@emailens/engine 0.10.4 → 0.11.0

package/README.md

@@ -21,7 +21,7 @@
 
 **Your email looks perfect in Apple Mail. Gmail strips half the CSS. Outlook renders it in Word.**
 
-`@emailens/engine` analyzes your email against 255 CSS and HTML features across 21 email clients, scores compatibility, and shows you exactly what to fix — before you hit send.
+`@emailens/engine` analyzes your email against 255 CSS and HTML features across 21 email clients, scores compatibility, and shows you exactly what to fix: before you hit send.
 
 Write it however you like. **HTML, MJML, Maizzle and React Email** all go in the front: the engine compiles the template with your own compiler and lints the HTML that actually gets sent, which is the only version your reader sees.
 
@@ -29,7 +29,7 @@ Our data says you need this: of those 255 features, **only 6 are fully supported
 
 ![emailens lint output showing errors and warnings across email clients](./docs/lint-demo.png)
 
-> **[emailens.dev](https://emailens.dev)** — Try the hosted version. Paste HTML, get a full audit in seconds.
+> **[emailens.dev](https://emailens.dev)**: Try the hosted version. Paste HTML, get a full audit in seconds.
 
 ## Quick Start
 
@@ -108,19 +108,19 @@ const { code } = await generateAiFix({
 
 10 analysis engines, one `auditEmail()` call.
 
-- **CSS compatibility** — 255 CSS and HTML features tested across 21 email clients, with fix snippets and AI-powered auto-fix
-- **Content overflow** — fixed widths wider than the email frame and unbreakable strings that force horizontal scrolling
-- **Visual bugs** — gradients/background images with no color fallback (invisible content in Outlook) and fonts with no web-safe fallback, each with a concrete fix
-- **Spam scoring** — 45+ signals modeled after SpamAssassin, CAN-SPAM, and GDPR
-- **Accessibility** — WCAG contrast ratios, alt text, semantic structure, heading hierarchy
-- **Link validation** — broken hrefs, insecure HTTP, `javascript:` protocols, deceptive URLs
-- **Image analysis** — missing dimensions, oversized data URIs, tracking pixels, WebP/SVG format
-- **Inbox preview** — subject/preheader truncation per client, Gmail clipping detection
-- **Domain authentication** — SPF, DKIM, DMARC, MX, and BIMI DNS record validation
-- **Template variables** — unresolved merge tags across 6 template systems (Handlebars, ERB, Mailchimp, etc.)
-
-Every finding can carry its **source position** — line, column and offset, plus
-every place it occurs — so a result can be pointed at, annotated on a pull
+- **CSS compatibility**: 255 CSS and HTML features tested across 21 email clients, with fix snippets and AI-powered auto-fix
+- **Content overflow**: fixed widths wider than the email frame and unbreakable strings that force horizontal scrolling
+- **Visual bugs**: gradients/background images with no color fallback (invisible content in Outlook) and fonts with no web-safe fallback, each with a concrete fix
+- **Spam scoring**: 45+ signals modeled after SpamAssassin, CAN-SPAM, and GDPR
+- **Accessibility**: WCAG contrast ratios, alt text, semantic structure, heading hierarchy
+- **Link validation**: broken hrefs, insecure HTTP, `javascript:` protocols, deceptive URLs
+- **Image analysis**: missing dimensions, oversized data URIs, tracking pixels, WebP/SVG format
+- **Inbox preview**: subject/preheader truncation per client, Gmail clipping detection
+- **Domain authentication**: SPF, DKIM, DMARC, MX, and BIMI DNS record validation
+- **Template variables**: unresolved merge tags across 6 template systems (Handlebars, ERB, Mailchimp, etc.)
+
+Every finding can carry its **source position**: line, column and offset, plus
+every place it occurs, so a result can be pointed at, annotated on a pull
 request, or fixed in place:
 
 ```typescript
@@ -140,17 +140,17 @@ Three entry points:
 
 | Import | Description |
 |---|---|
-| `@emailens/engine` | Core analysis — CSS, spam, a11y, links, images, inbox preview, size, templates, AI fix |
+| `@emailens/engine` | Core analysis: CSS, spam, a11y, links, images, inbox preview, size, templates, AI fix |
 | `@emailens/engine/compile` | JSX / MJML / Maizzle → HTML compilers |
 | `@emailens/engine/server` | Node-only: DNS deliverability checks, SpamAssassin integration |
 
 ## Why Emailens?
 
-- **Offline-first** — runs entirely locally, no network calls required (except DNS deliverability checks)
-- **Unified audit** — one function call returns CSS compatibility, spam, accessibility, links, images, inbox preview, size, and template checks
-- **Framework-aware** — fix snippets tailored to React Email (JSX), MJML, and Maizzle
-- **AI-ready** — structural issues get LLM-powered auto-fix with any provider (Claude, GPT, etc.)
-- **Programmable** — TypeScript API, not a GUI — integrate into CI, editors, or build pipelines
+- **Offline-first**: runs entirely locally, no network calls required (except DNS deliverability checks)
+- **Unified audit**: one function call returns CSS compatibility, spam, accessibility, links, images, inbox preview, size, and template checks
+- **Framework-aware**: fix snippets tailored to React Email (JSX), MJML, and Maizzle
+- **AI-ready**: structural issues get LLM-powered auto-fix with any provider (Claude, GPT, etc.)
+- **Programmable**: a TypeScript API, not a GUI. Drops into CI, editors, or build pipelines
 
 | | @emailens/engine | Litmus | Email on Acid | caniemail.com |
 |---|---|---|---|---|
@@ -162,7 +162,7 @@ Three entry points:
 
 ### vs other email libraries
 
-`@emailens/engine` sits in the **QA / lint / scoring** slot — it analyzes finished HTML. It's complementary to (not a replacement for) composition and inlining libraries.
+`@emailens/engine` sits in the **QA / lint / scoring** slot: it analyzes finished HTML. It's complementary to (not a replacement for) composition and inlining libraries.
 
 | | @emailens/engine | [juice](https://github.com/automattic/juice) | [email-comb](https://github.com/codsen/email-comb) | [mjml](https://mjml.io/) | [maizzle](https://maizzle.com/) |
 |---|---|---|---|---|---|
@@ -206,7 +206,7 @@ A typical pipeline: write in **mjml** or **maizzle** → inline with **juice**
 Full API reference: **[docs/API.md](./docs/API.md)**
 
 Covers:
-- `auditEmail` and `createSession` — core analysis
+- `auditEmail` and `createSession`: core analysis
 - Standalone analyzers (CSS, spam, links, accessibility, images, inbox preview, size, templates)
 - DNS deliverability and SpamAssassin integration
 - Client transforms and dark mode simulation
@@ -234,7 +234,7 @@ Contributions are welcome! See **[CONTRIBUTING.md](./CONTRIBUTING.md)** for arch
 bun install && bun test   # 719 tests
 ```
 
-Optional real-render validation — renders engine output in a real browser engine (free, no Litmus/Email on Acid needed). Off by default; needs a browser-capable machine:
+Optional real-render validation: renders engine output in a real browser engine (free, no Litmus/Email on Acid needed). Off by default; needs a browser-capable machine:
 
 ```bash
 bunx playwright install chromium
@@ -254,7 +254,7 @@ See [CONTRIBUTING.md](./CONTRIBUTING.md#data-sources-and-freshness) for full det
 
 ## License
 
-MIT — Copyright 2025 [Emailens](https://emailens.dev)
+MIT, Copyright 2025 [Emailens](https://emailens.dev)
 
 ---
 

package/dist/{chunk-HBKZMR7V.js → chunk-UFSYNSDP.js}

@@ -356,4 +356,4 @@ async function executeInQuickJs(code, React, ReactEmailComponents) {
 export {
   compileReactEmail
 };
-//# sourceMappingURL=chunk-HBKZMR7V.js.map
+//# sourceMappingURL=chunk-UFSYNSDP.js.map

package/dist/chunk-UFSYNSDP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/compile/react-email.ts"],"sourcesContent":["import { CompileError } from \"./errors.js\";\r\n\r\n/** Maximum source code size: 256KB */\r\nconst MAX_SOURCE_SIZE = 256_000;\r\n\r\n/** Execution timeout: 5 seconds */\r\nconst EXECUTION_TIMEOUT_MS = 5_000;\r\n\r\n/**\r\n * Sandbox strategy for JSX execution.\r\n *\r\n * - `\"vm\"`: `node:vm` with hardened globals. Fast, zero-dependency,\r\n *   but NOT a true security boundary (prototype-chain escapes are possible).\r\n *   Suitable for CLI / local use where users run their own code.\r\n *\r\n * - `\"isolated-vm\"` (default): Separate V8 isolate via the `isolated-vm`\r\n *   npm package. True heap isolation; escapes require a V8 engine bug.\r\n *   Requires `isolated-vm` to be installed (native addon).\r\n *\r\n * - `\"quickjs\"`: Validates code structure in a QuickJS WASM sandbox, then\r\n *   executes in `node:vm` for React rendering. Security is equivalent to\r\n *   `node:vm`: the QuickJS phase validates import restrictions only.\r\n *   No native addons needed, but only supports ES2020 and is slower.\r\n *   For true isolation on servers, use `isolated-vm`.\r\n */\r\nexport type SandboxStrategy = \"vm\" | \"isolated-vm\" | \"quickjs\";\r\n\r\nexport interface CompileReactEmailOptions {\r\n  /**\r\n   * Sandbox strategy to use for executing user JSX code.\r\n   * @default \"isolated-vm\"\r\n   */\r\n  sandbox?: SandboxStrategy;\r\n}\r\n\r\n/**\r\n * Compile a React Email JSX/TSX source string into an HTML email string.\r\n *\r\n * Pipeline:\r\n *  1. Validate input (size, basic checks)\r\n *  2. Transpile JSX/TSX → CommonJS JS using sucrase\r\n *  3. Execute inside a sandbox (configurable strategy)\r\n *  4. Render the exported component to a full HTML email string\r\n *\r\n * Requires peer dependencies: sucrase, react, @react-email/components,\r\n * @react-email/render. Additionally:\r\n *  - sandbox \"isolated-vm\" requires `isolated-vm`\r\n *  - sandbox \"quickjs\" requires `quickjs-emscripten`\r\n */\r\nexport async function compileReactEmail(\r\n  source: string,\r\n  options?: CompileReactEmailOptions,\r\n): Promise<string> {\r\n  const strategy = options?.sandbox ?? \"isolated-vm\";\r\n\r\n  // ── 1. Validate ──────────────────────────────────────────────────────\r\n  if (!source || !source.trim()) {\r\n    throw new CompileError(\"JSX source must not be empty.\", \"jsx\", \"validation\");\r\n  }\r\n\r\n  if (source.length > MAX_SOURCE_SIZE) {\r\n    throw new CompileError(\r\n      `JSX source exceeds ${MAX_SOURCE_SIZE / 1000}KB limit.`,\r\n      \"jsx\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  // ── 2. Load peer dependencies ────────────────────────────────────────\r\n  let transform: typeof import(\"sucrase\").transform;\r\n  let React: typeof import(\"react\");\r\n  let ReactEmailComponents: typeof import(\"@react-email/components\");\r\n  let render: typeof import(\"@react-email/render\").render;\r\n\r\n  try {\r\n    ({ transform } = await import(\"sucrase\"));\r\n  } catch {\r\n    throw new CompileError(\r\n      'JSX compilation requires \"sucrase\". Install it:\\n  npm install sucrase',\r\n      \"jsx\",\r\n      \"transpile\",\r\n    );\r\n  }\r\n\r\n  try {\r\n    React = await import(\"react\");\r\n  } catch {\r\n    throw new CompileError(\r\n      'JSX compilation requires \"react\". Install it:\\n  npm install react',\r\n      \"jsx\",\r\n      \"transpile\",\r\n    );\r\n  }\r\n\r\n  try {\r\n    ReactEmailComponents = await import(\"@react-email/components\");\r\n  } catch {\r\n    throw new CompileError(\r\n      'JSX compilation requires \"@react-email/components\". Install it:\\n  npm install @react-email/components',\r\n      \"jsx\",\r\n      \"transpile\",\r\n    );\r\n  }\r\n\r\n  try {\r\n    ({ render } = await import(\"@react-email/render\"));\r\n  } catch {\r\n    throw new CompileError(\r\n      'JSX compilation requires \"@react-email/render\". Install it:\\n  npm install @react-email/render',\r\n      \"jsx\",\r\n      \"transpile\",\r\n    );\r\n  }\r\n\r\n  // ── 3. Transpile JSX/TSX → CommonJS ──────────────────────────────────\r\n  let transpiledCode: string;\r\n  try {\r\n    const result = transform(source, {\r\n      transforms: [\"typescript\", \"jsx\", \"imports\"],\r\n      jsxRuntime: \"classic\",\r\n      production: true,\r\n    });\r\n    transpiledCode = result.code;\r\n  } catch (err: unknown) {\r\n    const message = err instanceof Error ? err.message : \"Unknown transpilation error\";\r\n    throw new CompileError(`JSX syntax error: ${message}`, \"jsx\", \"transpile\");\r\n  }\r\n\r\n  // ── 4. Execute in sandbox ────────────────────────────────────────────\r\n  let moduleExports: Record<string, unknown>;\r\n\r\n  switch (strategy) {\r\n    case \"isolated-vm\":\r\n      moduleExports = await executeInIsolatedVm(transpiledCode, React, ReactEmailComponents);\r\n      break;\r\n    case \"quickjs\":\r\n      moduleExports = await executeInQuickJs(transpiledCode, React, ReactEmailComponents);\r\n      break;\r\n    case \"vm\":\r\n      moduleExports = await executeInVm(transpiledCode, React, ReactEmailComponents);\r\n      break;\r\n    default:\r\n      throw new CompileError(\r\n        `Unknown sandbox strategy: \"${strategy}\". Use \"vm\", \"isolated-vm\", or \"quickjs\".`,\r\n        \"jsx\",\r\n        \"execution\",\r\n      );\r\n  }\r\n\r\n  // ── 5. Extract component and render ──────────────────────────────────\r\n  let Component: unknown = moduleExports.default ?? moduleExports;\r\n\r\n  if (typeof Component !== \"function\" && typeof Component === \"object\" && Component !== null) {\r\n    const values = Object.values(Component as Record<string, unknown>);\r\n    const fn = values.find((v) => typeof v === \"function\");\r\n    if (fn) Component = fn;\r\n  }\r\n\r\n  if (typeof Component !