-function p(e) {
+function g(e) {
 	let t = {};
-	for (let n of e.matchAll(/([^\s=<>/]+)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/g)) t[n[1].toLowerCase()] = f(n[2] ?? n[3] ?? n[4] ?? "");
+	for (let n of e.matchAll(/([^\s=<>/]+)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/g)) t[n[1].toLowerCase()] = h(n[2] ?? n[3] ?? n[4] ?? "");
 	return t;
 }
-function m(e) {
-	let t = [...e.matchAll(/<meta\b[^>]*>/gi)].filter((e) => p(e[0])["http-equiv"]?.toLowerCase() === "content-security-policy");
+function _(e) {
+	let t = [...e.matchAll(/<meta\b[^>]*>/gi)].filter((e) => g(e[0])["http-equiv"]?.toLowerCase() === "content-security-policy");
 	if (t.length === 0) return { html: e };
 	if (t.length > 1) throw Error("tempestCsp: index.html declares more than one Content-Security-Policy <meta>; merge them into one");
 	let n = t[0];
 	return {
 		html: e.slice(0, n.index) + e.slice(n.index + n[0].length).replace(/^[ \t]*\r?\n/, ""),
-		declared: c(p(n[0]).content ?? "")
+		declared: c(g(n[0]).content ?? "")
 	};
 }
-function h(e, t) {
+function v(e, t) {
 	let n = RegExp(`<${t}\\b([^>]*)>([\\s\\S]*?)</${t}>`, "gi"), r = [];
 	for (let i of e.matchAll(n)) {
-		let e = p(`<x ${i[1]}>`);
+		let e = g(`<x ${i[1]}>`);
 		if (t === "script" && "src" in e || i[2].length === 0) continue;
-		let n = d(i[2]);
+		let n = m(i[2]);
 		r.includes(n) || r.push(n);
 	}
 	return r;
 }
-function g(e, t) {
+function y(e, t) {
 	let n = `<meta http-equiv="Content-Security-Policy" content="${t.replace(/&/g, "&amp;").replace(/"/g, "&quot;")}" />`, r = /<meta\b[^>]*\bcharset\s*=[^>]*>/i.exec(e), i = /<head\b[^>]*>/i.exec(e), a = r !== null && i !== null && /<(?:script|link|style)\b/i.test(e.slice(i.index, r.index)), o = r && i && r.index > i.index && !a ? r : i;
 	if (!o) return `${n}\n${e}`;
 	let s = o.index + o[0].length;
 	return `${e.slice(0, s)}\n    ${n}${e.slice(s)}`;
 }
-function _(e) {
+function b(e) {
 	let t = [];
 	for (let n of Object.values(e.bundle ?? {})) n.type === "chunk" && t.push(...n.moduleIds ?? Object.keys(n.modules ?? {}));
 	return t;
 }
-function v(e = {}) {
-	let { connect: t = [], env: r = !0, sockets: o = !0, wasm: c = !0, inlineStyles: d = !0, directives: f = {}, dev: p = !0, log: v = !0, onPolicy: y } = e, b = Object.fromEntries(Object.entries(f).map(([e, t]) => [e.toLowerCase(), t])), x, S = [], C = "";
-	function w(e, t, n) {
+function x(e = {}) {
+	let { connect: t = [], env: r = !0, sockets: o = !0, wasm: c = !0, inlineStyles: m = !0, directives: h = {}, dev: g = !0, log: x = !0, onPolicy: S } = e, C = Object.fromEntries(Object.entries(h).map(([e, t]) => [e.toLowerCase(), t])), w, T = [], E = "";
+	function D(e, t, n) {
 		t === void 0 || e.some((e) => e.origin === t) || e.push({
 			origin: t,
 			from: n
 		});
 	}
-	function T(e) {
+	function O(e) {
 		let n = [], i = e.env ?? {}, o = [e.envPrefix ?? "VITE_"].flat();
-		if (r === !0) for (let [e, t] of Object.entries(i)) o.some((t) => e.startsWith(t)) && typeof t == "string" && a.test(t.trim()) && w(n, s(t, `env ${e}`), `env ${e}`);
+		if (r === !0) for (let [e, t] of Object.entries(i)) o.some((t) => e.startsWith(t)) && typeof t == "string" && a.test(t.trim()) && D(n, s(t, `env ${e}`), `env ${e}`);
 		else if (Array.isArray(r)) for (let t of r) {
 			let r = i[t];
-			if (typeof r != "string" || r.trim() === "") {
-				e.logger.warn(`tempestCsp: env ${t} is empty — nothing added to connect-src`);
-				continue;
-			}
-			w(n, s(r, `env ${t}`), `env ${t}`);
+			typeof r != "string" || r.trim() === "" ? e.logger.warn(`tempestCsp: env ${t} is empty — nothing added to connect-src`) : D(n, s(r, `env ${t}`), `env ${t}`);
 		}
 		return t.forEach((t, r) => {
-			if (!t || t.trim() === "") {
-				e.logger.warn(`tempestCsp: connect[${r}] is empty — skipped, nothing added to connect-src`);
-				return;
-			}
-			w(n, s(t, `connect[${r}]`), `connect[${r}]`);
+			!t || t.trim() === "" ? e.logger.warn(`tempestCsp: connect[${r}] is empty — skipped, nothing added to connect-src`) : D(n, s(t, `connect[${r}]`), `connect[${r}]`);
 		}), n;
 	}
-	function E(e) {
+	function k(e) {
 		let t = [...e];
 		if (!o) return t;
 		for (let { origin: n } of e) {
 			let e = n.replace(/^http(s?):/i, "ws$1:");
-			e !== n && w(t, e, `sockets (${n})`);
+			e !== n && D(t, e, `sockets (${n})`);
 		}
 		return t;
 	}
-	function D(e, t) {
+	function A(e, t) {
 		let n = e ? ["'self'", e] : ["'self'"], r = {
 			"default-src": [...n],
 			"script-src": c ? [...n, "'wasm-unsafe-eval'"] : [...n],
-			"style-src": d || t ? [...n, "'unsafe-inline'"] : [...n],
+			"style-src": m || t ? [...n, "'unsafe-inline'"] : [...n],
 			"img-src": [
 				...n,
 				"data:",
@@ -171,74 +172,76 @@ function v(e = {}) {
 			"base-uri": ["'self'"],
 			"form-action": ["'self'"]
 		};
-		for (let [e, t] of Object.entries(b)) t === !1 ? delete r[e] : r[e] = u(r[e] ?? [], t);
+		for (let [e, t] of Object.entries(C)) t === !1 ? delete r[e] : r[e] = p(r[e] ?? [], t);
 		return r;
 	}
-	function O(e, t) {
+	function j(e, t) {
 		let n = {};
 		for (let [r, a] of Object.entries(e)) {
 			if (r in t) {
 				n[r] = t[r];
 				continue;
 			}
-			let e = i(t, r), o = b[r];
-			e === void 0 ? n[r] = a : Array.isArray(o) ? n[r] = u(e, o) : a.length === 1 && a[0] === "'none'" && (n[r] = a);
+			let e = i(t, r), o = C[r];
+			e === void 0 ? n[r] = a : Array.isArray(o) ? n[r] = p(e, o) : a.length > 0 && d(a) && (n[r] = a);
 		}
 		for (let [e, r] of Object.entries(t)) n[e] ??= r;
-		for (let [e, r] of Object.entries(b)) {
+		for (let [e, r] of Object.entries(C)) {
 			if (!(e in t)) continue;
 			if (r === !1) {
 				delete n[e];
 				continue;
 			}
 			let i = r.filter((n) => !t[e].includes(n));
-			i.length > 0 && x?.logger.warn(`tempestCsp: index.html declares ${e}, so directives["${e}"] is not added to it (${i.join(" ")}); the plugin never loosens a declared policy — add them to the <meta> instead`);
+			i.length > 0 && w?.logger.warn(`tempestCsp: index.html declares ${e}, so directives["${e}"] is not added to it (${i.join(" ")}); the plugin never loosens a declared policy — add them to the <meta> instead`);
 		}
 		return n;
 	}
-	function k(e, t, n) {
-		if (!n || !x || n.includes("'unsafe-inline'") && !n.some((e) => /^'(?:sha\d{3}|nonce)-/.test(e))) return;
-		let r = h(e, "script").filter((e) => !n.includes(e));
-		r.length !== 0 && x.logger.warn(`tempestCsp: the Content-Security-Policy declared in index.html blocks ${r.length} inline <script> (${t} ${n.join(" ")}); the plugin never loosens a declared policy, so add ${r.join(" ")} to ${t}`);
+	function M(e, t, n) {
+		if (!n || !w) return;
+		let r = n.map(f);
+		if (n.some((e) => u(e, "'unsafe-inline'")) && !r.some((e) => /^'(?:sha\d{3}|nonce)-/.test(e))) return;
+		let i = v(e, "script").filter((e) => !r.includes(e));
+		i.length !== 0 && w.logger.warn(`tempestCsp: the Content-Security-Policy declared in index.html blocks ${i.length} inline <script> (${t} ${n.join(" ")}); the plugin never loosens a declared policy, so add ${i.join(" ")} to ${t}`);
 	}
 	return {
 		name: "tempest-csp",
 		configResolved(e) {
-			x = e, S = T(e);
+			w = e, T = O(e);
 		},
 		transformIndexHtml: {
 			order: "post",
 			handler(e, t) {
-				let r = x?.command === "serve";
-				if (r && !p) return e;
-				let o = E(S), c = x?.base ?? "/", d = a.test(c) ? s(c, "base") : void 0;
-				d && w(o, d, "base");
-				let f = r ? [] : _(t);
-				for (let e of n) (r || f.some((t) => e.module.test(t))) && w(o, e.origin, e.from);
-				let b = o, { html: T, declared: A = {} } = m(e), j = D(d, r), M = (e) => !(e in A) && i(A, e) === void 0;
-				M("script-src") && !("script-src-elem" in A) && (j["script-src"] = u(j["script-src"] ?? [], h(T, "script"))), M("style-src") && !("style-src-elem" in A) && !j["style-src"]?.includes("'unsafe-inline'") && (j["style-src"] = u(j["style-src"] ?? [], h(T, "style")));
-				let N = O(j, A), P = b.map((e) => e.origin), F = i(A, "connect-src"), I = N["connect-src"] ?? F;
-				I?.length === 1 && I[0] === "'none'" && ("connect-src" in A || F !== void 0) ? P.length > 0 && x?.logger.warn(`tempestCsp: index.html declares connect-src 'none'${"connect-src" in A ? "" : " (through default-src)"}, so these origins stay out and requests to them will be blocked: ${P.join(" ")}`) : ("connect-src" in N || P.length > 0 || F === void 0) && (N["connect-src"] = u(I ?? ["'self'"], P));
-				let L = "script-src-elem" in A ? "script-src-elem" : "script-src";
-				k(T, L, N[L] ?? i(A, L));
-				let R = {
-					directives: N,
-					meta: l(N, "meta"),
-					header: l(N, "header"),
-					connect: b,
+				let r = w?.command === "serve";
+				if (r && !g) return e;
+				let o = k(T), c = w?.base ?? "/", f = a.test(c) ? s(c, "base") : void 0;
+				f && D(o, f, "base");
+				let m = r ? [] : b(t);
+				for (let e of n) (r || m.some((t) => e.module.test(t))) && D(o, e.origin, e.from);
+				let h = o, { html: C, declared: O = {} } = _(e), N = A(f, r), P = (e) => !(e in O) && i(O, e) === void 0;
+				P("script-src") && !("script-src-elem" in O) && (N["script-src"] = p(N["script-src"] ?? [], v(C, "script"))), P("style-src") && !("style-src-elem" in O) && !N["style-src"]?.some((e) => u(e, "'unsafe-inline'")) && (N["style-src"] = p(N["style-src"] ?? [], v(C, "style")));
+				let F = j(N, O), I = h.map((e) => e.origin), L = i(O, "connect-src"), R = F["connect-src"] ?? L;
+				R !== void 0 && d(R) && ("connect-src" in O || L !== void 0) ? I.length > 0 && w?.logger.warn(`tempestCsp: index.html declares connect-src ${R.join(" ") || "with no source"}${"connect-src" in O ? "" : " (through default-src)"}, so these origins stay out and requests to them will be blocked: ${I.join(" ")}`) : ("connect-src" in F || I.length > 0 || L === void 0) && (F["connect-src"] = p(R ?? ["'self'"], I));
+				let z = "script-src-elem" in O ? "script-src-elem" : "script-src";
+				M(C, z, F[z] ?? i(O, z));
+				let B = {
+					directives: F,
+					meta: l(F, "meta"),
+					header: l(F, "header"),
+					connect: h,
 					command: r ? "serve" : "build"
 				};
-				if (v && x && R.header !== C) {
-					C = R.header;
-					let e = b.map((e) => `  ${e.origin}  ← ${e.from}`);
-					x.logger.info([`tempest-csp: connect-src ${(N["connect-src"] ?? F ?? []).join(" ")}`, ...e.length > 0 ? e : ["  (no cross-origin endpoint: only 'self')"]].join("\n"));
+				if (x && w && B.header !== E) {
+					E = B.header;
+					let e = h.map((e) => `  ${e.origin}  ← ${e.from}`);
+					w.logger.info([`tempest-csp: connect-src ${(F["connect-src"] ?? L ?? []).join(" ")}`, ...e.length > 0 ? e : ["  (no cross-origin endpoint: only 'self')"]].join("\n"));
 				}
-				return y?.(R), g(T, R.meta);
+				return S?.(B), y(C, B.meta);
 			}
 		}
 	};
 }
 //#endregion
-export { s as cspOrigin, c as parseCsp, l as serializeCsp, v as tempestCsp };
+export { s as cspOrigin, c as parseCsp, l as serializeCsp, x as tempestCsp };
 
 //# sourceMappingURL=tempest-csp.js.map

package/dist/vite/tempest-csp.js.map

@@ -1 +1 @@
-{"version":3,"file":"tempest-csp.js","names":[],"sources":["../../src/vite/tempest-csp.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { IndexHtmlTransformContext, Plugin, ResolvedConfig } from \"vite\";\n\nimport type { TempestVitePlugin } from \"./tempest-pwa-manifest\";\n\n/** Options for {@link tempestCsp}. */\nexport interface TempestCspOptions {\n    /**\n     * Endpoints the app calls at runtime, as full URLs. Only the origin\n     * (`scheme://host[:port]`) enters `connect-src`: a source expression with a path\n     * matches that path alone, so `https://idp/realms/x` would still block\n     * `https://idp/realms/x/protocol/openid-connect/token`.\n     *\n     * Empty entries (`undefined`, `null`, `false`, `\"\"`) are skipped with a build\n     * warning instead of leaving a hole in the directive, so passing an env var\n     * that is not set is safe. A root-relative path (`/api`) is same-origin and\n     * already covered by `'self'`. Anything else that is not an absolute\n     * `http(s)`/`ws(s)` URL throws at config time — failing the build, not\n     * production. A wildcard host (`https://*.example.com`) is kept as written.\n     */\n    connect?: ReadonlyArray<string | null | undefined | false>;\n    /**\n     * Read origins from the same environment the runtime reads. `true` (the\n     * default) adds every variable Vite exposes to `import.meta.env` (the\n     * `envPrefix` ones, `VITE_` by default) whose value is an absolute\n     * `http(s)`/`ws(s)` URL. This is the structural bridge: an origin added to\n     * `.env` for a new runtime call lands in the policy with no second list to\n     * keep in sync. Pass a list of names to include exactly those — a name that\n     * resolves to nothing is reported as a build warning — or `false` to rely on\n     * {@link TempestCspOptions.connect} alone.\n     */\n    env?: boolean | readonly string[];\n    /**\n     * Also allow the WebSocket twin of every `http(s)` origin (`https://api` →\n     * `wss://api`). Measured in Chromium (23/09/2026): `connect-src https://api`\n     * blocks `new WebSocket(\"wss://api\")`, while `'self'` does cover a same-origin\n     * `ws:` — so an app that derives its socket URL from the API URL breaks\n     * without this. Default `true`.\n     */\n    sockets?: boolean;\n    /**\n     * Add `'wasm-unsafe-eval'` to `script-src`, which `onnxruntime-web` (the\n     * `/vision` and `/tabular` subpaths) needs to compile its WebAssembly. Without\n     * it `WebAssembly.compile` throws a `CompileError` naming `script-src`.\n     * It grants WebAssembly compilation only, not `eval`. Default `true`.\n     */\n    wasm?: boolean;\n    /**\n     * Add `'unsafe-inline'` to `style-src`. React's `style` prop does **not** need\n     * it — it writes through the CSSOM, which CSP does not govern (measured in\n     * Chromium, 23/09/2026). What needs it is a `<style>` element or a `style=\"\"`\n     * attribute, and the SDK's own `applyTheme` injects a `<style>`. Pass `false`\n     * when the app never calls `applyTheme`; inline `<style>` blocks in\n     * `index.html` are then hashed instead. Always on under `vite dev`, whose CSS\n     * injection is a `<style>` element. Default `true`.\n     */\n    inlineStyles?: boolean;\n    /**\n     * Extra sources per directive, merged into the defaults (`{ \"img-src\":\n     * [\"https://tiles.example.com\"] }`), or `false` to drop a directive.\n     * `frame-ancestors`, `report-uri` and `sandbox` are ignored by browsers when\n     * delivered by `<meta>`, so they reach {@link TempestCspPolicy.header} only.\n     */\n    directives?: Readonly<Record<string, readonly string[] | false>>;\n    /**\n     * Apply the policy under `vite dev` too. Default `true`: the failure this\n     * plugin exists for is \"works in dev, blocked in production\", and a policy\n     * enforced in dev moves every missing origin to the first page load on the\n     * developer's machine. Dev differs from build only in `style-src\n     * 'unsafe-inline'` and in allowing every SDK-known origin (see\n     * {@link TempestCspPolicy.connect}), because the dev server cannot know which\n     * modules the page will load.\n     */\n    dev?: boolean;\n    /** Print the resolved `connect-src` and where each origin came from. Default `true`. */\n    log?: boolean;\n    /**\n     * Receive the resolved policy — for asserting it in a test, or for writing the\n     * same policy as an HTTP header (the only channel for `frame-ancestors`).\n     */\n    onPolicy?: (policy: TempestCspPolicy) => void;\n}\n\n/** One origin in `connect-src` and the input that put it there. */\nexport interface TempestCspSource {\n    /** The source expression, e.g. `https://api.example.com`. */\n    origin: string;\n    /** Where it came from: `env VITE_API_URL`, `connect[0]`, `sockets`, `base` or an SDK module. */\n    from: string;\n}\n\n/** The policy {@link tempestCsp} resolved for one `index.html`. */\nexport interface TempestCspPolicy {\n    /** Every directive and its sources, including the header-only ones. */\n    directives: Record<string, string[]>;\n    /** The policy as written into the `<meta http-equiv>` tag. */\n    meta: string;\n    /** The full policy for a `Content-Security-Policy` response header. */\n    header: string;\n    /** Every origin added to `connect-src`, with its provenance. */\n    connect: TempestCspSource[];\n    /** `\"serve\"` under `vite dev`, `\"build\"` under `vite build`. */\n    command: \"serve\" | \"build\";\n}\n\n/**\n * Directives a browser ignores when the policy arrives by `<meta>` (CSP3 §3.3),\n * printing a console warning for each.\n */\nconst HEADER_ONLY_DIRECTIVES: ReadonlySet<string> = new Set([\n    \"frame-ancestors\",\n    \"report-uri\",\n    \"sandbox\",\n]);\n\n/**\n * Origins the SDK itself calls, keyed by the module that calls them. In a build\n * the origin enters only when the module is in the bundle; in dev always.\n */\nconst SDK_ORIGINS: ReadonlyArray<{ module: RegExp; origin: string; from: string }> = [\n    {\n        module: /[\\\\/]forms[\\\\/]use-viacep\\.(?:[cm]?js|tsx?)$/,\n        origin: \"https://viacep.com.br\",\n        from: \"tempest-react-sdk useViaCEP\",\n    },\n];\n\n/**\n * Where each fetch directive falls back when a policy does not declare it, in\n * order. Ported from CSP3 §6.8.3, \"Get fetch directive fallback list\"\n * (https://w3c.github.io/webappsec-csp/#directive-fallback-list, checked\n * 11/10/2026), which lists twelve effective directives: `script-src-elem`,\n * `script-src-attr`, `style-src-elem`, `style-src-attr`, `worker-src`,\n * `connect-src`, `manifest-src`, `object-src`, `frame-src`, `media-src`,\n * `font-src` and `img-src`. Four more are listed here on purpose:\n *\n * - `script-src`, `style-src` and `child-src` are never an effective directive,\n *   but every chain that reaches them continues to `default-src`;\n * - `fenced-frame-src` comes from the Fenced Frame spec, which extends the\n *   `frame-src` chain;\n * - `prefetch-src` was in earlier CSP3 drafts (→ `default-src`) and is gone from\n *   the current one; a browser that still resolves it does so through\n *   `default-src`, so it is treated as inherited.\n *\n * A directive absent from this map does not fall back at all (`base-uri`,\n * `form-action`, `frame-ancestors`, …): leaving it out of a policy allows\n * everything, so adding it only ever restricts.