@corbet-labs/cink 0.1.1 → 0.1.3

package/LICENSES/FSL-1.1-ALv2.txt

@@ -0,0 +1,105 @@
+# Functional Source License, Version 1.1, ALv2 Future License
+
+## Abbreviation
+
+FSL-1.1-ALv2
+
+## Notice
+
+Copyright 2026 Julian Y. Richard Corbet
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to
+use, copy, modify, create derivative works, publicly perform, publicly display
+and redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+means making the Software available to others in a commercial product or
+service that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software
+   that exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee
+   using the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to
+the infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of
+the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software,
+you must include a copy of or a link to these Terms and Conditions and not
+remove any copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
+PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+
+IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
+EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Trademarks
+
+Except for displaying the License Details and identifying us as the origin of
+the Software, you have no right under these Terms and Conditions to use our
+trademarks, trade names, service marks or product names.
+
+## Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under
+the Apache License, Version 2.0 that is effective on the second anniversary of
+the date we make the Software available. On or after that date, you may use the
+Software under the Apache License, Version 2.0, in which case the following
+will apply:
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+this file except in compliance with the License.
+
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed
+under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.

package/README.md

@@ -1,27 +1,103 @@
-# @corbet-labs/cink
+# cink
 
-Handwritten signature image rendering for formal correspondence. Pure port
-of the [cink](https://github.com/corbet-labs/cink) Rust crate: zero
-dependencies, zero Node APIs, synchronous, no I/O. Pixels, not
-signatures — no cryptography, no identity, no legal ceremony.
+**Prepare handwritten signature images for correspondence.**
 
-```ts
-import { normalize, signatureSize, imageSnippet } from '@corbet-labs/cink';
+[![crates.io](https://img.shields.io/crates/v/cink.svg)](https://crates.io/crates/cink) [![npm](https://img.shields.io/npm/v/@corbet-labs/cink.svg)](https://www.npmjs.com/package/@corbet-labs/cink) [![Rust API](https://docs.rs/cink/badge.svg)](https://docs.rs/cink)
 
-const img = normalize(dataUrl); // null when unusable
-const [w, h] = signatureSize(img, 31.5, 120);
-const snippet = imageSnippet('/signature.png', h, w === 31.5 ? undefined : w);
+Recognize PNG, JPEG, and SVG input, inspect raster dimensions, calculate an aspect-preserving size, and generate a Typst image call. Runs without an image-decoding library.
+
+```js
+import { imageSnippet } from '@corbet-labs/cink';
+
+imageSnippet('/signature.png', 31.5);
+// #image("/signature.png", height: 31.5pt)
+```
+
+## Install
+
+| Environment | Command |
+| --- | --- |
+| Rust / Cargo | `cargo add cink` |
+| Node.js / npm | `npm install @corbet-labs/cink` |
+| pnpm | `pnpm add @corbet-labs/cink` |
+| Yarn | `yarn add @corbet-labs/cink` |
+| Bun | `bun add @corbet-labs/cink` |
+| Deno | `deno add npm:@corbet-labs/cink` |
+
+The 0.1.3 JavaScript distribution includes compiled ESM, CommonJS,
+TypeScript declarations, and a standalone browser module. Node.js 20+ is
+supported; no TypeScript loader is required.
+
+```js
+// CommonJS
+const { imageSnippet } = require('@corbet-labs/cink');
+```
+
+```html
+<script type="module">
+  import { imageSnippet } from 'https://cdn.jsdelivr.net/npm/@corbet-labs/cink@0.1.3/dist/browser.js';
+  console.log(imageSnippet('/signature.png', 31.5));
+</script>
+```
+
+Python wheels, source distributions, and CLI instructions are in the
+[installation guide](https://github.com/corbet-labs/cink/blob/main/docs/installation.md).
+JSR publication and Typst availability are listed there explicitly.
+
+## Rust
+
+```rust
+use cink::image_snippet;
+
+assert_eq!(image_snippet("/signature.png", 31.5, None), "#image(\"/signature.png\", height: 31.5pt)");
 ```
 
-PNG and JPEG dimensions are read from headers, never decoded; SVG passes
-through dimension-less. WebP, GIF, corrupt, and empty inputs are rejected.
-Oversized rasters are reported (`exceedsLimits`, `scaleToFit`), never
-silently resampled.
+## Python
+
+```python
+from cink import image_snippet
+
+assert image_snippet("/signature.png", 31.5) == '#image("/signature.png", height: 31.5pt)'
+```
+
+## API
+
+| JavaScript / Python or Rust | Purpose |
+| --- | --- |
+| `normalize` | Recognize a base64 image or data URL |
+| `exceedsLimits` / `exceeds_limits` | Check a raster pixel budget |
+| `scaleToFit` / `scale_to_fit` | Calculate a downscaling factor |
+| `signatureSize` / `signature_size` | Fit dimensions to a point size |
+| `imageSnippet` / `image_snippet` | Generate a Typst image call |
+
+Base64 input uses the standard alphabet, required padding, and canonical trailing bits; embedded whitespace is rejected.
+
+PNG and JPEG dimensions are read from headers; this is not a full raster integrity check. SVG passes through without sanitization or known dimensions. Unrecognized headers and unsupported formats return `null`/`None`. Nonpositive, nonfinite, and unrepresentable requested sizes return `null`/`None`. Resampling and placement belong to the caller. These are handwriting images, not cryptographic or electronic signatures.