== \"function\") {\r\n    throw new CompileError(\r\n      'The JSX source must export a React component function. ' +\r\n        'Use \"export default function Email() { ... }\" or ' +\r\n        '\"export function Email() { ... }\".',\r\n      \"jsx\",\r\n      \"execution\",\r\n    );\r\n  }\r\n\r\n  try {\r\n    const element = React.createElement(Component as React.FC);\r\n    const html = await render(element);\r\n    return html;\r\n  } catch (err: unknown) {\r\n    const message = err instanceof Error ? err.message : \"Unknown rendering error\";\r\n    throw new CompileError(`React rendering error: ${message}`, \"jsx\", \"render\");\r\n  }\r\n}\r\n\r\n// ─── Sandbox: node:vm ──────────────────────────────────────────────────────\r\n\r\n/**\r\n * Execute transpiled code in a node:vm context with hardened globals.\r\n *\r\n * NOT a security boundary, see node:vm documentation. Suitable for CLI\r\n * use where the user runs their own code. For server use, prefer\r\n * \"isolated-vm\" or \"quickjs\".\r\n */\r\nasync function executeInVm(\r\n  code: string,\r\n  React: typeof import(\"react\"),\r\n  ReactEmailComponents: typeof import(\"@react-email/components\"),\r\n): Promise<Record<string, unknown>> {\r\n  const { createContext, Script } = await import(\"node:vm\");\r\n\r\n  const ALLOWED_MODULES: Record<string, unknown> = {\r\n    react: React,\r\n    \"@react-email/components\": ReactEmailComponents,\r\n  };\r\n\r\n  const moduleExports: Record<string, unknown> = {};\r\n  const moduleObj = { exports: moduleExports };\r\n\r\n  const mockRequire = (moduleName: string): unknown => {\r\n    if (moduleName in ALLOWED_MODULES) {\r\n      return ALLOWED_MODULES[moduleName];\r\n    }\r\n    throw new Error(\r\n      `Import of \"${moduleName}\" is not allowed. ` +\r\n        `Only \"react\" and \"@react-email/components\" can be imported.`,\r\n    );\r\n  };\r\n\r\n  const sandbox: Record<string, unknown> = {\r\n    module: moduleObj,\r\n    exports: moduleExports,\r\n    require: mockRequire,\r\n    React,\r\n    Object, Array, String, Number, Boolean,\r\n    Map, Set, WeakMap, WeakSet,\r\n    JSON, Math, Date, RegExp,\r\n    Error, TypeError, RangeError, ReferenceError, SyntaxError, URIError,\r\n    Promise, Symbol,\r\n    Proxy: undefined, Reflect: undefined,\r\n    parseInt, parseFloat, isNaN, isFinite,\r\n    encodeURIComponent, decodeURIComponent, encodeURI, decodeURI,\r\n    undefined, NaN, Infinity,\r\n    console: { log: () => {}, warn: () => {}, error: () => {}, info: () => {}, debug: () => {} },\r\n    setTimeout: undefined, setInterval: undefined, setImmediate: undefined, queueMicrotask: undefined,\r\n    process: undefined, globalThis: undefined, global: undefined, Buffer: undefined,\r\n    __dirname: undefined, __filename: undefined,\r\n  };\r\n\r\n  const context = createContext(sandbox, {\r\n    codeGeneration: { strings: false, wasm: false },\r\n  });\r\n\r\n  try {\r\n    const script = new Script(code, { filename: \"user-email-component.tsx\" });\r\n    script.runInContext(context, { timeout: EXECUTION_TIMEOUT_MS, displayErrors: true });\r\n  } catch (err: unknown) {\r\n    const message = err instanceof Error ? err.message : \"Unknown execution error\";\r\n    if (message.includes(\"Script execution timed out\")) {\r\n      throw new CompileError(\"JSX execution timed out (possible infinite loop).\", \"jsx\", \"execution\");\r\n    }\r\n    throw new CompileError(`JSX execution error: ${message}`, \"jsx\", \"execution\");\r\n  }\r\n\r\n  return moduleObj.exports as Record<string, unknown>;\r\n}\r\n\r\n// ─── Sandbox: isolated-vm ──────────────────────────────────────────────────\r\n\r\n/**\r\n * Validate code in a separate V8 isolate, then execute in `node:vm`.\r\n *\r\n * Two-phase approach:\r\n *  1. **Validate**: run the transpiled code in a true V8 isolate with stub\r\n *     React/component implementations. This catches disallowed imports and\r\n *     structural errors inside a genuine security boundary (separate heap,\r\n *     128 MB memory cap, timeout). Escape requires a V8 engine bug.\r\n *  2. **Execute**: run the validated code in `node:vm` with real React\r\n *     objects for actual rendering.\r\n *\r\n * Why two phases: React's internal type system uses Symbols\r\n * (`Symbol(react.forward_ref)`, `Symbol(react.element)`, etc.) which cannot\r\n * be transferred across V8 isolate boundaries, the structured clone\r\n * algorithm does not support Symbols. Running React code directly inside\r\n * `isolated-vm` is not possible.\r\n */\r\nasync function executeInIsolatedVm(\r\n  code: string,\r\n  React: typeof import(\"react\"),\r\n  ReactEmailComponents: typeof import(\"@react-email/components\"),\r\n): Promise<Record<string, unknown>> {\r\n  let ivm: typeof import(\"isolated-vm\");\r\n  try {\r\n    const ivmMod = await import(\"isolated-vm\");\r\n    ivm = (ivmMod as any).default ?? ivmMod;\r\n  } catch {\r\n    throw new CompileError(\r\n      'Sandbox strategy \"isolated-vm\" requires the \"isolated-vm\" package. Install it:\\n' +\r\n        \"  npm install isolated-vm\\n\" +\r\n        'Or use sandbox: \"vm\" for a lighter (but less secure) alternative.',\r\n      \"jsx\",\r\n      \"execution\",\r\n    );\r\n  }\r\n\r\n  // ── Phase 1: Validate in a true V8 isolate ─────────────────────────────\r\n  const isolate = new ivm.Isolate({ memoryLimit: 128 });\r\n  try {\r\n    const ivmContext = await isolate.createContext();\r\n\r\n    // Stub implementations let the code parse and execute structurally\r\n    // without needing real React objects (which contain non-cloneable Symbols).\r\n    // Stub React: createElement returns a plain object, forwardRef passes\r\n    // through, and any unknown property returns a no-op function. The Proxy\r\n    // on the components module ensures that any named import (Html, Head,\r\n    // Button, etc.) resolves to a dummy component function so the transpiled\r\n    // code can execute structurally without real React objects.\r\n    const validationCode = `\r\n      (function() {\r\n        var module = { exports: {} };\r\n        var exports = module.exports;\r\n        var noop = function() { return {}; };\r\n        var React = new Proxy({\r\n          createElement: noop,\r\n          forwardRef: function(fn) { return fn; },\r\n          Fragment: \"Fragment\",\r\n          createContext: function() { return { Provider: noop, Consumer: noop }; },\r\n          useState: function(v) { return [v, noop]; },\r\n          useRef: function() { return { current: null }; },\r\n          useEffect: noop,\r\n          useMemo: function(fn) { return fn(); },\r\n          useCallback: function(fn) { return fn; },\r\n          Children: { map: noop, forEach: noop, toArray: function() { return []; } },\r\n        }, { get: function(t, p) { return p in t ? t[p] : noop; } });\r\n        var componentsProxy = new Proxy({}, {\r\n          get: function() { return noop; }\r\n        });\r\n        function require(name) {\r\n          if (name === \"react\") return React;\r\n          if (name === \"@react-email/components\") return componentsProxy;\r\n          throw new Error('Import of \"' + name + '\" is not allowed. Only \"react\" and \"@react-email/components\" can be imported.');\r\n        }\r\n        try {\r\n          ${code}\r\n          return JSON.stringify({ ok: true });\r\n        } catch(e) {\r\n          return JSON.stringify({ ok: false, error: e.message || \"Unknown error\" });\r\n        }\r\n      })()\r\n    `;\r\n\r\n    try {\r\n      const result = await ivmContext.eval(validationCode, {\r\n        timeout: EXECUTION_TIMEOUT_MS,\r\n      });\r\n\r\n      if (typeof result === \"string\") {\r\n        const parsed = JSON.parse(result) as { ok: boolean; error?: string };\r\n        if (!parsed.ok) {\r\n          throw new CompileError(\r\n            `JSX execution error: ${parsed.error ?? \"Unknown error\"}`,\r\n            \"jsx\",\r\n            \"execution\",\r\n          );\r\n        }\r\n      }\r\n    } catch (err: unknown) {\r\n      if (err instanceof CompileError) throw err;\r\n      const message = err instanceof Error ? err.message : \"Unknown execution error\";\r\n      if (message.includes(\"timed out\") || message.includes(\"Timeout\")) {\r\n        throw new CompileError(\"JSX execution timed out (possible infinite loop).\", \"jsx\", \"execution\");\r\n      }\r\n      throw new CompileError(`JSX execution error: ${message}`, \"jsx\", \"execution\");\r\n    }\r\n  } finally {\r\n    isolate.dispose();\r\n  }\r\n\r\n  // ── Phase 2: Execute validated code in node:vm with real React ──────────\r\n  return executeInVm(code, React, ReactEmailComponents);\r\n}\r\n\r\n// ─── Sandbox: QuickJS (WASM) ──────────────────────────────────────────────\r\n\r\n/**\r\n * Validate code structure in QuickJS WASM, then execute in `node:vm`.\r\n *\r\n * Two-phase approach:\r\n *  1. Validate that the code doesn't access disallowed modules by running it\r\n *     in a QuickJS WASM sandbox with stub implementations.\r\n *  2. Execute in `node:vm` for actual React rendering (React objects can't\r\n *     cross the WASM boundary).\r\n *\r\n * **Security note:** The actual execution happens in `node:vm`, so runtime\r\n * security is equivalent to the `\"vm\"` strategy. The QuickJS phase only\r\n * validates import restrictions. For true isolation on servers, use\r\n * `\"isolated-vm\"`.\r\n */\r\nasync function executeInQuickJs(\r\n  code: string,\r\n  React: typeof import(\"react\"),\r\n  ReactEmailComponents: typeof import(\"@react-email/components\"),\r\n): Promise<Record<string, unknown>> {\r\n  let getQuickJS: typeof import(\"quickjs-emscripten\").getQuickJS;\r\n  try {\r\n    ({ getQuickJS } = await import(\"quickjs-emscripten\"));\r\n  } catch {\r\n    throw new CompileError(\r\n      'Sandbox strategy \"quickjs\" requires the \"quickjs-emscripten\" package. Install it:\\n' +\r\n        \"  npm install quickjs-emscripten\\n\" +\r\n        'Or use sandbox: \"vm\" for a lighter alternative.',\r\n      \"jsx\",\r\n      \"execution\",\r\n    );\r\n  }\r\n\r\n  const QuickJS = await getQuickJS();\r\n  const vm = QuickJS.newContext();\r\n\r\n  try {\r\n    // Phase 1: Validate code safety in the WASM sandbox.\r\n    // We provide stub implementations of React and the module system so\r\n    // the code can execute without errors, but we only care that it\r\n    // doesn't try to access anything dangerous.\r\n    // QuickJS (ES2020) does not support Proxy, so we enumerate known\r\n    // React Email component names as stub functions instead.\r\n    const validationCode = `\r\n      (function() {\r\n        var module = { exports: {} };\r\n        var exports = module.exports;\r\n        var noop = function() { return {}; };\r\n        var React = {\r\n          createElement: noop,\r\n          forwardRef: function(fn) { return fn; },\r\n          Fragment: \"Fragment\",\r\n          createContext: function() { return { Provider: noop, Consumer: noop }; },\r\n          useState: function(v) { return [v, noop]; },\r\n          useRef: function() { return { current: null }; },\r\n          useEffect: noop,\r\n          useMemo: function(fn) { return fn(); },\r\n          useCallback: function(fn) { return fn; },\r\n          Children: { map: noop, forEach: noop, toArray: function() { return []; } },\r\n        };\r\n        var components = {};\r\n        var names = [\r\n          \"Html\",\"Head\",\"Body\",\"Container\",\"Section\",\"Row\",\"Column\",\"Text\",\r\n          \"Link\",\"Button\",\"Img\",\"Hr\",\"Preview\",\"Heading\",\"Font\",\"Style\",\r\n          \"CodeBlock\",\"CodeInline\",\"Markdown\",\"Tailwind\",\"Responsive\",\r\n        ];\r\n        for (var i = 0; i < names.length; i++) components[names[i]] = noop;\r\n        function require(name) {\r\n          if (name === \"react\") return React;\r\n          if (name === \"@react-email/components\") return components;\r\n          throw new Error('Import of \"' + name + '\" is not allowed.');\r\n        }\r\n        try {\r\n          ${code}\r\n          return JSON.stringify({ ok: true });\r\n        } catch(e) {\r\n          return JSON.stringify({ ok: false, error: e.message || \"Unknown error\" });\r\n        }\r\n      })()\r\n    `;\r\n\r\n    const result = vm.evalCode(validationCode);\r\n    if (result.error) {\r\n      const errorVal = vm.dump(result.error);\r\n      result.error.dispose();\r\n      throw new CompileError(\r\n        `JSX execution error: ${typeof errorVal === \"string\" ? errorVal : \"QuickJS execution failed\"}`,\r\n        \"jsx\",\r\n        \"execution\",\r\n      );\r\n    }\r\n\r\n    const resultStr = vm.dump(result.value);\r\n    result.value.dispose();\r\n\r\n    if (typeof resultStr === \"string\") {\r\n      const parsed = JSON.parse(resultStr) as { ok: boolean; error?: string };\r\n      if (!parsed.ok) {\r\n        throw new CompileError(\r\n          `JSX execution error: ${parsed.error ?? \"Unknown error\"}`,\r\n          \"jsx\",\r\n          \"execution\",\r\n        );\r\n      }\r\n    }\r\n\r\n    // Phase 2: Code validated as safe; execute in node:vm for actual\r\n    // React rendering (React objects can't cross the WASM boundary)\r\n    return executeInVm(code, React, ReactEmailComponents);\r\n  } finally {\r\n    vm.dispose();\r\n  }\r\n}\r\n"],"mappings":";;;;;AAGA,IAAM,kBAAkB;AAGxB,IAAM,uBAAuB;AA2C7B,eAAsB,kBACpB,QACA,SACiB;AApDnB;AAqDE,QAAM,YAAW,wCAAS,YAAT,YAAoB;AAGrC,MAAI,CAAC,UAAU,CAAC,OAAO,KAAK,GAAG;AAC7B,UAAM,IAAI,aAAa,iCAAiC,OAAO,YAAY;AAAA,EAC7E;AAEA,MAAI,OAAO,SAAS,iBAAiB;AACnC,UAAM,IAAI;AAAA,MACR,sBAAsB,kBAAkB,GAAI;AAAA,MAC5C;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AAEJ,MAAI;AACF,KAAC,EAAE,UAAU,IAAI,MAAM,OAAO,SAAS;AAAA,EACzC,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,YAAQ,MAAM,OAAO,OAAO;AAAA,EAC9B,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,2BAAuB,MAAM,OAAO,yBAAyB;AAAA,EAC/D,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,KAAC,EAAE,OAAO,IAAI,MAAM,OAAO,qBAAqB;AAAA,EAClD,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,UAAU,QAAQ;AAAA,MAC/B,YAAY,CAAC,cAAc,OAAO,SAAS;AAAA,MAC3C,YAAY;AAAA,MACZ,YAAY;AAAA,IACd,CAAC;AACD,qBAAiB,OAAO;AAAA,EAC1B,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,qBAAqB,OAAO,IAAI,OAAO,WAAW;AAAA,EAC3E;AAGA,MAAI;AAEJ,UAAQ,UAAU;AAAA,IAChB,KAAK;AACH,sBAAgB,MAAM,oBAAoB,gBAAgB,OAAO,oBAAoB;AACrF;AAAA,IACF,KAAK;AACH,sBAAgB,MAAM,iBAAiB,gBAAgB,OAAO,oBAAoB;AAClF;AAAA,IACF,KAAK;AACH,sBAAgB,MAAM,YAAY,gBAAgB,OAAO,oBAAoB;AAC7E;AAAA,IACF;AACE,YAAM,IAAI;AAAA,QACR,8BAA8B,QAAQ;AAAA,QACtC;AAAA,QACA;AAAA,MACF;AAAA,EACJ;AAGA,MAAI,aAAqB,mBAAc,YAAd,YAAyB;AAElD,MAAI,OAAO,cAAc,cAAc,OAAO,cAAc,YAAY,cAAc,MAAM;AAC1F,UAAM,SAAS,OAAO,OAAO,SAAoC;AACjE,UAAM,KAAK,OAAO,KAAK,CAAC,MAAM,OAAO,MAAM,UAAU;AACrD,QAAI,GAAI,aAAY;AAAA,EACtB;AAEA,MAAI,OAAO,cAAc,YAAY;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,UAAM,UAAU,MAAM,cAAc,SAAqB;AACzD,UAAM,OAAO,MAAM,OAAO,OAAO;AACjC,WAAO;AAAA,EACT,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,0BAA0B,OAAO,IAAI,OAAO,QAAQ;AAAA,EAC7E;AACF;AAWA,eAAe,YACb,MACA,OACA,sBACkC;AAClC,QAAM,EAAE,eAAe,OAAO,IAAI,MAAM,OAAO,IAAS;AAExD,QAAM,kBAA2C;AAAA,IAC/C,OAAO;AAAA,IACP,2BAA2B;AAAA,EAC7B;AAEA,QAAM,gBAAyC,CAAC;AAChD,QAAM,YAAY,EAAE,SAAS,cAAc;AAE3C,QAAM,cAAc,CAAC,eAAgC;AACnD,QAAI,cAAc,iBAAiB;AACjC,aAAO,gBAAgB,UAAU;AAAA,IACnC;AACA,UAAM,IAAI;AAAA,MACR,cAAc,UAAU;AAAA,IAE1B;AAAA,EACF;AAEA,QAAM,UAAmC;AAAA,IACvC,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IAAQ;AAAA,IAAO;AAAA,IAAQ;AAAA,IAAQ;AAAA,IAC/B;AAAA,IAAK;AAAA,IAAK;AAAA,IAAS;AAAA,IACnB;AAAA,IAAM;AAAA,IAAM;AAAA,IAAM;AAAA,IAClB;AAAA,IAAO;AAAA,IAAW;AAAA,IAAY;AAAA,IAAgB;AAAA,IAAa;AAAA,IAC3D;AAAA,IAAS;AAAA,IACT,OAAO;AAAA,IAAW,SAAS;AAAA,IAC3B;AAAA,IAAU;AAAA,IAAY;AAAA,IAAO;AAAA,IAC7B;AAAA,IAAoB;AAAA,IAAoB;AAAA,IAAW;AAAA,IACnD;AAAA,IAAW;AAAA,IAAK;AAAA,IAChB,SAAS,EAAE,KAAK,MAAM;AAAA,IAAC,GAAG,MAAM,MAAM;AAAA,IAAC,GAAG,OAAO,MAAM;AAAA,IAAC,GAAG,MAAM,MAAM;AAAA,IAAC,GAAG,OAAO,MAAM;AAAA,IAAC,EAAE;AAAA,IAC3F,YAAY;AAAA,IAAW,aAAa;AAAA,IAAW,cAAc;AAAA,IAAW,gBAAgB;AAAA,IACxF,SAAS;AAAA,IAAW,YAAY;AAAA,IAAW,QAAQ;AAAA,IAAW,QAAQ;AAAA,IACtE,WAAW;AAAA,IAAW,YAAY;AAAA,EACpC;AAEA,QAAM,UAAU,cAAc,SAAS;AAAA,IACrC,gBAAgB,EAAE,SAAS,OAAO,MAAM,MAAM;AAAA,EAChD,CAAC;AAED,MAAI;AACF,UAAM,SAAS,IAAI,OAAO,MAAM,EAAE,UAAU,2BAA2B,CAAC;AACxE,WAAO,aAAa,SAAS,EAAE,SAAS,sBAAsB,eAAe,KAAK,CAAC;AAAA,EACrF,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,QAAI,QAAQ,SAAS,4BAA4B,GAAG;AAClD,YAAM,IAAI,aAAa,qDAAqD,OAAO,WAAW;AAAA,IAChG;AACA,UAAM,IAAI,aAAa,wBAAwB,OAAO,IAAI,OAAO,WAAW;AAAA,EAC9E;AAEA,SAAO,UAAU;AACnB;AAqBA,eAAe,oBACb,MACA,OACA,sBACkC;AAjRpC;AAkRE,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,aAAa;AACzC,WAAO,YAAe,YAAf,YAA0B;AAAA,EACnC,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,QAAM,UAAU,IAAI,IAAI,QAAQ,EAAE,aAAa,IAAI,CAAC;AACpD,MAAI;AACF,UAAM,aAAa,MAAM,QAAQ,cAAc;AAS/C,UAAM,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YA0Bf,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQZ,QAAI;AACF,YAAM,SAAS,MAAM,WAAW,KAAK,gBAAgB;AAAA,QACnD,SAAS;AAAA,MACX,CAAC;AAED,UAAI,OAAO,WAAW,UAAU;AAC9B,cAAM,SAAS,KAAK,MAAM,MAAM;AAChC,YAAI,CAAC,OAAO,IAAI;AACd,gBAAM,IAAI;AAAA,YACR,yBAAwB,YAAO,UAAP,YAAgB,eAAe;AAAA,YACvD;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAc;AACrB,UAAI,eAAe,aAAc,OAAM;AACvC,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAI,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,SAAS,GAAG;AAChE,cAAM,IAAI,aAAa,qDAAqD,OAAO,WAAW;AAAA,MAChG;AACA,YAAM,IAAI,aAAa,wBAAwB,OAAO,IAAI,OAAO,WAAW;AAAA,IAC9E;AAAA,EACF,UAAE;AACA,YAAQ,QAAQ;AAAA,EAClB;AAGA,SAAO,YAAY,MAAM,OAAO,oBAAoB;AACtD;AAkBA,eAAe,iBACb,MACA,OACA,sBACkC;AAjYpC;AAkYE,MAAI;AACJ,MAAI;AACF,KAAC,EAAE,WAAW,IAAI,MAAM,OAAO,oBAAoB;AAAA,EACrD,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,WAAW;AACjC,QAAM,KAAK,QAAQ,WAAW;AAE9B,MAAI;AAOF,UAAM,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YA8Bf,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQZ,UAAM,SAAS,GAAG,SAAS,cAAc;AACzC,QAAI,OAAO,OAAO;AAChB,YAAM,WAAW,GAAG,KAAK,OAAO,KAAK;AACrC,aAAO,MAAM,QAAQ;AACrB,YAAM,IAAI;AAAA,QACR,wBAAwB,OAAO,aAAa,WAAW,WAAW,0BAA0B;AAAA,QAC5F;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,YAAY,GAAG,KAAK,OAAO,KAAK;AACtC,WAAO,MAAM,QAAQ;AAErB,QAAI,OAAO,cAAc,UAAU;AACjC,YAAM,SAAS,KAAK,MAAM,SAAS;AACnC,UAAI,CAAC,OAAO,IAAI;AACd,cAAM,IAAI;AAAA,UACR,yBAAwB,YAAO,UAAP,YAAgB,eAAe;AAAA,UACvD;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAIA,WAAO,YAAY,MAAM,OAAO,oBAAoB;AAAA,EACtD,UAAE;AACA,OAAG,QAAQ;AAAA,EACb;AACF;","names":[]}

package/dist/compile/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/compile/errors.ts","../../src/compile/react-email.ts","../../src/compile/mjml.ts","../../src/compile/maizzle.ts","../../src/compile/index.ts"],"sourcesContent":["import type { InputFormat } from \"../types.js\";\r\n\r\n/**\r\n * Unified error class for all email compilation failures.\r\n *\r\n * Replaces the per-format error classes (ReactEmailCompileError,\r\n * MjmlCompileError, MaizzleCompileError) with a single class that\r\n * carries the source format and failure phase.\r\n */\r\nexport class CompileError extends Error {\r\n  override name = \"CompileError\";\r\n  readonly format: Exclude<InputFormat, \"html\">;\r\n  readonly phase: \"validation\" | \"transpile\" | \"execution\" | \"render\" | \"compile\";\r\n\r\n  constructor(\r\n    message: string,\r\n    format: CompileError[\"format\"],\r\n    phase: CompileError[\"phase\"],\r\n  ) {\r\n    super(message);\r\n    this.format = format;\r\n    this.phase = phase;\r\n  }\r\n}\r\n","import { CompileError } from \"./errors.js\";\r\n\r\n/** Maximum source code size: 256KB */\r\nconst MAX_SOURCE_SIZE = 256_000;\r\n\r\n/** Execution timeout: 5 seconds */\r\nconst EXECUTION_TIMEOUT_MS = 5_000;\r\n\r\n/**\r\n * Sandbox strategy for JSX execution.\r\n *\r\n * - `\"vm\"` — `node:vm` with hardened globals. Fast, zero-dependency,\r\n *   but NOT a true security boundary (prototype-chain escapes are possible).\r\n *   Suitable for CLI / local use where users run their own code.\r\n *\r\n * - `\"isolated-vm\"` (default) — Separate V8 isolate via the `isolated-vm`\r\n *   npm package. True heap isolation; escapes require a V8 engine bug.\r\n *   Requires `isolated-vm` to be installed (native addon).\r\n *\r\n * - `\"quickjs\"` — Validates code structure in a QuickJS WASM sandbox, then\r\n *   executes in `node:vm` for React rendering. Security is equivalent to\r\n *   `node:vm` — the QuickJS phase validates import restrictions only.\r\n *   No native addons needed, but only supports ES2020 and is slower.\r\n *   For true isolation on servers, use `isolated-vm`.\r\n */\r\nexport type SandboxStrategy = \"vm\" | \"isolated-vm\" | \"quickjs\";\r\n\r\nexport interface CompileReactEmailOptions {\r\n  /**\r\n   * Sandbox strategy to use for executing user JSX code.\r\n   * @default \"isolated-vm\"\r\n   */\r\n  sandbox?: SandboxStrategy;\r\n}\r\n\r\n/**\r\n * Compile a React Email JSX/TSX source string into an HTML email string.\r\n *\r\n * Pipeline:\r\n *  1. Validate input (size, basic checks)\r\n *  2. Transpile JSX/TSX → CommonJS JS using sucrase\r\n *  3. Execute inside a sandbox (configurable strategy)\r\n *  4. Render the exported component to a full HTML email string\r\n *\r\n * Requires peer dependencies: sucrase, react, @react-email/components,\r\n * @react-email/render. Additionally:\r\n *  - sandbox \"isolated-vm\" requires `isolated-vm`\r\n *  - sandbox \"quickjs\" requires `quickjs-emscripten`\r\n */\r\nexport async function compileReactEmail(\r\n  source: string,\r\n  options?: CompileReactEmailOptions,\r\n): Promise<string> {\r\n  const strategy = options?.sandbox ?? \"isolated-vm\";\r\n\r\n  // ── 1. Validate ──────────────────────────────────────────────────────\r\n  if (!source || !source.trim()) {\r\n    throw new CompileError(\"JSX source must not be empty.\", \"jsx\", \"validation\");\r\n  }\r\n\r\n  if (source.length > MAX_SOURCE_SIZE) {\r\n    throw new CompileError(\r\n      `JSX source exceeds ${MAX_SOURCE_SIZE / 1000}KB limit.`,\r\n      \"jsx\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  // ── 2. Load peer dependencies ────────────────────────────────────────\r\n  let transform: typeof import(\"sucrase\").transform;\r\n  let React: typeof import(\"react\");\r\n  let ReactEmailComponents: typeof import(\"@react-email/components\");\r\n  let render: typeof import(\"@react-email/render\").render;\r\n\r\n  try {\r\n    ({ transform } = await import(\"sucrase\"));\r\n  } catch {\r\n    throw new CompileError(\r\n      'JSX compilation requires \"sucrase\". Install it:\\n  npm install sucrase',\r\n      \"jsx\",\r\n      \"transpile\",\r\n    );\r\n  }\r\n\r\n  try {\r\n    React = await import(\"react\");\r\n  } catch {\r\n    throw new CompileError(\r\n      'JSX compilation requires \"react\". Install it:\\n  npm install react',\r\n      \"jsx\",\r\n      \"transpile\",\r\n    );\r\n  }\r\n\r\n  try {\r\n    ReactEmailComponents = await import(\"@react-email/components\");\r\n  } catch {\r\n    throw new CompileError(\r\n      'JSX compilation requires \"@react-email/components\". Install it:\\n  npm install @react-email/components',\r\n      \"jsx\",\r\n      \"transpile\",\r\n    );\r\n  }\r\n\r\n  try {\r\n    ({ render } = await import(\"@react-email/render\"));\r\n  } catch {\r\n    throw new CompileError(\r\n      'JSX compilation requires \"@react-email/render\". Install it:\\n  npm install @react-email/render',\r\n      \"jsx\",\r\n      \"transpile\",\r\n    );\r\n  }\r\n\r\n  // ── 3. Transpile JSX/TSX → CommonJS ──────────────────────────────────\r\n  let transpiledCode: string;\r\n  try {\r\n    const result = transform(source, {\r\n      transforms: [\"typescript\", \"jsx\", \"imports\"],\r\n      jsxRuntime: \"classic\",\r\n      production: true,\r\n    });\r\n    transpiledCode = result.code;\r\n  } catch (err: unknown) {\r\n    const message = err instanceof Error ? err.message : \"Unknown transpilation error\";\r\n    throw new CompileError(`JSX syntax error: ${message}`, \"jsx\", \"transpile\");\r\n  }\r\n\r\n  // ── 4. Execute in sandbox ────────────────────────────────────────────\r\n  let moduleExports: Record<string, unknown>;\r\n\r\n  switch (strategy) {\r\n    case \"isolated-vm\":\r\n      moduleExports = await executeInIsolatedVm(transpiledCode, React, ReactEmailComponents);\r\n      break;\r\n    case \"quickjs\":\r\n      moduleExports = await executeInQuickJs(transpiledCode, React, ReactEmailComponents);\r\n      break;\r\n    case \"vm\":\r\n      moduleExports = await executeInVm(transpiledCode, React, ReactEmailComponents);\r\n      break;\r\n    default:\r\n      throw new CompileError(\r\n        `Unknown sandbox strategy: \"${strategy}\". Use \"vm\", \"isolated-vm\", or \"quickjs\".`,\r\n        \"jsx\",\r\n        \"execution\",\r\n      );\r\n  }\r\n\r\n  // ── 5. Extract component and render ──────────────────────────────────\r\n  let Component: unknown = moduleExports.default ?? moduleExports;\r\n\r\n  if (typeof Component !== \"function\" && typeof Component === \"object\" && Component !== null) {\r\n    const values = Object.values(Component as Record<string, unknown>);\r\n    const fn = values.find((v) => typeof v === \"function\");\r\n    if (fn) Component = fn;\r\n  }\r\n\r\n  if (typeof Component !== \"function\") {\r\n    throw new CompileError(\r\n      'The JSX source must export a React component function. ' +\r\n        'Use \"export default function Email() { ... }\" or ' +\r\n        '\"export function Email() { ... }\".',\r\n      \"jsx\",\r\n      \"execution\",\r\n    );\r\n  }\r\n\r\n  try {\r\n    const element = React.createElement(Component as React.FC);\r\n    const html = await render(element);\r\n    return html;\r\n  } catch (err: unknown) {\r\n    const message = err instanceof Error ? err.message : \"Unknown rendering error\";\r\n    throw new CompileError(`React rendering error: ${message}`, \"jsx\", \"render\");\r\n  }\r\n}\r\n\r\n// ─── Sandbox: node:vm ──────────────────────────────────────────────────────\r\n\r\n/**\r\n * Execute transpiled code in a node:vm context with hardened globals.\r\n *\r\n * NOT a security boundary — see node:vm documentation. Suitable for CLI\r\n * use where the user runs their own code. For server use, prefer\r\n * \"isolated-vm\" or \"quickjs\".\r\n */\r\nasync function executeInVm(\r\n  code: string,\r\n  React: typeof import(\"react\"),\r\n  ReactEmailComponents: typeof import(\"@react-email/components\"),\r\n): Promise<Record<string, unknown>> {\r\n  const { createContext, Script } = await import(\"node:vm\");\r\n\r\n  const ALLOWED_MODULES: Record<string, unknown> = {\r\n    react: React,\r\n    \"@react-email/components\": ReactEmailComponents,\r\n  };\r\n\r\n  const moduleExports: Record<string, unknown> = {};\r\n  const moduleObj = { exports: moduleExports };\r\n\r\n  const mockRequire = (moduleName: string): unknown => {\r\n    if (moduleName in ALLOWED_MODULES) {\r\n      return ALLOWED_MODULES[moduleName];\r\n    }\r\n    throw new Error(\r\n      `Import of \"${moduleName}\" is not allowed. ` +\r\n        `Only \"react\" and \"@react-email/components\" can be imported.`,\r\n    );\r\n  };\r\n\r\n  const sandbox: Record<string, unknown> = {\r\n    module: moduleObj,\r\n    exports: moduleExports,\r\n    require: mockRequire,\r\n    React,\r\n    Object, Array, String, Number, Boolean,\r\n    Map, Set, WeakMap, WeakSet,\r\n    JSON, Math, Date, RegExp,\r\n    Error, TypeError, RangeError, ReferenceError, SyntaxError, URIError,\r\n    Promise, Symbol,\r\n    Proxy: undefined, Reflect: undefined,\r\n    parseInt, parseFloat, isNaN, isFinite,\r\n    encodeURIComponent, decodeURIComponent, encodeURI, decodeURI,\r\n    undefined, NaN, Infinity,\r\n    console: { log: () => {}, warn: () => {}, error: () => {}, info: () => {}, debug: () => {} },\r\n    setTimeout: undefined, setInterval: undefined, setImmediate: undefined, queueMicrotask: undefined,\r\n    process: undefined, globalThis: undefined, global: undefined, Buffer: undefined,\r\n    __dirname: undefined, __filename: undefined,\r\n  };\r\n\r\n  const context = createContext(sandbox, {\r\n    codeGeneration: { strings: false, wasm: false },\r\n  });\r\n\r\n  try {\r\n    const script = new Script(code, { filename: \"user-email-component.tsx\" });\r\n    script.runInContext(context, { timeout: EXECUTION_TIMEOUT_MS, displayErrors: true });\r\n  } catch (err: unknown) {\r\n    const message = err instanceof Error ? err.message : \"Unknown execution error\";\r\n    if (message.includes(\"Script execution timed out\")) {\r\n      throw new CompileError(\"JSX execution timed out (possible infinite loop).