\n */\nconst CSP_FALLBACK: Readonly<Record<string, readonly string[]>> = {\n    \"script-src-elem\": [\"script-src\", \"default-src\"],\n    \"script-src-attr\": [\"script-src\", \"default-src\"],\n    \"style-src-elem\": [\"style-src\", \"default-src\"],\n    \"style-src-attr\": [\"style-src\", \"default-src\"],\n    \"worker-src\": [\"child-src\", \"script-src\", \"default-src\"],\n    \"frame-src\": [\"child-src\", \"default-src\"],\n    \"fenced-frame-src\": [\"frame-src\", \"child-src\", \"default-src\"],\n    \"child-src\": [\"default-src\"],\n    \"connect-src\": [\"default-src\"],\n    \"font-src\": [\"default-src\"],\n    \"img-src\": [\"default-src\"],\n    \"manifest-src\": [\"default-src\"],\n    \"media-src\": [\"default-src\"],\n    \"object-src\": [\"default-src\"],\n    \"prefetch-src\": [\"default-src\"],\n    \"script-src\": [\"default-src\"],\n    \"style-src\": [\"default-src\"],\n};\n\n/**\n * The sources a declared policy already applies to a directive it does not\n * name, by walking {@link CSP_FALLBACK}.\n *\n * @param declared - The policy the app declared.\n * @param name - A directive the app did not declare.\n * @returns The inherited sources, or `undefined` when nothing governs the directive.\n */\nfunction inheritedSources(\n    declared: Readonly<Record<string, string[]>>,\n    name: string,\n): string[] | undefined {\n    for (const parent of CSP_FALLBACK[name] ?? []) {\n        if (parent in declared) return declared[parent];\n    }\n    return undefined;\n}\n\nconst ABSOLUTE_URL = /^(?:https?|wss?):\\/\\//i;\nconst WILDCARD_SOURCE = /^((?:https?|wss?):\\/\\/\\*\\.[a-z0-9.-]+(?::\\d+)?)(?:[/?#].*)?$/i;\n\n/**\n * Reduce a URL to the origin a CSP source expression should carry.\n *\n * @param value - The URL as the app configured it.\n * @param from - Its provenance, quoted in the error.\n * @returns The origin, or `undefined` for a root-relative path (covered by `'self'`).\n * @throws {Error} When the value is neither an absolute `http(s)`/`ws(s)` URL nor a path.\n */\nexport function cspOrigin(value: string, from: string): string | undefined {\n    const trimmed = value.trim();\n    if (trimmed.startsWith(\"/\") && !trimmed.startsWith(\"//\")) return undefined;\n    const wildcard = WILDCARD_SOURCE.exec(trimmed);\n    if (wildcard) return wildcard[1]!.toLowerCase();\n    if (ABSOLUTE_URL.test(trimmed)) {\n        try {\n            const url = new URL(trimmed);\n            return `${url.protocol}//${url.host}`;\n        } catch {\n            throw new Error(`tempestCsp: ${from} is not a valid URL: \"${value}\"`);\n        }\n    }\n    throw new Error(\n        `tempestCsp: ${from} must be an absolute http(s)/ws(s) URL or a root-relative path, got \"${value}\"`,\n    );\n}\n\n/**\n * Parse a serialized policy into directives, lowercasing names. A repeated\n * directive keeps its first occurrence, as browsers do.\n *\n * @param policy - A `Content-Security-Policy` value.\n * @returns Directive name → sources.\n */\nexport function parseCsp(policy: string): Record<string, string[]> {\n    const out: Record<string, string[]> = {};\n    for (const part of policy.split(\";\")) {\n        const [name, ...sources] = part.trim().split(/\\s+/);\n        if (!name) continue;\n        const key = name.toLowerCase();\n        if (!(key in out)) out[key] = sources;\n    }\n    return out;\n}\n\n/**\n * Serialize directives into a policy string, dropping header-only directives\n * when the target is a `<meta>` tag.\n *\n * @param directives - Directive name → sources.\n * @param target - `\"meta\"` or `\"header\"`.\n * @returns The policy value.\n */\nexport function serializeCsp(\n    directives: Readonly<Record<string, readonly string[]>>,\n    target: \"meta\" | \"header\",\n): string {\n    return Object.entries(directives)\n        .filter(([name]) => target === \"header\" || !HEADER_ONLY_DIRECTIVES.has(name))\n        .map(([name, sources]) => [name, ...sources].join(\" \"))\n        .join(\"; \");\n}\n\nfunction union(base: readonly string[], extra: readonly string[]): string[] {\n    const out = base.filter((source) => source !== \"'none'\" || extra.length === 0);\n    for (const source of extra) if (!out.includes(source)) out.push(source);\n    return out.length === 0 ? [\"'none'\"] : out;\n}\n\nfunction sha256(content: string): string {\n    return `'sha256-${createHash(\"sha256\").update(content, \"utf8\").digest(\"base64\")}'`;\n}\n\nfunction decodeEntities(value: string): string {\n    return value\n        .replace(/&#39;|&#x27;|&apos;/gi, \"'\")\n        .replace(/&quot;/gi, '\"')\n        .replace(/&amp;/gi, \"&\");\n}\n\nfunction readAttributes(tag: string): Record<string, string> {\n    const out: Record<string, string> = {};\n    const pattern = /([^\\s=<>/]+)\\s*=\\s*(?:\"([^\"]*)\"|'([^']*)'|([^\\s>]+))/g;\n    for (const match of tag.matchAll(pattern)) {\n        out[match[1]!.toLowerCase()] = decodeEntities(match[2] ?? match[3] ?? match[4] ?? \"\");\n    }\n    return out;\n}\n\n/**\n * Find the policy `index.html` already declares and remove its tag, so the merged\n * policy replaces it instead of stacking a second one (two policies are\n * intersected by the browser, so the stricter would win silently).\n *\n * @throws {Error} When the page declares more than one CSP `<meta>`: merging an\n *   intersection into a union would weaken it, so the plugin refuses.\n */\nfunction extractMetaPolicy(html: string): { html: string; declared?: Record<string, string[]> } {\n    const tags = [...html.matchAll(/<meta\\b[^>]*>/gi)].filter(\n        (match) =>\n            readAttributes(match[0])[\"http-equiv\"]?.toLowerCase() === \"content-security-policy\",\n    );\n    if (tags.length === 0) return { html };\n    if (tags.length > 1) {\n        throw new Error(\n            \"tempestCsp: index.html declares more than one Content-Security-Policy <meta>; merge them into one\",\n        );\n    }\n    const tag = tags[0]!;\n    return {\n        html:\n            html.slice(0, tag.index) +\n            html.slice(tag.index! + tag[0].length).replace(/^[ \\t]*\\r?\\n/, \"\"),\n        declared: parseCsp(readAttributes(tag[0]).content ?? \"\"),\n    };\n}\n\nfunction inlineHashes(html: string, element: \"script\" | \"style\"): string[] {\n    const pattern = new RegExp(`<${element}\\\\b([^>]*)>([\\\\s\\\\S]*?)</${element}>`, \"gi\");\n    const hashes: string[] = [];\n    for (const match of html.matchAll(pattern)) {\n        const attributes = readAttributes(`<x ${match[1]}>`);\n        if (element === \"script\" && \"src\" in attributes) continue;\n        if (match[2]!.length === 0) continue;\n        const hash = sha256(match[2]!);\n        if (!hashes.includes(hash)) hashes.push(hash);\n    }\n    return hashes;\n}\n\n/**\n * Write the policy tag where it governs the whole page. A `<meta>` CSP applies\n * only to what follows it, so it goes right after `<meta charset>` — unless a\n * resource precedes the charset, as the React Refresh preamble does under\n * `vite dev` (`head-prepend`), in which case it goes right after `<head>`.\n */\nfunction insertMeta(html: string, policy: string): string {\n    const escaped = policy.replace(/&/g, \"&amp;\").replace(/\"/g, \"&quot;\");\n    const tag = `<meta http-equiv=\"Content-Security-Policy\" content=\"${escaped}\" />`;\n    const charset = /<meta\\b[^>]*\\bcharset\\s*=[^>]*>/i.exec(html);\n    const head = /<head\\b[^>]*>/i.exec(html);\n    const resourceFirst =\n        charset !== null &&\n        head !== null &&\n        /<(?:script|link|style)\\b/i.test(html.slice(head.index, charset.index));\n    const anchor = charset && head && charset.index > head.index && !resourceFirst ? charset : head;\n    if (!anchor) return `${tag}\\n${html}`;\n    const at = anchor.index + anchor[0].length;\n    return `${html.slice(0, at)}\\n    ${tag}${html.slice(at)}`;\n}\n\nfunction bundleModuleIds(ctx: IndexHtmlTransformContext): string[] {\n    const ids: string[] = [];\n    for (const output of Object.values(ctx.bundle ?? {})) {\n        if (output.type !== \"chunk\") continue;\n        ids.push(...(output.moduleIds ?? Object.keys(output.modules ?? {})));\n    }\n    return ids;\n}\n\n/**\n * Vite plugin that writes a Content-Security-Policy `<meta>` into `index.html`\n * and derives `connect-src` from the origins the app actually calls.\n *\n * It exists because of how a missing origin fails: the request is blocked\n * before a connection opens, so there is no entry in the Network tab, nothing in\n * the server log, `curl` succeeds, and the app sees `TypeError: Failed to\n * fetch` — indistinguishable from offline, DNS or CORS. And a hand-written CSP\n * plugin is usually `apply: \"build\"`, so it only fails in production. This\n * plugin closes both ends:\n *\n * - origins come from the same `import.meta.env` the runtime reads\n *   ({@link TempestCspOptions.env}), reduced to `scheme://host[:port]`, with\n *   empty values skipped — no second list to drift;\n * - the policy is enforced under `vite dev` as well ({@link TempestCspOptions.dev});\n * - the build prints every origin and its provenance.\n *\n * Defaults cover what the SDK's stack needs and nothing more: `'self'`\n * everywhere, `'wasm-unsafe-eval'` for ONNX Runtime, `blob:` for workers, object\n * URLs and media, `data:` for images and fonts, `object-src 'none'`,\n * `base-uri 'self'`, `form-action 'self'`. Inline `<script>` blocks left in\n * `index.html` (a `themeInitScript()` anti-flash script, say) are allowed by\n * SHA-256 hash, never by `'unsafe-inline'`.\n *\n * An existing CSP `<meta>` in `index.html` is merged, not overwritten, and the\n * merge never loosens what the app wrote:\n *\n * - a directive it declares is kept verbatim, except `connect-src`, which gains\n *   the resolved origins (the list the plugin exists to maintain) unless it is\n *   `'none'` — declared or inherited from `default-src` — in which case the\n *   origins stay out and each one is reported as a build warning. Sources in\n *   {@link TempestCspOptions.directives} for a declared directive are not added\n *   (a build warning names them); `false` there removes it;\n * - a fetch directive it does not declare but already governs through the CSP3\n *   fallback chain (§6.8.3 — `img-src` → `default-src`,\n *   `worker-src` → `child-src` → `script-src` → `default-src`) is left out, so it\n *   keeps falling back. Filling it from the defaults would replace a\n *   `default-src 'none'` with `'self' data: blob:`. No inline-script hash and no\n *   `'wasm-unsafe-eval'` is added to it, and an inline `<script>` is judged by a\n *   declared `script-src-elem` before `script-src`; `connect-src` starts from the inherited\n *   value, and so does any directive passed in {@link TempestCspOptions.directives};\n * - a default that is exactly `'none'` (`object-src`), or a directive that does\n *   not fall back (`base-uri`, `form-action`), is still added: it can only\n *   restrict;\n * - a directive nothing in the declared policy governs comes from the defaults.\n *\n * @param options - See {@link TempestCspOptions}.\n * @returns A Vite plugin, to be placed in `plugins`. It runs as a `post` HTML\n *   transform, so a plugin that rewrites inline scripts after it would\n *   invalidate the hashes.\n *\n * @example\n * // vite.config.ts\n * import { createViteConfig, tempestCsp } from \"tempest-react-sdk/vite\";\n *\n * export default createViteConfig({\n *     plugins: [tempestCsp({ connect: [\"https://sso.example.com/realms/app\"] })],\n * });\n */\nexport function tempestCsp(options: TempestCspOptions = {}): TempestVitePlugin {\n    const {\n        connect = [],\n        env = true,\n        sockets = true,\n        wasm = true,\n        inlineStyles = true,\n        directives: extra = {},\n        dev = true,\n        log = true,\n        onPolicy,\n    } = options;\n\n    const configured: Record<string, readonly string[] | false> = Object.fromEntries(\n        Object.entries(extra).map(([name, sources]) => [name.toLowerCase(), sources]),\n    );\n    let config: ResolvedConfig | undefined;\n    let resolved: TempestCspSource[] = [];\n    let lastLogged = \"\";\n\n    function add(list: TempestCspSource[], origin: string | undefined, from: string): void {\n        if (origin === undefined || list.some((source) => source.origin === origin)) return;\n        list.push({ origin, from });\n    }\n\n    function resolveSources(resolvedConfig: ResolvedConfig): TempestCspSource[] {\n        const list: TempestCspSource[] = [];\n        const values: Record<string, unknown> = resolvedConfig.env ?? {};\n        const prefixes = [resolvedConfig.envPrefix ?? \"VITE_\"].flat();\n        if (env === true) {\n            for (const [name, value] of Object.entries(values)) {\n                if (!prefixes.some((prefix) => name.startsWith(prefix))) continue;\n                if (typeof value !== \"string\" || !ABSOLUTE_URL.test(value.trim())) continue;\n                add(list, cspOrigin(value, `env ${name}`), `env ${name}`);\n            }\n        } else if (Array.isArray(env)) {\n            for (const name of env) {\n                const value = values[name];\n                if (typeof value !== \"string\" || value.trim() === \"\") {\n                    resolvedConfig.logger.warn(\n                        `tempestCsp: env ${name} is empty — nothing added to connect-src`,\n                    );\n                    continue;\n                }\n                add(list, cspOrigin(value, `env ${name}`), `env ${name}`);\n            }\n        }\n        connect.forEach((value, index) => {\n            if (!value || value.trim() === \"\") {\n                resolvedConfig.logger.warn(\n                    `tempestCsp: connect[${index}] is empty — skipped, nothing added to connect-src`,\n                );\n                return;\n            }\n            add(list, cspOrigin(value, `connect[${index}]`), `connect[${index}]`);\n        });\n        return list;\n    }\n\n    function withSockets(list: readonly TempestCspSource[]): TempestCspSource[] {\n        const out = [...list];\n        if (!sockets) return out;\n        for (const { origin } of list) {\n            const twin = origin.replace(/^http(s?):/i, \"ws$1:\");\n            if (twin !== origin) add(out, twin, `sockets (${origin})`);\n        }\n        return out;\n    }\n\n    function defaults(baseOrigin: string | undefined, serve: boolean): Record<string, string[]> {\n        const self = baseOrigin ? [\"'self'\", baseOrigin] : [\"'self'\"];\n        const policy: Record<string, string[]> = {\n            \"default-src\": [...self],\n            \"script-src\": wasm ? [...self, \"'wasm-unsafe-eval'\"] : [...self],\n            \"style-src\": inlineStyles || serve ? [...self, \"'unsafe-inline'\"] : [...self],\n            \"img-src\": [...self, \"data:\", \"blob:\"],\n            \"font-src\": [...self, \"data:\"],\n            \"media-src\": [...self, \"blob:\"],\n            \"connect-src\": [\"'self'\", \"blob:\", \"data:\"],\n            \"worker-src\": [...self, \"blob:\"],\n            \"manifest-src\": [...self],\n            \"object-src\": [\"'none'\"],\n            \"base-uri\": [\"'self'\"],\n            \"form-action\": [\"'self'\"],\n        };\n        for (const [name, sources] of Object.entries(configured)) {\n            if (sources === false) delete policy[name];\n            else policy[name] = union(policy[name] ?? [], sources);\n        }\n        return policy;\n    }\n\n    /**\n     * Merge the defaults, the declared policy and the configured\n     * {@link TempestCspOptions.directives}, never loosening what was declared. A\n     * declared directive is kept verbatim: configured sources for it are not\n     * added — adding would loosen the app's policy — and each ignored source is\n     * reported as a build warning, while a configured `false` removes it, since\n     * removing is an explicit choice. An inherited directive (see\n     * {@link inheritedSources}) is omitted unless the default is `'none'` or the\n     * config adds sources, which then extend the inherited value instead of the\n     * defaults.\n     */\n    function mergePolicy(\n        policy: Readonly<Record<string, string[]>>,\n        declared: Readonly<Record<string, string[]>>,\n    ): Record<string, string[]> {\n        const merged: Record<string, string[]> = {};\n        for (const [name, sources] of Object.entries(policy)) {\n            if (name in declared) {\n                merged[name] = declared[name]!;\n                continue;\n            }\n            const inherited = inheritedSources(declared, name);\n            const added = configured[name];\n            if (inherited === undefined) merged[name] = sources;\n            else if (Array.isArray(added)) merged[name] = union(inherited, added);\n            else if (sources.length === 1 && sources[0] === \"'none'\") merged[name] = sources;\n        }\n        for (const [name, sources] of Object.entries(declared)) merged[name] ??= sources;\n        for (const [name, sources] of Object.entries(configured)) {\n            if (!(name in declared)) continue;\n            if (sources === false) {\n                delete merged[name];\n                continue;\n            }\n            const ignored = sources.filter((source) => !declared[name]!.includes(source));\n            if (ignored.length > 0) {\n                config?.logger.warn(\n                    `tempestCsp: index.html declares ${name}, so directives[\"${name}\"] is not added to it ` +\n                        `(${ignored.join(\" \")}); the plugin never loosens a declared policy — add them to the <meta> instead`,\n                );\n            }\n        }\n        return merged;\n    }\n\n    /**\n     * Report every inline `<script>` the final policy blocks. It only happens when\n     * the app's declared policy governs `script-src` — directly or through\n     * `default-src` — since the plugin then adds no hash, and the symptom would\n     * otherwise be a script that silently never runs (under `vite dev`, the React\n     * Refresh preamble, which takes the page down with it).\n     *\n     * `<script>` elements are governed by `script-src-elem` when the policy has\n     * one, so that is the directive judged and named.\n     *\n     * @param html - The page, without its CSP `<meta>`.\n     * @param directive - `\"script-src-elem\"` when declared, else `\"script-src\"`.\n     * @param effective - The sources the browser will apply to inline `<script>`\n     *   elements, or `undefined` when no directive governs them.