+
+## Correspondence family
+
+| Library | Responsibility |
+| --- | --- |
+| [cletter](https://github.com/corbet-labs/cletter) | Compose the correspondence helpers |
+| [cgreet](https://github.com/corbet-labs/cgreet) | German salutations and titles |
+| [cfarewell](https://github.com/corbet-labs/cfarewell) | Locale-specific closings |
+| [cdate](https://github.com/corbet-labs/cdate) | Calendar-date formatting |
+| [cink](https://github.com/corbet-labs/cink) | Handwritten signature images |
+
+
+## Development
+
+Behavior is defined by [the locale tables](https://github.com/corbet-labs/cink/tree/main/tables)
+and [shared conformance vectors](https://github.com/corbet-labs/cink/tree/main/tests/vectors).
+Rust, JavaScript, and Python run the same vectors. Selected CI checks exercise
+installed JavaScript tarballs, Python wheels and command-line entrypoints, and
+Typst packages. Release validation records the actual runtime and platform;
+Linux results do not establish native Windows or macOS coverage.
+All five Rust crates forbid unsafe code in their own source.
 
-Run `bun ./scripts/conformance.mts` and `tsc --noEmit -p ./tsconfig.json`
-before pushing.
+See [the release guide](https://github.com/corbet-labs/cink/blob/main/docs/releasing.md)
+for generation, verification, and publication commands.
 
 ## License
 
-FSL-1.1-ALv2. Each published version becomes available under Apache-2.0
-two years after publication.
+FSL-1.1-ALv2. Each release becomes available under Apache-2.0 two years after publication. See [the full license](https://github.com/corbet-labs/cink/blob/main/LICENSES/FSL-1.1-ALv2.txt) for permitted use.

package/dist/browser.js

@@ -0,0 +1,195 @@
+// src/generated/tables.ts
+var DEFAULTS = { max_pixels: 1600, formats: ["png", "jpeg", "svg"] };
+
+// src/index.ts
+var defaults = DEFAULTS;
+function defaultMaxPixels() {
+  return defaults.max_pixels;
+}
+function supportedFormats() {
+  return [...defaults.formats].sort();
+}
+var PNG_MAGIC = [137, 80, 78, 71, 13, 10, 26, 10];
+function pngDimensions(bytes) {
+  if (bytes.length < 33)
+    return null;
+  for (let i = 0;i < 8; i++)
+    if (bytes[i] !== PNG_MAGIC[i])
+      return null;
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  if (view.getUint32(8) !== 13)
+    return null;
+  if (view.getUint32(12) !== 1229472850)
+    return null;
+  const width = view.getUint32(16);
+  const height = view.getUint32(20);
+  if (width === 0 || height === 0 || width > 2147483647 || height > 2147483647)
+    return null;
+  const depth = bytes[24];
+  const color = bytes[25];
+  const validDepth = color === 0 ? [1, 2, 4, 8, 16].includes(depth) : color === 3 ? [1, 2, 4, 8].includes(depth) : [2, 4, 6].includes(color) && [8, 16].includes(depth);
+  if (!validDepth || bytes[26] !== 0 || bytes[27] !== 0 || bytes[28] > 1)
+    return null;
+  return [width, height];
+}
+var SOF_MARKERS = new Set([
+  192,
+  193,
+  194,
+  195,
+  197,
+  198,
+  199,
+  201,
+  202,
+  203,
+  205,
+  206,
+  207
+]);
+function jpegDimensions(bytes) {
+  if (bytes.length < 2 || bytes[0] !== 255 || bytes[1] !== 216)
+    return null;
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  let pos = 2;
+  while (pos < bytes.length) {
+    if (bytes[pos] !== 255)
+      return null;
+    while (pos < bytes.length && bytes[pos] === 255)
+      pos++;
+    if (pos >= bytes.length)
+      return null;
+    const marker = bytes[pos];
+    pos++;
+    if (marker === 1)
+      continue;
+    if (marker === 0 || marker >= 208 && marker <= 218)
+      return null;
+    if (pos + 2 > bytes.length)
+      return null;
+    const len = view.getUint16(pos);
+    if (len < 2 || len > bytes.length - pos)
+      return null;
+    if (SOF_MARKERS.has(marker)) {
+      if (len < 8)
+        return null;
+      const components = bytes[pos + 7];
+      if (components === 0 || len !== 8 + 3 * components)
+        return null;
+      const height = view.getUint16(pos + 3);
+      const width = view.getUint16(pos + 5);
+      if (width === 0 || height === 0)
+        return null;
+      return [width, height];
+    }
+    pos += len;
+  }
+  return null;
+}
+function sniff(bytes) {
+  if (bytes.length >= 8 && PNG_MAGIC.every((b, i) => bytes[i] === b)) {
+    const dims = pngDimensions(bytes);
+    if (dims === null)
+      return null;
+    return { mime: "png", width: dims[0], height: dims[1], bytes };
+  }
+  if (bytes.length >= 2 && bytes[0] === 255 && bytes[1] === 216) {
+    const dims = jpegDimensions(bytes);
+    if (dims === null)
+      return null;
+    return { mime: "jpeg", width: dims[0], height: dims[1], bytes };
+  }
+  let start = 0;
+  while (start < bytes.length && [9, 10, 12, 13, 32].includes(bytes[start]))
+    start++;