\", \"jsx\", \"execution\");\r\n    }\r\n    throw new CompileError(`JSX execution error: ${message}`, \"jsx\", \"execution\");\r\n  }\r\n\r\n  return moduleObj.exports as Record<string, unknown>;\r\n}\r\n\r\n// ─── Sandbox: isolated-vm ──────────────────────────────────────────────────\r\n\r\n/**\r\n * Validate code in a separate V8 isolate, then execute in `node:vm`.\r\n *\r\n * Two-phase approach:\r\n *  1. **Validate** — run the transpiled code in a true V8 isolate with stub\r\n *     React/component implementations. This catches disallowed imports and\r\n *     structural errors inside a genuine security boundary (separate heap,\r\n *     128 MB memory cap, timeout). Escape requires a V8 engine bug.\r\n *  2. **Execute** — run the validated code in `node:vm` with real React\r\n *     objects for actual rendering.\r\n *\r\n * Why two phases: React's internal type system uses Symbols\r\n * (`Symbol(react.forward_ref)`, `Symbol(react.element)`, etc.) which cannot\r\n * be transferred across V8 isolate boundaries — the structured clone\r\n * algorithm does not support Symbols. Running React code directly inside\r\n * `isolated-vm` is not possible.\r\n */\r\nasync function executeInIsolatedVm(\r\n  code: string,\r\n  React: typeof import(\"react\"),\r\n  ReactEmailComponents: typeof import(\"@react-email/components\"),\r\n): Promise<Record<string, unknown>> {\r\n  let ivm: typeof import(\"isolated-vm\");\r\n  try {\r\n    const ivmMod = await import(\"isolated-vm\");\r\n    ivm = (ivmMod as any).default ?? ivmMod;\r\n  } catch {\r\n    throw new CompileError(\r\n      'Sandbox strategy \"isolated-vm\" requires the \"isolated-vm\" package. Install it:\\n' +\r\n        \"  npm install isolated-vm\\n\" +\r\n        'Or use sandbox: \"vm\" for a lighter (but less secure) alternative.',\r\n      \"jsx\",\r\n      \"execution\",\r\n    );\r\n  }\r\n\r\n  // ── Phase 1: Validate in a true V8 isolate ─────────────────────────────\r\n  const isolate = new ivm.Isolate({ memoryLimit: 128 });\r\n  try {\r\n    const ivmContext = await isolate.createContext();\r\n\r\n    // Stub implementations let the code parse and execute structurally\r\n    // without needing real React objects (which contain non-cloneable Symbols).\r\n    // Stub React: createElement returns a plain object, forwardRef passes\r\n    // through, and any unknown property returns a no-op function. The Proxy\r\n    // on the components module ensures that any named import (Html, Head,\r\n    // Button, etc.) resolves to a dummy component function so the transpiled\r\n    // code can execute structurally without real React objects.\r\n    const validationCode = `\r\n      (function() {\r\n        var module = { exports: {} };\r\n        var exports = module.exports;\r\n        var noop = function() { return {}; };\r\n        var React = new Proxy({\r\n          createElement: noop,\r\n          forwardRef: function(fn) { return fn; },\r\n          Fragment: \"Fragment\",\r\n          createContext: function() { return { Provider: noop, Consumer: noop }; },\r\n          useState: function(v) { return [v, noop]; },\r\n          useRef: function() { return { current: null }; },\r\n          useEffect: noop,\r\n          useMemo: function(fn) { return fn(); },\r\n          useCallback: function(fn) { return fn; },\r\n          Children: { map: noop, forEach: noop, toArray: function() { return []; } },\r\n        }, { get: function(t, p) { return p in t ? t[p] : noop; } });\r\n        var componentsProxy = new Proxy({}, {\r\n          get: function() { return noop; }\r\n        });\r\n        function require(name) {\r\n          if (name === \"react\") return React;\r\n          if (name === \"@react-email/components\") return componentsProxy;\r\n          throw new Error('Import of \"' + name + '\" is not allowed. Only \"react\" and \"@react-email/components\" can be imported.');\r\n        }\r\n        try {\r\n          ${code}\r\n          return JSON.stringify({ ok: true });\r\n        } catch(e) {\r\n          return JSON.stringify({ ok: false, error: e.message || \"Unknown error\" });\r\n        }\r\n      })()\r\n    `;\r\n\r\n    try {\r\n      const result = await ivmContext.eval(validationCode, {\r\n        timeout: EXECUTION_TIMEOUT_MS,\r\n      });\r\n\r\n      if (typeof result === \"string\") {\r\n        const parsed = JSON.parse(result) as { ok: boolean; error?: string };\r\n        if (!parsed.ok) {\r\n          throw new CompileError(\r\n            `JSX execution error: ${parsed.error ?? \"Unknown error\"}`,\r\n            \"jsx\",\r\n            \"execution\",\r\n          );\r\n        }\r\n      }\r\n    } catch (err: unknown) {\r\n      if (err instanceof CompileError) throw err;\r\n      const message = err instanceof Error ? err.message : \"Unknown execution error\";\r\n      if (message.includes(\"timed out\") || message.includes(\"Timeout\")) {\r\n        throw new CompileError(\"JSX execution timed out (possible infinite loop).\", \"jsx\", \"execution\");\r\n      }\r\n      throw new CompileError(`JSX execution error: ${message}`, \"jsx\", \"execution\");\r\n    }\r\n  } finally {\r\n    isolate.dispose();\r\n  }\r\n\r\n  // ── Phase 2: Execute validated code in node:vm with real React ──────────\r\n  return executeInVm(code, React, ReactEmailComponents);\r\n}\r\n\r\n// ─── Sandbox: QuickJS (WASM) ──────────────────────────────────────────────\r\n\r\n/**\r\n * Validate code structure in QuickJS WASM, then execute in `node:vm`.\r\n *\r\n * Two-phase approach:\r\n *  1. Validate that the code doesn't access disallowed modules by running it\r\n *     in a QuickJS WASM sandbox with stub implementations.\r\n *  2. Execute in `node:vm` for actual React rendering (React objects can't\r\n *     cross the WASM boundary).\r\n *\r\n * **Security note:** The actual execution happens in `node:vm`, so runtime\r\n * security is equivalent to the `\"vm\"` strategy. The QuickJS phase only\r\n * validates import restrictions. For true isolation on servers, use\r\n * `\"isolated-vm\"`.\r\n */\r\nasync function executeInQuickJs(\r\n  code: string,\r\n  React: typeof import(\"react\"),\r\n  ReactEmailComponents: typeof import(\"@react-email/components\"),\r\n): Promise<Record<string, unknown>> {\r\n  let getQuickJS: typeof import(\"quickjs-emscripten\").getQuickJS;\r\n  try {\r\n    ({ getQuickJS } = await import(\"quickjs-emscripten\"));\r\n  } catch {\r\n    throw new CompileError(\r\n      'Sandbox strategy \"quickjs\" requires the \"quickjs-emscripten\" package. Install it:\\n' +\r\n        \"  npm install quickjs-emscripten\\n\" +\r\n        'Or use sandbox: \"vm\" for a lighter alternative.',\r\n      \"jsx\",\r\n      \"execution\",\r\n    );\r\n  }\r\n\r\n  const QuickJS = await getQuickJS();\r\n  const vm = QuickJS.newContext();\r\n\r\n  try {\r\n    // Phase 1: Validate code safety in the WASM sandbox.\r\n    // We provide stub implementations of React and the module system so\r\n    // the code can execute without errors, but we only care that it\r\n    // doesn't try to access anything dangerous.\r\n    // QuickJS (ES2020) does not support Proxy, so we enumerate known\r\n    // React Email component names as stub functions instead.\r\n    const validationCode = `\r\n      (function() {\r\n        var module = { exports: {} };\r\n        var exports = module.exports;\r\n        var noop = function() { return {}; };\r\n        var React = {\r\n          createElement: noop,\r\n          forwardRef: function(fn) { return fn; },\r\n          Fragment: \"Fragment\",\r\n          createContext: function() { return { Provider: noop, Consumer: noop }; },\r\n          useState: function(v) { return [v, noop]; },\r\n          useRef: function() { return { current: null }; },\r\n          useEffect: noop,\r\n          useMemo: function(fn) { return fn(); },\r\n          useCallback: function(fn) { return fn; },\r\n          Children: { map: noop, forEach: noop, toArray: function() { return []; } },\r\n        };\r\n        var components = {};\r\n        var names = [\r\n          \"Html\",\"Head\",\"Body\",\"Container\",\"Section\",\"Row\",\"Column\",\"Text\",\r\n          \"Link\",\"Button\",\"Img\",\"Hr\",\"Preview\",\"Heading\",\"Font\",\"Style\",\r\n          \"CodeBlock\",\"CodeInline\",\"Markdown\",\"Tailwind\",\"Responsive\",\r\n        ];\r\n        for (var i = 0; i < names.length; i++) components[names[i]] = noop;\r\n        function require(name) {\r\n          if (name === \"react\") return React;\r\n          if (name === \"@react-email/components\") return components;\r\n          throw new Error('Import of \"' + name + '\" is not allowed.');\r\n        }\r\n        try {\r\n          ${code}\r\n          return JSON.stringify({ ok: true });\r\n        } catch(e) {\r\n          return JSON.stringify({ ok: false, error: e.message || \"Unknown error\" });\r\n        }\r\n      })()\r\n    `;\r\n\r\n    const result = vm.evalCode(validationCode);\r\n    if (result.error) {\r\n      const errorVal = vm.dump(result.error);\r\n      result.error.dispose();\r\n      throw new CompileError(\r\n        `JSX execution error: ${typeof errorVal === \"string\" ? errorVal : \"QuickJS execution failed\"}`,\r\n        \"jsx\",\r\n        \"execution\",\r\n      );\r\n    }\r\n\r\n    const resultStr = vm.dump(result.value);\r\n    result.value.dispose();\r\n\r\n    if (typeof resultStr === \"string\") {\r\n      const parsed = JSON.parse(resultStr) as { ok: boolean; error?: string };\r\n      if (!parsed.ok) {\r\n        throw new CompileError(\r\n          `JSX execution error: ${parsed.error ?? \"Unknown error\"}`,\r\n          \"jsx\",\r\n          \"execution\",\r\n        );\r\n      }\r\n    }\r\n\r\n    // Phase 2: Code validated as safe — execute in node:vm for actual\r\n    // React rendering (React objects can't cross the WASM boundary)\r\n    return executeInVm(code, React, ReactEmailComponents);\r\n  } finally {\r\n    vm.dispose();\r\n  }\r\n}\r\n","import { CompileError } from \"./errors.js\";\r\n\r\n/** Maximum MJML source size: 512KB */\r\nconst MAX_SOURCE_SIZE = 512_000;\r\n\r\n/**\r\n * Compile an MJML source string into an HTML email string.\r\n *\r\n * MJML is a declarative markup language with no code execution capability\r\n * (unlike JSX). The mjml library parses XML and generates HTML; there is\r\n * no sandboxing concern.\r\n *\r\n * Requires peer dependency: mjml\r\n */\r\nexport async function compileMjml(source: string): Promise<string> {\r\n  // ── 1. Validate ──────────────────────────────────────────────────────\r\n  if (!source || !source.trim()) {\r\n    throw new CompileError(\"MJML source must not be empty.\", \"mjml\", \"validation\");\r\n  }\r\n\r\n  if (source.length > MAX_SOURCE_SIZE) {\r\n    throw new CompileError(\r\n      `MJML source exceeds ${MAX_SOURCE_SIZE / 1000}KB limit.`,\r\n      \"mjml\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  if (!/<mjml[\\s>]/i.test(source)) {\r\n    throw new CompileError(\r\n      \"MJML source must contain a root <mjml> element. \" +\r\n        \"Example: <mjml><mj-body><mj-section><mj-column><mj-text>Hello</mj-text></mj-column></mj-section></mj-body></mjml>\",\r\n      \"mjml\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  // ── 2. Load peer dependency ──────────────────────────────────────────\r\n  type MjmlResult = {\r\n    html: string;\r\n    errors: Array<{ line: number; message: string; tagName: string; formattedMessage: string }>;\r\n  };\r\n  let mjml2html: (\r\n    input: string,\r\n    options?: Record<string, unknown>,\r\n  ) => MjmlResult | Promise<MjmlResult>;\r\n\r\n  try {\r\n    const mjmlModule = await import(\"mjml\");\r\n    mjml2html = mjmlModule.default ?? mjmlModule;\r\n  } catch {\r\n    throw new CompileError(\r\n      'MJML compilation requires \"mjml\". Install it:\\n  npm install mjml',\r\n      \"mjml\",\r\n      \"compile\",\r\n    );\r\n  }\r\n\r\n  // ── 3. Compile ───────────────────────────────────────────────────────\r\n  try {\r\n    // mjml v5+ returns a Promise; v4 returns synchronously.\r\n    // Await handles both cases.\r\n    const result = await mjml2html(source, {\r\n      validationLevel: \"soft\",\r\n      keepComments: false,\r\n    });\r\n\r\n    if (result.errors && result.errors.length > 0 && !result.html) {\r\n      const errorMessages = result.errors\r\n        .map((e) => `Line ${e.line}: ${e.message} (${e.tagName})`)\r\n        .join(\"; \");\r\n      throw new CompileError(\r\n        `MJML compilation errors: ${errorMessages}`,\r\n        \"mjml\",\r\n        \"compile\",\r\n      );\r\n    }\r\n\r\n    if (!result.html) {\r\n      throw new CompileError(\"MJML compilation produced empty output.\", \"mjml\", \"compile\");\r\n    }\r\n\r\n    return result.html;\r\n  } catch (err: unknown) {\r\n    if (err instanceof CompileError) throw err;\r\n    const message = err instanceof Error ? err.message : \"Unknown MJML compilation error\";\r\n    throw new CompileError(`MJML compilation failed: ${message}`, \"mjml\", \"compile\");\r\n  }\r\n}\r\n","import { CompileError } from \"./errors.js\";\r\n\r\n/** Maximum Maizzle source size: 512KB */\r\nconst MAX_SOURCE_SIZE = 512_000;\r\n\r\n/** Compilation timeout: 15 seconds */\r\nconst COMPILE_TIMEOUT_MS = 15_000;\r\n\r\n/**\r\n * PostHTML directives that perform file-system reads or network fetches.