\n     */\n    function warnBlockedInlineScripts(\n        html: string,\n        directive: string,\n        effective: readonly string[] | undefined,\n    ): void {\n        if (!effective || !config) return;\n        const unsafeInline =\n            effective.includes(\"'unsafe-inline'\") &&\n            !effective.some((source) => /^'(?:sha\\d{3}|nonce)-/.test(source));\n        if (unsafeInline) return;\n        const blocked = inlineHashes(html, \"script\").filter((hash) => !effective.includes(hash));\n        if (blocked.length === 0) return;\n        config.logger.warn(\n            `tempestCsp: the Content-Security-Policy declared in index.html blocks ${blocked.length} inline <script> ` +\n                `(${directive} ${effective.join(\" \")}); the plugin never loosens a declared policy, so add ${blocked.join(\" \")} to ${directive}`,\n        );\n    }\n\n    const plugin: Plugin = {\n        name: \"tempest-csp\",\n        configResolved(resolvedConfig) {\n            config = resolvedConfig;\n            resolved = resolveSources(resolvedConfig);\n        },\n        transformIndexHtml: {\n            order: \"post\",\n            handler(source, ctx) {\n                const serve = config?.command === \"serve\";\n                if (serve && !dev) return source;\n\n                const connectSources = withSockets(resolved);\n                const base = config?.base ?? \"/\";\n                const baseOrigin = ABSOLUTE_URL.test(base) ? cspOrigin(base, \"base\") : undefined;\n                if (baseOrigin) add(connectSources, baseOrigin, \"base\");\n                const moduleIds = serve ? [] : bundleModuleIds(ctx);\n                for (const known of SDK_ORIGINS) {\n                    if (serve || moduleIds.some((id) => known.module.test(id))) {\n                        add(connectSources, known.origin, known.from);\n                    }\n                }\n                const allSources = connectSources;\n\n                const { html, declared = {} } = extractMetaPolicy(source);\n                const policy = defaults(baseOrigin, serve);\n                const filled = (name: string): boolean =>\n                    !(name in declared) && inheritedSources(declared, name) === undefined;\n                if (filled(\"script-src\") && !(\"script-src-elem\" in declared)) {\n                    policy[\"script-src\"] = union(\n                        policy[\"script-src\"] ?? [],\n                        inlineHashes(html, \"script\"),\n                    );\n                }\n                if (\n                    filled(\"style-src\") &&\n                    !(\"style-src-elem\" in declared) &&\n                    !policy[\"style-src\"]?.includes(\"'unsafe-inline'\")\n                ) {\n                    policy[\"style-src\"] = union(\n                        policy[\"style-src\"] ?? [],\n                        inlineHashes(html, \"style\"),\n                    );\n                }\n                const merged = mergePolicy(policy, declared);\n                const origins = allSources.map((entry) => entry.origin);\n                const inheritedConnect = inheritedSources(declared, \"connect-src\");\n                const declaredConnect = merged[\"connect-src\"] ?? inheritedConnect;\n                const declaredNone =\n                    declaredConnect?.length === 1 &&\n                    declaredConnect[0] === \"'none'\" &&\n                    (\"connect-src\" in declared || inheritedConnect !== undefined);\n                if (declaredNone) {\n                    if (origins.length > 0) {\n                        config?.logger.warn(\n                            `tempestCsp: index.html declares connect-src 'none'${\"connect-src\" in declared ? \"\" : \" (through default-src)\"}, ` +\n                                `so these origins stay out and requests to them will be blocked: ${origins.join(\" \")}`,\n                        );\n                    }\n                } else if (\n                    \"connect-src\" in merged ||\n                    origins.length > 0 ||\n                    inheritedConnect === undefined\n                ) {\n                    merged[\"connect-src\"] = union(declaredConnect ?? [\"'self'\"], origins);\n                }\n\n                const scriptElem = \"script-src-elem\" in declared ? \"script-src-elem\" : \"script-src\";\n                warnBlockedInlineScripts(\n                    html,\n                    scriptElem,\n                    merged[scriptElem] ?? inheritedSources(declared, scriptElem),\n                );\n\n                const result: TempestCspPolicy = {\n                    directives: merged,\n                    meta: serializeCsp(merged, \"meta\"),\n                    header: serializeCsp(merged, \"header\"),\n                    connect: allSources,\n                    command: serve ? \"serve\" : \"build\",\n                };\n\n                if (log && config && result.header !== lastLogged) {\n                    lastLogged = result.header;\n                    const lines = allSources.map((entry) => `  ${entry.origin}  ← ${entry.from}`);\n                    config.logger.info(\n                        [\n                            `tempest-csp: connect-src ${(merged[\"connect-src\"] ?? inheritedConnect ?? []).join(\" \")}`,\n                            ...(lines.length > 0\n                                ? lines\n                                : [\"  (no cross-origin endpoint: only 'self')\"]),\n                        ].join(\"\\n\"),\n                    );\n                }\n                onPolicy?.(result);\n                return insertMeta(html, result.meta);\n            },\n        },\n    };\n\n    return plugin as TempestVitePlugin;\n}\n"],"mappings":";;AA6GA,IAAM,oBAA8C,IAAI,IAAI;CACxD;CACA;CACA;AACJ,CAAC,GAMK,IAA+E,CACjF;CACI,QAAQ;CACR,QAAQ;CACR,MAAM;AACV,CACJ,GAuBM,IAA4D;CAC9D,mBAAmB,CAAC,cAAc,aAAa;CAC/C,mBAAmB,CAAC,cAAc,aAAa;CAC/C,kBAAkB,CAAC,aAAa,aAAa;CAC7C,kBAAkB,CAAC,aAAa,aAAa;CAC7C,cAAc;EAAC;EAAa;EAAc;CAAa;CACvD,aAAa,CAAC,aAAa,aAAa;CACxC,oBAAoB;EAAC;EAAa;EAAa;CAAa;CAC5D,aAAa,CAAC,aAAa;CAC3B,eAAe,CAAC,aAAa;CAC7B,YAAY,CAAC,aAAa;CAC1B,WAAW,CAAC,aAAa;CACzB,gBAAgB,CAAC,aAAa;CAC9B,aAAa,CAAC,aAAa;CAC3B,cAAc,CAAC,aAAa;CAC5B,gBAAgB,CAAC,aAAa;CAC9B,cAAc,CAAC,aAAa;CAC5B,aAAa,CAAC,aAAa;AAC/B;AAUA,SAAS,EACL,GACA,GACoB;CACpB,KAAK,IAAM,KAAU,EAAa,MAAS,CAAC,GACxC,IAAI,KAAU,GAAU,OAAO,EAAS;AAGhD;AAEA,IAAM,IAAe,0BACf,IAAkB;AAUxB,SAAgB,EAAU,GAAe,GAAkC;CACvE,IAAM,IAAU,EAAM,KAAK;CAC3B,IAAI,EAAQ,WAAW,GAAG,KAAK,CAAC,EAAQ,WAAW,IAAI,GAAG;CAC1D,IAAM,IAAW,EAAgB,KAAK,CAAO;CAC7C,IAAI,GAAU,OAAO,EAAS,EAAE,CAAE,YAAY;CAC9C,IAAI,EAAa,KAAK,CAAO,GACzB,IAAI;EACA,IAAM,IAAM,IAAI,IAAI,CAAO;EAC3B,OAAO,GAAG,EAAI,SAAS,IAAI,EAAI;CACnC,QAAQ;EACJ,MAAU,MAAM,eAAe,EAAK,wBAAwB,EAAM,EAAE;CACxE;CAEJ,MAAU,MACN,eAAe,EAAK,uEAAuE,EAAM,EACrG;AACJ;AASA,SAAgB,EAAS,GAA0C;CAC/D,IAAM,IAAgC,CAAC;CACvC,KAAK,IAAM,KAAQ,EAAO,MAAM,GAAG,GAAG;EAClC,IAAM,CAAC,GAAM,GAAG,KAAW,EAAK,KAAK,CAAC,CAAC,MAAM,KAAK;EAClD,IAAI,CAAC,GAAM;EACX,IAAM,IAAM,EAAK,YAAY;EAC7B,AAAM,KAAO,MAAM,EAAI,KAAO;CAClC;CACA,OAAO;AACX;AAUA,SAAgB,EACZ,GACA,GACM;CACN,OAAO,OAAO,QAAQ,CAAU,CAAC,CAC5B,QAAQ,CAAC,OAAU,MAAW,YAAY,CAAC,EAAuB,IAAI,CAAI,CAAC,CAAC,CAC5E,KAAK,CAAC,GAAM,OAAa,CAAC,GAAM,GAAG,CAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CACtD,KAAK,IAAI;AAClB;AAEA,SAAS,EAAM,GAAyB,GAAoC;CACxE,IAAM,IAAM,EAAK,QAAQ,MAAW,MAAW,YAAY,EAAM,WAAW,CAAC;CAC7E,KAAK,IAAM,KAAU,GAAO,AAAK,EAAI,SAAS,CAAM,KAAG,EAAI,KAAK,CAAM;CACtE,OAAO,EAAI,WAAW,IAAI,CAAC,QAAQ,IAAI;AAC3C;AAEA,SAAS,EAAO,GAAyB;CACrC,OAAO,WAAW,EAAW,QAAQ,CAAC,CAAC,OAAO,GAAS,MAAM,CAAC,CAAC,OAAO,QAAQ,EAAE;AACpF;AAEA,SAAS,EAAe,GAAuB;CAC3C,OAAO,EACF,QAAQ,yBAAyB,GAAG,CAAC,CACrC,QAAQ,YAAY,IAAG,CAAC,CACxB,QAAQ,WAAW,GAAG;AAC/B;AAEA,SAAS,EAAe,GAAqC;CACzD,IAAM,IAA8B,CAAC;CAErC,KAAK,IAAM,KAAS,EAAI,SAAS,uDAAO,GACpC,EAAI,EAAM,EAAE,CAAE,YAAY,KAAK,EAAe,EAAM,MAAM,EAAM,MAAM,EAAM,MAAM,EAAE;CAExF,OAAO;AACX;AAUA,SAAS,EAAkB,GAAqE;CAC5F,IAAM,IAAO,CAAC,GAAG,EAAK,SAAS,iBAAiB,CAAC,CAAC,CAAC,QAC9C,MACG,EAAe,EAAM,EAAE,CAAC,CAAC,aAAa,EAAE,YAAY,MAAM,yBAClE;CACA,IAAI,EAAK,WAAW,GAAG,OAAO,EAAE,QAAK;CACrC,IAAI,EAAK,SAAS,GACd,MAAU,MACN,mGACJ;CAEJ,IAAM,IAAM,EAAK;CACjB,OAAO;EACH,MACI,EAAK,MAAM,GAAG,EAAI,KAAK,IACvB,EAAK,MAAM,EAAI,QAAS,EAAI,EAAE,CAAC,MAAM,CAAC,CAAC,QAAQ,gBAAgB,EAAE;EACrE,UAAU,EAAS,EAAe,EAAI,EAAE,CAAC,CAAC,WAAW,EAAE;CAC3D;AACJ;AAEA,SAAS,EAAa,GAAc,GAAuC;CACvE,IAAM,IAAc,OAAO,IAAI,EAAQ,2BAA2B,EAAQ,IAAI,IAAI,GAC5E,IAAmB,CAAC;CAC1B,KAAK,IAAM,KAAS,EAAK,SAAS,CAAO,GAAG;EACxC,IAAM,IAAa,EAAe,MAAM,EAAM,GAAG,EAAE;EAEnD,IADI,MAAY,YAAY,SAAS,KACjC,EAAM,EAAE,CAAE,WAAW,GAAG;EAC5B,IAAM,IAAO,EAAO,EAAM,EAAG;EAC7B,AAAK,EAAO,SAAS,CAAI,KAAG,EAAO,KAAK,CAAI;CAChD;CACA,OAAO;AACX;AAQA,SAAS,EAAW,GAAc,GAAwB;CAEtD,IAAM,IAAM,uDADI,EAAO,QAAQ,MAAM,OAAO,CAAC,CAAC,QAAQ,MAAM,QACO,EAAQ,OACrE,IAAU,mCAAmC,KAAK,CAAI,GACtD,IAAO,iBAAiB,KAAK,CAAI,GACjC,IACF,MAAY,QACZ,MAAS,QACT,4BAA4B,KAAK,EAAK,MAAM,EAAK,OAAO,EAAQ,KAAK,CAAC,GACpE,IAAS,KAAW,KAAQ,EAAQ,QAAQ,EAAK,SAAS,CAAC,IAAgB,IAAU;CAC3F,IAAI,CAAC,GAAQ,OAAO,GAAG,EAAI,IAAI;CAC/B,IAAM,IAAK,EAAO,QAAQ,EAAO,EAAE,CAAC;CACpC,OAAO,GAAG,EAAK,MAAM,GAAG,CAAE,EAAE,QAAQ,IAAM,EAAK,MAAM,CAAE;AAC3D;AAEA,SAAS,EAAgB,GAA0C;CAC/D,IAAM,IAAgB,CAAC;CACvB,KAAK,IAAM,KAAU,OAAO,OAAO,EAAI,UAAU,CAAC,CAAC,GAC3C,EAAO,SAAS,WACpB,EAAI,KAAK,GAAI,EAAO,aAAa,OAAO,KAAK,EAAO,WAAW,CAAC,CAAC,CAAE;CAEvE,OAAO;AACX;AA6DA,SAAgB,EAAW,IAA6B,CAAC,GAAsB;CAC3E,IAAM,EACF,aAAU,CAAC,GACX,SAAM,IACN,aAAU,IACV,UAAO,IACP,kBAAe,IACf,YAAY,IAAQ,CAAC,GACrB,SAAM,IACN,SAAM,IACN,gBACA,GAEE,IAAwD,OAAO,YACjE,OAAO,QAAQ,CAAK,CAAC,CAAC,KAAK,CAAC,GAAM,OAAa,CAAC,EAAK,YAAY,GAAG,CAAO,CAAC,CAChF,GACI,GACA,IAA+B,CAAC,GAChC,IAAa;CAEjB,SAAS,EAAI,GAA0B,GAA4B,GAAoB;EAC/E,MAAW,KAAA,KAAa,EAAK,MAAM,MAAW,EAAO,WAAW,CAAM,KAC1E,EAAK,KAAK;GAAE;GAAQ;EAAK,CAAC;CAC9B;CAEA,SAAS,EAAe,GAAoD;EACxE,IAAM,IAA2B,CAAC,GAC5B,IAAkC,EAAe,OAAO,CAAC,GACzD,IAAW,CAAC,EAAe,aAAa,OAAO,CAAC,CAAC,KAAK;EAC5D,IAAI,MAAQ,IACR,KAAK,IAAM,CAAC,GAAM,MAAU,OAAO,QAAQ,CAAM,GACxC,EAAS,MAAM,MAAW,EAAK,WAAW,CAAM,CAAC,KAClD,OAAO,KAAU,YAAa,EAAa,KAAK,EAAM,KAAK,CAAC,KAChE,EAAI,GAAM,EAAU,GAAO,OAAO,GAAM,GAAG,OAAO,GAAM;OAEzD,IAAI,MAAM,QAAQ,CAAG,GACxB,KAAK,IAAM,KAAQ,GAAK;GACpB,IAAM,IAAQ,EAAO;GACrB,IAAI,OAAO,KAAU,YAAY,EAAM,KAAK,MAAM,IAAI;IAClD,EAAe,OAAO,KAClB,mBAAmB,EAAK,yCAC5B;IACA;GACJ;GACA,EAAI,GAAM,EAAU,GAAO,OAAO,GAAM,GAAG,OAAO,GAAM;EAC5D;EAWJ,OATA,EAAQ,SAAS,GAAO,MAAU;GAC9B,IAAI,CAAC,KAAS,EAAM,KAAK,MAAM,IAAI;IAC/B,EAAe,OAAO,KAClB,uBAAuB,EAAM,mDACjC;IACA;GACJ;GACA,EAAI,GAAM,EAAU,GAAO,WAAW,EAAM,EAAE,GAAG,WAAW,EAAM,EAAE;EACxE,CAAC,GACM;CACX;CAEA,SAAS,EAAY,GAAuD;EACxE,IAAM,IAAM,CAAC,GAAG,CAAI;EACpB,IAAI,CAAC,GAAS,OAAO;EACrB,KAAK,IAAM,EAAE,eAAY,GAAM;GAC3B,IAAM,IAAO,EAAO,QAAQ,eAAe,OAAO;GAClD,AAAI,MAAS,KAAQ,EAAI,GAAK,GAAM,YAAY,EAAO,EAAE;EAC7D;EACA,OAAO;CACX;CAEA,SAAS,EAAS,GAAgC,GAA0C;EACxF,IAAM,IAAO,IAAa,CAAC,UAAU,CAAU,IAAI,CAAC,QAAQ,GACtD,IAAmC;GACrC,eAAe,CAAC,GAAG,CAAI;GACvB,cAAc,IAAO,CAAC,GAAG,GAAM,oBAAoB,IAAI,CAAC,GAAG,CAAI;GAC/D,aAAa,KAAgB,IAAQ,CAAC,GAAG,GAAM,iBAAiB,IAAI,CAAC,GAAG,CAAI;GAC5E,WAAW;IAAC,GAAG;IAAM;IAAS;GAAO;GACrC,YAAY,CAAC,GAAG,GAAM,OAAO;GAC7B,aAAa,CAAC,GAAG,GAAM,OAAO;GAC9B,eAAe;IAAC;IAAU;IAAS;GAAO;GAC1C,cAAc,CAAC,GAAG,GAAM,OAAO;GAC/B,gBAAgB,CAAC,GAAG,CAAI;GACxB,cAAc,CAAC,QAAQ;GACvB,YAAY,CAAC,QAAQ;GACrB,eAAe,CAAC,QAAQ;EAC5B;EACA,KAAK,IAAM,CAAC,GAAM,MAAY,OAAO,QAAQ,CAAU,GACnD,AAAI,MAAY,KAAO,OAAO,EAAO,KAChC,EAAO,KAAQ,EAAM,EAAO,MAAS,CAAC,GAAG,CAAO;EAEzD,OAAO;CACX;CAaA,SAAS,EACL,GACA,GACwB;EACxB,IAAM,IAAmC,CAAC;EAC1C,KAAK,IAAM,CAAC,GAAM,MAAY,OAAO,QAAQ,CAAM,GAAG;GAClD,IAAI,KAAQ,GAAU;IAClB,EAAO,KAAQ,EAAS;IACxB;GACJ;GACA,IAAM,IAAY,EAAiB,GAAU,CAAI,GAC3C,IAAQ,EAAW;GACzB,AAAI,MAAc,KAAA,IAAW,EAAO,KAAQ,IACnC,MAAM,QAAQ,CAAK,IAAG,EAAO,KAAQ,EAAM,GAAW,CAAK,IAC3D,EAAQ,WAAW,KAAK,EAAQ,OAAO,aAAU,EAAO,KAAQ;EAC7E;EACA,KAAK,IAAM,CAAC,GAAM,MAAY,OAAO,QAAQ,CAAQ,GAAG,EAAO,OAAU;EACzE,KAAK,IAAM,CAAC,GAAM,MAAY,OAAO,QAAQ,CAAU,GAAG;GACtD,IAAI,EAAE,KAAQ,IAAW;GACzB,IAAI,MAAY,IAAO;IACnB,OAAO,EAAO;IACd;GACJ;GACA,IAAM,IAAU,EAAQ,QAAQ,MAAW,CAAC,EAAS,EAAK,CAAE,SAAS,CAAM,CAAC;GAC5E,AAAI,EAAQ,SAAS,KACjB,GAAQ,OAAO,KACX,mCAAmC,EAAK,mBAAmB,EAAK,yBACxD,EAAQ,KAAK,GAAG,EAAE,+EAC9B;EAER;EACA,OAAO;CACX;CAiBA,SAAS,EACL,GACA,GACA,GACI;EAKJ,IAJI,CAAC,KAAa,CAAC,KAEf,EAAU,SAAS,iBAAiB,KACpC,CAAC,EAAU,MAAM,MAAW,wBAAwB,KAAK,CAAM,CAAC,GAClD;EAClB,IAAM,IAAU,EAAa,GAAM,QAAQ,CAAC,CAAC,QAAQ,MAAS,CAAC,EAAU,SAAS,CAAI,CAAC;EACnF,EAAQ,WAAW,KACvB,EAAO,OAAO,KACV,yEAAyE,EAAQ,OAAO,oBAChF,EAAU,GAAG,EAAU,KAAK,GAAG,EAAE,wDAAwD,EAAQ,KAAK,GAAG,EAAE,MAAM,GAC7H;CACJ;CAsGA,OAAO;EAnGH,MAAM;EACN,eAAe,GAAgB;GAE3B,AADA,IAAS,GACT,IAAW,EAAe,CAAc;EAC5C;EACA,oBAAoB;GAChB,OAAO;GACP,QAAQ,GAAQ,GAAK;IACjB,IAAM,IAAQ,GAAQ,YAAY;IAClC,IAAI,KAAS,CAAC,GAAK,OAAO;IAE1B,IAAM,IAAiB,EAAY,CAAQ,GACrC,IAAO,GAAQ,QAAQ,KACvB,IAAa,EAAa,KAAK,CAAI,IAAI,EAAU,GAAM,MAAM,IAAI,KAAA;IACvE,AAAI,KAAY,EAAI,GAAgB,GAAY,MAAM;IACtD,IAAM,IAAY,IAAQ,CAAC,IAAI,EAAgB,CAAG;IAClD,KAAK,IAAM,KAAS,GAChB,CAAI,KAAS,EAAU,MAAM,MAAO,EAAM,OAAO,KAAK,CAAE,CAAC,MACrD,EAAI,GAAgB,EAAM,QAAQ,EAAM,IAAI;IAGpD,IAAM,IAAa,GAEb,EAAE,SAAM,cAAW,CAAC,MAAM,EAAkB,CAAM,GAClD,IAAS,EAAS,GAAY,CAAK,GACnC,KAAU,MACZ,EAAE,KAAQ,MAAa,EAAiB,GAAU,CAAI,MAAM,KAAA;IAOhE,AANI,EAAO,YAAY,KAAK,EAAE,qBAAqB,OAC/C,EAAO,gBAAgB,EACnB,EAAO,iBAAiB,CAAC,GACzB,EAAa,GAAM,QAAQ,CAC/B,IAGA,EAAO,WAAW,KAClB,EAAE,oBAAoB,MACtB,CAAC,EAAO,YAAY,EAAE,SAAS,iBAAiB,MAEhD,EAAO,eAAe,EAClB,EAAO,gBAAgB,CAAC,GACxB,EAAa,GAAM,OAAO,CAC9B;IAEJ,IAAM,IAAS,EAAY,GAAQ,CAAQ,GACrC,IAAU,EAAW,KAAK,MAAU,EAAM,MAAM,GAChD,IAAmB,EAAiB,GAAU,aAAa,GAC3D,IAAkB,EAAO,kBAAkB;IAKjD,AAHI,GAAiB,WAAW,KAC5B,EAAgB,OAAO,aACtB,iBAAiB,KAAY,MAAqB,KAAA,KAE/C,EAAQ,SAAS,KACjB,GAAQ,OAAO,KACX,qDAAqD,iBAAiB,IAAW,KAAK,yBAAyB,oEACxC,EAAQ,KAAK,GAAG,GAC3F,KAGJ,iBAAiB,KACjB,EAAQ,SAAS,KACjB,MAAqB,KAAA,OAErB,EAAO,iBAAiB,EAAM,KAAmB,CAAC,QAAQ,GAAG,CAAO;IAGxE,IAAM,IAAa,qBAAqB,IAAW,oBAAoB;IACvE,EACI,GACA,GACA,EAAO,MAAe,EAAiB,GAAU,CAAU,CAC/D;IAEA,IAAM,IAA2B;KAC7B,YAAY;KACZ,MAAM,EAAa,GAAQ,MAAM;KACjC,QAAQ,EAAa,GAAQ,QAAQ;KACrC,SAAS;KACT,SAAS,IAAQ,UAAU;IAC/B;IAEA,IAAI,KAAO,KAAU,EAAO,WAAW,GAAY;KAC/C,IAAa,EAAO;KACpB,IAAM,IAAQ,EAAW,KAAK,MAAU,KAAK,EAAM,OAAO,MAAM,EAAM,MAAM;KAC5E,EAAO,OAAO,KACV,CACI,6BAA6B,EAAO,kBAAkB,KAAoB,CAAC,EAAA,CAAG,KAAK,GAAG,KACtF,GAAI,EAAM,SAAS,IACb,IACA,CAAC,2CAA2C,CACtD,CAAC,CAAC,KAAK,IAAI,CACf;IACJ;IAEA,OADA,IAAW,CAAM,GACV,EAAW,GAAM,EAAO,IAAI;GACvC;EACJ;CAGG;AACX"}
+{"version":3,"file":"tempest-csp.js","names":["HEADER_ONLY_DIRECTIVES","SDK_ORIGINS","CSP_FALLBACK","inheritedSources","parent","name","declared","ABSOLUTE_URL","WILDCARD_SOURCE","cspOrigin","trimmed","value","wildcard","url","from","parseCsp","out","part","policy","sources","key","serializeCsp","directives","target","isKeyword","source","keyword","matchesNothing","normalizeHashSource","prefix","union","base","extra","sha256","createHash","content","decodeEntities","readAttributes","match","tag","extractMetaPolicy","tags","html","inlineHashes","pattern","element","hashes","attributes","hash","insertMeta","charset","head","resourceFirst","anchor","at","bundleModuleIds","ids","output","ctx","tempestCsp","options","configured","config","resolved","lastLogged","add","origin","list","resolveSources","values","resolvedConfig","prefixes","env","connect","index","withSockets","sockets","twin","defaults","self","baseOrigin","wasm","inlineStyles","serve","mergePolicy","merged","inherited","added","ignored","warnBlockedInlineScripts","effective","normalized","blocked","directive","dev","connectSources","moduleIds","known","id","allSources","filled","origins","entry","inheritedConnect","declaredConnect","scriptElem","result","log","lines","onPolicy"],"sources":["../../src/vite/tempest-csp.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { IndexHtmlTransformContext, Plugin, ResolvedConfig } from \"vite\";\n\nimport type { TempestVitePlugin } from \"./tempest-pwa-manifest\";\n\n/** Options for {@link tempestCsp}. */\nexport interface TempestCspOptions {\n    /**\n     * Endpoints the app calls at runtime, as full URLs. Only the origin\n     * (`scheme://host[:port]`) enters `connect-src`: a source expression with a path\n     * matches that path alone, so `https://idp/realms/x` would still block\n     * `https://idp/realms/x/protocol/openid-connect/token`.\n     *\n     * Empty entries (`undefined`, `null`, `false`, `\"\"`) are skipped with a build\n     * warning instead of leaving a hole in the directive, so passing an env var\n     * that is not set is safe. A root-relative path (`/api`) is same-origin and\n     * already covered by `'self'`. Anything else that is not an absolute\n     * `http(s)`/`ws(s)` URL throws at config time — failing the build, not\n     * production. A wildcard host (`https://*.example.com`) is kept as written.\n     */\n    connect?: ReadonlyArray<string | null | undefined | false>;\n    /**\n     * Read origins from the same environment the runtime reads. `true` (the\n     * default) adds every variable Vite exposes to `import.meta.env` (the\n     * `envPrefix` ones, `VITE_` by default) whose value is an absolute\n     * `http(s)`/`ws(s)` URL. This is the structural bridge: an origin added to\n     * `.env` for a new runtime call lands in the policy with no second list to\n     * keep in sync. Pass a list of names to include exactly those — a name that\n     * resolves to nothing is reported as a build warning — or `false` to rely on\n     * {@link TempestCspOptions.connect} alone.\n     */\n    env?: boolean | readonly string[];\n    /**\n     * Also allow the WebSocket twin of every `http(s)` origin (`https://api` →\n     * `wss://api`). Measured in Chromium (23/09/2026): `connect-src https://api`\n     * blocks `new WebSocket(\"wss://api\")`, while `'self'` does cover a same-origin\n     * `ws:` — so an app that derives its socket URL from the API URL breaks\n     * without this. Default `true`.\n     */\n    sockets?: boolean;\n    /**\n     * Add `'wasm-unsafe-eval'` to `script-src`, which `onnxruntime-web` (the\n     * `/vision` and `/tabular` subpaths) needs to compile its WebAssembly. Without\n     * it `WebAssembly.compile` throws a `CompileError` naming `script-src`.\n     * It grants WebAssembly compilation only, not `eval`. Default `true`.\n     */\n    wasm?: boolean;\n    /**\n     * Add `'unsafe-inline'` to `style-src`. React's `style` prop does **not** need\n     * it — it writes through the CSSOM, which CSP does not govern (measured in\n     * Chromium, 23/09/2026). What needs it is a `<style>` element or a `style=\"\"`\n     * attribute, and the SDK's own `applyTheme` injects a `<style>`. Pass `false`\n     * when the app never calls `applyTheme`; inline `<style>` blocks in\n     * `index.html` are then hashed instead. Always on under `vite dev`, whose CSS\n     * injection is a `<style>` element. Default `true`.