+  const head = String.fromCharCode(...bytes.slice(start, start + 4));
+  if (head === "<svg")
+    return { mime: "svg", width: null, height: null, bytes };
+  return null;
+}
+function decodeBase64(payload) {
+  if (payload === "")
+    return null;
+  try {
+    const text = atob(payload);
+    if (btoa(text) !== payload)
+      return null;
+    const bytes = new Uint8Array(text.length);
+    for (let i = 0;i < text.length; i++)
+      bytes[i] = text.charCodeAt(i);
+    return bytes.length > 0 ? bytes : null;
+  } catch {
+    return null;
+  }
+}
+function normalize(input) {
+  let payload = input;
+  const comma = input.indexOf(",");
+  if (comma >= 0 && input.startsWith("data:")) {
+    const meta = input.slice(0, comma);
+    if (!meta.endsWith(";base64"))
+      return null;
+    payload = input.slice(comma + 1);
+  }
+  const bytes = decodeBase64(payload);
+  if (bytes === null)
+    return null;
+  return sniff(bytes);
+}
+function exceedsLimits(image, maxPixels) {
+  if (image.width === null || image.height === null)
+    return false;
+  return image.width * image.height > maxPixels;
+}
+function scaleToFit(image, maxPixels) {
+  if (image.width === null || image.height === null)
+    return 1;
+  const pixels = image.width * image.height;
+  if (pixels <= maxPixels)
+    return 1;
+  return Math.sqrt(maxPixels / pixels);
+}
+function signatureSize(image, heightPt, maxWidthPt) {
+  if (image.width === null || image.height === null || !Number.isInteger(image.width) || !Number.isInteger(image.height) || image.width <= 0 || image.height <= 0 || image.width > 4294967295 || image.height > 4294967295 || !Number.isFinite(heightPt) || heightPt <= 0 || maxWidthPt !== undefined && (!Number.isFinite(maxWidthPt) || maxWidthPt <= 0))
+    return null;
+  const ratio = image.width / image.height;
+  const natural = heightPt * ratio;
+  let width = natural;
+  let height = heightPt;
+  if (maxWidthPt !== undefined && natural > maxWidthPt) {
+    width = maxWidthPt;
+    height = maxWidthPt / ratio;
+  }
+  return Number.isFinite(width) && Number.isFinite(height) && width > 0 && height > 0 ? [width, height] : null;
+}
+function escapePath(path) {
+  return path.replace(/["\\\u0000-\u001f\u007f-\u009f]/g, (character) => {
+    if (character === '"')
+      return "\\\"";
+    if (character === "\\")
+      return "\\\\";
+    if (character === `
+`)
+      return "\\n";
+    if (character === "\r")
+      return "\\r";
+    if (character === "\t")
+      return "\\t";
+    return `\\u{${character.charCodeAt(0).toString(16)}}`;
+  });
+}
+function imageSnippet(path, heightPt, widthPt) {
+  const safe = escapePath(path);
+  if (widthPt === undefined)
+    return `#image("${safe}", height: ${heightPt}pt)`;
+  return `#image("${safe}", height: ${heightPt}pt, width: ${widthPt}pt)`;
+}
+export {
+  supportedFormats,
+  signatureSize,
+  scaleToFit,
+  normalize,
+  imageSnippet,
+  exceedsLimits,
+  defaultMaxPixels
+};

package/dist/index.cjs

@@ -0,0 +1,237 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toCommonJS = (from) => {
+  var entry = (__moduleCache ??= new WeakMap).get(from), desc;
+  if (entry)
+    return entry;
+  entry = __defProp({}, "__esModule", { value: true });
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (var key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(entry, key))
+        __defProp(entry, key, {
+          get: __accessProp.bind(from, key),
+          enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+        });
+  }
+  __moduleCache.set(from, entry);
+  return entry;
+};
+var __moduleCache;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+
+// src/index.ts
+var exports_src = {};
+__export(exports_src, {
+  supportedFormats: () => supportedFormats,
+  signatureSize: () => signatureSize,
+  scaleToFit: () => scaleToFit,
+  normalize: () => normalize,
+  imageSnippet: () => imageSnippet,
+  exceedsLimits: () => exceedsLimits,
+  defaultMaxPixels: () => defaultMaxPixels
+});
+module.exports = __toCommonJS(exports_src);
+
+// src/generated/tables.ts
+var DEFAULTS = { max_pixels: 1600, formats: ["png", "jpeg", "svg"] };
+
+// src/index.ts
+var defaults = DEFAULTS;
+function defaultMaxPixels() {
+  return defaults.max_pixels;
+}
+function supportedFormats() {
+  return [...defaults.formats].sort();
+}
+var PNG_MAGIC = [137, 80, 78, 71, 13, 10, 26, 10];
+function pngDimensions(bytes) {
+  if (bytes.length < 33)
+    return null;
+  for (let i = 0;i < 8; i++)
+    if (bytes[i] !== PNG_MAGIC[i])
+      return null;
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  if (view.getUint32(8) !== 13)
+    return null;
+  if (view.getUint32(12) !== 1229472850)
+    return null;
+  const width = view.getUint32(16);
+  const height = view.getUint32(20);