\r\n *\r\n * Maizzle's PostHTML pipeline resolves these at compile time: a template\r\n * like `<extends src=\"/etc/passwd\">` causes the server to read that path\r\n * and include the content in rendered output (server-side file read). We\r\n * reject any input containing these directives rather than stripping them,\r\n * because stripping is error-prone with nested or malformed markup.\r\n *\r\n * Affected plugins: posthtml-extend, posthtml-fetch, posthtml-components,\r\n * posthtml-include, posthtml-modules.\r\n */\r\nconst DANGEROUS_DIRECTIVE_RE =\r\n  /<\\s*(?:extends|component|fetch|include|module|slot|fill|raw|block|yield)\\b/i;\r\n\r\n/**\r\n * Compile a Maizzle template string into an HTML email string.\r\n *\r\n * Pipeline:\r\n *  1. Validate input (size, basic structure check)\r\n *  2. Reject inputs containing PostHTML file-access directives\r\n *  3. Compile using @maizzle/framework\r\n *\r\n * Security:\r\n *  - PostHTML file-system directives are rejected at validation time\r\n *    to prevent server-side file reads and SSRF.\r\n *  - Template expressions ({{ expr }}) are evaluated by posthtml-expressions\r\n *    with empty `locals`, so unknown identifiers like `process` or `require`\r\n *    return the literal string '{local}' rather than accessing Node.js globals.\r\n *  - A hard timeout prevents pathological PostCSS/Tailwind inputs from\r\n *    hanging indefinitely.\r\n *\r\n * Requires peer dependency: @maizzle/framework\r\n */\r\nexport async function compileMaizzle(source: string): Promise<string> {\r\n  // ── 1. Validate ──────────────────────────────────────────────────────\r\n  if (!source || !source.trim()) {\r\n    throw new CompileError(\"Maizzle source must not be empty.\", \"maizzle\", \"validation\");\r\n  }\r\n\r\n  if (source.length > MAX_SOURCE_SIZE) {\r\n    throw new CompileError(\r\n      `Maizzle source exceeds ${MAX_SOURCE_SIZE / 1000}KB limit.`,\r\n      \"maizzle\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  // ── 2. Block file-system and network PostHTML directives ─────────────\r\n  if (DANGEROUS_DIRECTIVE_RE.test(source)) {\r\n    throw new CompileError(\r\n      \"Maizzle templates may not use <extends>, <component>, <fetch>, <include>, \" +\r\n        \"<module>, <slot>, <fill>, <raw>, <block>, or <yield> directives. These directives \" +\r\n        \"access the server file system at compile time. Use inline HTML and Tailwind utility classes instead.\",\r\n      \"maizzle\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  // ── 3. Load peer dependency ──────────────────────────────────────────\r\n  let maizzleRender: (\r\n    input: string,\r\n    options: Record<string, unknown>,\r\n  ) => Promise<{ html: string }>;\r\n\r\n  try {\r\n    const maizzle = await import(\"@maizzle/framework\");\r\n    maizzleRender = maizzle.render;\r\n  } catch {\r\n    throw new CompileError(\r\n      'Maizzle compilation requires \"@maizzle/framework\". Install it:\\n  npm install @maizzle/framework',\r\n      \"maizzle\",\r\n      \"compile\",\r\n    );\r\n  }\r\n\r\n  // ── 4. Compile with timeout ──────────────────────────────────────────\r\n  const compilePromise = maizzleRender(source, {\r\n    css: {\r\n      inline: {\r\n        removeInlinedSelectors: true,\r\n        applyWidthAttributes: true,\r\n        applyHeightAttributes: true,\r\n      },\r\n      shorthand: true,\r\n      sixHex: true,\r\n    },\r\n    locals: {},\r\n  });\r\n\r\n  const timeoutPromise = new Promise<never>((_, reject) => {\r\n    const t = setTimeout(() => {\r\n      reject(\r\n        new CompileError(\r\n          `Maizzle compilation timed out after ${COMPILE_TIMEOUT_MS / 1000}s.`,\r\n          \"maizzle\",\r\n          \"compile\",\r\n        ),\r\n      );\r\n    }, COMPILE_TIMEOUT_MS);\r\n    if (typeof t.unref === \"function\") t.unref();\r\n  });\r\n\r\n  try {\r\n    const { html } = await Promise.race([compilePromise, timeoutPromise]);\r\n\r\n    if (!html) {\r\n      throw new CompileError(\"Maizzle compilation produced empty output.\", \"maizzle\", \"compile\");\r\n    }\r\n\r\n    return html;\r\n  } catch (err: unknown) {\r\n    if (err instanceof CompileError) throw err;\r\n    const message = err instanceof Error ? err.message : \"Unknown Maizzle compilation error\";\r\n    throw new CompileError(`Maizzle compilation failed: ${message}`, \"maizzle\", \"compile\");\r\n  }\r\n}\r\n","import { extname } from \"node:path\";\r\nimport type { InputFormat } from \"../types.js\";\r\n\r\nexport { CompileError } from \"./errors.js\";\r\nexport { compileReactEmail } from \"./react-email.js\";\r\nexport type { SandboxStrategy, CompileReactEmailOptions } from \"./react-email.js\";\r\nexport { compileMjml } from \"./mjml.js\";\r\nexport { compileMaizzle } from \"./maizzle.js\";\r\n\r\n/**\r\n * Compile source to HTML based on format.\r\n * Returns the HTML unchanged if format is \"html\".\r\n * Lazily imports per-format compilers to avoid loading unnecessary deps.\r\n */\r\nexport async function compile(\r\n  source: string,\r\n  format: InputFormat,\r\n): Promise<string> {\r\n  switch (format) {\r\n    case \"html\":\r\n      return source;\r\n\r\n    case \"jsx\": {\r\n      const { compileReactEmail } = await import(\"./react-email.js\");\r\n      return compileReactEmail(source);\r\n    }\r\n\r\n    case \"mjml\": {\r\n      const { compileMjml } = await import(\"./mjml.js\");\r\n      return compileMjml(source);\r\n    }\r\n\r\n    case \"maizzle\": {\r\n      const { compileMaizzle } = await import(\"./maizzle.js\");\r\n      return compileMaizzle(source);\r\n    }\r\n\r\n    default:\r\n      throw new Error(`Unknown format: \"${format}\". Use html, jsx, mjml, or maizzle.`);\r\n  }\r\n}\r\n\r\n/**\r\n * Auto-detect input format from file extension.\r\n */\r\nexport function detectFormat(filePath: string): InputFormat {\r\n  const ext = extname(filePath).toLowerCase();\r\n\r\n  switch (ext) {\r\n    case \".tsx\":\r\n    case \".jsx\":\r\n      return \"jsx\";\r\n    case \".mjml\":\r\n      return \"mjml\";\r\n    case \".html\":\r\n    case \".htm\":\r\n      return \"html\";\r\n    default:\r\n      return \"html\";\r\n  }\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IASa;AATb;AAAA;AAAA;AASO,IAAM,eAAN,cAA2B,MAAM;AAAA,MAKtC,YACE,SACA,QACA,OACA;AACA,cAAM,OAAO;AATf,aAAS,OAAO;AAUd,aAAK,SAAS;AACd,aAAK,QAAQ;AAAA,MACf;AAAA,IACF;AAAA;AAAA;;;ACvBA;AAAA;AAAA;AAAA;AAiDA,eAAsB,kBACpB,QACA,SACiB;AApDnB;AAqDE,QAAM,YAAW,wCAAS,YAAT,YAAoB;AAGrC,MAAI,CAAC,UAAU,CAAC,OAAO,KAAK,GAAG;AAC7B,UAAM,IAAI,aAAa,iCAAiC,OAAO,YAAY;AAAA,EAC7E;AAEA,MAAI,OAAO,SAAS,iBAAiB;AACnC,UAAM,IAAI;AAAA,MACR,sBAAsB,kBAAkB,GAAI;AAAA,MAC5C;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AAEJ,MAAI;AACF,KAAC,EAAE,UAAU,IAAI,MAAM,OAAO,SAAS;AAAA,EACzC,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,YAAQ,MAAM,OAAO,OAAO;AAAA,EAC9B,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,2BAAuB,MAAM,OAAO,yBAAyB;AAAA,EAC/D,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,KAAC,EAAE,OAAO,IAAI,MAAM,OAAO,qBAAqB;AAAA,EAClD,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,UAAU,QAAQ;AAAA,MAC/B,YAAY,CAAC,cAAc,OAAO,SAAS;AAAA,MAC3C,YAAY;AAAA,MACZ,YAAY;AAAA,IACd,CAAC;AACD,qBAAiB,OAAO;AAAA,EAC1B,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,qBAAqB,OAAO,IAAI,OAAO,WAAW;AAAA,EAC3E;AAGA,MAAI;AAEJ,UAAQ,UAAU;AAAA,IAChB,KAAK;AACH,sBAAgB,MAAM,oBAAoB,gBAAgB,OAAO,oBAAoB;AACrF;AAAA,IACF,KAAK;AACH,sBAAgB,MAAM,iBAAiB,gBAAgB,OAAO,oBAAoB;AAClF;AAAA,IACF,KAAK;AACH,sBAAgB,MAAM,YAAY,gBAAgB,OAAO,oBAAoB;AAC7E;AAAA,IACF;AACE,YAAM,IAAI;AAAA,QACR,8BAA8B,QAAQ;AAAA,QACtC;AAAA,QACA;AAAA,MACF;AAAA,EACJ;AAGA,MAAI,aAAqB,mBAAc,YAAd,YAAyB;AAElD,MAAI,OAAO,cAAc,cAAc,OAAO,cAAc,YAAY,cAAc,MAAM;AAC1F,UAAM,SAAS,OAAO,OAAO,SAAoC;AACjE,UAAM,KAAK,OAAO,KAAK,CAAC,MAAM,OAAO,MAAM,UAAU;AACrD,QAAI,GAAI,aAAY;AAAA,EACtB;AAEA,MAAI,OAAO,cAAc,YAAY;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,UAAM,UAAU,MAAM,cAAc,SAAqB;AACzD,UAAM,OAAO,MAAM,OAAO,OAAO;AACjC,WAAO;AAAA,EACT,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,0BAA0B,OAAO,IAAI,OAAO,QAAQ;AAAA,EAC7E;AACF;AAWA,eAAe,YACb,MACA,OACA,sBACkC;AAClC,QAAM,EAAE,eAAe,OAAO,IAAI,MAAM,OAAO,IAAS;AAExD,QAAM,kBAA2C;AAAA,IAC/C,OAAO;AAAA,IACP,2BAA2B;AAAA,EAC7B;AAEA,QAAM,gBAAyC,CAAC;AAChD,QAAM,YAAY,EAAE,SAAS,cAAc;AAE3C,QAAM,cAAc,CAAC,eAAgC;AACnD,QAAI,cAAc,iBAAiB;AACjC,aAAO,gBAAgB,UAAU;AAAA,IACnC;AACA,UAAM,IAAI;AAAA,MACR,cAAc,UAAU;AAAA,IAE1B;AAAA,EACF;AAEA,QAAM,UAAmC;AAAA,IACvC,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IAAQ;AAAA,IAAO;AAAA,IAAQ;AAAA,IAAQ;AAAA,IAC/B;AAAA,IAAK;AAAA,IAAK;AAAA,IAAS;AAAA,IACnB;AAAA,IAAM;AAAA,IAAM;AAAA,IAAM;AAAA,IAClB;AAAA,IAAO;AAAA,IAAW;AAAA,IAAY;AAAA,IAAgB;AAAA,IAAa;AAAA,IAC3D;AAAA,IAAS;AAAA,IACT,OAAO;AAAA,IAAW,SAAS;AAAA,IAC3B;AAAA,IAAU;AAAA,IAAY;AAAA,IAAO;AAAA,IAC7B;AAAA,IAAoB;AAAA,IAAoB;AAAA,IAAW;AAAA,IACnD;AAAA,IAAW;AAAA,IAAK;AAAA,IAChB,SAAS,EAAE,KAAK,MAAM;AAAA,IAAC,GAAG,MAAM,MAAM;AAAA,IAAC,GAAG,OAAO,MAAM;AAAA,IAAC,GAAG,MAAM,MAAM;AAAA,IAAC,GAAG,OAAO,MAAM;AAAA,IAAC,EAAE;AAAA,IAC3F,YAAY;AAAA,IAAW,aAAa;AAAA,IAAW,cAAc;AAAA,IAAW,gBAAgB;AAAA,IACxF,SAAS;AAAA,IAAW,YAAY;AAAA,IAAW,QAAQ;AAAA,IAAW,QAAQ;AAAA,IACtE,WAAW;AAAA,IAAW,YAAY;AAAA,EACpC;AAEA,QAAM,UAAU,cAAc,SAAS;AAAA,IACrC,gBAAgB,EAAE,SAAS,OAAO,MAAM,MAAM;AAAA,EAChD,CAAC;AAED,MAAI;AACF,UAAM,SAAS,IAAI,OAAO,MAAM,EAAE,UAAU,2BAA2B,CAAC;AACxE,WAAO,aAAa,SAAS,EAAE,SAAS,sBAAsB,eAAe,KAAK,CAAC;AAAA,EACrF,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,QAAI,QAAQ,SAAS,4BAA4B,GAAG;AAClD,YAAM,IAAI,aAAa,qDAAqD,OAAO,WAAW;AAAA,IAChG;AACA,UAAM,IAAI,aAAa,wBAAwB,OAAO,IAAI,OAAO,WAAW;AAAA,EAC9E;AAEA,SAAO,UAAU;AACnB;AAqBA,eAAe,oBACb,MACA,OACA,sBACkC;AAjRpC;AAkRE,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,aAAa;AACzC,WAAO,YAAe,YAAf,YAA0B;AAAA,EACnC,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,QAAM,UAAU,IAAI,IAAI,QAAQ,EAAE,aAAa,IAAI,CAAC;AACpD,MAAI;AACF,UAAM,aAAa,MAAM,QAAQ,cAAc;AAS/C,UAAM,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YA0Bf,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQZ,QAAI;AACF,YAAM,SAAS,MAAM,WAAW,KAAK,gBAAgB;AAAA,QACnD,SAAS;AAAA,MACX,CAAC;AAED,UAAI,OAAO,WAAW,UAAU;AAC9B,cAAM,SAAS,KAAK,MAAM,MAAM;AAChC,YAAI,CAAC,OAAO,IAAI;AACd,gBAAM,IAAI;AAAA,YACR,yBAAwB,YAAO,UAAP,YAAgB,eAAe;AAAA,YACvD;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAc;AACrB,UAAI,eAAe,aAAc,OAAM;AACvC,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAI,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,SAAS,GAAG;AAChE,cAAM,IAAI,aAAa,qDAAqD,OAAO,WAAW;AAAA,MAChG;AACA,YAAM,IAAI,aAAa,wBAAwB,OAAO,IAAI,OAAO,WAAW;AAAA,IAC9E;AAAA,EACF,UAAE;AACA,YAAQ,QAAQ;AAAA,EAClB;AAGA,SAAO,YAAY,MAAM,OAAO,oBAAoB;AACtD;AAkBA,eAAe,iBACb,MACA,OACA,sBACkC;AAjYpC;AAkYE,MAAI;AACJ,MAAI;AACF,KAAC,EAAE,WAAW,IAAI,MAAM,OAAO,oBAAoB;AAAA,EACrD,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,WAAW;AACjC,QAAM,KAAK,QAAQ,WAAW;AAE9B,MAAI;AAOF,UAAM,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YA8Bf,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQZ,UAAM,SAAS,GAAG,SAAS,cAAc;AACzC,QAAI,OAAO,OAAO;AAChB,YAAM,WAAW,GAAG,KAAK,OAAO,KAAK;AACrC,aAAO,MAAM,QAAQ;AACrB,YAAM,IAAI;AAAA,QACR,wBAAwB,OAAO,aAAa,WAAW,WAAW,0BAA0B;AAAA,QAC5F;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,YAAY,GAAG,KAAK,OAAO,KAAK;AACtC,WAAO,MAAM,QAAQ;AAErB,QAAI,OAAO,cAAc,UAAU;AACjC,YAAM,SAAS,KAAK,MAAM,SAAS;AACnC,UAAI,CAAC,OAAO,IAAI;AACd,cAAM,IAAI;AAAA,UACR,yBAAwB,YAAO,UAAP,YAAgB,eAAe;AAAA,UACvD;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAIA,WAAO,YAAY,MAAM,OAAO,oBAAoB;AAAA,EACtD,UAAE;AACA,OAAG,QAAQ;AAAA,EACb;AACF;AA9dA,IAGM,iBAGA;AANN;AAAA;AAAA;AAAA;AAGA,IAAM,kBAAkB;AAGxB,IAAM,uBAAuB;AAAA;AAAA;;;ACN7B;AAAA;AAAA;AAAA;AAcA,eAAsB,YAAY,QAAiC;AAdnE;AAgBE,MAAI,CAAC,UAAU,CAAC,OAAO,KAAK,GAAG;AAC7B,UAAM,IAAI,aAAa,kCAAkC,QAAQ,YAAY;AAAA,EAC/E;AAEA,MAAI,OAAO,SAASA,kBAAiB;AACnC,UAAM,IAAI;AAAA,MACR,uBAAuBA,mBAAkB,GAAI;AAAA,MAC7C;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,cAAc,KAAK,MAAM,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MAEA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAOA,MAAI;AAKJ,MAAI;AACF,UAAM,aAAa,MAAM,OAAO,MAAM;AACtC,iBAAY,gBAAW,YAAX,YAAsB;AAAA,EACpC,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AAGF,UAAM,SAAS,MAAM,UAAU,QAAQ;AAAA,MACrC,iBAAiB;AAAA,MACjB,cAAc;AAAA,IAChB,CAAC;AAED,QAAI,OAAO,UAAU,OAAO,OAAO,SAAS,KAAK,CAAC,OAAO,MAAM;AAC7D,YAAM,gBAAgB,OAAO,OAC1B,IAAI,CAAC,MAAM,QAAQ,EAAE,IAAI,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO,GAAG,EACxD,KAAK,IAAI;AACZ,YAAM,IAAI;AAAA,QACR,4BAA4B,aAAa;AAAA,QACzC;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,MAAM;AAChB,YAAM,IAAI,aAAa,2CAA2C,QAAQ,SAAS;AAAA,IACrF;AAEA,WAAO,OAAO;AAAA,EAChB,SAAS,KAAc;AACrB,QAAI,eAAe,aAAc,OAAM;AACvC,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,4BAA4B,OAAO,IAAI,QAAQ,SAAS;AAAA,EACjF;AACF;AAxFA,IAGMA;AAHN;AAAA;AAAA;AAAA;AAGA,IAAMA,mBAAkB;AAAA;AAAA;;;ACHxB;AAAA;AAAA;AAAA;AA0CA,eAAsB,eAAe,QAAiC;AAEpE,MAAI,CAAC,UAAU,CAAC,OAAO,KAAK,GAAG;AAC7B,UAAM,IAAI,aAAa,qCAAqC,WAAW,YAAY;AAAA,EACrF;AAEA,MAAI,OAAO,SAASC,kBAAiB;AACnC,UAAM,IAAI;AAAA,MACR,0BAA0BA,mBAAkB,GAAI;AAAA,MAChD;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI,uBAAuB,KAAK,MAAM,GAAG;AACvC,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AAKJ,MAAI;AACF,UAAM,UAAU,MAAM,OAAO,oBAAoB;AACjD,oBAAgB,QAAQ;AAAA,EAC1B,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,QAAM,iBAAiB,cAAc,QAAQ;AAAA,IAC3C,KAAK;AAAA,MACH,QAAQ;AAAA,QACN,wBAAwB;AAAA,QACxB,sBAAsB;AAAA,QACtB,uBAAuB;AAAA,MACzB;AAAA,MACA,WAAW;AAAA,MACX,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ,CAAC;AAAA,EACX,CAAC;AAED,QAAM,iBAAiB,IAAI,QAAe,CAAC,GAAG,WAAW;AACvD,UAAM,IAAI,WAAW,MAAM;AACzB;AAAA,QACE,IAAI;AAAA,UACF,uCAAuC,qBAAqB,GAAI;AAAA,UAChE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF,GAAG,kBAAkB;AACrB,QAAI,OAAO,EAAE,UAAU,WAAY,GAAE,MAAM;AAAA,EAC7C,CAAC;AAED,MAAI;AACF,UAAM,EAAE,KAAK,IAAI,MAAM,QAAQ,KAAK,CAAC,gBAAgB,cAAc,CAAC;AAEpE,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,aAAa,8CAA8C,WAAW,SAAS;AAAA,IAC3F;AAEA,WAAO;AAAA,EACT,SAAS,KAAc;AACrB,QAAI,eAAe,aAAc,OAAM;AACvC,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,+BAA+B,OAAO,IAAI,WAAW,SAAS;AAAA,EACvF;AACF;AA5HA,IAGMA,kBAGA,oBAcA;AApBN;AAAA;AAAA;AAAA;AAGA,IAAMA,mBAAkB;AAGxB,IAAM,qBAAqB;AAc3B,IAAM,yBACJ;AAAA;AAAA;;;ACrBF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uBAAwB;AAGxB;AACA;AAEA;AACA;AAOA,eAAsB,QACpB,QACA,QACiB;AACjB,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IAET,KAAK,OAAO;AACV,YAAM,EAAE,mBAAAC,mBAAkB,IAAI,MAAM;AACpC,aAAOA,mBAAkB,MAAM;AAAA,IACjC;AAAA,IAEA,KAAK,QAAQ;AACX,YAAM,EAAE,aAAAC,aAAY,IAAI,MAAM;AAC9B,aAAOA,aAAY,MAAM;AAAA,IAC3B;AAAA,IAEA,KAAK,WAAW;AACd,YAAM,EAAE,gBAAAC,gBAAe,IAAI,MAAM;AACjC,aAAOA,gBAAe,MAAM;AAAA,IAC9B;AAAA,IAEA;AACE,YAAM,IAAI,MAAM,oBAAoB,MAAM,qCAAqC;AAAA,EACnF;AACF;AAKO,SAAS,aAAa,UAA+B;AAC1D,QAAM,UAAM,0BAAQ,QAAQ,EAAE,YAAY;AAE1C,UAAQ,KAAK;AAAA,IACX,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;","names":["MAX_SOURCE_SIZE","MAX_SOURCE_SIZE","compileReactEmail","compileMjml","compileMaizzle"]}