\n     */\n    inlineStyles?: boolean;\n    /**\n     * Extra sources per directive, merged into the defaults (`{ \"img-src\":\n     * [\"https://tiles.example.com\"] }`), or `false` to drop a directive.\n     * `frame-ancestors`, `report-uri` and `sandbox` are ignored by browsers when\n     * delivered by `<meta>`, so they reach {@link TempestCspPolicy.header} only.\n     */\n    directives?: Readonly<Record<string, readonly string[] | false>>;\n    /**\n     * Apply the policy under `vite dev` too. Default `true`: the failure this\n     * plugin exists for is \"works in dev, blocked in production\", and a policy\n     * enforced in dev moves every missing origin to the first page load on the\n     * developer's machine. Dev differs from build only in `style-src\n     * 'unsafe-inline'` and in allowing every SDK-known origin (see\n     * {@link TempestCspPolicy.connect}), because the dev server cannot know which\n     * modules the page will load.\n     */\n    dev?: boolean;\n    /** Print the resolved `connect-src` and where each origin came from. Default `true`. */\n    log?: boolean;\n    /**\n     * Receive the resolved policy — for asserting it in a test, or for writing the\n     * same policy as an HTTP header (the only channel for `frame-ancestors`).\n     */\n    onPolicy?: (policy: TempestCspPolicy) => void;\n}\n\n/** One origin in `connect-src` and the input that put it there. */\nexport interface TempestCspSource {\n    /** The source expression, e.g. `https://api.example.com`. */\n    origin: string;\n    /** Where it came from: `env VITE_API_URL`, `connect[0]`, `sockets`, `base` or an SDK module. */\n    from: string;\n}\n\n/** The policy {@link tempestCsp} resolved for one `index.html`. */\nexport interface TempestCspPolicy {\n    /** Every directive and its sources, including the header-only ones. */\n    directives: Record<string, string[]>;\n    /** The policy as written into the `<meta http-equiv>` tag. */\n    meta: string;\n    /** The full policy for a `Content-Security-Policy` response header. */\n    header: string;\n    /** Every origin added to `connect-src`, with its provenance. */\n    connect: TempestCspSource[];\n    /** `\"serve\"` under `vite dev`, `\"build\"` under `vite build`. */\n    command: \"serve\" | \"build\";\n}\n\n/**\n * Directives a browser ignores when the policy arrives by `<meta>` (CSP3 §3.3),\n * printing a console warning for each.\n */\nconst HEADER_ONLY_DIRECTIVES: ReadonlySet<string> = new Set([\n    \"frame-ancestors\",\n    \"report-uri\",\n    \"sandbox\",\n]);\n\n/**\n * Origins the SDK itself calls, keyed by the module that calls them. In a build\n * the origin enters only when the module is in the bundle; in dev always.\n */\nconst SDK_ORIGINS: ReadonlyArray<{ module: RegExp; origin: string; from: string }> = [\n    {\n        module: /[\\\\/]forms[\\\\/]use-viacep\\.(?:[cm]?js|tsx?)$/,\n        origin: \"https://viacep.com.br\",\n        from: \"tempest-react-sdk useViaCEP\",\n    },\n];\n\n/**\n * Where each fetch directive falls back when a policy does not declare it, in\n * order. Ported from CSP3 §6.8.3, \"Get fetch directive fallback list\"\n * (https://w3c.github.io/webappsec-csp/#directive-fallback-list, checked\n * 11/10/2026), which lists twelve effective directives: `script-src-elem`,\n * `script-src-attr`, `style-src-elem`, `style-src-attr`, `worker-src`,\n * `connect-src`, `manifest-src`, `object-src`, `frame-src`, `media-src`,\n * `font-src` and `img-src`. Four more are listed here on purpose:\n *\n * - `script-src`, `style-src` and `child-src` are never an effective directive,\n *   but every chain that reaches them continues to `default-src`;\n * - `fenced-frame-src` comes from the Fenced Frame spec, which extends the\n *   `frame-src` chain;\n * - `prefetch-src` was in earlier CSP3 drafts (→ `default-src`) and is gone from\n *   the current one; a browser that still resolves it does so through\n *   `default-src`, so it is treated as inherited.\n *\n * A directive absent from this map does not fall back at all (`base-uri`,\n * `form-action`, `frame-ancestors`, …): leaving it out of a policy allows\n * everything, so adding it only ever restricts.\n */\nconst CSP_FALLBACK: Readonly<Record<string, readonly string[]>> = {\n    \"script-src-elem\": [\"script-src\", \"default-src\"],\n    \"script-src-attr\": [\"script-src\", \"default-src\"],\n    \"style-src-elem\": [\"style-src\", \"default-src\"],\n    \"style-src-attr\": [\"style-src\", \"default-src\"],\n    \"worker-src\": [\"child-src\", \"script-src\", \"default-src\"],\n    \"frame-src\": [\"child-src\", \"default-src\"],\n    \"fenced-frame-src\": [\"frame-src\", \"child-src\", \"default-src\"],\n    \"child-src\": [\"default-src\"],\n    \"connect-src\": [\"default-src\"],\n    \"font-src\": [\"default-src\"],\n    \"img-src\": [\"default-src\"],\n    \"manifest-src\": [\"default-src\"],\n    \"media-src\": [\"default-src\"],\n    \"object-src\": [\"default-src\"],\n    \"prefetch-src\": [\"default-src\"],\n    \"script-src\": [\"default-src\"],\n    \"style-src\": [\"default-src\"],\n};\n\n/**\n * The sources a declared policy already applies to a directive it does not\n * name, by walking {@link CSP_FALLBACK}.\n *\n * @param declared - The policy the app declared.\n * @param name - A directive the app did not declare.\n * @returns The inherited sources, or `undefined` when nothing governs the directive.\n */\nfunction inheritedSources(\n    declared: Readonly<Record<string, string[]>>,\n    name: string,\n): string[] | undefined {\n    for (const parent of CSP_FALLBACK[name] ?? []) {\n        if (parent in declared) return declared[parent];\n    }\n    return undefined;\n}\n\nconst ABSOLUTE_URL = /^(?:https?|wss?):\\/\\//i;\nconst WILDCARD_SOURCE = /^((?:https?|wss?):\\/\\/\\*\\.[a-z0-9.-]+(?::\\d+)?)(?:[/?#].*)?$/i;\n\n/**\n * Reduce a URL to the origin a CSP source expression should carry.\n *\n * @param value - The URL as the app configured it.\n * @param from - Its provenance, quoted in the error.\n * @returns The origin, or `undefined` for a root-relative path (covered by `'self'`).\n * @throws {Error} When the value is neither an absolute `http(s)`/`ws(s)` URL nor a path.\n */\nexport function cspOrigin(value: string, from: string): string | undefined {\n    const trimmed = value.trim();\n    if (trimmed.startsWith(\"/\") && !trimmed.startsWith(\"//\")) return undefined;\n    const wildcard = WILDCARD_SOURCE.exec(trimmed);\n    if (wildcard) return wildcard[1]!.toLowerCase();\n    if (ABSOLUTE_URL.test(trimmed)) {\n        try {\n            const url = new URL(trimmed);\n            return `${url.protocol}//${url.host}`;\n        } catch {\n            throw new Error(`tempestCsp: ${from} is not a valid URL: \"${value}\"`);\n        }\n    }\n    throw new Error(\n        `tempestCsp: ${from} must be an absolute http(s)/ws(s) URL or a root-relative path, got \"${value}\"`,\n    );\n}\n\n/**\n * Parse a serialized policy into directives, lowercasing names. A repeated\n * directive keeps its first occurrence, as browsers do.\n *\n * @param policy - A `Content-Security-Policy` value.\n * @returns Directive name → sources.\n */\nexport function parseCsp(policy: string): Record<string, string[]> {\n    const out: Record<string, string[]> = {};\n    for (const part of policy.split(\";\")) {\n        const [name, ...sources] = part.trim().split(/\\s+/);\n        if (!name) continue;\n        const key = name.toLowerCase();\n        if (!(key in out)) out[key] = sources;\n    }\n    return out;\n}\n\n/**\n * Serialize directives into a policy string, dropping header-only directives\n * when the target is a `<meta>` tag.\n *\n * @param directives - Directive name → sources.\n * @param target - `\"meta\"` or `\"header\"`.\n * @returns The policy value.\n */\nexport function serializeCsp(\n    directives: Readonly<Record<string, readonly string[]>>,\n    target: \"meta\" | \"header\",\n): string {\n    return Object.entries(directives)\n        .filter(([name]) => target === \"header\" || !HEADER_ONLY_DIRECTIVES.has(name))\n        .map(([name, sources]) => [name, ...sources].join(\" \"))\n        .join(\"; \");\n}\n\n/**\n * Compare a source with a CSP keyword (`'self'`, `'none'`, `'unsafe-inline'`…).\n * Keywords are ASCII case-insensitive (CSP3 §2.3.1), so `'NONE'` is `'none'`.\n *\n * @param source - A source expression as written.\n * @param keyword - The keyword, quoted and lowercase.\n * @returns Whether the source is that keyword.\n */\nfunction isKeyword(source: string, keyword: string): boolean {\n    return source.toLowerCase() === keyword;\n}\n\n/**\n * Whether a source list matches nothing: CSP3 §6.7.2.5 gives \"does not match\"\n * for an empty list and for one that holds only `'none'` — in any letter case.\n *\n * @param sources - The directive's sources.\n * @returns `true` for `[]`, `['none']`, `['NONE']`, `['none', 'None']`.\n */\nfunction matchesNothing(sources: readonly string[]): boolean {\n    return sources.every((source) => isKeyword(source, \"'none'\"));\n}\n\n/**\n * Lowercase the algorithm (or `nonce`) prefix of a hash or nonce source,\n * leaving the case-sensitive base64 value alone, so `'SHA256-…'` compares\n * equal to the `'sha256-…'` the plugin computes.\n *\n * @param source - A source expression as written.\n * @returns The source with a normalized prefix.\n */\nfunction normalizeHashSource(source: string): string {\n    return source.replace(/^'(?:sha\\d{3}|nonce)-/i, (prefix) => prefix.toLowerCase());\n}\n\nfunction union(base: readonly string[], extra: readonly string[]): string[] {\n    const out = base.filter((source) => !isKeyword(source, \"'none'\") || extra.length === 0);\n    for (const source of extra) if (!out.includes(source)) out.push(source);\n    return out.length === 0 ? [\"'none'\"] : out;\n}\n\nfunction sha256(content: string): string {\n    return `'sha256-${createHash(\"sha256\").update(content, \"utf8\").digest(\"base64\")}'`;\n}\n\nfunction decodeEntities(value: string): string {\n    return value\n        .replace(/&#39;|&#x27;|&apos;/gi, \"'\")\n        .replace(/&quot;/gi, '\"')\n        .replace(/&amp;/gi, \"&\");\n}\n\nfunction readAttributes(tag: string): Record<string, string> {\n    const out: Record<string, string> = {};\n    const pattern = /([^\\s=<>/]+)\\s*=\\s*(?:\"([^\"]*)\"|'([^']*)'|([^\\s>]+))/g;\n    for (const match of tag.matchAll(pattern)) {\n        out[match[1]!.toLowerCase()] = decodeEntities(match[2] ?? match[3] ?? match[4] ?? \"\");\n    }\n    return out;\n}\n\n/**\n * Find the policy `index.html` already declares and remove its tag, so the merged\n * policy replaces it instead of stacking a second one (two policies are\n * intersected by the browser, so the stricter would win silently).\n *\n * @throws {Error} When the page declares more than one CSP `<meta>`: merging an\n *   intersection into a union would weaken it, so the plugin refuses.\n */\nfunction extractMetaPolicy(html: string): { html: string; declared?: Record<string, string[]> } {\n    const tags = [...html.matchAll(/<meta\\b[^>]*>/gi)].filter(\n        (match) =>\n            readAttributes(match[0])[\"http-equiv\"]?.toLowerCase() === \"content-security-policy\",\n    );\n    if (tags.length === 0) return { html };\n    if (tags.length > 1) {\n        throw new Error(\n            \"tempestCsp: index.html declares more than one Content-Security-Policy <meta>; merge them into one\",\n        );\n    }\n    const tag = tags[0]!;\n    return {\n        html:\n            html.slice(0, tag.index) +\n            html.slice(tag.index! + tag[0].length).replace(/^[ \\t]*\\r?\\n/, \"\"),\n        declared: parseCsp(readAttributes(tag[0]).content ?? \"\"),\n    };\n}\n\nfunction inlineHashes(html: string, element: \"script\" | \"style\"): string[] {\n    const pattern = new RegExp(`<${element}\\\\b([^>]*)>([\\\\s\\\\S]*?)</${element}>`, \"gi\");\n    const hashes: string[] = [];\n    for (const match of html.matchAll(pattern)) {\n        const attributes = readAttributes(`<x ${match[1]}>`);\n        if (element === \"script\" && \"src\" in attributes) continue;\n        if (match[2]!.length === 0) continue;\n        const hash = sha256(match[2]!);\n        if (!hashes.includes(hash)) hashes.push(hash);\n    }\n    return hashes;\n}\n\n/**\n * Write the policy tag where it governs the whole page. A `<meta>` CSP applies\n * only to what follows it, so it goes right after `<meta charset>` — unless a\n * resource precedes the charset, as the React Refresh preamble does under\n * `vite dev` (`head-prepend`), in which case it goes right after `<head>`.\n */\nfunction insertMeta(html: string, policy: string): string {\n    const escaped = policy.replace(/&/g, \"&amp;\").replace(/\"/g, \"&quot;\");\n    const tag = `<meta http-equiv=\"Content-Security-Policy\" content=\"${escaped}\" />`;\n    const charset = /<meta\\b[^>]*\\bcharset\\s*=[^>]*>/i.exec(html);\n    const head = /<head\\b[^>]*>/i.exec(html);\n    const resourceFirst =\n        charset !== null &&\n        head !== null &&\n        /<(?:script|link|style)\\b/i.test(html.slice(head.index, charset.index));\n    const anchor = charset && head && charset.index > head.index && !resourceFirst ? charset : head;\n    if (!anchor) return `${tag}\\n${html}`;\n    const at = anchor.index + anchor[0].length;\n    return `${html.slice(0, at)}\\n    ${tag}${html.slice(at)}`;\n}\n\nfunction bundleModuleIds(ctx: IndexHtmlTransformContext): string[] {\n    const ids: string[] = [];\n    for (const output of Object.values(ctx.bundle ?? {})) {\n        if (output.type !== \"chunk\") continue;\n        ids.push(...(output.moduleIds ?? Object.keys(output.modules ?? {})));\n    }\n    return ids;\n}\n\n/**\n * Vite plugin that writes a Content-Security-Policy `<meta>` into `index.html`\n * and derives `connect-src` from the origins the app actually calls.\n *\n * It exists because of how a missing origin fails: the request is blocked\n * before a connection opens, so there is no entry in the Network tab, nothing in\n * the server log, `curl` succeeds, and the app sees `TypeError: Failed to\n * fetch` — indistinguishable from offline, DNS or CORS. And a hand-written CSP\n * plugin is usually `apply: \"build\"`, so it only fails in production. This\n * plugin closes both ends:\n *\n * - origins come from the same `import.meta.env` the runtime reads\n *   ({@link TempestCspOptions.env}), reduced to `scheme://host[:port]`, with\n *   empty values skipped — no second list to drift;\n * - the policy is enforced under `vite dev` as well ({@link TempestCspOptions.dev});\n * - the build prints every origin and its provenance.\n *\n * Defaults cover what the SDK's stack needs and nothing more: `'self'`\n * everywhere, `'wasm-unsafe-eval'` for ONNX Runtime, `blob:` for workers, object\n * URLs and media, `data:` for images and fonts, `object-src 'none'`,\n * `base-uri 'self'`, `form-action 'self'`. Inline `<script>` blocks left in\n * `index.html` (a `themeInitScript()` anti-flash script, say) are allowed by\n * SHA-256 hash, never by `'unsafe-inline'`.\n *\n * An existing CSP `<meta>` in `index.html` is merged, not overwritten, and the\n * merge never loosens what the app wrote:\n *\n * - a directive it declares is kept verbatim, except `connect-src`, which gains\n *   the resolved origins (the list the plugin exists to maintain) unless it\n *   matches nothing — `'none'` in any letter case, or an empty list, declared or\n *   inherited from `default-src` — in which case the origins stay out and each\n *   one is reported as a build warning. Keywords are compared case-insensitively\n *   throughout, as browsers do. Sources in\n *   {@link TempestCspOptions.directives} for a declared directive are not added\n *   (a build warning names them); `false` there removes it;\n * - a fetch directive it does not declare but already governs through the CSP3\n *   fallback chain (§6.8.3 — `img-src` → `default-src`,\n *   `worker-src` → `child-src` → `script-src` → `default-src`) is left out, so it\n *   keeps falling back. Filling it from the defaults would replace a\n *   `default-src 'none'` with `'self' data: blob:`. No inline-script hash and no\n *   `'wasm-unsafe-eval'` is added to it, and an inline `<script>` is judged by a\n *   declared `script-src-elem` before `script-src`; `connect-src` starts from the inherited\n *   value, and so does any directive passed in {@link TempestCspOptions.directives};\n * - a default that is exactly `'none'` (`object-src`), or a directive that does\n *   not fall back (`base-uri`, `form-action`), is still added: it can only\n *   restrict;\n * - a directive nothing in the declared policy governs comes from the defaults.\n *\n * @param options - See {@link TempestCspOptions}.\n * @returns A Vite plugin, to be placed in `plugins`. It runs as a `post` HTML\n *   transform, so a plugin that rewrites inline scripts after it would\n *   invalidate the hashes.\n *\n * @example\n * // vite.config.ts\n * import { createViteConfig, tempestCsp } from \"tempest-react-sdk/vite\";\n *\n * export default createViteConfig({\n *     plugins: [tempestCsp({ connect: [\"https://sso.example.com/realms/app\"] })],\n * });\n */\nexport function tempestCsp(options: TempestCspOptions = {}): TempestVitePlugin {\n    const {\n        connect = [],\n        env = true,\n        sockets = true,\n        wasm = true,\n        inlineStyles = true,\n        directives: extra = {},\n        dev = true,\n        log = true,\n        onPolicy,\n    } = options;\n\n    const configured: Record<string, readonly string[] | false> = Object.fromEntries(\n        Object.entries(extra).map(([name, sources]) => [name.toLowerCase(), sources]),\n    );\n    let config: ResolvedConfig | undefined;\n    let resolved: TempestCspSource[] = [];\n    let lastLogged = \"\";\n\n    function add(list: TempestCspSource[], origin: string | undefined, from: string): void {\n        if (origin === undefined || list.some((source) => source.origin === origin)) return;\n        list.push({ origin, from });\n    }\n\n    function resolveSources(resolvedConfig: ResolvedConfig): TempestCspSource[] {\n        const list: TempestCspSource[] = [];\n        const values: Record<string, unknown> = resolvedConfig.env ?? {};\n        const prefixes = [resolvedConfig.envPrefix ?? \"VITE_\"].flat();\n        if (env === true) {\n            for (const [name, value] of Object.entries(values)) {\n                if (!prefixes.some((prefix) => name.startsWith(prefix))) continue;\n                if (typeof value !