+  if (width === 0 || height === 0 || width > 2147483647 || height > 2147483647)
+    return null;
+  const depth = bytes[24];
+  const color = bytes[25];
+  const validDepth = color === 0 ? [1, 2, 4, 8, 16].includes(depth) : color === 3 ? [1, 2, 4, 8].includes(depth) : [2, 4, 6].includes(color) && [8, 16].includes(depth);
+  if (!validDepth || bytes[26] !== 0 || bytes[27] !== 0 || bytes[28] > 1)
+    return null;
+  return [width, height];
+}
+var SOF_MARKERS = new Set([
+  192,
+  193,
+  194,
+  195,
+  197,
+  198,
+  199,
+  201,
+  202,
+  203,
+  205,
+  206,
+  207
+]);
+function jpegDimensions(bytes) {
+  if (bytes.length < 2 || bytes[0] !== 255 || bytes[1] !== 216)
+    return null;
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  let pos = 2;
+  while (pos < bytes.length) {
+    if (bytes[pos] !== 255)
+      return null;
+    while (pos < bytes.length && bytes[pos] === 255)
+      pos++;
+    if (pos >= bytes.length)
+      return null;
+    const marker = bytes[pos];
+    pos++;
+    if (marker === 1)
+      continue;
+    if (marker === 0 || marker >= 208 && marker <= 218)
+      return null;
+    if (pos + 2 > bytes.length)
+      return null;
+    const len = view.getUint16(pos);
+    if (len < 2 || len > bytes.length - pos)
+      return null;
+    if (SOF_MARKERS.has(marker)) {
+      if (len < 8)
+        return null;
+      const components = bytes[pos + 7];
+      if (components === 0 || len !== 8 + 3 * components)
+        return null;
+      const height = view.getUint16(pos + 3);
+      const width = view.getUint16(pos + 5);
+      if (width === 0 || height === 0)
+        return null;
+      return [width, height];
+    }
+    pos += len;
+  }
+  return null;
+}
+function sniff(bytes) {
+  if (bytes.length >= 8 && PNG_MAGIC.every((b, i) => bytes[i] === b)) {
+    const dims = pngDimensions(bytes);
+    if (dims === null)
+      return null;
+    return { mime: "png", width: dims[0], height: dims[1], bytes };
+  }
+  if (bytes.length >= 2 && bytes[0] === 255 && bytes[1] === 216) {
+    const dims = jpegDimensions(bytes);
+    if (dims === null)
+      return null;
+    return { mime: "jpeg", width: dims[0], height: dims[1], bytes };
+  }
+  let start = 0;
+  while (start < bytes.length && [9, 10, 12, 13, 32].includes(bytes[start]))
+    start++;
+  const head = String.fromCharCode(...bytes.slice(start, start + 4));
+  if (head === "<svg")
+    return { mime: "svg", width: null, height: null, bytes };
+  return null;
+}
+function decodeBase64(payload) {
+  if (payload === "")
+    return null;
+  try {
+    const text = atob(payload);
+    if (btoa(text) !== payload)
+      return null;
+    const bytes = new Uint8Array(text.length);
+    for (let i = 0;i < text.length; i++)
+      bytes[i] = text.charCodeAt(i);
+    return bytes.length > 0 ? bytes : null;
+  } catch {
+    return null;
+  }
+}
+function normalize(input) {
+  let payload = input;
+  const comma = input.indexOf(",");
+  if (comma >= 0 && input.startsWith("data:")) {
+    const meta = input.slice(0, comma);
+    if (!meta.endsWith(";base64"))
+      return null;
+    payload = input.slice(comma + 1);
+  }
+  const bytes = decodeBase64(payload);
+  if (bytes === null)
+    return null;
+  return sniff(bytes);
+}
+function exceedsLimits(image, maxPixels) {
+  if (image.width === null || image.height === null)
+    return false;
+  return image.width * image.height > maxPixels;
+}
+function scaleToFit(image, maxPixels) {
+  if (image.width === null || image.height === null)
+    return 1;
+  const pixels = image.width * image.height;
+  if (pixels <= maxPixels)
+    return 1;
+  return Math.sqrt(maxPixels / pixels);
+}
+function signatureSize(image, heightPt, maxWidthPt) {
+  if (image.width === null || image.height === null || !Number.isInteger(image.width) || !Number.isInteger(image.height) || image.width <= 0 || image.height <= 0 || image.width > 4294967295 || image.height > 4294967295 || !Number.isFinite(heightPt) || heightPt <= 0 || maxWidthPt !== undefined && (!Number.isFinite(maxWidthPt) || maxWidthPt <= 0))
+    return null;
+  const ratio = image.width / image.height;
+  const natural = heightPt * ratio;
+  let width = natural;
+  let height = heightPt;
+  if (maxWidthPt !== undefined && natural > maxWidthPt) {
+    width = maxWidthPt;
+    height = maxWidthPt / ratio;
+  }
+  return Number.isFinite(width) && Number.isFinite(height) && width > 0 && height > 0 ? [width, height] : null;
+}
+function escapePath(path) {
+  return path.replace(/["\\\u0000-\u001f\u007f-\u009f]/g, (character) => {
+    if (character === '"')
+      return "\\\"";
+    if (character === "\\")
+      return "\\\\";
+    if (character === `
+`)
+      return "\\n";
+    if (character === "\r")
+      return "\\r";