+{"version":3,"sources":["../../src/compile/errors.ts","../../src/compile/react-email.ts","../../src/compile/mjml.ts","../../src/compile/maizzle.ts","../../src/compile/index.ts"],"sourcesContent":["import type { InputFormat } from \"../types.js\";\r\n\r\n/**\r\n * Unified error class for all email compilation failures.\r\n *\r\n * Replaces the per-format error classes (ReactEmailCompileError,\r\n * MjmlCompileError, MaizzleCompileError) with a single class that\r\n * carries the source format and failure phase.\r\n */\r\nexport class CompileError extends Error {\r\n  override name = \"CompileError\";\r\n  readonly format: Exclude<InputFormat, \"html\">;\r\n  readonly phase: \"validation\" | \"transpile\" | \"execution\" | \"render\" | \"compile\";\r\n\r\n  constructor(\r\n    message: string,\r\n    format: CompileError[\"format\"],\r\n    phase: CompileError[\"phase\"],\r\n  ) {\r\n    super(message);\r\n    this.format = format;\r\n    this.phase = phase;\r\n  }\r\n}\r\n","import { CompileError } from \"./errors.js\";\r\n\r\n/** Maximum source code size: 256KB */\r\nconst MAX_SOURCE_SIZE = 256_000;\r\n\r\n/** Execution timeout: 5 seconds */\r\nconst EXECUTION_TIMEOUT_MS = 5_000;\r\n\r\n/**\r\n * Sandbox strategy for JSX execution.\r\n *\r\n * - `\"vm\"`: `node:vm` with hardened globals. Fast, zero-dependency,\r\n *   but NOT a true security boundary (prototype-chain escapes are possible).\r\n *   Suitable for CLI / local use where users run their own code.\r\n *\r\n * - `\"isolated-vm\"` (default): Separate V8 isolate via the `isolated-vm`\r\n *   npm package. True heap isolation; escapes require a V8 engine bug.\r\n *   Requires `isolated-vm` to be installed (native addon).\r\n *\r\n * - `\"quickjs\"`: Validates code structure in a QuickJS WASM sandbox, then\r\n *   executes in `node:vm` for React rendering. Security is equivalent to\r\n *   `node:vm`: the QuickJS phase validates import restrictions only.\r\n *   No native addons needed, but only supports ES2020 and is slower.\r\n *   For true isolation on servers, use `isolated-vm`.\r\n */\r\nexport type SandboxStrategy = \"vm\" | \"isolated-vm\" | \"quickjs\";\r\n\r\nexport interface CompileReactEmailOptions {\r\n  /**\r\n   * Sandbox strategy to use for executing user JSX code.\r\n   * @default \"isolated-vm\"\r\n   */\r\n  sandbox?: SandboxStrategy;\r\n}\r\n\r\n/**\r\n * Compile a React Email JSX/TSX source string into an HTML email string.\r\n *\r\n * Pipeline:\r\n *  1. Validate input (size, basic checks)\r\n *  2. Transpile JSX/TSX → CommonJS JS using sucrase\r\n *  3. Execute inside a sandbox (configurable strategy)\r\n *  4. Render the exported component to a full HTML email string\r\n *\r\n * Requires peer dependencies: sucrase, react, @react-email/components,\r\n * @react-email/render. Additionally:\r\n *  - sandbox \"isolated-vm\" requires `isolated-vm`\r\n *  - sandbox \"quickjs\" requires `quickjs-emscripten`\r\n */\r\nexport async function compileReactEmail(\r\n  source: string,\r\n  options?: CompileReactEmailOptions,\r\n): Promise<string> {\r\n  const strategy = options?.sandbox ?? \"isolated-vm\";\r\n\r\n  // ── 1. Validate ──────────────────────────────────────────────────────\r\n  if (!source || !source.trim()) {\r\n    throw new CompileError(\"JSX source must not be empty.\", \"jsx\", \"validation\");\r\n  }\r\n\r\n  if (source.length > MAX_SOURCE_SIZE) {\r\n    throw new CompileError(\r\n      `JSX source exceeds ${MAX_SOURCE_SIZE / 1000}KB limit.`,\r\n      \"jsx\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  // ── 2. Load peer dependencies ────────────────────────────────────────\r\n  let transform: typeof import(\"sucrase\").transform;\r\n  let React: typeof import(\"react\");\r\n  let ReactEmailComponents: typeof import(\"@react-email/components\");\r\n  let render: typeof import(\"@react-email/render\").render;\r\n\r\n  try {\r\n    ({ transform } = await import(\"sucrase\"));\r\n  } catch {\r\n    throw new CompileError(\r\n      'JSX compilation requires \"sucrase\". Install it:\\n  npm install sucrase',\r\n      \"jsx\",\r\n      \"transpile\",\r\n    );\r\n  }\r\n\r\n  try {\r\n    React = await import(\"react\");\r\n  } catch {\r\n    throw new CompileError(\r\n      'JSX compilation requires \"react\". Install it:\\n  npm install react',\r\n      \"jsx\",\r\n      \"transpile\",\r\n    );\r\n  }\r\n\r\n  try {\r\n    ReactEmailComponents = await import(\"@react-email/components\");\r\n  } catch {\r\n    throw new CompileError(\r\n      'JSX compilation requires \"@react-email/components\". Install it:\\n  npm install @react-email/components',\r\n      \"jsx\",\r\n      \"transpile\",\r\n    );\r\n  }\r\n\r\n  try {\r\n    ({ render } = await import(\"@react-email/render\"));\r\n  } catch {\r\n    throw new CompileError(\r\n      'JSX compilation requires \"@react-email/render\". Install it:\\n  npm install @react-email/render',\r\n      \"jsx\",\r\n      \"transpile\",\r\n    );\r\n  }\r\n\r\n  // ── 3. Transpile JSX/TSX → CommonJS ──────────────────────────────────\r\n  let transpiledCode: string;\r\n  try {\r\n    const result = transform(source, {\r\n      transforms: [\"typescript\", \"jsx\", \"imports\"],\r\n      jsxRuntime: \"classic\",\r\n      production: true,\r\n    });\r\n    transpiledCode = result.code;\r\n  } catch (err: unknown) {\r\n    const message = err instanceof Error ? err.message : \"Unknown transpilation error\";\r\n    throw new CompileError(`JSX syntax error: ${message}`, \"jsx\", \"transpile\");\r\n  }\r\n\r\n  // ── 4. Execute in sandbox ────────────────────────────────────────────\r\n  let moduleExports: Record<string, unknown>;\r\n\r\n  switch (strategy) {\r\n    case \"isolated-vm\":\r\n      moduleExports = await executeInIsolatedVm(transpiledCode, React, ReactEmailComponents);\r\n      break;\r\n    case \"quickjs\":\r\n      moduleExports = await executeInQuickJs(transpiledCode, React, ReactEmailComponents);\r\n      break;\r\n    case \"vm\":\r\n      moduleExports = await executeInVm(transpiledCode, React, ReactEmailComponents);\r\n      break;\r\n    default:\r\n      throw new CompileError(\r\n        `Unknown sandbox strategy: \"${strategy}\". Use \"vm\", \"isolated-vm\", or \"quickjs\".`,\r\n        \"jsx\",\r\n        \"execution\",\r\n      );\r\n  }\r\n\r\n  // ── 5. Extract component and render ──────────────────────────────────\r\n  let Component: unknown = moduleExports.default ?? moduleExports;\r\n\r\n  if (typeof Component !== \"function\" && typeof Component === \"object\" && Component !== null) {\r\n    const values = Object.values(Component as Record<string, unknown>);\r\n    const fn = values.find((v) => typeof v === \"function\");\r\n    if (fn) Component = fn;\r\n  }\r\n\r\n  if (typeof Component !== \"function\") {\r\n    throw new CompileError(\r\n      'The JSX source must export a React component function. ' +\r\n        'Use \"export default function Email() { ... }\" or ' +\r\n        '\"export function Email() { ... }\".',\r\n      \"jsx\",\r\n      \"execution\",\r\n    );\r\n  }\r\n\r\n  try {\r\n    const element = React.createElement(Component as React.FC);\r\n    const html = await render(element);\r\n    return html;\r\n  } catch (err: unknown) {\r\n    const message = err instanceof Error ? err.message : \"Unknown rendering error\";\r\n    throw new CompileError(`React rendering error: ${message}`, \"jsx\", \"render\");\r\n  }\r\n}\r\n\r\n// ─── Sandbox: node:vm ──────────────────────────────────────────────────────\r\n\r\n/**\r\n * Execute transpiled code in a node:vm context with hardened globals.\r\n *\r\n * NOT a security boundary, see node:vm documentation. Suitable for CLI\r\n * use where the user runs their own code. For server use, prefer\r\n * \"isolated-vm\" or \"quickjs\".\r\n */\r\nasync function executeInVm(\r\n  code: string,\r\n  React: typeof import(\"react\"),\r\n  ReactEmailComponents: typeof import(\"@react-email/components\"),\r\n): Promise<Record<string, unknown>> {\r\n  const { createContext, Script } = await import(\"node:vm\");\r\n\r\n  const ALLOWED_MODULES: Record<string, unknown> = {\r\n    react: React,\r\n    \"@react-email/components\": ReactEmailComponents,\r\n  };\r\n\r\n  const moduleExports: Record<string, unknown> = {};\r\n  const moduleObj = { exports: moduleExports };\r\n\r\n  const mockRequire = (moduleName: string): unknown => {\r\n    if (moduleName in ALLOWED_MODULES) {\r\n      return ALLOWED_MODULES[moduleName];\r\n    }\r\n    throw new Error(\r\n      `Import of \"${moduleName}\" is not allowed. ` +\r\n        `Only \"react\" and \"@react-email/components\" can be imported.`,\r\n    );\r\n  };\r\n\r\n  const sandbox: Record<string, unknown> = {\r\n    module: moduleObj,\r\n    exports: moduleExports,\r\n    require: mockRequire,\r\n    React,\r\n    Object, Array, String, Number, Boolean,\r\n    Map, Set, WeakMap, WeakSet,\r\n    JSON, Math, Date, RegExp,\r\n    Error, TypeError, RangeError, ReferenceError, SyntaxError, URIError,\r\n    Promise, Symbol,\r\n    Proxy: undefined, Reflect: undefined,\r\n    parseInt, parseFloat, isNaN, isFinite,\r\n    encodeURIComponent, decodeURIComponent, encodeURI, decodeURI,\r\n    undefined, NaN, Infinity,\r\n    console: { log: () => {}, warn: () => {}, error: () => {}, info: () => {}, debug: () => {} },\r\n    setTimeout: undefined, setInterval: undefined, setImmediate: undefined, queueMicrotask: undefined,\r\n    process: undefined, globalThis: undefined, global: undefined, Buffer: undefined,\r\n    __dirname: undefined, __filename: undefined,\r\n  };\r\n\r\n  const context = createContext(sandbox, {\r\n    codeGeneration: { strings: false, wasm: false },\r\n  });\r\n\r\n  try {\r\n    const script = new Script(code, { filename: \"user-email-component.tsx\" });\r\n    script.runInContext(context, { timeout: EXECUTION_TIMEOUT_MS, displayErrors: true });\r\n  } catch (err: unknown) {\r\n    const message = err instanceof Error ? err.message : \"Unknown execution error\";\r\n    if (message.includes(\"Script execution timed out\")) {\r\n      throw new CompileError(\"JSX execution timed out (possible infinite loop).\", \"jsx\", \"execution\");\r\n    }\r\n    throw new CompileError(`JSX execution error: ${message}`, \"jsx\", \"execution\");\r\n  }\r\n\r\n  return moduleObj.exports as Record<string, unknown>;\r\n}\r\n\r\n// ─── Sandbox: isolated-vm ──────────────────────────────────────────────────\r\n\r\n/**\r\n * Validate code in a separate V8 isolate, then execute in `node:vm`.\r\n *\r\n * Two-phase approach:\r\n *  1. **Validate**: run the transpiled code in a true V8 isolate with stub\r\n *     React/component implementations. This catches disallowed imports and\r\n *     structural errors inside a genuine security boundary (separate heap,\r\n *     128 MB memory cap, timeout). Escape requires a V8 engine bug.\r\n *  2. **Execute**: run the validated code in `node:vm` with real React\r\n *     objects for actual rendering.\r\n *\r\n * Why two phases: React's internal type system uses Symbols\r\n * (`Symbol(react.forward_ref)`, `Symbol(react.element)`, etc.) which cannot\r\n * be transferred across V8 isolate boundaries, the structured clone\r\n * algorithm does not support Symbols. Running React code directly inside\r\n * `isolated-vm` is not possible.\r\n */\r\nasync function executeInIsolatedVm(\r\n  code: string,\r\n  React: typeof import(\"react\"),\r\n  ReactEmailComponents: typeof import(\"@react-email/components\"),\r\n): Promise<Record<string, unknown>> {\r\n  let ivm: typeof import(\"isolated-vm\");\r\n  try {\r\n    const ivmMod = await import(\"isolated-vm\");\r\n    ivm = (ivmMod as any).default ?? ivmMod;\r\n  } catch {\r\n    throw new CompileError(\r\n      'Sandbox strategy \"isolated-vm\" requires the \"isolated-vm\" package. Install it:\\n' +\r\n        \"  npm install isolated-vm\\n\" +\r\n        'Or use sandbox: \"vm\" for a lighter (but less secure) alternative.',\r\n      \"jsx\",\r\n      \"execution\",\r\n    );\r\n  }\r\n\r\n  // ── Phase 1: Validate in a true V8 isolate ─────────────────────────────\r\n  const isolate = new ivm.Isolate({ memoryLimit: 128 });\r\n  try {\r\n    const ivmContext = await isolate.createContext();\r\n\r\n    // Stub implementations let the code parse and execute structurally\r\n    // without needing real React objects (which contain non-cloneable Symbols).