== \"string\" || !ABSOLUTE_URL.test(value.trim())) continue;\n                add(list, cspOrigin(value, `env ${name}`), `env ${name}`);\n            }\n        } else if (Array.isArray(env)) {\n            for (const name of env) {\n                const value = values[name];\n                if (typeof value !== \"string\" || value.trim() === \"\") {\n                    resolvedConfig.logger.warn(\n                        `tempestCsp: env ${name} is empty — nothing added to connect-src`,\n                    );\n                    continue;\n                }\n                add(list, cspOrigin(value, `env ${name}`), `env ${name}`);\n            }\n        }\n        connect.forEach((value, index) => {\n            if (!value || value.trim() === \"\") {\n                resolvedConfig.logger.warn(\n                    `tempestCsp: connect[${index}] is empty — skipped, nothing added to connect-src`,\n                );\n                return;\n            }\n            add(list, cspOrigin(value, `connect[${index}]`), `connect[${index}]`);\n        });\n        return list;\n    }\n\n    function withSockets(list: readonly TempestCspSource[]): TempestCspSource[] {\n        const out = [...list];\n        if (!sockets) return out;\n        for (const { origin } of list) {\n            const twin = origin.replace(/^http(s?):/i, \"ws$1:\");\n            if (twin !== origin) add(out, twin, `sockets (${origin})`);\n        }\n        return out;\n    }\n\n    function defaults(baseOrigin: string | undefined, serve: boolean): Record<string, string[]> {\n        const self = baseOrigin ? [\"'self'\", baseOrigin] : [\"'self'\"];\n        const policy: Record<string, string[]> = {\n            \"default-src\": [...self],\n            \"script-src\": wasm ? [...self, \"'wasm-unsafe-eval'\"] : [...self],\n            \"style-src\": inlineStyles || serve ? [...self, \"'unsafe-inline'\"] : [...self],\n            \"img-src\": [...self, \"data:\", \"blob:\"],\n            \"font-src\": [...self, \"data:\"],\n            \"media-src\": [...self, \"blob:\"],\n            \"connect-src\": [\"'self'\", \"blob:\", \"data:\"],\n            \"worker-src\": [...self, \"blob:\"],\n            \"manifest-src\": [...self],\n            \"object-src\": [\"'none'\"],\n            \"base-uri\": [\"'self'\"],\n            \"form-action\": [\"'self'\"],\n        };\n        for (const [name, sources] of Object.entries(configured)) {\n            if (sources === false) delete policy[name];\n            else policy[name] = union(policy[name] ?? [], sources);\n        }\n        return policy;\n    }\n\n    /**\n     * Merge the defaults, the declared policy and the configured\n     * {@link TempestCspOptions.directives}, never loosening what was declared. A\n     * declared directive is kept verbatim: configured sources for it are not\n     * added — adding would loosen the app's policy — and each ignored source is\n     * reported as a build warning, while a configured `false` removes it, since\n     * removing is an explicit choice. An inherited directive (see\n     * {@link inheritedSources}) is omitted unless the default is `'none'` or the\n     * config adds sources, which then extend the inherited value instead of the\n     * defaults.\n     */\n    function mergePolicy(\n        policy: Readonly<Record<string, string[]>>,\n        declared: Readonly<Record<string, string[]>>,\n    ): Record<string, string[]> {\n        const merged: Record<string, string[]> = {};\n        for (const [name, sources] of Object.entries(policy)) {\n            if (name in declared) {\n                merged[name] = declared[name]!;\n                continue;\n            }\n            const inherited = inheritedSources(declared, name);\n            const added = configured[name];\n            if (inherited === undefined) merged[name] = sources;\n            else if (Array.isArray(added)) merged[name] = union(inherited, added);\n            else if (sources.length > 0 && matchesNothing(sources)) merged[name] = sources;\n        }\n        for (const [name, sources] of Object.entries(declared)) merged[name] ??= sources;\n        for (const [name, sources] of Object.entries(configured)) {\n            if (!(name in declared)) continue;\n            if (sources === false) {\n                delete merged[name];\n                continue;\n            }\n            const ignored = sources.filter((source) => !declared[name]!.includes(source));\n            if (ignored.length > 0) {\n                config?.logger.warn(\n                    `tempestCsp: index.html declares ${name}, so directives[\"${name}\"] is not added to it ` +\n                        `(${ignored.join(\" \")}); the plugin never loosens a declared policy — add them to the <meta> instead`,\n                );\n            }\n        }\n        return merged;\n    }\n\n    /**\n     * Report every inline `<script>` the final policy blocks. It only happens when\n     * the app's declared policy governs `script-src` — directly or through\n     * `default-src` — since the plugin then adds no hash, and the symptom would\n     * otherwise be a script that silently never runs (under `vite dev`, the React\n     * Refresh preamble, which takes the page down with it).\n     *\n     * `<script>` elements are governed by `script-src-elem` when the policy has\n     * one, so that is the directive judged and named.\n     *\n     * @param html - The page, without its CSP `<meta>`.\n     * @param directive - `\"script-src-elem\"` when declared, else `\"script-src\"`.\n     * @param effective - The sources the browser will apply to inline `<script>`\n     *   elements, or `undefined` when no directive governs them.\n     */\n    function warnBlockedInlineScripts(\n        html: string,\n        directive: string,\n        effective: readonly string[] | undefined,\n    ): void {\n        if (!effective || !config) return;\n        const normalized = effective.map(normalizeHashSource);\n        const unsafeInline =\n            effective.some((source) => isKeyword(source, \"'unsafe-inline'\")) &&\n            !normalized.some((source) => /^'(?:sha\\d{3}|nonce)-/.test(source));\n        if (unsafeInline) return;\n        const blocked = inlineHashes(html, \"script\").filter((hash) => !normalized.includes(hash));\n        if (blocked.length === 0) return;\n        config.logger.warn(\n            `tempestCsp: the Content-Security-Policy declared in index.html blocks ${blocked.length} inline <script> ` +\n                `(${directive} ${effective.join(\" \")}); the plugin never loosens a declared policy, so add ${blocked.join(\" \")} to ${directive}`,\n        );\n    }\n\n    const plugin: Plugin = {\n        name: \"tempest-csp\",\n        configResolved(resolvedConfig) {\n            config = resolvedConfig;\n            resolved = resolveSources(resolvedConfig);\n        },\n        transformIndexHtml: {\n            order: \"post\",\n            handler(source, ctx) {\n                const serve = config?.command === \"serve\";\n                if (serve && !dev) return source;\n\n                const connectSources = withSockets(resolved);\n                const base = config?.base ?? \"/\";\n                const baseOrigin = ABSOLUTE_URL.test(base) ? cspOrigin(base, \"base\") : undefined;\n                if (baseOrigin) add(connectSources, baseOrigin, \"base\");\n                const moduleIds = serve ? [] : bundleModuleIds(ctx);\n                for (const known of SDK_ORIGINS) {\n                    if (serve || moduleIds.some((id) => known.module.test(id))) {\n                        add(connectSources, known.origin, known.from);\n                    }\n                }\n                const allSources = connectSources;\n\n                const { html, declared = {} } = extractMetaPolicy(source);\n                const policy = defaults(baseOrigin, serve);\n                const filled = (name: string): boolean =>\n                    !(name in declared) && inheritedSources(declared, name) === undefined;\n                if (filled(\"script-src\") && !(\"script-src-elem\" in declared)) {\n                    policy[\"script-src\"] = union(\n                        policy[\"script-src\"] ?? [],\n                        inlineHashes(html, \"script\"),\n                    );\n                }\n                if (\n                    filled(\"style-src\") &&\n                    !(\"style-src-elem\" in declared) &&\n                    !policy[\"style-src\"]?.some((source) => isKeyword(source, \"'unsafe-inline'\"))\n                ) {\n                    policy[\"style-src\"] = union(\n                        policy[\"style-src\"] ?? [],\n                        inlineHashes(html, \"style\"),\n                    );\n                }\n                const merged = mergePolicy(policy, declared);\n                const origins = allSources.map((entry) => entry.origin);\n                const inheritedConnect = inheritedSources(declared, \"connect-src\");\n                const declaredConnect = merged[\"connect-src\"] ?? inheritedConnect;\n                const declaredNone =\n                    declaredConnect !== undefined &&\n                    matchesNothing(declaredConnect) &&\n                    (\"connect-src\" in declared || inheritedConnect !== undefined);\n                if (declaredNone) {\n                    if (origins.length > 0) {\n                        config?.logger.warn(\n                            `tempestCsp: index.html declares connect-src ${declaredConnect.join(\" \") || \"with no source\"}${\"connect-src\" in declared ? \"\" : \" (through default-src)\"}, ` +\n                                `so these origins stay out and requests to them will be blocked: ${origins.join(\" \")}`,\n                        );\n                    }\n                } else if (\n                    \"connect-src\" in merged ||\n                    origins.length > 0 ||\n                    inheritedConnect === undefined\n                ) {\n                    merged[\"connect-src\"] = union(declaredConnect ?? [\"'self'\"], origins);\n                }\n\n                const scriptElem = \"script-src-elem\" in declared ? \"script-src-elem\" : \"script-src\";\n                warnBlockedInlineScripts(\n                    html,\n                    scriptElem,\n                    merged[scriptElem] ?? inheritedSources(declared, scriptElem),\n                );\n\n                const result: TempestCspPolicy = {\n                    directives: merged,\n                    meta: serializeCsp(merged, \"meta\"),\n                    header: serializeCsp(merged, \"header\"),\n                    connect: allSources,\n                    command: serve ? \"serve\" : \"build\",\n                };\n\n                if (log && config && result.header !== lastLogged) {\n                    lastLogged = result.header;\n                    const lines = allSources.map((entry) => `  ${entry.origin}  ← ${entry.from}`);\n                    config.logger.info(\n                        [\n                            `tempest-csp: connect-src ${(merged[\"connect-src\"] ?? inheritedConnect ?? []).join(\" \")}`,\n                            ...(lines.length > 0\n                                ? lines\n                                : [\"  (no cross-origin endpoint: only 'self')\"]),\n                        ].join(\"\\n\"),\n                    );\n                }\n                onPolicy?.(result);\n                return insertMeta(html, result.meta);\n            },\n        },\n    };\n\n    return plugin as TempestVitePlugin;\n}\n"],"mappings":";;AA6GA,IAAMA,oBAA8C,IAAI,IAAI;CACxD;CACA;CACA;AACJ,CAAC,GAMKC,IAA+E,CACjF;CACI,QAAQ;CACR,QAAQ;CACR,MAAM;AACV,CACJ,GAuBMC,IAA4D;CAC9D,mBAAmB,CAAC,cAAc,aAAa;CAC/C,mBAAmB,CAAC,cAAc,aAAa;CAC/C,kBAAkB,CAAC,aAAa,aAAa;CAC7C,kBAAkB,CAAC,aAAa,aAAa;CAC7C,cAAc;EAAC;EAAa;EAAc;CAAa;CACvD,aAAa,CAAC,aAAa,aAAa;CACxC,oBAAoB;EAAC;EAAa;EAAa;CAAa;CAC5D,aAAa,CAAC,aAAa;CAC3B,eAAe,CAAC,aAAa;CAC7B,YAAY,CAAC,aAAa;CAC1B,WAAW,CAAC,aAAa;CACzB,gBAAgB,CAAC,aAAa;CAC9B,aAAa,CAAC,aAAa;CAC3B,cAAc,CAAC,aAAa;CAC5B,gBAAgB,CAAC,aAAa;CAC9B,cAAc,CAAC,aAAa;CAC5B,aAAa,CAAC,aAAa;AAC/B;AAUA,SAASC,EACL,GACA,GACoB;CACpB,KAAK,IAAMC,KAAUF,EAAaG,MAAS,CAAC,GACxC,IAAID,KAAUE,GAAU,OAAOA,EAASF;AAGhD;AAEA,IAAMG,IAAe,0BACfC,IAAkB;AAUxB,SAAgBC,EAAU,GAAe,GAAkC;CACvE,IAAMC,IAAUC,EAAM,KAAK;CAC3B,IAAID,EAAQ,WAAW,GAAG,KAAK,CAACA,EAAQ,WAAW,IAAI,GAAG;CAC1D,IAAME,IAAWJ,EAAgB,KAAKE,CAAO;CAC7C,IAAIE,GAAU,OAAOA,EAAS,EAAE,CAAE,YAAY;CAC9C,IAAIL,EAAa,KAAKG,CAAO,GACzB,IAAI;EACA,IAAMG,IAAM,IAAI,IAAIH,CAAO;EAC3B,OAAO,GAAGG,EAAI,SAAS,IAAIA,EAAI;CACnC,QAAQ;EACJ,MAAU,MAAM,eAAeC,EAAK,wBAAwBH,EAAM,EAAE;CACxE;CAEJ,MAAU,MACN,eAAeG,EAAK,uEAAuEH,EAAM,EACrG;AACJ;AASA,SAAgBI,EAAS,GAA0C;CAC/D,IAAMC,IAAgC,CAAC;CACvC,KAAK,IAAMC,KAAQC,EAAO,MAAM,GAAG,GAAG;EAClC,IAAM,CAACb,GAAM,GAAGc,KAAWF,EAAK,KAAK,CAAC,CAAC,MAAM,KAAK;EAClD,IAAI,CAACZ,GAAM;EACX,IAAMe,IAAMf,EAAK,YAAY;EAC7B,AAAMe,KAAOJ,MAAM,EAAII,KAAOD;CAClC;CACA,OAAOH;AACX;AAUA,SAAgBK,EACZ,GACA,GACM;CACN,OAAO,OAAO,QAAQC,CAAU,CAAC,CAC5B,QAAQ,CAACjB,OAAUkB,MAAW,YAAY,CAACvB,EAAuB,IAAIK,CAAI,CAAC,CAAC,CAC5E,KAAK,CAACA,GAAMc,OAAa,CAACd,GAAM,GAAGc,CAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CACtD,KAAK,IAAI;AAClB;AAUA,SAASK,EAAU,GAAgB,GAA0B;CACzD,OAAOC,EAAO,YAAY,MAAMC;AACpC;AASA,SAASC,EAAe,GAAqC;CACzD,OAAOR,EAAQ,OAAO,MAAWK,EAAUC,GAAQ,QAAQ,CAAC;AAChE;AAUA,SAASG,EAAoB,GAAwB;CACjD,OAAOH,EAAO,QAAQ,2BAA2B,MAAWI,EAAO,YAAY,CAAC;AACpF;AAEA,SAASC,EAAM,GAAyB,GAAoC;CACxE,IAAMd,IAAMe,EAAK,QAAQ,MAAW,CAACP,EAAUC,GAAQ,QAAQ,KAAKO,EAAM,WAAW,CAAC;CACtF,KAAK,IAAMP,KAAUO,GAAO,AAAKhB,EAAI,SAASS,CAAM,KAAGT,EAAI,KAAKS,CAAM;CACtE,OAAOT,EAAI,WAAW,IAAI,CAAC,QAAQ,IAAIA;AAC3C;AAEA,SAASiB,EAAO,GAAyB;CACrC,OAAO,WAAWC,EAAW,QAAQ,CAAC,CAAC,OAAOC,GAAS,MAAM,CAAC,CAAC,OAAO,QAAQ,EAAE;AACpF;AAEA,SAASC,EAAe,GAAuB;CAC3C,OAAOzB,EACF,QAAQ,yBAAyB,GAAG,CAAC,CACrC,QAAQ,YAAY,IAAG,CAAC,CACxB,QAAQ,WAAW,GAAG;AAC/B;AAEA,SAAS0B,EAAe,GAAqC;CACzD,IAAMrB,IAA8B,CAAC;CAErC,KAAK,IAAMsB,KAASC,EAAI,SAAS,uDAAO,GACpC,EAAID,EAAM,EAAE,CAAE,YAAY,KAAKF,EAAeE,EAAM,MAAMA,EAAM,MAAMA,EAAM,MAAM,EAAE;CAExF,OAAOtB;AACX;AAUA,SAASwB,EAAkB,GAAqE;CAC5F,IAAMC,IAAO,CAAC,GAAGC,EAAK,SAAS,iBAAiB,CAAC,CAAC,CAAC,QAC9C,MACGL,EAAeC,EAAM,EAAE,CAAC,CAAC,aAAa,EAAE,YAAY,MAAM,yBAClE;CACA,IAAIG,EAAK,WAAW,GAAG,OAAO,EAAE,QAAK;CACrC,IAAIA,EAAK,SAAS,GACd,MAAU,MACN,mGACJ;CAEJ,IAAMF,IAAME,EAAK;CACjB,OAAO;EACH,MACIC,EAAK,MAAM,GAAGH,EAAI,KAAK,IACvBG,EAAK,MAAMH,EAAI,QAASA,EAAI,EAAE,CAAC,MAAM,CAAC,CAAC,QAAQ,gBAAgB,EAAE;EACrE,UAAUxB,EAASsB,EAAeE,EAAI,EAAE,CAAC,CAAC,WAAW,EAAE;CAC3D;AACJ;AAEA,SAASI,EAAa,GAAc,GAAuC;CACvE,IAAMC,IAAc,OAAO,IAAIC,EAAQ,2BAA2BA,EAAQ,IAAI,IAAI,GAC5EC,IAAmB,CAAC;CAC1B,KAAK,IAAMR,KAASI,EAAK,SAASE,CAAO,GAAG;EACxC,IAAMG,IAAaV,EAAe,MAAMC,EAAM,GAAG,EAAE;EAEnD,IADIO,MAAY,YAAY,SAASE,KACjCT,EAAM,EAAE,CAAE,WAAW,GAAG;EAC5B,IAAMU,IAAOf,EAAOK,EAAM,EAAG;EAC7B,AAAKQ,EAAO,SAASE,CAAI,KAAGF,EAAO,KAAKE,CAAI;CAChD;CACA,OAAOF;AACX;AAQA,SAASG,EAAW,GAAc,GAAwB;CAEtD,IAAMV,IAAM,uDADIrB,EAAO,QAAQ,MAAM,OAAO,CAAC,CAAC,QAAQ,MAAM,QACO,EAAQ,OACrEgC,IAAU,mCAAmC,KAAKR,CAAI,GACtDS,IAAO,iBAAiB,KAAKT,CAAI,GACjCU,IACFF,MAAY,QACZC,MAAS,QACT,4BAA4B,KAAKT,EAAK,MAAMS,EAAK,OAAOD,EAAQ,KAAK,CAAC,GACpEG,IAASH,KAAWC,KAAQD,EAAQ,QAAQC,EAAK,SAAS,CAACC,IAAgBF,IAAUC;CAC3F,IAAI,CAACE,GAAQ,OAAO,GAAGd,EAAI,IAAIG;CAC/B,IAAMY,IAAKD,EAAO,QAAQA,EAAO,EAAE,CAAC;CACpC,OAAO,GAAGX,EAAK,MAAM,GAAGY,CAAE,EAAE,QAAQf,IAAMG,EAAK,MAAMY,CAAE;AAC3D;AAEA,SAASC,EAAgB,GAA0C;CAC/D,IAAMC,IAAgB,CAAC;CACvB,KAAK,IAAMC,KAAU,OAAO,OAAOC,EAAI,UAAU,CAAC,CAAC,GAC/C,AAAID,EAAO,SAAS,WACpBD,EAAI,KAAK,GAAIC,EAAO,aAAa,OAAO,KAAKA,EAAO,WAAW,CAAC,CAAC,CAAE;CAEvE,OAAOD;AACX;AA+DA,SAAgBG,EAAW,IAA6B,CAAC,GAAsB;CAC3E,IAAM,EACF,aAAU,CAAC,GACX,SAAM,IACN,aAAU,IACV,UAAO,IACP,kBAAe,IACf,YAAY3B,IAAQ,CAAC,GACrB,SAAM,IACN,SAAM,IACN,gBACA4B,GAEEC,IAAwD,OAAO,YACjE,OAAO,QAAQ7B,CAAK,CAAC,CAAC,KAAK,CAAC3B,GAAMc,OAAa,CAACd,EAAK,YAAY,GAAGc,CAAO,CAAC,CAChF,GACI2C,GACAC,IAA+B,CAAC,GAChCC,IAAa;CAEjB,SAASC,EAAI,GAA0B,GAA4B,GAAoB;EACnF,AAAIC,MAAW,KAAA,KAAaC,EAAK,MAAM,MAAW1C,EAAO,WAAWyC,CAAM,KAC1EC,EAAK,KAAK;GAAE;GAAQ;EAAK,CAAC;CAC9B;CAEA,SAASC,EAAe,GAAoD;EACxE,IAAMD,IAA2B,CAAC,GAC5BE,IAAkCC,EAAe,OAAO,CAAC,GACzDC,IAAW,CAACD,EAAe,aAAa,OAAO,CAAC,CAAC,KAAK;EAC5D,IAAIE,MAAQ,IACR,KAAK,IAAM,CAACnE,GAAMM,MAAU,OAAO,QAAQ0D,CAAM,GAC7C,AAAKE,EAAS,MAAM,MAAWlE,EAAK,WAAWwB,CAAM,CAAC,KAClD,OAAOlB,KAAU,YAAaJ,EAAa,KAAKI,EAAM,KAAK,CAAC,KAChEsD,EAAIE,GAAM1D,EAAUE,GAAO,OAAON,GAAM,GAAG,OAAOA,GAAM;OAEzD,IAAI,MAAM,QAAQmE,CAAG,GACxB,KAAK,IAAMnE,KAAQmE,GAAK;GACpB,IAAM7D,IAAQ0D,EAAOhE;GACrB,AAAI,OAAOM,KAAU,YAAYA,EAAM,KAAK,MAAM,KAC9C2D,EAAe,OAAO,KAClB,mBAAmBjE,EAAK,yCAC5B,IAGJ4D,EAAIE,GAAM1D,EAAUE,GAAO,OAAON,GAAM,GAAG,OAAOA,GAAM;EAC5D;EAWJ,OATAoE,EAAQ,SAAS,GAAO,MAAU;GAC9B,AAAI,CAAC9D,KAASA,EAAM,KAAK,MAAM,KAC3B2D,EAAe,OAAO,KAClB,uBAAuBI,EAAM,mDACjC,IAGJT,EAAIE,GAAM1D,EAAUE,GAAO,WAAW+D,EAAM,EAAE,GAAG,WAAWA,EAAM,EAAE;EACxE,CAAC,GACMP;CACX;CAEA,SAASQ,EAAY,GAAuD;EACxE,IAAM3D,IAAM,CAAC,GAAGmD,CAAI;EACpB,IAAI,CAACS,GAAS,OAAO5D;EACrB,KAAK,IAAM,EAAE,eAAYmD,GAAM;GAC3B,IAAMU,IAAOX,EAAO,QAAQ,eAAe,OAAO;GAClD,AAAIW,MAASX,KAAQD,EAAIjD,GAAK6D,GAAM,YAAYX,EAAO,EAAE;EAC7D;EACA,OAAOlD;CACX;CAEA,SAAS8D,EAAS,GAAgC,GAA0C;EACxF,IAAMC,IAAOC,IAAa,CAAC,UAAUA,CAAU,IAAI,CAAC,QAAQ,GACtD9D,IAAmC;GACrC,eAAe,CAAC,GAAG6D,CAAI;GACvB,cAAcE,IAAO,CAAC,GAAGF,GAAM,oBAAoB,IAAI,CAAC,GAAGA,CAAI;GAC/D,aAAaG,KAAgBC,IAAQ,CAAC,GAAGJ,GAAM,iBAAiB,IAAI,CAAC,GAAGA,CAAI;GAC5E,WAAW;IAAC,GAAGA;IAAM;IAAS;GAAO;GACrC,YAAY,CAAC,GAAGA,GAAM,OAAO;GAC7B,aAAa,CAAC,GAAGA,GAAM,OAAO;GAC9B,eAAe;IAAC;IAAU;IAAS;GAAO;GAC1C,cAAc,CAAC,GAAGA,GAAM,OAAO;GAC/B,gBAAgB,CAAC,GAAGA,CAAI;GACxB,cAAc,CAAC,QAAQ;GACvB,YAAY,CAAC,QAAQ;GACrB,eAAe,CAAC,QAAQ;EAC5B;EACA,KAAK,IAAM,CAAC1E,GAAMc,MAAY,OAAO,QAAQ0C,CAAU,GACnD,AAAI1C,MAAY,KAAO,OAAOD,EAAOb,KAChC,EAAOA,KAAQyB,EAAMZ,EAAOb,MAAS,CAAC,GAAGc,CAAO;EAEzD,OAAOD;CACX;CAaA,SAASkE,EACL,GACA,GACwB;EACxB,IAAMC,IAAmC,CAAC;EAC1C,KAAK,IAAM,CAAChF,GAAMc,MAAY,OAAO,QAAQD,CAAM,GAAG;GAClD,IAAIb,KAAQC,GAAU;IAClB,EAAOD,KAAQC,EAASD;IACxB;GACJ;GACA,IAAMiF,IAAYnF,EAAiBG,GAAUD,CAAI,GAC3CkF,IAAQ1B,EAAWxD;GACzB,AAAIiF,MAAc,KAAA,IAAW,EAAOjF,KAAQc,IACnC,MAAM,QAAQoE,CAAK,IAAG,EAAOlF,KAAQyB,EAAMwD,GAAWC,CAAK,IAC3DpE,EAAQ,SAAS,KAAKQ,EAAeR,CAAO,MAAG,EAAOd,KAAQc;EAC3E;EACA,KAAK,IAAM,CAACd,GAAMc,MAAY,OAAO,QAAQb,CAAQ,GAAG,EAAOD,OAAUc;EACzE,KAAK,IAAM,CAACd,GAAMc,MAAY,OAAO,QAAQ0C,CAAU,GAAG;GACtD,IAAI,EAAExD,KAAQC,IAAW;GACzB,IAAIa,MAAY,IAAO;IACnB,OAAOkE,EAAOhF;IACd;GACJ;GACA,IAAMmF,IAAUrE,EAAQ,QAAQ,MAAW,CAACb,EAASD,EAAK,CAAE,SAASoB,CAAM,CAAC;GAC5E,AAAI+D,EAAQ,SAAS,KACjB1B,GAAQ,OAAO,KACX,mCAAmCzD,EAAK,mBAAmBA,EAAK,yBACxDmF,EAAQ,KAAK,GAAG,EAAE,+EAC9B;EAER;EACA,OAAOH;CACX;CAiBA,SAASI,EACL,GACA,GACA,GACI;EACJ,IAAI,CAACC,KAAa,CAAC5B,GAAQ;EAC3B,IAAM6B,IAAaD,EAAU,IAAI9D,CAAmB;EAIpD,IAFI8D,EAAU,MAAM,MAAWlE,EAAUC,GAAQ,iBAAiB,CAAC,KAC/D,CAACkE,EAAW,MAAM,MAAW,wBAAwB,KAAKlE,CAAM,CAAC,GACnD;EAClB,IAAMmE,IAAUjD,EAAaD,GAAM,QAAQ,CAAC,CAAC,QAAQ,MAAS,CAACiD,EAAW,SAAS3C,CAAI,CAAC;EACxF,AAAI4C,EAAQ,WAAW,KACvB9B,EAAO,OAAO,KACV,yEAAyE8B,EAAQ,OAAO,oBAChFC,EAAU,GAAGH,EAAU,KAAK,GAAG,EAAE,wDAAwDE,EAAQ,KAAK,GAAG,EAAE,MAAMC,GAC7H;CACJ;CAsGA,OAAO;EAnGH,MAAM;EACN,eAAe,GAAgB;GAE3B,AADA,IAASvB,GACT,IAAWF,EAAeE,CAAc;EAC5C;EACA,oBAAoB;GAChB,OAAO;GACP,QAAQ,GAAQ,GAAK;IACjB,IAAMa,IAAQrB,GAAQ,YAAY;IAClC,IAAIqB,KAAS,CAACW,GAAK,OAAOrE;IAE1B,IAAMsE,IAAiBpB,EAAYZ,CAAQ,GACrChC,IAAO+B,GAAQ,QAAQ,KACvBkB,IAAazE,EAAa,KAAKwB,CAAI,IAAItB,EAAUsB,GAAM,MAAM,IAAI,KAAA;IACvE,AAAIiD,KAAYf,EAAI8B,GAAgBf,GAAY,MAAM;IACtD,IAAMgB,IAAYb,IAAQ,CAAC,IAAI5B,EAAgBG,CAAG;IAClD,KAAK,IAAMuC,KAAShG,GAChB,CAAIkF,KAASa,EAAU,MAAM,MAAOC,EAAM,OAAO,KAAKC,CAAE,CAAC,MACrDjC,EAAI8B,GAAgBE,EAAM,QAAQA,EAAM,IAAI;IAGpD,IAAME,IAAaJ,GAEb,EAAE,SAAM,cAAW,CAAC,MAAMvD,EAAkBf,CAAM,GAClDP,IAAS4D,EAASE,GAAYG,CAAK,GACnCiB,KAAU,MACZ,EAAE/F,KAAQC,MAAaH,EAAiBG,GAAUD,CAAI,MAAM,KAAA;IAOhE,AANI+F,EAAO,YAAY,KAAK,EAAE,qBAAqB9F,OAC/C,EAAO,gBAAgBwB,EACnBZ,EAAO,iBAAiB,CAAC,GACzByB,EAAaD,GAAM,QAAQ,CAC/B,IAGA0D,EAAO,WAAW,KAClB,EAAE,oBAAoB9F,MACtB,CAACY,EAAO,YAAY,EAAE,MAAM,MAAWM,EAAUC,GAAQ,iBAAiB,CAAC,MAE3E,EAAO,eAAeK,EAClBZ,EAAO,gBAAgB,CAAC,GACxByB,EAAaD,GAAM,OAAO,CAC9B;IAEJ,IAAM2C,IAASD,EAAYlE,GAAQZ,CAAQ,GACrC+F,IAAUF,EAAW,KAAK,MAAUG,EAAM,MAAM,GAChDC,IAAmBpG,EAAiBG,GAAU,aAAa,GAC3DkG,IAAkBnB,EAAO,kBAAkBkB;IAKjD,AAHIC,MAAoB,KAAA,KACpB7E,EAAe6E,CAAe,MAC7B,iBAAiBlG,KAAYiG,MAAqB,KAAA,KAE/CF,EAAQ,SAAS,KACjBvC,GAAQ,OAAO,KACX,+CAA+C0C,EAAgB,KAAK,GAAG,KAAK,mBAAmB,iBAAiBlG,IAAW,KAAK,yBAAyB,oEAClF+F,EAAQ,KAAK,GAAG,GAC3F,KAGJ,iBAAiBhB,KACjBgB,EAAQ,SAAS,KACjBE,MAAqB,KAAA,OAErB,EAAO,iBAAiBzE,EAAM0E,KAAmB,CAAC,QAAQ,GAAGH,CAAO;IAGxE,IAAMI,IAAa,qBAAqBnG,IAAW,oBAAoB;IACvE,EACIoC,GACA+D,GACApB,EAAOoB,MAAetG,EAAiBG,GAAUmG,CAAU,CAC/D;IAEA,IAAMC,IAA2B;KAC7B,YAAYrB;KACZ,MAAMhE,EAAagE,GAAQ,MAAM;KACjC,QAAQhE,EAAagE,GAAQ,QAAQ;KACrC,SAASc;KACT,SAAShB,IAAQ,UAAU;IAC/B;IAEA,IAAIwB,KAAO7C,KAAU4C,EAAO,WAAW1C,GAAY;KAC/C,IAAa0C,EAAO;KACpB,IAAME,IAAQT,EAAW,KAAK,MAAU,KAAKG,EAAM,OAAO,MAAMA,EAAM,MAAM;KAC5E,EAAO,OAAO,KACV,CACI,6BAA6BjB,EAAO,kBAAkBkB,KAAoB,CAAC,EAAA,CAAG,KAAK,GAAG,KACtF,GAAIK,EAAM,SAAS,IACbA,IACA,CAAC,2CAA2C,CACtD,CAAC,CAAC,KAAK,IAAI,CACf;IACJ;IAEA,OADAC,IAAWH,CAAM,GACVzD,EAAWP,GAAMgE,EAAO,IAAI;GACvC;EACJ;CAGG;AACX"}