+    if (character === "\t")
+      return "\\t";
+    return `\\u{${character.charCodeAt(0).toString(16)}}`;
+  });
+}
+function imageSnippet(path, heightPt, widthPt) {
+  const safe = escapePath(path);
+  if (widthPt === undefined)
+    return `#image("${safe}", height: ${heightPt}pt)`;
+  return `#image("${safe}", height: ${heightPt}pt, width: ${widthPt}pt)`;
+}

package/dist/index.js

@@ -0,0 +1,195 @@
+// src/generated/tables.ts
+var DEFAULTS = { max_pixels: 1600, formats: ["png", "jpeg", "svg"] };
+
+// src/index.ts
+var defaults = DEFAULTS;
+function defaultMaxPixels() {
+  return defaults.max_pixels;
+}
+function supportedFormats() {
+  return [...defaults.formats].sort();
+}
+var PNG_MAGIC = [137, 80, 78, 71, 13, 10, 26, 10];
+function pngDimensions(bytes) {
+  if (bytes.length < 33)
+    return null;
+  for (let i = 0;i < 8; i++)
+    if (bytes[i] !== PNG_MAGIC[i])
+      return null;
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  if (view.getUint32(8) !== 13)
+    return null;
+  if (view.getUint32(12) !== 1229472850)
+    return null;
+  const width = view.getUint32(16);
+  const height = view.getUint32(20);
+  if (width === 0 || height === 0 || width > 2147483647 || height > 2147483647)
+    return null;
+  const depth = bytes[24];
+  const color = bytes[25];
+  const validDepth = color === 0 ? [1, 2, 4, 8, 16].includes(depth) : color === 3 ? [1, 2, 4, 8].includes(depth) : [2, 4, 6].includes(color) && [8, 16].includes(depth);
+  if (!validDepth || bytes[26] !== 0 || bytes[27] !== 0 || bytes[28] > 1)
+    return null;
+  return [width, height];
+}
+var SOF_MARKERS = new Set([
+  192,
+  193,
+  194,
+  195,
+  197,
+  198,
+  199,
+  201,
+  202,
+  203,
+  205,
+  206,
+  207
+]);
+function jpegDimensions(bytes) {
+  if (bytes.length < 2 || bytes[0] !== 255 || bytes[1] !== 216)
+    return null;
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  let pos = 2;
+  while (pos < bytes.length) {
+    if (bytes[pos] !== 255)
+      return null;
+    while (pos < bytes.length && bytes[pos] === 255)
+      pos++;
+    if (pos >= bytes.length)
+      return null;
+    const marker = bytes[pos];
+    pos++;
+    if (marker === 1)
+      continue;
+    if (marker === 0 || marker >= 208 && marker <= 218)
+      return null;
+    if (pos + 2 > bytes.length)
+      return null;
+    const len = view.getUint16(pos);
+    if (len < 2 || len > bytes.length - pos)
+      return null;
+    if (SOF_MARKERS.has(marker)) {
+      if (len < 8)
+        return null;
+      const components = bytes[pos + 7];
+      if (components === 0 || len !== 8 + 3 * components)
+        return null;
+      const height = view.getUint16(pos + 3);
+      const width = view.getUint16(pos + 5);
+      if (width === 0 || height === 0)
+        return null;
+      return [width, height];
+    }
+    pos += len;
+  }
+  return null;
+}
+function sniff(bytes) {
+  if (bytes.length >= 8 && PNG_MAGIC.every((b, i) => bytes[i] === b)) {
+    const dims = pngDimensions(bytes);
+    if (dims === null)
+      return null;
+    return { mime: "png", width: dims[0], height: dims[1], bytes };
+  }
+  if (bytes.length >= 2 && bytes[0] === 255 && bytes[1] === 216) {
+    const dims = jpegDimensions(bytes);
+    if (dims === null)
+      return null;
+    return { mime: "jpeg", width: dims[0], height: dims[1], bytes };
+  }
+  let start = 0;
+  while (start < bytes.length && [9, 10, 12, 13, 32].includes(bytes[start]))
+    start++;
+  const head = String.fromCharCode(...bytes.slice(start, start + 4));
+  if (head === "<svg")
+    return { mime: "svg", width: null, height: null, bytes };
+  return null;
+}
+function decodeBase64(payload) {
+  if (payload === "")
+    return null;
+  try {
+    const text = atob(payload);
+    if (btoa(text) !== payload)
+      return null;
+    const bytes = new Uint8Array(text.length);
+    for (let i = 0;i < text.length; i++)
+      bytes[i] = text.charCodeAt(i);
+    return bytes.length > 0 ? bytes : null;
+  } catch {
+    return null;
+  }
+}
+function normalize(input) {
+  let payload = input;
+  const comma = input.indexOf(",");
+  if (comma >= 0 && input.startsWith("data:")) {
+    const meta = input.slice(0, comma);
+    if (!meta.endsWith(";base64"))
+      return null;
+    payload = input.slice(comma + 1);
+  }
+  const bytes = decodeBase64(payload);
+  if (bytes === null)
+    return null;
+  return sniff(bytes);
+}
+function exceedsLimits(image, maxPixels) {
+  if (image.width === null || image.height === null)
+    return false;
+  return image.width * image.height > maxPixels;
+}
+function scaleToFit(image, maxPixels) {
+  if (image.width === null || image.height === null)
+    return 1;
+  const pixels = image.width * image.height;
+  if (pixels <= maxPixels)