\r\n    // Stub React: createElement returns a plain object, forwardRef passes\r\n    // through, and any unknown property returns a no-op function. The Proxy\r\n    // on the components module ensures that any named import (Html, Head,\r\n    // Button, etc.) resolves to a dummy component function so the transpiled\r\n    // code can execute structurally without real React objects.\r\n    const validationCode = `\r\n      (function() {\r\n        var module = { exports: {} };\r\n        var exports = module.exports;\r\n        var noop = function() { return {}; };\r\n        var React = new Proxy({\r\n          createElement: noop,\r\n          forwardRef: function(fn) { return fn; },\r\n          Fragment: \"Fragment\",\r\n          createContext: function() { return { Provider: noop, Consumer: noop }; },\r\n          useState: function(v) { return [v, noop]; },\r\n          useRef: function() { return { current: null }; },\r\n          useEffect: noop,\r\n          useMemo: function(fn) { return fn(); },\r\n          useCallback: function(fn) { return fn; },\r\n          Children: { map: noop, forEach: noop, toArray: function() { return []; } },\r\n        }, { get: function(t, p) { return p in t ? t[p] : noop; } });\r\n        var componentsProxy = new Proxy({}, {\r\n          get: function() { return noop; }\r\n        });\r\n        function require(name) {\r\n          if (name === \"react\") return React;\r\n          if (name === \"@react-email/components\") return componentsProxy;\r\n          throw new Error('Import of \"' + name + '\" is not allowed. Only \"react\" and \"@react-email/components\" can be imported.');\r\n        }\r\n        try {\r\n          ${code}\r\n          return JSON.stringify({ ok: true });\r\n        } catch(e) {\r\n          return JSON.stringify({ ok: false, error: e.message || \"Unknown error\" });\r\n        }\r\n      })()\r\n    `;\r\n\r\n    try {\r\n      const result = await ivmContext.eval(validationCode, {\r\n        timeout: EXECUTION_TIMEOUT_MS,\r\n      });\r\n\r\n      if (typeof result === \"string\") {\r\n        const parsed = JSON.parse(result) as { ok: boolean; error?: string };\r\n        if (!parsed.ok) {\r\n          throw new CompileError(\r\n            `JSX execution error: ${parsed.error ?? \"Unknown error\"}`,\r\n            \"jsx\",\r\n            \"execution\",\r\n          );\r\n        }\r\n      }\r\n    } catch (err: unknown) {\r\n      if (err instanceof CompileError) throw err;\r\n      const message = err instanceof Error ? err.message : \"Unknown execution error\";\r\n      if (message.includes(\"timed out\") || message.includes(\"Timeout\")) {\r\n        throw new CompileError(\"JSX execution timed out (possible infinite loop).\", \"jsx\", \"execution\");\r\n      }\r\n      throw new CompileError(`JSX execution error: ${message}`, \"jsx\", \"execution\");\r\n    }\r\n  } finally {\r\n    isolate.dispose();\r\n  }\r\n\r\n  // ── Phase 2: Execute validated code in node:vm with real React ──────────\r\n  return executeInVm(code, React, ReactEmailComponents);\r\n}\r\n\r\n// ─── Sandbox: QuickJS (WASM) ──────────────────────────────────────────────\r\n\r\n/**\r\n * Validate code structure in QuickJS WASM, then execute in `node:vm`.\r\n *\r\n * Two-phase approach:\r\n *  1. Validate that the code doesn't access disallowed modules by running it\r\n *     in a QuickJS WASM sandbox with stub implementations.\r\n *  2. Execute in `node:vm` for actual React rendering (React objects can't\r\n *     cross the WASM boundary).\r\n *\r\n * **Security note:** The actual execution happens in `node:vm`, so runtime\r\n * security is equivalent to the `\"vm\"` strategy. The QuickJS phase only\r\n * validates import restrictions. For true isolation on servers, use\r\n * `\"isolated-vm\"`.\r\n */\r\nasync function executeInQuickJs(\r\n  code: string,\r\n  React: typeof import(\"react\"),\r\n  ReactEmailComponents: typeof import(\"@react-email/components\"),\r\n): Promise<Record<string, unknown>> {\r\n  let getQuickJS: typeof import(\"quickjs-emscripten\").getQuickJS;\r\n  try {\r\n    ({ getQuickJS } = await import(\"quickjs-emscripten\"));\r\n  } catch {\r\n    throw new CompileError(\r\n      'Sandbox strategy \"quickjs\" requires the \"quickjs-emscripten\" package. Install it:\\n' +\r\n        \"  npm install quickjs-emscripten\\n\" +\r\n        'Or use sandbox: \"vm\" for a lighter alternative.',\r\n      \"jsx\",\r\n      \"execution\",\r\n    );\r\n  }\r\n\r\n  const QuickJS = await getQuickJS();\r\n  const vm = QuickJS.newContext();\r\n\r\n  try {\r\n    // Phase 1: Validate code safety in the WASM sandbox.\r\n    // We provide stub implementations of React and the module system so\r\n    // the code can execute without errors, but we only care that it\r\n    // doesn't try to access anything dangerous.\r\n    // QuickJS (ES2020) does not support Proxy, so we enumerate known\r\n    // React Email component names as stub functions instead.\r\n    const validationCode = `\r\n      (function() {\r\n        var module = { exports: {} };\r\n        var exports = module.exports;\r\n        var noop = function() { return {}; };\r\n        var React = {\r\n          createElement: noop,\r\n          forwardRef: function(fn) { return fn; },\r\n          Fragment: \"Fragment\",\r\n          createContext: function() { return { Provider: noop, Consumer: noop }; },\r\n          useState: function(v) { return [v, noop]; },\r\n          useRef: function() { return { current: null }; },\r\n          useEffect: noop,\r\n          useMemo: function(fn) { return fn(); },\r\n          useCallback: function(fn) { return fn; },\r\n          Children: { map: noop, forEach: noop, toArray: function() { return []; } },\r\n        };\r\n        var components = {};\r\n        var names = [\r\n          \"Html\",\"Head\",\"Body\",\"Container\",\"Section\",\"Row\",\"Column\",\"Text\",\r\n          \"Link\",\"Button\",\"Img\",\"Hr\",\"Preview\",\"Heading\",\"Font\",\"Style\",\r\n          \"CodeBlock\",\"CodeInline\",\"Markdown\",\"Tailwind\",\"Responsive\",\r\n        ];\r\n        for (var i = 0; i < names.length; i++) components[names[i]] = noop;\r\n        function require(name) {\r\n          if (name === \"react\") return React;\r\n          if (name === \"@react-email/components\") return components;\r\n          throw new Error('Import of \"' + name + '\" is not allowed.');\r\n        }\r\n        try {\r\n          ${code}\r\n          return JSON.stringify({ ok: true });\r\n        } catch(e) {\r\n          return JSON.stringify({ ok: false, error: e.message || \"Unknown error\" });\r\n        }\r\n      })()\r\n    `;\r\n\r\n    const result = vm.evalCode(validationCode);\r\n    if (result.error) {\r\n      const errorVal = vm.dump(result.error);\r\n      result.error.dispose();\r\n      throw new CompileError(\r\n        `JSX execution error: ${typeof errorVal === \"string\" ? errorVal : \"QuickJS execution failed\"}`,\r\n        \"jsx\",\r\n        \"execution\",\r\n      );\r\n    }\r\n\r\n    const resultStr = vm.dump(result.value);\r\n    result.value.dispose();\r\n\r\n    if (typeof resultStr === \"string\") {\r\n      const parsed = JSON.parse(resultStr) as { ok: boolean; error?: string };\r\n      if (!parsed.ok) {\r\n        throw new CompileError(\r\n          `JSX execution error: ${parsed.error ?? \"Unknown error\"}`,\r\n          \"jsx\",\r\n          \"execution\",\r\n        );\r\n      }\r\n    }\r\n\r\n    // Phase 2: Code validated as safe; execute in node:vm for actual\r\n    // React rendering (React objects can't cross the WASM boundary)\r\n    return executeInVm(code, React, ReactEmailComponents);\r\n  } finally {\r\n    vm.dispose();\r\n  }\r\n}\r\n","import { CompileError } from \"./errors.js\";\r\n\r\n/** Maximum MJML source size: 512KB */\r\nconst MAX_SOURCE_SIZE = 512_000;\r\n\r\n/**\r\n * Compile an MJML source string into an HTML email string.\r\n *\r\n * MJML is a declarative markup language with no code execution capability\r\n * (unlike JSX). The mjml library parses XML and generates HTML; there is\r\n * no sandboxing concern.\r\n *\r\n * Requires peer dependency: mjml\r\n */\r\nexport async function compileMjml(source: string): Promise<string> {\r\n  // ── 1. Validate ──────────────────────────────────────────────────────\r\n  if (!source || !source.trim()) {\r\n    throw new CompileError(\"MJML source must not be empty.\", \"mjml\", \"validation\");\r\n  }\r\n\r\n  if (source.length > MAX_SOURCE_SIZE) {\r\n    throw new CompileError(\r\n      `MJML source exceeds ${MAX_SOURCE_SIZE / 1000}KB limit.`,\r\n      \"mjml\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  if (!/<mjml[\\s>]/i.test(source)) {\r\n    throw new CompileError(\r\n      \"MJML source must contain a root <mjml> element. \" +\r\n        \"Example: <mjml><mj-body><mj-section><mj-column><mj-text>Hello</mj-text></mj-column></mj-section></mj-body></mjml>\",\r\n      \"mjml\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  // ── 2. Load peer dependency ──────────────────────────────────────────\r\n  type MjmlResult = {\r\n    html: string;\r\n    errors: Array<{ line: number; message: string; tagName: string; formattedMessage: string }>;\r\n  };\r\n  let mjml2html: (\r\n    input: string,\r\n    options?: Record<string, unknown>,\r\n  ) => MjmlResult | Promise<MjmlResult>;\r\n\r\n  try {\r\n    const mjmlModule = await import(\"mjml\");\r\n    mjml2html = mjmlModule.default ?? mjmlModule;\r\n  } catch {\r\n    throw new CompileError(\r\n      'MJML compilation requires \"mjml\". Install it:\\n  npm install mjml',\r\n      \"mjml\",\r\n      \"compile\",\r\n    );\r\n  }\r\n\r\n  // ── 3. Compile ───────────────────────────────────────────────────────\r\n  try {\r\n    // mjml v5+ returns a Promise; v4 returns synchronously.\r\n    // Await handles both cases.\r\n    const result = await mjml2html(source, {\r\n      validationLevel: \"soft\",\r\n      keepComments: false,\r\n    });\r\n\r\n    if (result.errors && result.errors.length > 0 && !result.html) {\r\n      const errorMessages = result.errors\r\n        .map((e) => `Line ${e.line}: ${e.message} (${e.tagName})`)\r\n        .join(\"; \");\r\n      throw new CompileError(\r\n        `MJML compilation errors: ${errorMessages}`,\r\n        \"mjml\",\r\n        \"compile\",\r\n      );\r\n    }\r\n\r\n    if (!result.html) {\r\n      throw new CompileError(\"MJML compilation produced empty output.\", \"mjml\", \"compile\");\r\n    }\r\n\r\n    return result.html;\r\n  } catch (err: unknown) {\r\n    if (err instanceof CompileError) throw err;\r\n    const message = err instanceof Error ? err.message : \"Unknown MJML compilation error\";\r\n    throw new CompileError(`MJML compilation failed: ${message}`, \"mjml\", \"compile\");\r\n  }\r\n}\r\n","import { CompileError } from \"./errors.js\";\r\n\r\n/** Maximum Maizzle source size: 512KB */\r\nconst MAX_SOURCE_SIZE = 512_000;\r\n\r\n/** Compilation timeout: 15 seconds */\r\nconst COMPILE_TIMEOUT_MS = 15_000;\r\n\r\n/**\r\n * PostHTML directives that perform file-system reads or network fetches.\r\n *\r\n * Maizzle's PostHTML pipeline resolves these at compile time: a template\r\n * like `<extends src=\"/etc/passwd\">` causes the server to read that path\r\n * and include the content in rendered output (server-side file read). We\r\n * reject any input containing these directives rather than stripping them,\r\n * because stripping is error-prone with nested or malformed markup.\r\n *\r\n * Affected plugins: posthtml-extend, posthtml-fetch, posthtml-components,\r\n * posthtml-include, posthtml-modules.\r\n */\r\nconst DANGEROUS_DIRECTIVE_RE =\r\n  /<\\s*(?:extends|component|fetch|include|module|slot|fill|raw|block|yield)\\b/i;\r\n\r\n/**\r\n * Compile a Maizzle template string into an HTML email string.\r\n *\r\n * Pipeline:\r\n *  1. Validate input (size, basic structure check)\r\n *  2. Reject inputs containing PostHTML file-access directives\r\n *  3. Compile using @maizzle/framework\r\n *\r\n * Security:\r\n *  - PostHTML file-system directives are rejected at validation time\r\n *    to prevent server-side file reads and SSRF.\r\n *  - Template expressions ({{ expr }}) are evaluated by posthtml-expressions\r\n *    with empty `locals`, so unknown identifiers like `process` or `require`\r\n *    return the literal string '{local}' rather than accessing Node.js globals.\r\n *  - A hard timeout prevents pathological PostCSS/Tailwind inputs from\r\n *    hanging indefinitely.\r\n *\r\n * Requires peer dependency: @maizzle/framework\r\n */\r\nexport async function compileMaizzle(source: string): Promise<string> {\r\n  // ── 1. Validate ──────────────────────────────────────────────────────\r\n  if (!source || !source.trim()) {\r\n    throw new CompileError(\"Maizzle source must not be empty.\", \"maizzle\", \"validation\");\r\n  }\r\n\r\n  if (source.length > MAX_SOURCE_SIZE) {\r\n    throw new CompileError(\r\n      `Maizzle source exceeds ${MAX_SOURCE_SIZE / 1000}KB limit.`,\r\n      \"maizzle\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  // ── 2. Block file-system and network PostHTML directives ─────────────\r\n  if (DANGEROUS_DIRECTIVE_RE.test(source)) {\r\n    throw new CompileError(\r\n      \"Maizzle templates may not use <extends>, <component>, <fetch>, <include>, \" +\r\n        \"<module>, <slot>, <fill>, <raw>, <block>, or <yield> directives. These directives \" +\r\n        \"access the server file system at compile time. Use inline HTML and Tailwind utility classes instead.