package/dist/vite/tempest-icons.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"tempest-icons.cjs","names":[],"sources":["../../src/vite/tempest-icons.ts"],"sourcesContent":["import { readdir, readFile } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\n\nimport { iconAliases } from \"@/icons/generated/aliases\";\nimport { iconNames } from \"@/icons/generated/icon-names\";\n\nimport type { TempestVitePlugin } from \"./tempest-pwa-manifest\";\n\n/** The module id an app imports to get its static registry. */\nexport const TEMPEST_ICONS_ID = \"tempest-react-sdk/icons/virtual\";\n\n/**\n * The original virtual id, still honoured.\n *\n * Published as the documented import before the subpath existed, so apps have it\n * written in their entrypoints. It resolves to the same generated module — but it\n * only ever resolves *with the plugin*, which is the reason the subpath above\n * replaced it: that one also resolves without it, to an empty stub.\n */\nexport const TEMPEST_ICONS_VIRTUAL_ID = \"virtual:tempest-icons\";\n\nconst RESOLVED_ID = `\\0${TEMPEST_ICONS_VIRTUAL_ID}`;\n\n/**\n * Slugs written as a literal `name` prop or a literal `name:` field.\n *\n * Matching the *attribute* rather than any kebab-case string is what keeps the\n * scan from sweeping in unrelated text — a CSS class, a translation key and a\n * route segment all look like slugs otherwise. Everything matched is still\n * validated against lucide's real slug list before it reaches the module.\n */\nconst NAME_PATTERNS = [\n    /\\bname\\s*=\\s*[\"']([a-z0-9-]+)[\"']/g,\n    /\\bname\\s*=\\s*\\{\\s*[\"']([a-z0-9-]+)[\"']\\s*\\}/g,\n    /\\bname\\s*:\\s*[\"']([a-z0-9-]+)[\"']/g,\n];\n\nconst SOURCE_FILE = /\\.[cm]?[jt]sx?$/;\nconst SKIP_DIRS = new Set([\"node_modules\", \"dist\", \"build\", \"coverage\"]);\n\nexport interface TempestIconsOptions {\n    /**\n     * Directory to scan, relative to the Vite root. Default: `\"src\"`.\n     */\n    dir?: string;\n    /**\n     * Extra slugs to include even when the scan cannot see them — a name built by\n     * concatenation, or one that only ever arrives from the API but is worth\n     * paying for statically because it is on the first screen.\n     */\n    include?: readonly string[];\n    /** Directory names to skip. Default: `node_modules`, `dist`, `build`, `coverage`. */\n    skipDirs?: readonly string[];\n}\n\n/**\n * Collect the icon slugs a source file references literally.\n *\n * @param code - File contents.\n * @param known - The set of real lucide slugs, aliases included.\n * @returns The slugs found, validated against `known`.\n */\nexport function scanIconSlugs(code: string, known: ReadonlySet<string>): string[] {\n    const found = new Set<string>();\n    for (const pattern of NAME_PATTERNS) {\n        pattern.lastIndex = 0;\n        let match: RegExpExecArray | null;\n        while ((match = pattern.exec(code)) !== null) {\n            if (known.has(match[1])) found.add(match[1]);\n        }\n    }\n    return [...found];\n}\n\n/**\n * Build the virtual module source for a set of slugs.\n *\n * Aliases resolve to their canonical slug before importing, because only the\n * canonical name is a real lucide export — but the alias key still points at the\n * component, so `<Icon name=\"alert-circle\" />` stays a zero-request lookup.\n *\n * @param slugs - Validated slugs to include.\n * @param aliases - Alias slug → canonical slug.\n * @returns ES module source.\n */\nexport function buildIconsModule(\n    slugs: readonly string[],\n    aliases: Record<string, string>,\n): string {\n    const sorted = [...new Set(slugs)].sort();\n    if (!sorted.length) return \"export const staticIcons = {};\\n\";\n\n    const componentOf = new Map<string, string>();\n    for (const slug of sorted) componentOf.set(slug, pascalCase(aliases[slug] ?? slug));\n\n    const named = [...new Set(componentOf.values())]\n        .sort()\n        .map((name) => (localName(name) === name ? name : `${name} as ${localName(name)}`))\n        .join(\", \");\n    const entries = sorted\n        .map((slug) => `    \"${slug}\": ${localName(componentOf.get(slug) as string)},`)\n        .join(\"\\n\");\n    return `import { ${named} } from \"lucide-react\";\n\nexport const staticIcons = {\n${entries}\n};\n`;\n}\n\n/** `circle-alert` → `CircleAlert`; `a-arrow-down` → `AArrowDown`. */\nfunction pascalCase(slug: string): string {\n    return slug\n        .split(\"-\")\n        .map((part) => part.charAt(0).toUpperCase() + part.slice(1))\n        .join(\"\");\n}\n\n/**\n * Export names that would shadow a restricted global if bound directly.\n *\n * Lucide ships an icon literally called `infinity`, whose export is `Infinity`.\n * Binding that at module scope shadows the global, so the import is aliased.\n */\nconst RESERVED_NAMES = new Set([\"Infinity\", \"NaN\", \"undefined\", \"eval\", \"arguments\"]);\n\n/** The local binding to use for a lucide export name. */\nfunction localName(name: string): string {\n    return RESERVED_NAMES.has(name) ? `${name}Icon` : name;\n}\n\n/**\n * Walk a directory and collect every source file path.\n *\n * @param dir - Absolute directory to walk.\n * @param skip - Directory names to skip.\n * @returns Absolute file paths.\n */\nasync function collectSourceFiles(dir: string, skip: ReadonlySet<string>): Promise<string[]> {\n    const out: string[] = [];\n    let entries;\n    try {\n        entries = await readdir(dir, { withFileTypes: true });\n    } catch {\n        return out;\n    }\n    for (const entry of entries) {\n        if (entry.isDirectory()) {\n            if (skip.has(entry.name) || entry.name.startsWith(\".\")) continue;\n            out.push(...(await collectSourceFiles(join(dir, entry.name), skip)));\n        } else if (entry.isFile() && SOURCE_FILE.test(entry.name)) {\n            out.push(join(dir, entry.name));\n        }\n    }\n    return out;\n}\n\n/**\n * Generate a static icon registry from the slugs your source mentions.\n *\n * Removes the reason to reach for `lucide-react`'s `DynamicIcon`: the slugs an app\n * writes as literals become ordinary static imports, so the bundler keeps exactly\n * those icons and the browser makes **no** extra request for them. A slug that only\n * exists at runtime still works — `<Icon>` falls back to fetching one shard per\n * initial letter.\n *\n * The scan reads the source tree directly at `buildStart` rather than harvesting\n * modules as they pass through `transform`: relying on transform order would let\n * the virtual module load before every consumer had been seen, and the registry\n * would come out short on a cold dev start — silently, since the missing slugs\n * would still render via the lazy path.\n *\n * @example\n * // vite.config.ts\n * import { createViteConfig, tempestIcons } from \"tempest-react-sdk/vite\";\n *\n * export default createViteConfig({ plugins: [tempestIcons()] });\n *\n * @example\n * // src/main.tsx\n * import { IconProvider } from \"tempest-react-sdk/icons\";\n * import { staticIcons } from \"tempest-react-sdk/icons/virtual\";\n *\n * <IconProvider registry={staticIcons}>\n *     <App />\n * </IconProvider>\n */\nexport function tempestIcons(options: TempestIconsOptions = {}): TempestVitePlugin {\n    const { dir = \"src\", include = [], skipDirs } = options;\n    const known = new Set<string>(iconNames);\n    const skip = new Set<string>(skipDirs ?? SKIP_DIRS);\n    const slugs = new Set<string>(include.filter((slug) => known.has(slug)));\n    let root = process.cwd();\n\n    /**\n     * Rescan the source tree, keeping the explicitly included slugs.\n     *\n     * @tempest-limits empty-catch — the scan races the editor and the file system:\n     * a file listed a moment ago can be renamed, deleted, or held by another process\n     * by the time it is read. An unreadable file contributes no slugs and the build\n     * continues; failing the whole scan would break `vite dev` over a temp file that\n     * no longer exists.\n     */\n    const rescan = async (): Promise<void> => {\n        const files = await collectSourceFiles(resolve(root, dir), skip);\n        for (const file of files) {\n            try {\n                const code = await readFile(file, \"utf8\");\n                for (const slug of scanIconSlugs(code, known)) slugs.add(slug);\n            } catch {\n                /* empty */\n            }\n        }\n    };\n\n    return {\n        name: \"tempest-icons\",\n        enforce: \"pre\",\n\n        configResolved(config: { root?: string }) {\n            root = config.root ?? root;\n        },\n\n        async buildStart() {\n            await rescan();\n        },\n\n        /**\n         * Claim both spellings of the registry module.\n         *\n         * The subpath is a real file in the installed package, so returning the\n         * virtual id here is what overrides the empty stub with the generated\n         * table. Letting Vite resolve it normally would silently ship the stub.\n         */\n        resolveId(id: string) {\n            return id === TEMPEST_ICONS_ID || id === TEMPEST_ICONS_VIRTUAL_ID ? RESOLVED_ID : null;\n        },\n\n        load(id: string) {\n            return id === RESOLVED_ID ? buildIconsModule([...slugs], iconAliases) : null;\n        },\n\n        /**\n         * Pick up a slug added while the dev server is running.\n         *\n         * A newly written `<Icon name=\"save\" />` would otherwise only render via\n         * the lazy path until the next restart. Rescanning the changed file and\n         * invalidating the virtual module keeps dev and build agreeing on what the\n         * static registry contains.\n         */\n        async handleHotUpdate(ctx: {\n            file: string;\n            read: () => Promise<string>;\n            server: { moduleGraph: { getModuleById: (id: string) => unknown } };\n        }): Promise<unknown[] | undefined> {\n            if (!SOURCE_FILE.test(ctx.file)) return undefined;\n            const before = slugs.size;\n            for (const slug of scanIconSlugs(await ctx.read(), known)) slugs.add(slug);\n            if (slugs.size === before) return undefined;\n            const mod = ctx.server.moduleGraph.getModuleById(RESOLVED_ID);\n            return mod ? [mod] : undefined;\n        },\n    } as TempestVitePlugin;\n}\n"],"mappings":"0JASA,IAAa,EAAmB,kCAUnB,EAA2B,wBAElC,EAAc,KAAK,IAUnB,EAAgB,CAClB,qCACA,+CACA,oCACJ,EAEM,EAAc,kBACd,EAAY,IAAI,IAAI,CAAC,eAAgB,OAAQ,QAAS,UAAU,CAAC,EAwBvE,SAAgB,EAAc,EAAc,EAAsC,CAC9E,IAAM,EAAQ,IAAI,IAClB,IAAK,IAAM,KAAW,EAAe,CACjC,EAAQ,UAAY,EACpB,IAAI,EACJ,MAAQ,EAAQ,EAAQ,KAAK,CAAI,KAAO,MAChC,EAAM,IAAI,EAAM,EAAE,GAAG,EAAM,IAAI,EAAM,EAAE,CAEnD,CACA,MAAO,CAAC,GAAG,CAAK,CACpB,CAaA,SAAgB,EACZ,EACA,EACM,CACN,IAAM,EAAS,CAAC,GAAG,IAAI,IAAI,CAAK,CAAC,CAAC,CAAC,KAAK,EACxC,GAAI,CAAC,EAAO,OAAQ,MAAO;EAE3B,IAAM,EAAc,IAAI,IACxB,IAAK,IAAM,KAAQ,EAAQ,EAAY,IAAI,EAAM,EAAW,EAAQ,IAAS,CAAI,CAAC,EASlF,MAAO,YAPO,CAAC,GAAG,IAAI,IAAI,EAAY,OAAO,CAAC,CAAC,CAAC,CAC3C,KAAK,CAAC,CACN,IAAK,GAAU,EAAU,CAAI,IAAM,EAAO,EAAO,GAAG,EAAK,MAAM,EAAU,CAAI,GAAI,CAAC,CAClF,KAAK,IAIS,EAAM;;;EAHT,EACX,IAAK,GAAS,QAAQ,EAAK,KAAK,EAAU,EAAY,IAAI,CAAI,CAAW,EAAE,EAAE,CAAC,CAC9E,KAAK;CAIZ,EAAQ;;CAGV,CAGA,SAAS,EAAW,EAAsB,CACtC,OAAO,EACF,MAAM,GAAG,CAAC,CACV,IAAK,GAAS,EAAK,OAAO,CAAC,CAAC,CAAC,YAAY,EAAI,EAAK,MAAM,CAAC,CAAC,CAAC,CAC3D,KAAK,EAAE,CAChB,CAQA,IAAM,EAAiB,IAAI,IAAI,CAAC,WAAY,MAAO,YAAa,OAAQ,WAAW,CAAC,EAGpF,SAAS,EAAU,EAAsB,CACrC,OAAO,EAAe,IAAI,CAAI,EAAI,GAAG,EAAK,MAAQ,CACtD,CASA,eAAe,EAAmB,EAAa,EAA8C,CACzF,IAAM,EAAgB,CAAC,EACnB,EACJ,GAAI,CACA,EAAU,MAAA,EAAM,EAAA,QAAA,CAAQ,EAAK,CAAE,cAAe,EAAK,CAAC,CACxD,MAAQ,CACJ,OAAO,CACX,CACA,IAAK,IAAM,KAAS,EAChB,GAAI,EAAM,YAAY,EAAG,CACrB,GAAI,EAAK,IAAI,EAAM,IAAI,GAAK,EAAM,KAAK,WAAW,GAAG,EAAG,SACxD,EAAI,KAAK,GAAI,MAAM,GAAA,EAAmB,EAAA,KAAA,CAAK,EAAK,EAAM,IAAI,EAAG,CAAI,CAAE,CACvE,MAAW,EAAM,OAAO,GAAK,EAAY,KAAK,EAAM,IAAI,GACpD,EAAI,MAAA,EAAK,EAAA,KAAA,CAAK,EAAK,EAAM,IAAI,CAAC,EAGtC,OAAO,CACX,CAgCA,SAAgB,EAAa,EAA+B,CAAC,EAAsB,CAC/E,GAAM,CAAE,MAAM,MAAO,UAAU,CAAC,EAAG,YAAa,EAC1C,EAAQ,IAAI,IAAY,EAAA,SAAS,EACjC,EAAO,IAAI,IAAY,GAAY,CAAS,EAC5C,EAAQ,IAAI,IAAY,EAAQ,OAAQ,GAAS,EAAM,IAAI,CAAI,CAAC,CAAC,EACnE,EAAO,QAAQ,IAAI,EAWjB,EAAS,SAA2B,CACtC,IAAM,EAAQ,MAAM,GAAA,EAAmB,EAAA,QAAA,CAAQ,EAAM,CAAG,EAAG,CAAI,EAC/D,IAAK,IAAM,KAAQ,EACf,GAAI,CACA,IAAM,EAAO,MAAA,EAAM,EAAA,SAAA,CAAS,EAAM,MAAM,EACxC,IAAK,IAAM,KAAQ,EAAc,EAAM,CAAK,EAAG,EAAM,IAAI,CAAI,CACjE,MAAQ,CAER,CAER,EAEA,MAAO,CACH,KAAM,gBACN,QAAS,MAET,eAAe,EAA2B,CACtC,EAAO,EAAO,MAAQ,CAC1B,EAEA,MAAM,YAAa,CACf,MAAM,EAAO,CACjB,EASA,UAAU,EAAY,CAClB,OAAO,IAAA,mCAA2B,IAAA,wBAAkC,EAAc,IACtF,EAEA,KAAK,EAAY,CACb,OAAO,IAAO,EAAc,EAAiB,CAAC,GAAG,CAAK,EAAG,EAAA,WAAW,EAAI,IAC5E,EAUA,MAAM,gBAAgB,EAIa,CAC/B,GAAI,CAAC,EAAY,KAAK,EAAI,IAAI,EAAG,OACjC,IAAM,EAAS,EAAM,KACrB,IAAK,IAAM,KAAQ,EAAc,MAAM,EAAI,KAAK,EAAG,CAAK,EAAG,EAAM,IAAI,CAAI,EACzE,GAAI,EAAM,OAAS,EAAQ,OAC3B,IAAM,EAAM,EAAI,OAAO,YAAY,cAAc,CAAW,EAC5D,OAAO,EAAM,CAAC,CAAG,EAAI,IAAA,EACzB,CACJ,CACJ"}
+{"version":3,"file":"tempest-icons.cjs","names":["readdir","join","iconNames","resolve","readFile","iconAliases","require_aliases","require_icon_names","node_path","node_fs_promises","TEMPEST_ICONS_ID","TEMPEST_ICONS_VIRTUAL_ID","RESOLVED_ID","NAME_PATTERNS","SOURCE_FILE","SKIP_DIRS","scanIconSlugs","found","pattern","match","code","known","buildIconsModule","sorted","slugs","componentOf","slug","pascalCase","aliases","localName","name","part","RESERVED_NAMES","collectSourceFiles","out","entries","dir","entry","skip","tempestIcons","options","skipDirs","include","root","rescan","files","file","config","id","ctx","before","mod"],"sources":["../../src/vite/tempest-icons.ts"],"sourcesContent":["import { readdir, readFile } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\n\nimport { iconAliases } from \"@/icons/generated/aliases\";\nimport { iconNames } from \"@/icons/generated/icon-names\";\n\nimport type { TempestVitePlugin } from \"./tempest-pwa-manifest\";\n\n/** The module id an app imports to get its static registry. */\nexport const TEMPEST_ICONS_ID = \"tempest-react-sdk/icons/virtual\";\n\n/**\n * The original virtual id, still honoured.\n *\n * Published as the documented import before the subpath existed, so apps have it\n * written in their entrypoints. It resolves to the same generated module — but it\n * only ever resolves *with the plugin*, which is the reason the subpath above\n * replaced it: that one also resolves without it, to an empty stub.\n */\nexport const TEMPEST_ICONS_VIRTUAL_ID = \"virtual:tempest-icons\";\n\nconst RESOLVED_ID = `\\0${TEMPEST_ICONS_VIRTUAL_ID}`;\n\n/**\n * Slugs written as a literal `name` prop or a literal `name:` field.\n *\n * Matching the *attribute* rather than any kebab-case string is what keeps the\n * scan from sweeping in unrelated text — a CSS class, a translation key and a\n * route segment all look like slugs otherwise. Everything matched is still\n * validated against lucide's real slug list before it reaches the module.\n */\nconst NAME_PATTERNS = [\n    /\\bname\\s*=\\s*[\"']([a-z0-9-]+)[\"']/g,\n    /\\bname\\s*=\\s*\\{\\s*[\"']([a-z0-9-]+)[\"']\\s*\\}/g,\n    /\\bname\\s*:\\s*[\"']([a-z0-9-]+)[\"']/g,\n];\n\nconst SOURCE_FILE = /\\.[cm]?[jt]sx?$/;\nconst SKIP_DIRS = new Set([\"node_modules\", \"dist\", \"build\", \"coverage\"]);\n\nexport interface TempestIconsOptions {\n    /**\n     * Directory to scan, relative to the Vite root. Default: `\"src\"`.\n     */\n    dir?: string;\n    /**\n     * Extra slugs to include even when the scan cannot see them — a name built by\n     * concatenation, or one that only ever arrives from the API but is worth\n     * paying for statically because it is on the first screen.\n     */\n    include?: readonly string[];\n    /** Directory names to skip. Default: `node_modules`, `dist`, `build`, `coverage`. */\n    skipDirs?: readonly string[];\n}\n\n/**\n * Collect the icon slugs a source file references literally.