+    return 1;
+  return Math.sqrt(maxPixels / pixels);
+}
+function signatureSize(image, heightPt, maxWidthPt) {
+  if (image.width === null || image.height === null || !Number.isInteger(image.width) || !Number.isInteger(image.height) || image.width <= 0 || image.height <= 0 || image.width > 4294967295 || image.height > 4294967295 || !Number.isFinite(heightPt) || heightPt <= 0 || maxWidthPt !== undefined && (!Number.isFinite(maxWidthPt) || maxWidthPt <= 0))
+    return null;
+  const ratio = image.width / image.height;
+  const natural = heightPt * ratio;
+  let width = natural;
+  let height = heightPt;
+  if (maxWidthPt !== undefined && natural > maxWidthPt) {
+    width = maxWidthPt;
+    height = maxWidthPt / ratio;
+  }
+  return Number.isFinite(width) && Number.isFinite(height) && width > 0 && height > 0 ? [width, height] : null;
+}
+function escapePath(path) {
+  return path.replace(/["\\\u0000-\u001f\u007f-\u009f]/g, (character) => {
+    if (character === '"')
+      return "\\\"";
+    if (character === "\\")
+      return "\\\\";
+    if (character === `
+`)
+      return "\\n";
+    if (character === "\r")
+      return "\\r";
+    if (character === "\t")
+      return "\\t";
+    return `\\u{${character.charCodeAt(0).toString(16)}}`;
+  });
+}
+function imageSnippet(path, heightPt, widthPt) {
+  const safe = escapePath(path);
+  if (widthPt === undefined)
+    return `#image("${safe}", height: ${heightPt}pt)`;
+  return `#image("${safe}", height: ${heightPt}pt, width: ${widthPt}pt)`;
+}
+export {
+  supportedFormats,
+  signatureSize,
+  scaleToFit,
+  normalize,
+  imageSnippet,
+  exceedsLimits,
+  defaultMaxPixels
+};

package/dist/types/generated/tables.d.ts

@@ -0,0 +1,2 @@
+export declare const PACKAGE_VERSION: string;
+export declare const DEFAULTS: unknown;

package/dist/types/index.d.cts

@@ -0,0 +1,42 @@
+export interface Defaults {
+    max_pixels: number;
+    formats: string[];
+}
+export type ImageMime = 'png' | 'jpeg' | 'svg';
+export interface DecodedImage {
+    mime: ImageMime;
+    width: number | null;
+    height: number | null;
+    bytes: Uint8Array;
+}
+/** Default oversize threshold in pixels, from `tables/defaults.json`. */
+export declare function defaultMaxPixels(): number;
+/** Accepted image formats, from `tables/defaults.json`. */
+export declare function supportedFormats(): string[];
+/**
+ * Recognize a signature image given as a `data:` URL or raw canonical base64.
+ * Required padding must be present; whitespace and nonzero unused bits are rejected.
+ * Returns `null` for empty, undecodable, corrupt, or unsupported inputs.
+ */
+export declare function normalize(input: string): DecodedImage | null;
+/**
+ * Whether the raster exceeds a pixel budget. Dimension-less formats (SVG)
+ * scale without loss and never exceed.
+ */
+export declare function exceedsLimits(image: DecodedImage, maxPixels: number): boolean;
+/**
+ * Linear scale factor that fits the image into a pixel budget, never
+ * above 1.0 (never upscales). The caller resamples and re-submits.
+ */
+export declare function scaleToFit(image: DecodedImage, maxPixels: number): number;
+/**
+ * Point size for a target height, preserving aspect ratio, clamped to an
+ * optional maximum width. Returns `null` for missing or invalid dimensions,
+ * nonpositive/nonfinite point sizes, or a nonrepresentable result.
+ */
+export declare function signatureSize(image: DecodedImage, heightPt: number, maxWidthPt?: number): [number, number] | null;
+/**
+ * Typst `#image` call for a sized signature. Width is emitted only when a
+ * max-width clamp applied; layout and placement stay with the caller.
+ */
+export declare function imageSnippet(path: string, heightPt: number, widthPt?: number): string;

package/dist/types/index.d.ts

@@ -0,0 +1,42 @@
+export interface Defaults {
+    max_pixels: number;
+    formats: string[];
+}
+export type ImageMime = 'png' | 'jpeg' | 'svg';
+export interface DecodedImage {
+    mime: ImageMime;
+    width: number | null;
+    height: number | null;
+    bytes: Uint8Array;
+}
+/** Default oversize threshold in pixels, from `tables/defaults.json`. */
+export declare function defaultMaxPixels(): number;
+/** Accepted image formats, from `tables/defaults.json`. */
+export declare function supportedFormats(): string[];
+/**
+ * Recognize a signature image given as a `data:` URL or raw canonical base64.
+ * Required padding must be present; whitespace and nonzero unused bits are rejected.
+ * Returns `null` for empty, undecodable, corrupt, or unsupported inputs.
+ */
+export declare function normalize(input: string): DecodedImage | null;
+/**
+ * Whether the raster exceeds a pixel budget. Dimension-less formats (SVG)
+ * scale without loss and never exceed.