\",\r\n      \"maizzle\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  // ── 3. Load peer dependency ──────────────────────────────────────────\r\n  let maizzleRender: (\r\n    input: string,\r\n    options: Record<string, unknown>,\r\n  ) => Promise<{ html: string }>;\r\n\r\n  try {\r\n    const maizzle = await import(\"@maizzle/framework\");\r\n    maizzleRender = maizzle.render;\r\n  } catch {\r\n    throw new CompileError(\r\n      'Maizzle compilation requires \"@maizzle/framework\". Install it:\\n  npm install @maizzle/framework',\r\n      \"maizzle\",\r\n      \"compile\",\r\n    );\r\n  }\r\n\r\n  // ── 4. Compile with timeout ──────────────────────────────────────────\r\n  const compilePromise = maizzleRender(source, {\r\n    css: {\r\n      inline: {\r\n        removeInlinedSelectors: true,\r\n        applyWidthAttributes: true,\r\n        applyHeightAttributes: true,\r\n      },\r\n      shorthand: true,\r\n      sixHex: true,\r\n    },\r\n    locals: {},\r\n  });\r\n\r\n  const timeoutPromise = new Promise<never>((_, reject) => {\r\n    const t = setTimeout(() => {\r\n      reject(\r\n        new CompileError(\r\n          `Maizzle compilation timed out after ${COMPILE_TIMEOUT_MS / 1000}s.`,\r\n          \"maizzle\",\r\n          \"compile\",\r\n        ),\r\n      );\r\n    }, COMPILE_TIMEOUT_MS);\r\n    if (typeof t.unref === \"function\") t.unref();\r\n  });\r\n\r\n  try {\r\n    const { html } = await Promise.race([compilePromise, timeoutPromise]);\r\n\r\n    if (!html) {\r\n      throw new CompileError(\"Maizzle compilation produced empty output.\", \"maizzle\", \"compile\");\r\n    }\r\n\r\n    return html;\r\n  } catch (err: unknown) {\r\n    if (err instanceof CompileError) throw err;\r\n    const message = err instanceof Error ? err.message : \"Unknown Maizzle compilation error\";\r\n    throw new CompileError(`Maizzle compilation failed: ${message}`, \"maizzle\", \"compile\");\r\n  }\r\n}\r\n","import { extname } from \"node:path\";\r\nimport type { InputFormat } from \"../types.js\";\r\n\r\nexport { CompileError } from \"./errors.js\";\r\nexport { compileReactEmail } from \"./react-email.js\";\r\nexport type { SandboxStrategy, CompileReactEmailOptions } from \"./react-email.js\";\r\nexport { compileMjml } from \"./mjml.js\";\r\nexport { compileMaizzle } from \"./maizzle.js\";\r\n\r\n/**\r\n * Compile source to HTML based on format.\r\n * Returns the HTML unchanged if format is \"html\".\r\n * Lazily imports per-format compilers to avoid loading unnecessary deps.\r\n */\r\nexport async function compile(\r\n  source: string,\r\n  format: InputFormat,\r\n): Promise<string> {\r\n  switch (format) {\r\n    case \"html\":\r\n      return source;\r\n\r\n    case \"jsx\": {\r\n      const { compileReactEmail } = await import(\"./react-email.js\");\r\n      return compileReactEmail(source);\r\n    }\r\n\r\n    case \"mjml\": {\r\n      const { compileMjml } = await import(\"./mjml.js\");\r\n      return compileMjml(source);\r\n    }\r\n\r\n    case \"maizzle\": {\r\n      const { compileMaizzle } = await import(\"./maizzle.js\");\r\n      return compileMaizzle(source);\r\n    }\r\n\r\n    default:\r\n      throw new Error(`Unknown format: \"${format}\". Use html, jsx, mjml, or maizzle.`);\r\n  }\r\n}\r\n\r\n/**\r\n * Auto-detect input format from file extension.\r\n */\r\nexport function detectFormat(filePath: string): InputFormat {\r\n  const ext = extname(filePath).toLowerCase();\r\n\r\n  switch (ext) {\r\n    case \".tsx\":\r\n    case \".jsx\":\r\n      return \"jsx\";\r\n    case \".mjml\":\r\n      return \"mjml\";\r\n    case \".html\":\r\n    case \".htm\":\r\n      return \"html\";\r\n    default:\r\n      return \"html\";\r\n  }\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IASa;AATb;AAAA;AAAA;AASO,IAAM,eAAN,cAA2B,MAAM;AAAA,MAKtC,YACE,SACA,QACA,OACA;AACA,cAAM,OAAO;AATf,aAAS,OAAO;AAUd,aAAK,SAAS;AACd,aAAK,QAAQ;AAAA,MACf;AAAA,IACF;AAAA;AAAA;;;ACvBA;AAAA;AAAA;AAAA;AAiDA,eAAsB,kBACpB,QACA,SACiB;AApDnB;AAqDE,QAAM,YAAW,wCAAS,YAAT,YAAoB;AAGrC,MAAI,CAAC,UAAU,CAAC,OAAO,KAAK,GAAG;AAC7B,UAAM,IAAI,aAAa,iCAAiC,OAAO,YAAY;AAAA,EAC7E;AAEA,MAAI,OAAO,SAAS,iBAAiB;AACnC,UAAM,IAAI;AAAA,MACR,sBAAsB,kBAAkB,GAAI;AAAA,MAC5C;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AAEJ,MAAI;AACF,KAAC,EAAE,UAAU,IAAI,MAAM,OAAO,SAAS;AAAA,EACzC,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,YAAQ,MAAM,OAAO,OAAO;AAAA,EAC9B,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,2BAAuB,MAAM,OAAO,yBAAyB;AAAA,EAC/D,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,KAAC,EAAE,OAAO,IAAI,MAAM,OAAO,qBAAqB;AAAA,EAClD,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,UAAU,QAAQ;AAAA,MAC/B,YAAY,CAAC,cAAc,OAAO,SAAS;AAAA,MAC3C,YAAY;AAAA,MACZ,YAAY;AAAA,IACd,CAAC;AACD,qBAAiB,OAAO;AAAA,EAC1B,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,qBAAqB,OAAO,IAAI,OAAO,WAAW;AAAA,EAC3E;AAGA,MAAI;AAEJ,UAAQ,UAAU;AAAA,IAChB,KAAK;AACH,sBAAgB,MAAM,oBAAoB,gBAAgB,OAAO,oBAAoB;AACrF;AAAA,IACF,KAAK;AACH,sBAAgB,MAAM,iBAAiB,gBAAgB,OAAO,oBAAoB;AAClF;AAAA,IACF,KAAK;AACH,sBAAgB,MAAM,YAAY,gBAAgB,OAAO,oBAAoB;AAC7E;AAAA,IACF;AACE,YAAM,IAAI;AAAA,QACR,8BAA8B,QAAQ;AAAA,QACtC;AAAA,QACA;AAAA,MACF;AAAA,EACJ;AAGA,MAAI,aAAqB,mBAAc,YAAd,YAAyB;AAElD,MAAI,OAAO,cAAc,cAAc,OAAO,cAAc,YAAY,cAAc,MAAM;AAC1F,UAAM,SAAS,OAAO,OAAO,SAAoC;AACjE,UAAM,KAAK,OAAO,KAAK,CAAC,MAAM,OAAO,MAAM,UAAU;AACrD,QAAI,GAAI,aAAY;AAAA,EACtB;AAEA,MAAI,OAAO,cAAc,YAAY;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,UAAM,UAAU,MAAM,cAAc,SAAqB;AACzD,UAAM,OAAO,MAAM,OAAO,OAAO;AACjC,WAAO;AAAA,EACT,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,0BAA0B,OAAO,IAAI,OAAO,QAAQ;AAAA,EAC7E;AACF;AAWA,eAAe,YACb,MACA,OACA,sBACkC;AAClC,QAAM,EAAE,eAAe,OAAO,IAAI,MAAM,OAAO,IAAS;AAExD,QAAM,kBAA2C;AAAA,IAC/C,OAAO;AAAA,IACP,2BAA2B;AAAA,EAC7B;AAEA,QAAM,gBAAyC,CAAC;AAChD,QAAM,YAAY,EAAE,SAAS,cAAc;AAE3C,QAAM,cAAc,CAAC,eAAgC;AACnD,QAAI,cAAc,iBAAiB;AACjC,aAAO,gBAAgB,UAAU;AAAA,IACnC;AACA,UAAM,IAAI;AAAA,MACR,cAAc,UAAU;AAAA,IAE1B;AAAA,EACF;AAEA,QAAM,UAAmC;AAAA,IACvC,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IAAQ;AAAA,IAAO;AAAA,IAAQ;AAAA,IAAQ;AAAA,IAC/B;AAAA,IAAK;AAAA,IAAK;AAAA,IAAS;AAAA,IACnB;AAAA,IAAM;AAAA,IAAM;AAAA,IAAM;AAAA,IAClB;AAAA,IAAO;AAAA,IAAW;AAAA,IAAY;AAAA,IAAgB;AAAA,IAAa;AAAA,IAC3D;AAAA,IAAS;AAAA,IACT,OAAO;AAAA,IAAW,SAAS;AAAA,IAC3B;AAAA,IAAU;AAAA,IAAY;AAAA,IAAO;AAAA,IAC7B;AAAA,IAAoB;AAAA,IAAoB;AAAA,IAAW;AAAA,IACnD;AAAA,IAAW;AAAA,IAAK;AAAA,IAChB,SAAS,EAAE,KAAK,MAAM;AAAA,IAAC,GAAG,MAAM,MAAM;AAAA,IAAC,GAAG,OAAO,MAAM;AAAA,IAAC,GAAG,MAAM,MAAM;AAAA,IAAC,GAAG,OAAO,MAAM;AAAA,IAAC,EAAE;AAAA,IAC3F,YAAY;AAAA,IAAW,aAAa;AAAA,IAAW,cAAc;AAAA,IAAW,gBAAgB;AAAA,IACxF,SAAS;AAAA,IAAW,YAAY;AAAA,IAAW,QAAQ;AAAA,IAAW,QAAQ;AAAA,IACtE,WAAW;AAAA,IAAW,YAAY;AAAA,EACpC;AAEA,QAAM,UAAU,cAAc,SAAS;AAAA,IACrC,gBAAgB,EAAE,SAAS,OAAO,MAAM,MAAM;AAAA,EAChD,CAAC;AAED,MAAI;AACF,UAAM,SAAS,IAAI,OAAO,MAAM,EAAE,UAAU,2BAA2B,CAAC;AACxE,WAAO,aAAa,SAAS,EAAE,SAAS,sBAAsB,eAAe,KAAK,CAAC;AAAA,EACrF,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,QAAI,QAAQ,SAAS,4BAA4B,GAAG;AAClD,YAAM,IAAI,aAAa,qDAAqD,OAAO,WAAW;AAAA,IAChG;AACA,UAAM,IAAI,aAAa,wBAAwB,OAAO,IAAI,OAAO,WAAW;AAAA,EAC9E;AAEA,SAAO,UAAU;AACnB;AAqBA,eAAe,oBACb,MACA,OACA,sBACkC;AAjRpC;AAkRE,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,aAAa;AACzC,WAAO,YAAe,YAAf,YAA0B;AAAA,EACnC,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,QAAM,UAAU,IAAI,IAAI,QAAQ,EAAE,aAAa,IAAI,CAAC;AACpD,MAAI;AACF,UAAM,aAAa,MAAM,QAAQ,cAAc;AAS/C,UAAM,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YA0Bf,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQZ,QAAI;AACF,YAAM,SAAS,MAAM,WAAW,KAAK,gBAAgB;AAAA,QACnD,SAAS;AAAA,MACX,CAAC;AAED,UAAI,OAAO,WAAW,UAAU;AAC9B,cAAM,SAAS,KAAK,MAAM,MAAM;AAChC,YAAI,CAAC,OAAO,IAAI;AACd,gBAAM,IAAI;AAAA,YACR,yBAAwB,YAAO,UAAP,YAAgB,eAAe;AAAA,YACvD;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAc;AACrB,UAAI,eAAe,aAAc,OAAM;AACvC,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAI,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,SAAS,GAAG;AAChE,cAAM,IAAI,aAAa,qDAAqD,OAAO,WAAW;AAAA,MAChG;AACA,YAAM,IAAI,aAAa,wBAAwB,OAAO,IAAI,OAAO,WAAW;AAAA,IAC9E;AAAA,EACF,UAAE;AACA,YAAQ,QAAQ;AAAA,EAClB;AAGA,SAAO,YAAY,MAAM,OAAO,oBAAoB;AACtD;AAkBA,eAAe,iBACb,MACA,OACA,sBACkC;AAjYpC;AAkYE,MAAI;AACJ,MAAI;AACF,KAAC,EAAE,WAAW,IAAI,MAAM,OAAO,oBAAoB;AAAA,EACrD,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,WAAW;AACjC,QAAM,KAAK,QAAQ,WAAW;AAE9B,MAAI;AAOF,UAAM,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YA8Bf,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQZ,UAAM,SAAS,GAAG,SAAS,cAAc;AACzC,QAAI,OAAO,OAAO;AAChB,YAAM,WAAW,GAAG,KAAK,OAAO,KAAK;AACrC,aAAO,MAAM,QAAQ;AACrB,YAAM,IAAI;AAAA,QACR,wBAAwB,OAAO,aAAa,WAAW,WAAW,0BAA0B;AAAA,QAC5F;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,YAAY,GAAG,KAAK,OAAO,KAAK;AACtC,WAAO,MAAM,QAAQ;AAErB,QAAI,OAAO,cAAc,UAAU;AACjC,YAAM,SAAS,KAAK,MAAM,SAAS;AACnC,UAAI,CAAC,OAAO,IAAI;AACd,cAAM,IAAI;AAAA,UACR,yBAAwB,YAAO,UAAP,YAAgB,eAAe;AAAA,UACvD;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAIA,WAAO,YAAY,MAAM,OAAO,oBAAoB;AAAA,EACtD,UAAE;AACA,OAAG,QAAQ;AAAA,EACb;AACF;AA9dA,IAGM,iBAGA;AANN;AAAA;AAAA;AAAA;AAGA,IAAM,kBAAkB;AAGxB,IAAM,uBAAuB;AAAA;AAAA;;;ACN7B;AAAA;AAAA;AAAA;AAcA,eAAsB,YAAY,QAAiC;AAdnE;AAgBE,MAAI,CAAC,UAAU,CAAC,OAAO,KAAK,GAAG;AAC7B,UAAM,IAAI,aAAa,kCAAkC,QAAQ,YAAY;AAAA,EAC/E;AAEA,MAAI,OAAO,SAASA,kBAAiB;AACnC,UAAM,IAAI;AAAA,MACR,uBAAuBA,mBAAkB,GAAI;AAAA,MAC7C;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,cAAc,KAAK,MAAM,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MAEA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAOA,MAAI;AAKJ,MAAI;AACF,UAAM,aAAa,MAAM,OAAO,MAAM;AACtC,iBAAY,gBAAW,YAAX,YAAsB;AAAA,EACpC,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AAGF,UAAM,SAAS,MAAM,UAAU,QAAQ;AAAA,MACrC,iBAAiB;AAAA,MACjB,cAAc;AAAA,IAChB,CAAC;AAED,QAAI,OAAO,UAAU,OAAO,OAAO,SAAS,KAAK,CAAC,OAAO,MAAM;AAC7D,YAAM,gBAAgB,OAAO,OAC1B,IAAI,CAAC,MAAM,QAAQ,EAAE,IAAI,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO,GAAG,EACxD,KAAK,IAAI;AACZ,YAAM,IAAI;AAAA,QACR,4BAA4B,aAAa;AAAA,QACzC;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,MAAM;AAChB,YAAM,IAAI,aAAa,2CAA2C,QAAQ,SAAS;AAAA,IACrF;AAEA,WAAO,OAAO;AAAA,EAChB,SAAS,KAAc;AACrB,QAAI,eAAe,aAAc,OAAM;AACvC,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,4BAA4B,OAAO,IAAI,QAAQ,SAAS;AAAA,EACjF;AACF;AAxFA,IAGMA;AAHN;AAAA;AAAA;AAAA;AAGA,IAAMA,mBAAkB;AAAA;AAAA;;;ACHxB;AAAA;AAAA;AAAA;AA0CA,eAAsB,eAAe,QAAiC;AAEpE,MAAI,CAAC,UAAU,CAAC,OAAO,KAAK,GAAG;AAC7B,UAAM,IAAI,aAAa,qCAAqC,WAAW,YAAY;AAAA,EACrF;AAEA,MAAI,OAAO,SAASC,kBAAiB;AACnC,UAAM,IAAI;AAAA,MACR,0BAA0BA,mBAAkB,GAAI;AAAA,MAChD;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI,uBAAuB,KAAK,MAAM,GAAG;AACvC,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AAKJ,MAAI;AACF,UAAM,UAAU,MAAM,OAAO,oBAAoB;AACjD,oBAAgB,QAAQ;AAAA,EAC1B,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,QAAM,iBAAiB,cAAc,QAAQ;AAAA,IAC3C,KAAK;AAAA,MACH,QAAQ;AAAA,QACN,wBAAwB;AAAA,QACxB,sBAAsB;AAAA,QACtB,uBAAuB;AAAA,MACzB;AAAA,MACA,WAAW;AAAA,MACX,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ,CAAC;AAAA,EACX,CAAC;AAED,QAAM,iBAAiB,IAAI,QAAe,CAAC,GAAG,WAAW;AACvD,UAAM,IAAI,WAAW,MAAM;AACzB;AAAA,QACE,IAAI;AAAA,UACF,uCAAuC,qBAAqB,GAAI;AAAA,UAChE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF,GAAG,kBAAkB;AACrB,QAAI,OAAO,EAAE,UAAU,WAAY,GAAE,MAAM;AAAA,EAC7C,CAAC;AAED,MAAI;AACF,UAAM,EAAE,KAAK,IAAI,MAAM,QAAQ,KAAK,CAAC,gBAAgB,cAAc,CAAC;AAEpE,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,aAAa,8CAA8C,WAAW,SAAS;AAAA,IAC3F;AAEA,WAAO;AAAA,EACT,SAAS,KAAc;AACrB,QAAI,eAAe,aAAc,OAAM;AACvC,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,+BAA+B,OAAO,IAAI,WAAW,SAAS;AAAA,EACvF;AACF;AA5HA,IAGMA,kBAGA,oBAcA;AApBN;AAAA;AAAA;AAAA;AAGA,IAAMA,mBAAkB;AAGxB,IAAM,qBAAqB;AAc3B,IAAM,yBACJ;AAAA;AAAA;;;ACrBF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uBAAwB;AAGxB;AACA;AAEA;AACA;AAOA,eAAsB,QACpB,QACA,QACiB;AACjB,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IAET,KAAK,OAAO;AACV,YAAM,EAAE,mBAAAC,mBAAkB,IAAI,MAAM;AACpC,aAAOA,mBAAkB,MAAM;AAAA,IACjC;AAAA,IAEA,KAAK,QAAQ;AACX,YAAM,EAAE,aAAAC,aAAY,IAAI,MAAM;AAC9B,aAAOA,aAAY,MAAM;AAAA,IAC3B;AAAA,IAEA,KAAK,WAAW;AACd,YAAM,EAAE,gBAAAC,gBAAe,IAAI,MAAM;AACjC,aAAOA,gBAAe,MAAM;AAAA,IAC9B;AAAA,IAEA;AACE,YAAM,IAAI,MAAM,oBAAoB,MAAM,qCAAqC;AAAA,EACnF;AACF;AAKO,SAAS,aAAa,UAA+B;AAC1D,QAAM,UAAM,0BAAQ,QAAQ,EAAE,YAAY;AAE1C,UAAQ,KAAK;AAAA,IACX,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;","names":["MAX_SOURCE_SIZE","MAX_SOURCE_SIZE","compileReactEmail","compileMjml","compileMaizzle"]}

package/dist/compile/index.d.cts

@@ -1,5 +1,5 @@
-import { u as InputFormat } from '../types-BLR3-Fzo.cjs';
-export { C as CompileError, a as CompileReactEmailOptions, S as SandboxStrategy, c as compileReactEmail } from '../react-email-DTzVpGgB.cjs';
+import { w as InputFormat } from '../types-BFhPXh3c.cjs';
+export { C as CompileError, a as CompileReactEmailOptions, S as SandboxStrategy, c as compileReactEmail } from '../react-email-BWIfwG7U.cjs';
 
 /**
  * Compile an MJML source string into an HTML email string.

package/dist/compile/index.d.ts

@@ -1,5 +1,5 @@
-import { u as InputFormat } from '../types-BLR3-Fzo.js';
-export { C as CompileError, a as CompileReactEmailOptions, S as SandboxStrategy, c as compileReactEmail } from '../react-email-DwBWB2kr.js';
+import { w as InputFormat } from '../types-BFhPXh3c.js';
+export { C as CompileError, a as CompileReactEmailOptions, S as SandboxStrategy, c as compileReactEmail } from '../react-email-D24HkW2Z.js';
 
 /**
  * Compile an MJML source string into an HTML email string.

package/dist/compile/index.js

@@ -1,6 +1,6 @@
 import {
   compileReactEmail
-} from "../chunk-HBKZMR7V.js";
+} from "../chunk-UFSYNSDP.js";
 import {
   compileMjml
 } from "../chunk-E4QE4WXE.js";
@@ -19,7 +19,7 @@ async function compile(source, format) {
     case "html":
       return source;
     case "jsx": {
-      const { compileReactEmail: compileReactEmail2 } = await import("../react-email-QKHRTEJW.js");
+      const { compileReactEmail: compileReactEmail2 } = await import("../react-email-CVZZNVZ2.js");
       return compileReactEmail2(source);
     }
     case "mjml": {