\n *\n * @param code - File contents.\n * @param known - The set of real lucide slugs, aliases included.\n * @returns The slugs found, validated against `known`.\n */\nexport function scanIconSlugs(code: string, known: ReadonlySet<string>): string[] {\n    const found = new Set<string>();\n    for (const pattern of NAME_PATTERNS) {\n        pattern.lastIndex = 0;\n        let match: RegExpExecArray | null;\n        while ((match = pattern.exec(code)) !== null) {\n            if (known.has(match[1])) found.add(match[1]);\n        }\n    }\n    return [...found];\n}\n\n/**\n * Build the virtual module source for a set of slugs.\n *\n * Aliases resolve to their canonical slug before importing, because only the\n * canonical name is a real lucide export — but the alias key still points at the\n * component, so `<Icon name=\"alert-circle\" />` stays a zero-request lookup.\n *\n * @param slugs - Validated slugs to include.\n * @param aliases - Alias slug → canonical slug.\n * @returns ES module source.\n */\nexport function buildIconsModule(\n    slugs: readonly string[],\n    aliases: Record<string, string>,\n): string {\n    const sorted = [...new Set(slugs)].sort();\n    if (!sorted.length) return \"export const staticIcons = {};\\n\";\n\n    const componentOf = new Map<string, string>();\n    for (const slug of sorted) componentOf.set(slug, pascalCase(aliases[slug] ?? slug));\n\n    const named = [...new Set(componentOf.values())]\n        .sort()\n        .map((name) => (localName(name) === name ? name : `${name} as ${localName(name)}`))\n        .join(\", \");\n    const entries = sorted\n        .map((slug) => `    \"${slug}\": ${localName(componentOf.get(slug) as string)},`)\n        .join(\"\\n\");\n    return `import { ${named} } from \"lucide-react\";\n\nexport const staticIcons = {\n${entries}\n};\n`;\n}\n\n/** `circle-alert` → `CircleAlert`; `a-arrow-down` → `AArrowDown`. */\nfunction pascalCase(slug: string): string {\n    return slug\n        .split(\"-\")\n        .map((part) => part.charAt(0).toUpperCase() + part.slice(1))\n        .join(\"\");\n}\n\n/**\n * Export names that would shadow a restricted global if bound directly.\n *\n * Lucide ships an icon literally called `infinity`, whose export is `Infinity`.\n * Binding that at module scope shadows the global, so the import is aliased.\n */\nconst RESERVED_NAMES = new Set([\"Infinity\", \"NaN\", \"undefined\", \"eval\", \"arguments\"]);\n\n/** The local binding to use for a lucide export name. */\nfunction localName(name: string): string {\n    return RESERVED_NAMES.has(name) ? `${name}Icon` : name;\n}\n\n/**\n * Walk a directory and collect every source file path.\n *\n * @param dir - Absolute directory to walk.\n * @param skip - Directory names to skip.\n * @returns Absolute file paths.\n */\nasync function collectSourceFiles(dir: string, skip: ReadonlySet<string>): Promise<string[]> {\n    const out: string[] = [];\n    let entries;\n    try {\n        entries = await readdir(dir, { withFileTypes: true });\n    } catch {\n        return out;\n    }\n    for (const entry of entries) {\n        if (entry.isDirectory()) {\n            if (skip.has(entry.name) || entry.name.startsWith(\".\")) continue;\n            out.push(...(await collectSourceFiles(join(dir, entry.name), skip)));\n        } else if (entry.isFile() && SOURCE_FILE.test(entry.name)) {\n            out.push(join(dir, entry.name));\n        }\n    }\n    return out;\n}\n\n/**\n * Generate a static icon registry from the slugs your source mentions.\n *\n * Removes the reason to reach for `lucide-react`'s `DynamicIcon`: the slugs an app\n * writes as literals become ordinary static imports, so the bundler keeps exactly\n * those icons and the browser makes **no** extra request for them. A slug that only\n * exists at runtime still works — `<Icon>` falls back to fetching one shard per\n * initial letter.\n *\n * The scan reads the source tree directly at `buildStart` rather than harvesting\n * modules as they pass through `transform`: relying on transform order would let\n * the virtual module load before every consumer had been seen, and the registry\n * would come out short on a cold dev start — silently, since the missing slugs\n * would still render via the lazy path.\n *\n * @example\n * // vite.config.ts\n * import { createViteConfig, tempestIcons } from \"tempest-react-sdk/vite\";\n *\n * export default createViteConfig({ plugins: [tempestIcons()] });\n *\n * @example\n * // src/main.tsx\n * import { IconProvider } from \"tempest-react-sdk/icons\";\n * import { staticIcons } from \"tempest-react-sdk/icons/virtual\";\n *\n * <IconProvider registry={staticIcons}>\n *     <App />\n * </IconProvider>\n */\nexport function tempestIcons(options: TempestIconsOptions = {}): TempestVitePlugin {\n    const { dir = \"src\", include = [], skipDirs } = options;\n    const known = new Set<string>(iconNames);\n    const skip = new Set<string>(skipDirs ?? SKIP_DIRS);\n    const slugs = new Set<string>(include.filter((slug) => known.has(slug)));\n    let root = process.cwd();\n\n    /**\n     * Rescan the source tree, keeping the explicitly included slugs.\n     *\n     * @tempest-limits empty-catch — the scan races the editor and the file system:\n     * a file listed a moment ago can be renamed, deleted, or held by another process\n     * by the time it is read. An unreadable file contributes no slugs and the build\n     * continues; failing the whole scan would break `vite dev` over a temp file that\n     * no longer exists.\n     */\n    const rescan = async (): Promise<void> => {\n        const files = await collectSourceFiles(resolve(root, dir), skip);\n        for (const file of files) {\n            try {\n                const code = await readFile(file, \"utf8\");\n                for (const slug of scanIconSlugs(code, known)) slugs.add(slug);\n            } catch {\n                /* empty */\n            }\n        }\n    };\n\n    return {\n        name: \"tempest-icons\",\n        enforce: \"pre\",\n\n        configResolved(config: { root?: string }) {\n            root = config.root ?? root;\n        },\n\n        async buildStart() {\n            await rescan();\n        },\n\n        /**\n         * Claim both spellings of the registry module.\n         *\n         * The subpath is a real file in the installed package, so returning the\n         * virtual id here is what overrides the empty stub with the generated\n         * table. Letting Vite resolve it normally would silently ship the stub.\n         */\n        resolveId(id: string) {\n            return id === TEMPEST_ICONS_ID || id === TEMPEST_ICONS_VIRTUAL_ID ? RESOLVED_ID : null;\n        },\n\n        load(id: string) {\n            return id === RESOLVED_ID ? buildIconsModule([...slugs], iconAliases) : null;\n        },\n\n        /**\n         * Pick up a slug added while the dev server is running.\n         *\n         * A newly written `<Icon name=\"save\" />` would otherwise only render via\n         * the lazy path until the next restart. Rescanning the changed file and\n         * invalidating the virtual module keeps dev and build agreeing on what the\n         * static registry contains.\n         */\n        async handleHotUpdate(ctx: {\n            file: string;\n            read: () => Promise<string>;\n            server: { moduleGraph: { getModuleById: (id: string) => unknown } };\n        }): Promise<unknown[] | undefined> {\n            if (!SOURCE_FILE.test(ctx.file)) return undefined;\n            const before = slugs.size;\n            for (const slug of scanIconSlugs(await ctx.read(), known)) slugs.add(slug);\n            if (slugs.size === before) return undefined;\n            const mod = ctx.server.moduleGraph.getModuleById(RESOLVED_ID);\n            return mod ? [mod] : undefined;\n        },\n    } as TempestVitePlugin;\n}\n"],"mappings":"A,0JASA,IAAaU,EAAmB,kCAUnBC,EAA2B,wBAElCC,EAAc,KAAKD,IAUnBE,EAAgB,CAClB,qCACA,+CACA,oCACJ,EAEMC,EAAc,kBACdC,EAAY,IAAI,IAAI,CAAC,eAAgB,OAAQ,QAAS,UAAU,CAAC,EAwBvE,SAAgBC,EAAc,EAAc,EAAsC,CAC9E,IAAMC,EAAQ,IAAI,IAClB,IAAK,IAAMC,KAAWL,EAAe,CACjC,EAAQ,UAAY,EACpB,IAAIM,EACJ,MAAQ,EAAQD,EAAQ,KAAKE,CAAI,KAAO,MAChCC,EAAM,IAAIF,EAAM,EAAE,GAAGF,EAAM,IAAIE,EAAM,EAAE,CAEnD,CACA,MAAO,CAAC,GAAGF,CAAK,CACpB,CAaA,SAAgBK,EACZ,EACA,EACM,CACN,IAAMC,EAAS,CAAC,GAAG,IAAI,IAAIC,CAAK,CAAC,CAAC,CAAC,KAAK,EACxC,GAAI,CAACD,EAAO,OAAQ,MAAO;EAE3B,IAAME,EAAc,IAAI,IACxB,IAAK,IAAMC,KAAQH,EAAQE,EAAY,IAAIC,EAAMC,EAAWC,EAAQF,IAASA,CAAI,CAAC,EASlF,MAAO,YAPO,CAAC,GAAG,IAAI,IAAID,EAAY,OAAO,CAAC,CAAC,CAAC,CAC3C,KAAK,CAAC,CACN,IAAK,GAAUI,EAAUC,CAAI,IAAMA,EAAOA,EAAO,GAAGA,EAAK,MAAMD,EAAUC,CAAI,GAAI,CAAC,CAClF,KAAK,IAIS,EAAM;;;EAHTP,EACX,IAAK,GAAS,QAAQG,EAAK,KAAKG,EAAUJ,EAAY,IAAIC,CAAI,CAAW,EAAE,EAAE,CAAC,CAC9E,KAAK;CAIZ,EAAQ;;CAGV,CAGA,SAASC,EAAW,EAAsB,CACtC,OAAOD,EACF,MAAM,GAAG,CAAC,CACV,IAAK,GAASK,EAAK,OAAO,CAAC,CAAC,CAAC,YAAY,EAAIA,EAAK,MAAM,CAAC,CAAC,CAAC,CAC3D,KAAK,EAAE,CAChB,CAQA,IAAMC,EAAiB,IAAI,IAAI,CAAC,WAAY,MAAO,YAAa,OAAQ,WAAW,CAAC,EAGpF,SAASH,EAAU,EAAsB,CACrC,OAAOG,EAAe,IAAIF,CAAI,EAAI,GAAGA,EAAK,MAAQA,CACtD,CASA,eAAeG,EAAmB,EAAa,EAA8C,CACzF,IAAMC,EAAgB,CAAC,EACnBC,EACJ,GAAI,CACA,EAAU,MAAA,EAAMnC,EAAAA,QAAAA,CAAQoC,EAAK,CAAE,cAAe,EAAK,CAAC,CACxD,MAAQ,CACJ,OAAOF,CACX,CACA,IAAK,IAAMG,KAASF,EAChB,GAAIE,EAAM,YAAY,EAAG,CACrB,GAAIC,EAAK,IAAID,EAAM,IAAI,GAAKA,EAAM,KAAK,WAAW,GAAG,EAAG,SACxDH,EAAI,KAAK,GAAI,MAAMD,GAAA,EAAmBhC,EAAAA,KAAAA,CAAKmC,EAAKC,EAAM,IAAI,EAAGC,CAAI,CAAE,CACvE,MAAWD,EAAM,OAAO,GAAKvB,EAAY,KAAKuB,EAAM,IAAI,GACpDH,EAAI,MAAA,EAAKjC,EAAAA,KAAAA,CAAKmC,EAAKC,EAAM,IAAI,CAAC,EAGtC,OAAOH,CACX,CAgCA,SAAgBK,EAAa,EAA+B,CAAC,EAAsB,CAC/E,GAAM,CAAE,MAAM,MAAO,UAAU,CAAC,EAAG,YAAaC,EAC1CnB,EAAQ,IAAI,IAAYnB,EAAAA,SAAS,EACjCoC,EAAO,IAAI,IAAYG,GAAY1B,CAAS,EAC5CS,EAAQ,IAAI,IAAYkB,EAAQ,OAAQ,GAASrB,EAAM,IAAIK,CAAI,CAAC,CAAC,EACnEiB,EAAO,QAAQ,IAAI,EAWjBC,EAAS,SAA2B,CACtC,IAAMC,EAAQ,MAAMZ,GAAA,EAAmB9B,EAAAA,QAAAA,CAAQwC,EAAMP,CAAG,EAAGE,CAAI,EAC/D,IAAK,IAAMQ,KAAQD,EACf,GAAI,CACA,IAAMzB,EAAO,MAAA,EAAMhB,EAAAA,SAAAA,CAAS0C,EAAM,MAAM,EACxC,IAAK,IAAMpB,KAAQV,EAAcI,EAAMC,CAAK,EAAGG,EAAM,IAAIE,CAAI,CACjE,MAAQ,CAER,CAER,EAEA,MAAO,CACH,KAAM,gBACN,QAAS,MAET,eAAe,EAA2B,CACtC,EAAOqB,EAAO,MAAQJ,CAC1B,EAEA,MAAM,YAAa,CACf,MAAMC,EAAO,CACjB,EASA,UAAU,EAAY,CAClB,OAAOI,IAAA,mCAA2BA,IAAA,wBAAkCpC,EAAc,IACtF,EAEA,KAAK,EAAY,CACb,OAAOoC,IAAOpC,EAAcU,EAAiB,CAAC,GAAGE,CAAK,EAAGnB,EAAAA,WAAW,EAAI,IAC5E,EAUA,MAAM,gBAAgB,EAIa,CAC/B,GAAI,CAACS,EAAY,KAAKmC,EAAI,IAAI,EAAG,OACjC,IAAMC,EAAS1B,EAAM,KACrB,IAAK,IAAME,KAAQV,EAAc,MAAMiC,EAAI,KAAK,EAAG5B,CAAK,EAAGG,EAAM,IAAIE,CAAI,EACzE,GAAIF,EAAM,OAAS0B,EAAQ,OAC3B,IAAMC,EAAMF,EAAI,OAAO,YAAY,cAAcrC,CAAW,EAC5D,OAAOuC,EAAM,CAACA,CAAG,EAAI,IAAA,EACzB,CACJ,CACJ,C"}

package/dist/vite/tempest-icons.js.map

@@ -1 +1 @@
-{"version":3,"file":"tempest-icons.js","names":[],"sources":["../../src/vite/tempest-icons.ts"],"sourcesContent":["import { readdir, readFile } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\n\nimport { iconAliases } from \"@/icons/generated/aliases\";\nimport { iconNames } from \"@/icons/generated/icon-names\";\n\nimport type { TempestVitePlugin } from \"./tempest-pwa-manifest\";\n\n/** The module id an app imports to get its static registry. */\nexport const TEMPEST_ICONS_ID = \"tempest-react-sdk/icons/virtual\";\n\n/**\n * The original virtual id, still honoured.\n *\n * Published as the documented import before the subpath existed, so apps have it\n * written in their entrypoints. It resolves to the same generated module — but it\n * only ever resolves *with the plugin*, which is the reason the subpath above\n * replaced it: that one also resolves without it, to an empty stub.\n */\nexport const TEMPEST_ICONS_VIRTUAL_ID = \"virtual:tempest-icons\";\n\nconst RESOLVED_ID = `\\0${TEMPEST_ICONS_VIRTUAL_ID}`;\n\n/**\n * Slugs written as a literal `name` prop or a literal `name:` field.\n *\n * Matching the *attribute* rather than any kebab-case string is what keeps the\n * scan from sweeping in unrelated text — a CSS class, a translation key and a\n * route segment all look like slugs otherwise. Everything matched is still\n * validated against lucide's real slug list before it reaches the module.\n */\nconst NAME_PATTERNS = [\n    /\\bname\\s*=\\s*[\"']([a-z0-9-]+)[\"']/g,\n    /\\bname\\s*=\\s*\\{\\s*[\"']([a-z0-9-]+)[\"']\\s*\\}/g,\n    /\\bname\\s*:\\s*[\"']([a-z0-9-]+)[\"']/g,\n];\n\nconst SOURCE_FILE = /\\.[cm]?[jt]sx?$/;\nconst SKIP_DIRS = new Set([\"node_modules\", \"dist\", \"build\", \"coverage\"]);\n\nexport interface TempestIconsOptions {\n    /**\n     * Directory to scan, relative to the Vite root. Default: `\"src\"`.\n     */\n    dir?: string;\n    /**\n     * Extra slugs to include even when the scan cannot see them — a name built by\n     * concatenation, or one that only ever arrives from the API but is worth\n     * paying for statically because it is on the first screen.\n     */\n    include?: readonly string[];\n    /** Directory names to skip. Default: `node_modules`, `dist`, `build`, `coverage`. */\n    skipDirs?: readonly string[];\n}\n\n/**\n * Collect the icon slugs a source file references literally.\n *\n * @param code - File contents.\n * @param known - The set of real lucide slugs, aliases included.\n * @returns The slugs found, validated against `known`.\n */\nexport function scanIconSlugs(code: string, known: ReadonlySet<string>): string[] {\n    const found = new Set<string>();\n    for (const pattern of NAME_PATTERNS) {\n        pattern.lastIndex = 0;\n        let match: RegExpExecArray | null;\n        while ((match = pattern.exec(code)) !== null) {\n            if (known.has(match[1])) found.add(match[1]);\n        }\n    }\n    return [...found];\n}\n\n/**\n * Build the virtual module source for a set of slugs.\n *\n * Aliases resolve to their canonical slug before importing, because only the\n * canonical name is a real lucide export — but the alias key still points at the\n * component, so `<Icon name=\"alert-circle\" />` stays a zero-request lookup.\n *\n * @param slugs - Validated slugs to include.\n * @param aliases - Alias slug → canonical slug.\n * @returns ES module source.\n */\nexport function buildIconsModule(\n    slugs: readonly string[],\n    aliases: Record<string, string>,\n): string {\n    const sorted = [...new Set(slugs)].sort();\n    if (!sorted.length) return \"export const staticIcons = {};\\n\";\n\n    const componentOf = new Map<string, string>();\n    for (const slug of sorted) componentOf.set(slug, pascalCase(aliases[slug] ?? slug));\n\n    const named = [...new Set(componentOf.values())]\n        .sort()\n        .map((name) => (localName(name) === name ? name : `${name} as ${localName(name)}`))\n        .join(\", \");\n    const entries = sorted\n        .map((slug) => `    \"${slug}\": ${localName(componentOf.get(slug) as string)},`)\n        .join(\"\\n\");\n    return `import { ${named} } from \"lucide-react\";\n\nexport const staticIcons = {\n${entries}\n};\n`;\n}\n\n/** `circle-alert` → `CircleAlert`; `a-arrow-down` → `AArrowDown`. */\nfunction pascalCase(slug: string): string {\n    return slug\n        .split(\"-\")\n        .map((part) => part.charAt(0).toUpperCase() + part.slice(1))\n        .join(\"\");\n}\n\n/**\n * Export names that would shadow a restricted global if bound directly.\n *\n * Lucide ships an icon literally called `infinity`, whose export is `Infinity`.\n * Binding that at module scope shadows the global, so the import is aliased.\n */\nconst RESERVED_NAMES = new Set([\"Infinity\", \"NaN\", \"undefined\", \"eval\", \"arguments\"]);\n\n/** The local binding to use for a lucide export name. */\nfunction localName(name: string): string {\n    return RESERVED_NAMES.has(name) ? `${name}Icon` : name;\n}\n\n/**\n * Walk a directory and collect every source file path.\n *\n * @param dir - Absolute directory to walk.\n * @param skip - Directory names to skip.\n * @returns Absolute file paths.\n */\nasync function collectSourceFiles(dir: string, skip: ReadonlySet<string>): Promise<string[]> {\n    const out: string[] = [];\n    let entries;\n    try {\n        entries = await readdir(dir, { withFileTypes: true });\n    } catch {\n        return out;\n    }\n    for (const entry of entries) {\n        if (entry.isDirectory()) {\n            if (skip.has(entry.name) || entry.name.startsWith(\".\")) continue;\n            out.push(...(await collectSourceFiles(join(dir, entry.name), skip)));\n        } else if (entry.isFile() && SOURCE_FILE.test(entry.name)) {\n            out.push(join(dir, entry.name));\n        }\n    }\n    return out;\n}\n\n/**\n * Generate a static icon registry from the slugs your source mentions.\n *\n * Removes the reason to reach for `lucide-react`'s `DynamicIcon`: the slugs an app\n * writes as literals become ordinary static imports, so the bundler keeps exactly\n * those icons and the browser makes **no** extra request for them. A slug that only\n * exists at runtime still works — `<Icon>` falls back to fetching one shard per\n * initial letter.\n *\n * The scan reads the source tree directly at `buildStart` rather than harvesting\n * modules as they pass through `transform`: relying on transform order would let\n * the virtual module load before every consumer had been seen, and the registry\n * would come out short on a cold dev start — silently, since the missing slugs\n * would still render via the lazy path.\n *\n * @example\n * // vite.config.ts\n * import { createViteConfig, tempestIcons } from \"tempest-react-sdk/vite\";\n *\n * export default createViteConfig({ plugins: [tempestIcons()] });\n *\n * @example\n * // src/main.tsx\n * import { IconProvider } from \"tempest-react-sdk/icons\";\n * import { staticIcons } from \"tempest-react-sdk/icons/virtual\";\n *\n * <IconProvider registry={staticIcons}>\n *     <App />\n * </IconProvider>\n */\nexport function tempestIcons(options: TempestIconsOptions = {}): TempestVitePlugin {\n    const { dir = \"src\", include = [], skipDirs } = options;\n    const known = new Set<string>(iconNames);\n    const skip = new Set<string>(skipDirs ?? SKIP_DIRS);\n    const slugs = new Set<string>(include.filter((slug) => known.has(slug)));\n    let root = process.cwd();\n\n    /**\n     * Rescan the source tree, keeping the explicitly included slugs.\n     *\n     * @tempest-limits empty-catch — the scan races the editor and the file system:\n     * a file listed a moment ago can be renamed, deleted, or held by another process\n     * by the time it is read. An unreadable file contributes no slugs and the build\n     * continues; failing the whole scan would break `vite dev` over a temp file that\n     * no longer exists.