+ */
+export declare function exceedsLimits(image: DecodedImage, maxPixels: number): boolean;
+/**
+ * Linear scale factor that fits the image into a pixel budget, never
+ * above 1.0 (never upscales). The caller resamples and re-submits.
+ */
+export declare function scaleToFit(image: DecodedImage, maxPixels: number): number;
+/**
+ * Point size for a target height, preserving aspect ratio, clamped to an
+ * optional maximum width. Returns `null` for missing or invalid dimensions,
+ * nonpositive/nonfinite point sizes, or a nonrepresentable result.
+ */
+export declare function signatureSize(image: DecodedImage, heightPt: number, maxWidthPt?: number): [number, number] | null;
+/**
+ * Typst `#image` call for a sized signature. Width is emitted only when a
+ * max-width clamp applied; layout and placement stay with the caller.
+ */
+export declare function imageSnippet(path: string, heightPt: number, widthPt?: number): string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corbet-labs/cink",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Handwritten signature image rendering for correspondence. Pixels, not signatures. Mirrors the cink Rust crate release line.",
   "license": "FSL-1.1-ALv2",
   "publishConfig": {
@@ -9,26 +9,62 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/corbet-labs/cink.git",
+    "url": "git+https://github.com/corbet-labs/cink.git",
     "directory": "js/@corbet-labs/cink"
   },
   "type": "module",
-  "main": "./src/index.ts",
-  "types": "./src/index.ts",
+  "main": "./dist/index.cjs",
+  "types": "./dist/types/index.d.ts",
   "exports": {
-    ".": "./src/index.ts"
+    ".": {
+      "import": {
+        "types": "./dist/types/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/types/index.d.cts",
+        "default": "./dist/index.cjs"
+      },
+      "default": "./dist/index.js"
+    },
+    "./browser": {
+      "types": "./dist/types/index.d.ts",
+      "default": "./dist/browser.js"
+    },
+    "./package.json": "./package.json"
   },
   "files": [
+    "dist/**/*",
     "src/**/*",
-    "README.md"
+    "README.md",
+    "LICENSES/**/*"
   ],
   "scripts": {
-    "prepack": "bash ./scripts/sync-assets.sh",
+    "prepack": "bun run build",
     "conformance": "bun ./scripts/conformance.mts",
-    "typecheck": "tsc --noEmit -p ./tsconfig.json"
+    "typecheck": "tsc --noEmit -p ./tsconfig.json",
+    "build": "bun ./scripts/build.mjs"
   },
   "devDependencies": {
     "@types/node": "25.8.0",
     "typescript": "6.0.3"
-  }
+  },
+  "module": "./dist/index.js",
+  "unpkg": "./dist/browser.js",
+  "jsdelivr": "./dist/browser.js",
+  "sideEffects": false,
+  "engines": {
+    "node": ">=20"
+  },
+  "homepage": "https://github.com/corbet-labs/cink#readme",
+  "bugs": {
+    "url": "https://github.com/corbet-labs/cink/issues"
+  },
+  "keywords": [
+    "i18n",
+    "correspondence",
+    "typescript",
+    "rust",
+    "cink"
+  ]
 }

package/src/generated/tables.ts

@@ -1,3 +1,3 @@
 // GENERATED by scripts/sync-assets.sh — do not edit.
-export const PACKAGE_VERSION = "0.1.1";
-export const DEFAULTS = {"max_pixels": 1600, "formats": ["png", "jpeg", "svg"]};
+export const PACKAGE_VERSION: string = "0.1.3";
+export const DEFAULTS: unknown = {"max_pixels": 1600, "formats": ["png", "jpeg", "svg"]};

package/src/index.ts

@@ -9,7 +9,7 @@
  * in `tables/README.md`; `tests/vectors/*.json` with fixtures in
  * `tests/fixtures/` is the shared conformance suite.
  */
-import { DEFAULTS } from './generated/tables.js';
+import { DEFAULTS } from './generated/tables.ts';
 
 export interface Defaults {
     max_pixels: number;
@@ -40,14 +40,20 @@ export function supportedFormats(): string[] {
 const PNG_MAGIC = [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a];
 
 function pngDimensions(bytes: Uint8Array): [number, number] | null {
-    if (bytes.length < 24) return null;
+    if (bytes.length < 33) return null;
     for (let i = 0; i < 8; i++) if (bytes[i] !== PNG_MAGIC[i]) return null;
     const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
     if (view.getUint32(8) !== 13) return null;
     if (view.getUint32(12) !== 0x49484452) return null;
     const width = view.getUint32(16);
     const height = view.getUint32(20);
-    if (width === 0 || height === 0) return null;
+    if (width === 0 || height === 0 || width > 0x7fffffff || height > 0x7fffffff) return null;
+    const depth = bytes[24];
+    const color = bytes[25];
+    const validDepth = color === 0 ? [1, 2, 4, 8, 16].includes(depth)
+        : color === 3 ? [1, 2, 4, 8].includes(depth)
+        : [2, 4, 6].includes(color) && [8, 16].includes(depth);
+    if (!validDepth || bytes[26] !== 0 || bytes[27] !== 0 || bytes[28] > 1) return null;
     return [width, height];
 }
 
@@ -60,22 +66,25 @@ function jpegDimensions(bytes: Uint8Array): [number, number] | null {
     const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
     let pos = 2;
     while (pos < bytes.length) {
+        if (bytes[pos] !== 0xff) return null;
         while (pos < bytes.length && bytes[pos] === 0xff) pos++;
         if (pos >= bytes.length) return null;
         const marker = bytes[pos];
         pos++;
+        if (marker === 0x01) continue;
+        if (marker === 0x00 || (marker >= 0xd0 && marker <= 0xda)) return null;
+        if (pos + 2 > bytes.length) return null;
+        const len = view.getUint16(pos);
+        if (len < 2 || len > bytes.length - pos) return null;
         if (SOF_MARKERS.has(marker)) {
-            if (pos + 7 > bytes.length) return null;
+            if (len < 8) return null;
+            const components = bytes[pos + 7];
+            if (components === 0 || len !== 8 + 3 * components) return null;
             const height = view.getUint16(pos + 3);
             const width = view.getUint16(pos + 5);
             if (width === 0 || height === 0) return null;
             return [width, height];
         }
-        if (marker === 0xd9 || marker === 0xda) return null;
-        if (marker === 0x00 || marker === 0x01 || (marker >= 0xd0 && marker <= 0xd7)) continue;
-        if (pos + 2 > bytes.length) return null;
-        const len = view.getUint16(pos);
-        if (len < 2) return null;
         pos += len;
     }
     return null;
@@ -93,7 +102,7 @@ function sniff(bytes: Uint8Array): DecodedImage | null {
         return { mime: 'jpeg', width: dims[0], height: dims[1], bytes };
     }
     let start = 0;
-    while (start < bytes.length && /\s/.test(String.fromCharCode(bytes[start]))) start++;
+    while (start < bytes.length && [9, 10, 12, 13, 32].includes(bytes[start])) start++;
     const head = String.fromCharCode(...bytes.slice(start, start + 4));
     if (head === '<svg') return { mime: 'svg', width: null, height: null, bytes };
     return null;
@@ -103,6 +112,8 @@ function decodeBase64(payload: string): Uint8Array | null {
     if (payload === '') return null;
     try {
         const text = atob(payload);
+        // Rust STANDARD accepts only canonical base64, including required padding.
+        if (btoa(text) !== payload) return null;
         const bytes = new Uint8Array(text.length);
         for (let i = 0; i < text.length; i++) bytes[i] = text.charCodeAt(i);
         return bytes.length > 0 ? bytes : null;
@@ -112,7 +123,8 @@ function decodeBase64(payload: string): Uint8Array | null {
 }
 
 /**
- * Validate a signature image given as a `data:` URL or raw base64.
+ * Recognize a signature image given as a `data:` URL or raw canonical base64.
+ * Required padding must be present; whitespace and nonzero unused bits are rejected.
  * Returns `null` for empty, undecodable, corrupt, or unsupported inputs.
  */
 export function normalize(input: string): DecodedImage | null {
@@ -120,7 +132,7 @@ export function normalize(input: string): DecodedImage | null {
     const comma = input.indexOf(',');
     if (comma >= 0 && input.startsWith('data:')) {
         const meta = input.slice(0, comma);
-        if (!meta.includes(';base64')) return null;
+        if (!meta.endsWith(';base64')) return null;
         payload = input.slice(comma + 1);
     }
     const bytes = decodeBase64(payload);
@@ -150,25 +162,41 @@ export function scaleToFit(image: DecodedImage, maxPixels: number): number {
 
 /**
  * Point size for a target height, preserving aspect ratio, clamped to an
- * optional maximum width. Returns `null` when the image carries no
- * dimensions: the caller must size it.
+ * optional maximum width. Returns `null` for missing or invalid dimensions,
+ * nonpositive/nonfinite point sizes, or a nonrepresentable result.
  */
 export function signatureSize(
     image: DecodedImage,
     heightPt: number,
     maxWidthPt?: number,
 ): [number, number] | null {
-    if (image.width === null || image.height === null) return null;
-    const natural = (heightPt * image.width) / image.height;
+    if (image.width === null || image.height === null
+        || !Number.isInteger(image.width) || !Number.isInteger(image.height)
+        || image.width <= 0 || image.height <= 0
+        || image.width > 0xffffffff || image.height > 0xffffffff
+        || !Number.isFinite(heightPt) || heightPt <= 0
+        || (maxWidthPt !== undefined && (!Number.isFinite(maxWidthPt) || maxWidthPt <= 0))) return null;
+    const ratio = image.width / image.height;
+    const natural = heightPt * ratio;
+    let width = natural;
+    let height = heightPt;
     if (maxWidthPt !== undefined && natural > maxWidthPt) {
-        const scale = maxWidthPt / natural;
-        return [maxWidthPt, heightPt * scale];
+        width = maxWidthPt;
+        height = maxWidthPt / ratio;
     }
-    return [natural, heightPt];
+    return Number.isFinite(width) && Number.isFinite(height) && width > 0 && height > 0
+        ? [width, height] : null;
 }
 
 function escapePath(path: string): string {
-    return path.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+    return path.replace(/["\\\u0000-\u001f\u007f-\u009f]/g, (character) => {
+        if (character === '"') return '\\"';
+        if (character === '\\') return '\\\\';
+        if (character === '\n') return '\\n';
+        if (character === '\r') return '\\r';
+        if (character === '\t') return '\\t';
+        return `\\u{${character.charCodeAt(0).toString(16)}}`;
+    });
 }
 
 /**