\n     */\n    const rescan = async (): Promise<void> => {\n        const files = await collectSourceFiles(resolve(root, dir), skip);\n        for (const file of files) {\n            try {\n                const code = await readFile(file, \"utf8\");\n                for (const slug of scanIconSlugs(code, known)) slugs.add(slug);\n            } catch {\n                /* empty */\n            }\n        }\n    };\n\n    return {\n        name: \"tempest-icons\",\n        enforce: \"pre\",\n\n        configResolved(config: { root?: string }) {\n            root = config.root ?? root;\n        },\n\n        async buildStart() {\n            await rescan();\n        },\n\n        /**\n         * Claim both spellings of the registry module.\n         *\n         * The subpath is a real file in the installed package, so returning the\n         * virtual id here is what overrides the empty stub with the generated\n         * table. Letting Vite resolve it normally would silently ship the stub.\n         */\n        resolveId(id: string) {\n            return id === TEMPEST_ICONS_ID || id === TEMPEST_ICONS_VIRTUAL_ID ? RESOLVED_ID : null;\n        },\n\n        load(id: string) {\n            return id === RESOLVED_ID ? buildIconsModule([...slugs], iconAliases) : null;\n        },\n\n        /**\n         * Pick up a slug added while the dev server is running.\n         *\n         * A newly written `<Icon name=\"save\" />` would otherwise only render via\n         * the lazy path until the next restart. Rescanning the changed file and\n         * invalidating the virtual module keeps dev and build agreeing on what the\n         * static registry contains.\n         */\n        async handleHotUpdate(ctx: {\n            file: string;\n            read: () => Promise<string>;\n            server: { moduleGraph: { getModuleById: (id: string) => unknown } };\n        }): Promise<unknown[] | undefined> {\n            if (!SOURCE_FILE.test(ctx.file)) return undefined;\n            const before = slugs.size;\n            for (const slug of scanIconSlugs(await ctx.read(), known)) slugs.add(slug);\n            if (slugs.size === before) return undefined;\n            const mod = ctx.server.moduleGraph.getModuleById(RESOLVED_ID);\n            return mod ? [mod] : undefined;\n        },\n    } as TempestVitePlugin;\n}\n"],"mappings":";;;;;AASA,IAAa,IAAmB,mCAUnB,IAA2B,yBAElC,IAAc,KAAK,KAUnB,IAAgB;CAClB;CACA;CACA;AACJ,GAEM,IAAc,mBACd,oBAAY,IAAI,IAAI;CAAC;CAAgB;CAAQ;CAAS;AAAU,CAAC;AAwBvE,SAAgB,EAAc,GAAc,GAAsC;CAC9E,IAAM,oBAAQ,IAAI,IAAY;CAC9B,KAAK,IAAM,KAAW,GAAe;EACjC,EAAQ,YAAY;EACpB,IAAI;EACJ,QAAQ,IAAQ,EAAQ,KAAK,CAAI,OAAO,OACpC,AAAI,EAAM,IAAI,EAAM,EAAE,KAAG,EAAM,IAAI,EAAM,EAAE;CAEnD;CACA,OAAO,CAAC,GAAG,CAAK;AACpB;AAaA,SAAgB,EACZ,GACA,GACM;CACN,IAAM,IAAS,CAAC,GAAG,IAAI,IAAI,CAAK,CAAC,CAAC,CAAC,KAAK;CACxC,IAAI,CAAC,EAAO,QAAQ,OAAO;CAE3B,IAAM,oBAAc,IAAI,IAAoB;CAC5C,KAAK,IAAM,KAAQ,GAAQ,EAAY,IAAI,GAAM,EAAW,EAAQ,MAAS,CAAI,CAAC;CASlF,OAAO,YAPO,CAAC,GAAG,IAAI,IAAI,EAAY,OAAO,CAAC,CAAC,CAAC,CAC3C,KAAK,CAAC,CACN,KAAK,MAAU,EAAU,CAAI,MAAM,IAAO,IAAO,GAAG,EAAK,MAAM,EAAU,CAAI,GAAI,CAAC,CAClF,KAAK,IAIS,EAAM;;;EAHT,EACX,KAAK,MAAS,QAAQ,EAAK,KAAK,EAAU,EAAY,IAAI,CAAI,CAAW,EAAE,EAAE,CAAC,CAC9E,KAAK,IAIZ,EAAQ;;;AAGV;AAGA,SAAS,EAAW,GAAsB;CACtC,OAAO,EACF,MAAM,GAAG,CAAC,CACV,KAAK,MAAS,EAAK,OAAO,CAAC,CAAC,CAAC,YAAY,IAAI,EAAK,MAAM,CAAC,CAAC,CAAC,CAC3D,KAAK,EAAE;AAChB;AAQA,IAAM,oBAAiB,IAAI,IAAI;CAAC;CAAY;CAAO;CAAa;CAAQ;AAAW,CAAC;AAGpF,SAAS,EAAU,GAAsB;CACrC,OAAO,EAAe,IAAI,CAAI,IAAI,GAAG,EAAK,QAAQ;AACtD;AASA,eAAe,EAAmB,GAAa,GAA8C;CACzF,IAAM,IAAgB,CAAC,GACnB;CACJ,IAAI;EACA,IAAU,MAAM,EAAQ,GAAK,EAAE,eAAe,GAAK,CAAC;CACxD,QAAQ;EACJ,OAAO;CACX;CACA,KAAK,IAAM,KAAS,GAChB,IAAI,EAAM,YAAY,GAAG;EACrB,IAAI,EAAK,IAAI,EAAM,IAAI,KAAK,EAAM,KAAK,WAAW,GAAG,GAAG;EACxD,EAAI,KAAK,GAAI,MAAM,EAAmB,EAAK,GAAK,EAAM,IAAI,GAAG,CAAI,CAAE;CACvE,OAAO,AAAI,EAAM,OAAO,KAAK,EAAY,KAAK,EAAM,IAAI,KACpD,EAAI,KAAK,EAAK,GAAK,EAAM,IAAI,CAAC;CAGtC,OAAO;AACX;AAgCA,SAAgB,EAAa,IAA+B,CAAC,GAAsB;CAC/E,IAAM,EAAE,SAAM,OAAO,aAAU,CAAC,GAAG,gBAAa,GAC1C,IAAQ,IAAI,IAAY,CAAS,GACjC,IAAO,IAAI,IAAY,KAAY,CAAS,GAC5C,IAAQ,IAAI,IAAY,EAAQ,QAAQ,MAAS,EAAM,IAAI,CAAI,CAAC,CAAC,GACnE,IAAO,QAAQ,IAAI,GAWjB,IAAS,YAA2B;EACtC,IAAM,IAAQ,MAAM,EAAmB,EAAQ,GAAM,CAAG,GAAG,CAAI;EAC/D,KAAK,IAAM,KAAQ,GACf,IAAI;GACA,IAAM,IAAO,MAAM,EAAS,GAAM,MAAM;GACxC,KAAK,IAAM,KAAQ,EAAc,GAAM,CAAK,GAAG,EAAM,IAAI,CAAI;EACjE,QAAQ,CAER;CAER;CAEA,OAAO;EACH,MAAM;EACN,SAAS;EAET,eAAe,GAA2B;GACtC,IAAO,EAAO,QAAQ;EAC1B;EAEA,MAAM,aAAa;GACf,MAAM,EAAO;EACjB;EASA,UAAU,GAAY;GAClB,OAAO,MAAA,qCAA2B,MAAA,0BAAkC,IAAc;EACtF;EAEA,KAAK,GAAY;GACb,OAAO,MAAO,IAAc,EAAiB,CAAC,GAAG,CAAK,GAAG,CAAW,IAAI;EAC5E;EAUA,MAAM,gBAAgB,GAIa;GAC/B,IAAI,CAAC,EAAY,KAAK,EAAI,IAAI,GAAG;GACjC,IAAM,IAAS,EAAM;GACrB,KAAK,IAAM,KAAQ,EAAc,MAAM,EAAI,KAAK,GAAG,CAAK,GAAG,EAAM,IAAI,CAAI;GACzE,IAAI,EAAM,SAAS,GAAQ;GAC3B,IAAM,IAAM,EAAI,OAAO,YAAY,cAAc,CAAW;GAC5D,OAAO,IAAM,CAAC,CAAG,IAAI,KAAA;EACzB;CACJ;AACJ"}
+{"version":3,"file":"tempest-icons.js","names":["TEMPEST_ICONS_ID","TEMPEST_ICONS_VIRTUAL_ID","RESOLVED_ID","NAME_PATTERNS","SOURCE_FILE","SKIP_DIRS","scanIconSlugs","found","pattern","match","code","known","buildIconsModule","sorted","slugs","componentOf","slug","pascalCase","aliases","localName","name","part","RESERVED_NAMES","collectSourceFiles","out","entries","readdir","dir","entry","skip","join","tempestIcons","options","iconNames","skipDirs","include","root","rescan","files","resolve","file","readFile","config","id","iconAliases","ctx","before","mod"],"sources":["../../src/vite/tempest-icons.ts"],"sourcesContent":["import { readdir, readFile } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\n\nimport { iconAliases } from \"@/icons/generated/aliases\";\nimport { iconNames } from \"@/icons/generated/icon-names\";\n\nimport type { TempestVitePlugin } from \"./tempest-pwa-manifest\";\n\n/** The module id an app imports to get its static registry. */\nexport const TEMPEST_ICONS_ID = \"tempest-react-sdk/icons/virtual\";\n\n/**\n * The original virtual id, still honoured.\n *\n * Published as the documented import before the subpath existed, so apps have it\n * written in their entrypoints. It resolves to the same generated module — but it\n * only ever resolves *with the plugin*, which is the reason the subpath above\n * replaced it: that one also resolves without it, to an empty stub.\n */\nexport const TEMPEST_ICONS_VIRTUAL_ID = \"virtual:tempest-icons\";\n\nconst RESOLVED_ID = `\\0${TEMPEST_ICONS_VIRTUAL_ID}`;\n\n/**\n * Slugs written as a literal `name` prop or a literal `name:` field.\n *\n * Matching the *attribute* rather than any kebab-case string is what keeps the\n * scan from sweeping in unrelated text — a CSS class, a translation key and a\n * route segment all look like slugs otherwise. Everything matched is still\n * validated against lucide's real slug list before it reaches the module.\n */\nconst NAME_PATTERNS = [\n    /\\bname\\s*=\\s*[\"']([a-z0-9-]+)[\"']/g,\n    /\\bname\\s*=\\s*\\{\\s*[\"']([a-z0-9-]+)[\"']\\s*\\}/g,\n    /\\bname\\s*:\\s*[\"']([a-z0-9-]+)[\"']/g,\n];\n\nconst SOURCE_FILE = /\\.[cm]?[jt]sx?$/;\nconst SKIP_DIRS = new Set([\"node_modules\", \"dist\", \"build\", \"coverage\"]);\n\nexport interface TempestIconsOptions {\n    /**\n     * Directory to scan, relative to the Vite root. Default: `\"src\"`.\n     */\n    dir?: string;\n    /**\n     * Extra slugs to include even when the scan cannot see them — a name built by\n     * concatenation, or one that only ever arrives from the API but is worth\n     * paying for statically because it is on the first screen.\n     */\n    include?: readonly string[];\n    /** Directory names to skip. Default: `node_modules`, `dist`, `build`, `coverage`. */\n    skipDirs?: readonly string[];\n}\n\n/**\n * Collect the icon slugs a source file references literally.\n *\n * @param code - File contents.\n * @param known - The set of real lucide slugs, aliases included.\n * @returns The slugs found, validated against `known`.\n */\nexport function scanIconSlugs(code: string, known: ReadonlySet<string>): string[] {\n    const found = new Set<string>();\n    for (const pattern of NAME_PATTERNS) {\n        pattern.lastIndex = 0;\n        let match: RegExpExecArray | null;\n        while ((match = pattern.exec(code)) !== null) {\n            if (known.has(match[1])) found.add(match[1]);\n        }\n    }\n    return [...found];\n}\n\n/**\n * Build the virtual module source for a set of slugs.\n *\n * Aliases resolve to their canonical slug before importing, because only the\n * canonical name is a real lucide export — but the alias key still points at the\n * component, so `<Icon name=\"alert-circle\" />` stays a zero-request lookup.\n *\n * @param slugs - Validated slugs to include.\n * @param aliases - Alias slug → canonical slug.\n * @returns ES module source.\n */\nexport function buildIconsModule(\n    slugs: readonly string[],\n    aliases: Record<string, string>,\n): string {\n    const sorted = [...new Set(slugs)].sort();\n    if (!sorted.length) return \"export const staticIcons = {};\\n\";\n\n    const componentOf = new Map<string, string>();\n    for (const slug of sorted) componentOf.set(slug, pascalCase(aliases[slug] ?? slug));\n\n    const named = [...new Set(componentOf.values())]\n        .sort()\n        .map((name) => (localName(name) === name ? name : `${name} as ${localName(name)}`))\n        .join(\", \");\n    const entries = sorted\n        .map((slug) => `    \"${slug}\": ${localName(componentOf.get(slug) as string)},`)\n        .join(\"\\n\");\n    return `import { ${named} } from \"lucide-react\";\n\nexport const staticIcons = {\n${entries}\n};\n`;\n}\n\n/** `circle-alert` → `CircleAlert`; `a-arrow-down` → `AArrowDown`. */\nfunction pascalCase(slug: string): string {\n    return slug\n        .split(\"-\")\n        .map((part) => part.charAt(0).toUpperCase() + part.slice(1))\n        .join(\"\");\n}\n\n/**\n * Export names that would shadow a restricted global if bound directly.\n *\n * Lucide ships an icon literally called `infinity`, whose export is `Infinity`.\n * Binding that at module scope shadows the global, so the import is aliased.\n */\nconst RESERVED_NAMES = new Set([\"Infinity\", \"NaN\", \"undefined\", \"eval\", \"arguments\"]);\n\n/** The local binding to use for a lucide export name. */\nfunction localName(name: string): string {\n    return RESERVED_NAMES.has(name) ? `${name}Icon` : name;\n}\n\n/**\n * Walk a directory and collect every source file path.\n *\n * @param dir - Absolute directory to walk.\n * @param skip - Directory names to skip.\n * @returns Absolute file paths.\n */\nasync function collectSourceFiles(dir: string, skip: ReadonlySet<string>): Promise<string[]> {\n    const out: string[] = [];\n    let entries;\n    try {\n        entries = await readdir(dir, { withFileTypes: true });\n    } catch {\n        return out;\n    }\n    for (const entry of entries) {\n        if (entry.isDirectory()) {\n            if (skip.has(entry.name) || entry.name.startsWith(\".\")) continue;\n            out.push(...(await collectSourceFiles(join(dir, entry.name), skip)));\n        } else if (entry.isFile() && SOURCE_FILE.test(entry.name)) {\n            out.push(join(dir, entry.name));\n        }\n    }\n    return out;\n}\n\n/**\n * Generate a static icon registry from the slugs your source mentions.\n *\n * Removes the reason to reach for `lucide-react`'s `DynamicIcon`: the slugs an app\n * writes as literals become ordinary static imports, so the bundler keeps exactly\n * those icons and the browser makes **no** extra request for them. A slug that only\n * exists at runtime still works — `<Icon>` falls back to fetching one shard per\n * initial letter.\n *\n * The scan reads the source tree directly at `buildStart` rather than harvesting\n * modules as they pass through `transform`: relying on transform order would let\n * the virtual module load before every consumer had been seen, and the registry\n * would come out short on a cold dev start — silently, since the missing slugs\n * would still render via the lazy path.\n *\n * @example\n * // vite.config.ts\n * import { createViteConfig, tempestIcons } from \"tempest-react-sdk/vite\";\n *\n * export default createViteConfig({ plugins: [tempestIcons()] });\n *\n * @example\n * // src/main.tsx\n * import { IconProvider } from \"tempest-react-sdk/icons\";\n * import { staticIcons } from \"tempest-react-sdk/icons/virtual\";\n *\n * <IconProvider registry={staticIcons}>\n *     <App />\n * </IconProvider>\n */\nexport function tempestIcons(options: TempestIconsOptions = {}): TempestVitePlugin {\n    const { dir = \"src\", include = [], skipDirs } = options;\n    const known = new Set<string>(iconNames);\n    const skip = new Set<string>(skipDirs ?? SKIP_DIRS);\n    const slugs = new Set<string>(include.filter((slug) => known.has(slug)));\n    let root = process.cwd();\n\n    /**\n     * Rescan the source tree, keeping the explicitly included slugs.\n     *\n     * @tempest-limits empty-catch — the scan races the editor and the file system:\n     * a file listed a moment ago can be renamed, deleted, or held by another process\n     * by the time it is read. An unreadable file contributes no slugs and the build\n     * continues; failing the whole scan would break `vite dev` over a temp file that\n     * no longer exists.\n     */\n    const rescan = async (): Promise<void> => {\n        const files = await collectSourceFiles(resolve(root, dir), skip);\n        for (const file of files) {\n            try {\n                const code = await readFile(file, \"utf8\");\n                for (const slug of scanIconSlugs(code, known)) slugs.add(slug);\n            } catch {\n                /* empty */\n            }\n        }\n    };\n\n    return {\n        name: \"tempest-icons\",\n        enforce: \"pre\",\n\n        configResolved(config: { root?: string }) {\n            root = config.root ?? root;\n        },\n\n        async buildStart() {\n            await rescan();\n        },\n\n        /**\n         * Claim both spellings of the registry module.\n         *\n         * The subpath is a real file in the installed package, so returning the\n         * virtual id here is what overrides the empty stub with the generated\n         * table. Letting Vite resolve it normally would silently ship the stub.\n         */\n        resolveId(id: string) {\n            return id === TEMPEST_ICONS_ID || id === TEMPEST_ICONS_VIRTUAL_ID ? RESOLVED_ID : null;\n        },\n\n        load(id: string) {\n            return id === RESOLVED_ID ? buildIconsModule([...slugs], iconAliases) : null;\n        },\n\n        /**\n         * Pick up a slug added while the dev server is running.\n         *\n         * A newly written `<Icon name=\"save\" />` would otherwise only render via\n         * the lazy path until the next restart. Rescanning the changed file and\n         * invalidating the virtual module keeps dev and build agreeing on what the\n         * static registry contains.\n         */\n        async handleHotUpdate(ctx: {\n            file: string;\n            read: () => Promise<string>;\n            server: { moduleGraph: { getModuleById: (id: string) => unknown } };\n        }): Promise<unknown[] | undefined> {\n            if (!SOURCE_FILE.test(ctx.file)) return undefined;\n            const before = slugs.size;\n            for (const slug of scanIconSlugs(await ctx.read(), known)) slugs.add(slug);\n            if (slugs.size === before) return undefined;\n            const mod = ctx.server.moduleGraph.getModuleById(RESOLVED_ID);\n            return mod ? [mod] : undefined;\n        },\n    } as TempestVitePlugin;\n}\n"],"mappings":";;;;;AASA,IAAaA,IAAmB,mCAUnBC,IAA2B,yBAElCC,IAAc,KAAKD,KAUnBE,IAAgB;CAClB;CACA;CACA;AACJ,GAEMC,IAAc,mBACdC,oBAAY,IAAI,IAAI;CAAC;CAAgB;CAAQ;CAAS;AAAU,CAAC;AAwBvE,SAAgBC,EAAc,GAAc,GAAsC;CAC9E,IAAMC,oBAAQ,IAAI,IAAY;CAC9B,KAAK,IAAMC,KAAWL,GAAe;EACjC,EAAQ,YAAY;EACpB,IAAIM;EACJ,QAAQ,IAAQD,EAAQ,KAAKE,CAAI,OAAO,OACpC,AAAIC,EAAM,IAAIF,EAAM,EAAE,KAAGF,EAAM,IAAIE,EAAM,EAAE;CAEnD;CACA,OAAO,CAAC,GAAGF,CAAK;AACpB;AAaA,SAAgBK,EACZ,GACA,GACM;CACN,IAAMC,IAAS,CAAC,GAAG,IAAI,IAAIC,CAAK,CAAC,CAAC,CAAC,KAAK;CACxC,IAAI,CAACD,EAAO,QAAQ,OAAO;CAE3B,IAAME,oBAAc,IAAI,IAAoB;CAC5C,KAAK,IAAMC,KAAQH,GAAQ,EAAY,IAAIG,GAAMC,EAAWC,EAAQF,MAASA,CAAI,CAAC;CASlF,OAAO,YAPO,CAAC,GAAG,IAAI,IAAID,EAAY,OAAO,CAAC,CAAC,CAAC,CAC3C,KAAK,CAAC,CACN,KAAK,MAAUI,EAAUC,CAAI,MAAMA,IAAOA,IAAO,GAAGA,EAAK,MAAMD,EAAUC,CAAI,GAAI,CAAC,CAClF,KAAK,IAIS,EAAM;;;EAHTP,EACX,KAAK,MAAS,QAAQG,EAAK,KAAKG,EAAUJ,EAAY,IAAIC,CAAI,CAAW,EAAE,EAAE,CAAC,CAC9E,KAAK,IAIZ,EAAQ;;;AAGV;AAGA,SAASC,EAAW,GAAsB;CACtC,OAAOD,EACF,MAAM,GAAG,CAAC,CACV,KAAK,MAASK,EAAK,OAAO,CAAC,CAAC,CAAC,YAAY,IAAIA,EAAK,MAAM,CAAC,CAAC,CAAC,CAC3D,KAAK,EAAE;AAChB;AAQA,IAAMC,oBAAiB,IAAI,IAAI;CAAC;CAAY;CAAO;CAAa;CAAQ;AAAW,CAAC;AAGpF,SAASH,EAAU,GAAsB;CACrC,OAAOG,EAAe,IAAIF,CAAI,IAAI,GAAGA,EAAK,QAAQA;AACtD;AASA,eAAeG,EAAmB,GAAa,GAA8C;CACzF,IAAMC,IAAgB,CAAC,GACnBC;CACJ,IAAI;EACA,IAAU,MAAMC,EAAQC,GAAK,EAAE,eAAe,GAAK,CAAC;CACxD,QAAQ;EACJ,OAAOH;CACX;CACA,KAAK,IAAMI,KAASH,GAChB,IAAIG,EAAM,YAAY,GAAG;EACrB,IAAIC,EAAK,IAAID,EAAM,IAAI,KAAKA,EAAM,KAAK,WAAW,GAAG,GAAG;EACxD,EAAI,KAAK,GAAI,MAAML,EAAmBO,EAAKH,GAAKC,EAAM,IAAI,GAAGC,CAAI,CAAE;CACvE,OAAO,AAAID,EAAM,OAAO,KAAKxB,EAAY,KAAKwB,EAAM,IAAI,KACpDJ,EAAI,KAAKM,EAAKH,GAAKC,EAAM,IAAI,CAAC;CAGtC,OAAOJ;AACX;AAgCA,SAAgBO,EAAa,IAA+B,CAAC,GAAsB;CAC/E,IAAM,EAAE,SAAM,OAAO,aAAU,CAAC,GAAG,gBAAaC,GAC1CrB,IAAQ,IAAI,IAAYsB,CAAS,GACjCJ,IAAO,IAAI,IAAYK,KAAY7B,CAAS,GAC5CS,IAAQ,IAAI,IAAYqB,EAAQ,QAAQ,MAASxB,EAAM,IAAIK,CAAI,CAAC,CAAC,GACnEoB,IAAO,QAAQ,IAAI,GAWjBC,IAAS,YAA2B;EACtC,IAAMC,IAAQ,MAAMf,EAAmBgB,EAAQH,GAAMT,CAAG,GAAGE,CAAI;EAC/D,KAAK,IAAMW,KAAQF,GACf,IAAI;GACA,IAAM5B,IAAO,MAAM+B,EAASD,GAAM,MAAM;GACxC,KAAK,IAAMxB,KAAQV,EAAcI,GAAMC,CAAK,GAAG,EAAM,IAAIK,CAAI;EACjE,QAAQ,CAER;CAER;CAEA,OAAO;EACH,MAAM;EACN,SAAS;EAET,eAAe,GAA2B;GACtC,IAAO0B,EAAO,QAAQN;EAC1B;EAEA,MAAM,aAAa;GACf,MAAMC,EAAO;EACjB;EASA,UAAU,GAAY;GAClB,OAAOM,MAAA,qCAA2BA,MAAA,0BAAkCzC,IAAc;EACtF;EAEA,KAAK,GAAY;GACb,OAAOyC,MAAOzC,IAAcU,EAAiB,CAAC,GAAGE,CAAK,GAAG8B,CAAW,IAAI;EAC5E;EAUA,MAAM,gBAAgB,GAIa;GAC/B,IAAI,CAACxC,EAAY,KAAKyC,EAAI,IAAI,GAAG;GACjC,IAAMC,IAAShC,EAAM;GACrB,KAAK,IAAME,KAAQV,EAAc,MAAMuC,EAAI,KAAK,GAAGlC,CAAK,GAAG,EAAM,IAAIK,CAAI;GACzE,IAAIF,EAAM,SAASgC,GAAQ;GAC3B,IAAMC,IAAMF,EAAI,OAAO,YAAY,cAAc3C,CAAW;GAC5D,OAAO6C,IAAM,CAACA,CAAG,IAAI,KAAA;EACzB;CACJ;AACJ"}